一、Keepalived 是什么Keepalived 是一款运行在 Linux 下的高可用HA管理软件基于VRRPVirtual Router Redundancy Protocol虚拟路由冗余协议实现。它的核心作用是通过一组服务器对外提供一个虚拟 IPVIP当主节点故障时备用节点自动接管这个 VIP实现服务的故障自动转移从而保证业务不中断。一句话概括Keepalived 负责IP 漂移让多台机器伪装成同一个网关/入口谁挂了另一个人顶上。常见搭配Keepalived Nginx → Web/反向代理高可用Keepalived HAProxy → 负载均衡入口高可用Keepalived MySQL → 数据库主从高可用配合 MHA/MMMKeepalived 原生还可做 LVS 集群管理本文以Keepalived Nginx 实现 Web 服务主备高可用为实战案例覆盖从安装到故障转移验证的全流程。二、核心原理VRRP 协议与 VIP 漂移2.1 VRRP 是什么VRRP 是标准的网络协议RFC 5798它把一组路由器这里指运行 Keepalived 的服务器组合成一个虚拟路由器组对外只暴露一个虚拟 IP。组内成员分为角色MASTER主真正持有 VIP负责接收发往 VIP 的流量。BACKUP备监听 MASTER 的心跳MASTER 故障时抢过 VIP 顶替。2.2 工作流程多台服务器主备通过 VRRP 组播报文互相发送心跳默认每 1 秒一次。MASTER 正常时VIP 绑在 MASTER 网卡上BACKUP 处于待命状态。若 BACKUP 连续多个心跳周期没收到 MASTER 的报文master_down就判定 MASTER 故障。BACKUP 立即把 VIP 绑定到自己网卡并发送 ARP 广播告知网关和客户端VIP 的 MAC 地址变了流量随之切到备机。MASTER 恢复后根据**优先级priority**高低优先级高者重新抢占preempt回 VIP。2.3 关键概念概念说明VIP虚拟 IP漂移的入口地址客户端只认它priority优先级1~255数值越大越优先当 MASTERvrrp_instanceVRRP 实例一组参与漂移的成员state角色声明MASTER / BACKUP / BACKUPvirtual_router_id虚拟路由器 ID0~255同组必须一致unicast_src_ip单播源 IP跨网段或多播受限时用nopreempt非抢占模式MASTER 恢复后不主动抢回重要提示state只是初始声明真正决定谁是 MASTER 的是priority和心跳状态。BACKUP 也可以因为 priority 更高而成为 MASTER。三、架构设计本文实战拓扑2 台节点 1 个虚拟 IP-------------------| 客户端/访问者 || 访问 http://VIP |------------------|(VIP 192.168.1.100)|----------------------------------| |------------- -------------| node1 | | node2 || MASTER | VRRP心跳/组播 | BACKUP || 192.168.1.11| ----------------- | 192.168.1.12|| Nginx | | Nginx |-------------- --------------node1192.168.1.11优先级 150默认 MASTERnode2192.168.1.12优先级 100默认 BACKUPVIP192.168.1.100系统CentOS 7.x / 8.x软件Keepalived 2.4.3 Nginx 1.24客户端永远访问 VIP192.168.1.100。node1 挂了VIP 漂移到 node2业务不断。四、安装 Keepalived4.1 方式一YUM 安装最快bash# CentOS/RHELyum install -y keepalived nginx# 查看版本keepalived --version4.2 方式二源码编译安装推荐版本最新以官方最新稳定版Keepalived 2.4.3为例bash# 1. 安装编译依赖yum install -y gcc openssl-devel libnl3-devel popt-devel ipset-devel \libnfnetlink-devel# 2. 下载源码cd /usr/local/srcwget https://keepalived.org/software/keepalived-2.4.3.tar.gztar zxf keepalived-2.4.3.tar.gzcd keepalived-2.4.3# 3. 编译安装./configure --prefix/usr/local/keepalivedmake -j$(nproc) make install# 4. 拷贝配置与启停脚本习惯放默认位置cp /usr/local/keepalived/etc/sysconfig/keepalived /etc/sysconfig/cp /usr/local/keepalived/etc/rc.d/init.d/keepalived /etc/init.d/mkdir -p /etc/keepalivedln -s /usr/local/keepalived/etc/keepalived/keepalived.conf /etc/keepalived/# 5. 查看版本确认/usr/local/keepalived/sbin/keepalived --version五、配置详解keepalived.confKeepalived 的配置文件默认在/etc/keepalived/keepalived.conf由三大部分组成global_defs全局配置vrrp_instanceVRRP 实例高可用的核心vrrp_script / track_script自定义健康检查脚本5.1 全局配置global_defsconfglobal_defs {router_id KEEPALIVED_NODE1 # 路由器标识仅用于区分可自定义notification_email {adminexample.com # 报警邮箱需配置 sendmail}notification_email_from keepalivedexample.comsmtp_server 127.0.0.1smtp_connect_timeout 30vrrp_skip_check_adv_addr # 跳过对通告地址的检查防止误报vrrp_strict # 严格模式开启后限制较严调试时可先注释vrrp_garp_interval 0vrrp_gna_interval 0}5.2 实例配置vrrp_instance——主节点confvrrp_instance VI_1 {state MASTER # 初始角色主interface eth0 # 绑定网卡务必与 VIP 所在网卡一致virtual_router_id 51 # 虚拟路由器ID同组两台必须一致priority 150 # 优先级越大越优先主150备100advert_int 1 # 心跳通告间隔秒默认1秒nopreempt # 非抢占可选两台都配则MASTER挂了不抢回authentication {auth_type PASS # 认证方式PASS / AHauth_pass 123456 # 认证密码同组必须一致≤8位}unicast_src_ip 192.168.1.11 # 本机真实IPunicast_peer {192.168.1.12 # 对端节点IP单播模式必填}virtual_ipaddress {192.168.1.100/24 dev eth0 label eth0:0 # VIPdev和label可省略}track_script {check_nginx # 关联健康检查脚本见6.2}}5.3 备份节点配置只需改三处其余保持一致confvrrp_instance VI_1 {state BACKUP # 初始角色备interface eth0virtual_router_id 51 # 保持一致priority 100 # 比主小advert_int 1authentication {auth_type PASSauth_pass 123456 # 保持一致}unicast_src_ip 192.168.1.12unicast_peer {192.168.1.11}virtual_ipaddress {192.168.1.100/24 dev eth0 label eth0:0}track_script {check_nginx}}多播 vs 单播同网段默认用多播不需要unicast_src_ip/unicast_peer。跨网段、云服务器部分云商禁多播时必须改用单播即显式配置unicast_src_ip和unicast_peer。云环境务必用单播。六、结合 Nginx 实现 Web 高可用Keepalived 默认只保证VIP 在但它并不知道 Nginx 是否活着。所以我们要用vrrp_script做业务健康检查Nginx 挂了就降低优先级甚至剥夺 VIP把流量切到备机。6.1 先部署 Nginx两台都要bashyum install -y nginx# 或编译安装# 配置一个测试页用于验证echo h1Nginx on node1/h1 /usr/share/nginx/html/index.html # node1echo h1Nginx on node2/h1 /usr/share/nginx/html/index.html # node2systemctl start nginxsystemctl enable nginx6.2 编写健康检查脚本创建脚本/etc/keepalived/check_nginx.sh两台都要放bash#!/bin/bash# 检查 Nginx 进程是否存活if pgrep -x nginx /dev/null 21; thenexit 0 # 存活返回0elseexit 1 # 挂了返回非0fibashchmod x /etc/keepalived/check_nginx.sh6.3 在配置中声明脚本在 keepalived.conf 的 global_defs 之后、vrrp_instance 之前加confvrrp_script check_nginx {script /etc/keepalived/check_nginx.sh # 脚本路径interval 2 # 每2秒执行一次检查weight -20 # 检查失败时优先级减20150-20130 100fall 2 # 连续2次失败才判定失败rise 1 # 连续1次成功即恢复}weight 的坑主 priority150若weight -20挂了变 130备 priority100。130 100VIP 不会漂移所以要保证主挂了之后 priority 仍低于备。正确做法主 priority150weight-60 → 挂了变 90 100正常漂移。或用weight 0state 主备切换配合本文用减法方案保证主失败后必让位。修正后的主节点脚本声明confvrrp_script check_nginx {script /etc/keepalived/check_nginx.shinterval 2weight -60 # 150-6090 备的100确保漂移fall 2rise 1}备节点也声明同名脚本weight 可不设或一致保持逻辑统一。七、启动与验证7.1 启动服务两台bashsystemctl start keepalivedsystemctl enable keepalivedsystemctl status keepalived7.2 查看 VIP 归属baship addr show eth0# 或ip a正常情况下 VIP192.168.1.100应绑定在主节点 node1上text3: eth0: BROADCAST,MULTICAST,UP,LOWER_UP ...inet 192.168.1.11/24 scope global eth0inet 192.168.1.100/24 scope global secondary eth0 # ← VIP在主节点7.3 验证客户端访问bash# 在任意客户端curl http://192.168.1.100# 返回h1Nginx on node1/h17.4 查看 Keepalived 运行状态bash# 实时查看 VRRP 状态ps -ef | grep keepalived# 主节点日志tail -f /var/log/messages | grep -i keepalived# 或 journalctljournalctl -u keepalived -f主节点日志应出现textKeepalived_vrrp[xxx]: Sending gratuitous ARP on eth0 for 192.168.1.100Keepalived_vrrp[xxx]: Entering MASTER STATE八、故障转移验证重点实战8.1 场景一停掉主节点 Nginx业务级故障bash# 在 node1 上systemctl stop nginx等待健康检查判定失败fall 2 × interval 2 ≈ 4 秒 1 心跳bash# node1 日志Keepalived_vrrp[xxx]: (VI_1) Entering BACKUP STATE # 主降级为备Keepalived_vrrp[xxx]: (VI_1) removing VIP from eth0 # 释放VIP# node2 日志Keepalived_vrrp[xxx]: (VI_1) Entering MASTER STATE # 备升级为主Keepalived_vrrp[xxx]: Sending gratuitous ARP on eth0 for 192.168.1.100 # 抢过VIP验证baship addr show eth0 # VIP 已漂移到 node2curl http://192.168.1.100 # 返回 h1Nginx on node2/h1业务无缝切换8.2 场景二直接宕机/断网节点级故障bash# 在 node1 上直接关闭网络或关机systemctl stop network # 或 ifdown eth0 / 直接 poweroff备节点 node2 在心跳超时默认advert_int × 3≈ 3 秒后抢占 VIP业务自动切到 node2。8.3 恢复主节点bash# 在 node1 上systemctl start nginx # 恢复业务systemctl start keepalived # 若keepalived也停了一并启动重启后按优先级node1priority 150会重新抢占回 VIP流量切回 node1。若希望主恢复后不抢回两台配置都加上nopreempt且state都写BACKUP此时纯靠 priority 决定主恢复后 VIP 不自动回切避免频繁抖动。九、常见问题与排障现象原因与解决VIP 起不来网卡名不对ip a确认 eth0 还是 ens33virtual_router_id冲突两台都是 MASTER心跳不通多播被禁 → 改单播防火墙放行 VRRPvrrp 协议 112Nginx 挂了 VIP 不漂移weight设置导致主失败后优先级仍高于备见 6.3 的坑主恢复后频繁抖动两台都加nopreempt改为非抢占备机日志无输出防火墙拦截组播/单播放行iptables -A INPUT -p vrrp -j ACCEPT认证失败auth_pass长度超 8 位或两台不一致云服务器上漂移失败云商禁组播务必用unicast_*单播安全组放行对应端口防火墙放行 VRRPbash# firewalldfirewall-cmd --permanent --add-protocolvrrpfirewall-cmd --reload# iptablesiptables -A INPUT -p vrrp -j ACCEPTiptables -A INPUT -d 224.0.0.0/8 -j ACCEPT手动切换排障技巧bash# 手工停用主节点观察备节点是否立即接管ip addr del 192.168.1.100/24 dev eth0 # 仅测试生产不建议# 或直接查看状态变化watch -n1 ip addr show eth0 | grep 192.168.1.100十、总结Keepalived 高可用部署的核心要点可以归纳为三个一一个 VIP对外只暴露一个虚拟 IP客户端无感知故障。一组心跳VRRP 组播/单播心跳 优先级决定谁是 MASTER。一套检查vrrp_script健康检查业务进程确保VIP 跟业务走。关键经验云服务器记得用单播替代组播。健康检查的weight必须保证主挂后优先级低于备否则漂移失败。生产环境建议**非抢占nopreempt**模式减少主备抖动。先做故障转移演练停服务、断网、重启再上生产别等出事了才发现配置有误。本文基于 Keepalived 2.4.3 CentOS 7/8 Nginx 1.24 实战验证。