Instalasi Paket Dependensi

dnf install -y keepalived

Konfigurasi Keepalived

Referensi status Keepalived

  • MASTER-MASTER (jika down, kembali ke prioritas tertinggi)
  • MASTER-BACKUP (jika down, kembali ke MASTER)
  • BACKUP-BACKUP (jika down, mengikuti node dengan status MASTER)
  • Router dengan prioritas 101 akan menjadi MASTER dan router dengan prioritas 100 akan menjadi BACKUP.

Konfigurasi Node Pertama

cat <<EOF | tee /etc/keepalived/keepalived.conf
global_defs {
    router_id JumpServer
    enable_script_security
    vrrp_check_unicast_src
}

vrrp_track_process track_openvpn {
    process openvpn
    weight 2
}

vrrp_instance VIP {
    state MASTER
    interface eth1
    virtual_router_id 69
    priority 101
    advert_int 1
    nopreempt

    authentication {
        auth_type PASS
        auth_pass Pa\$\$w0rd
    }

    unicast_src_ip 10.79.80.1
    unicast_peer {
        10.79.80.2
    }

    virtual_ipaddress {
        103.150.80.130/28 dev eth0
        10.79.80.254/24 dev eth1
    }

    virtual_routes {
        0.0.0.0/0 via 103.150.80.142 dev eth0 metric 100
    }

    static_routes {
        0.0.0.0/0 via 10.79.80.251 dev eth1 metric 101
    }

    track_process {
        track_openvpn
    }
}
EOF

Mulai ulang layanan dan jalankan saat sistem dinyalakan

systemctl restart keepalived; systemctl enable keepalived

Konfigurasi Node Kedua

cat <<EOF | tee /etc/keepalived/keepalived.conf
global_defs {
    router_id JumpServer
    enable_script_security
    vrrp_check_unicast_src
}

vrrp_track_process track_openvpn {
    process openvpn
    weight 2
}

vrrp_instance VIP {
    state BACKUP
    interface eth1
    virtual_router_id 69
    priority 100
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass Pa\$\$w0rd
    }

    unicast_src_ip 10.79.80.2
    unicast_peer {
        10.79.80.1
    }

    virtual_ipaddress {
        104.18.5.103/28 dev eth0
        10.79.80.254/24 dev eth1
    }

    virtual_routes {
        0.0.0.0/0 via 103.150.80.142 dev eth0 metric 100
    }

    static_routes {
        0.0.0.0/0 via 10.79.80.251 dev eth1 metric 101
    }

    track_process {
        track_openvpn
    }
}
EOF

Mulai ulang layanan dan jalankan saat sistem dinyalakan

systemctl restart keepalived; systemctl enable keepalived

Custom Health Check

Jika ingin menggunakan skrip custom untuk health check, ubah atau sesuaikan file keepalived.conf seperti berikut.

vrrp_script healthcheck {
    script "/bin/bash /etc/keepalived/healthcheck.sh"
    user root root
    interval 2
    weight 2
}

vrrp_instance VIP {
    ...
    track_script {
        healthcheck
    }
    ...
}

dan buat skrip bash healthcheck.sh seperti ini

#!/bin/bash
TARGET_URL="https://127.0.0.1:443"
USER_AGENT=$(keepalived -v 2>&1 | awk '/Keepalived/ {print $1"/"$2}')

curl --head \
        --silent \
        --insecure \
        --max-time 1 \
        --header "Via: $HOSTNAME" \
        --header "User-Agent: $USER_AGENT" \
        --request GET "$TARGET_URL" -o /dev/null
echo "Result code $?"
exit $?

Jika SELinux dalam mode Enforcing, tambahkan modul berikut

semodule -r keepalived-health-check
cat <<EOF | tee keepalived-health-check.te
module keepalived-health-check 1.0;

require {
        type shell_exec_t;
        type keepalived_t;
        type keepalived_exec_t;
        type unreserved_port_t;
        type hostname_exec_t;
        class file { getattr setattr execute execute_no_trans open read map };
        class tcp_socket name_connect;
}

#============= keepalived_t ==============
allow keepalived_t shell_exec_t:file setattr;
allow keepalived_t unreserved_port_t:tcp_socket name_connect;
allow keepalived_t keepalived_exec_t:file { execute_no_trans open };
allow keepalived_t hostname_exec_t:file { getattr execute execute_no_trans open read };

#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
allow keepalived_t hostname_exec_t:file map;
EOF

checkmodule -M -m -o keepalived-health-check.mod keepalived-health-check.te
semodule_package -o keepalived-health-check.pp -m keepalived-health-check.mod
semodule -i keepalived-health-check.pp

sealert -a /var/log/audit/audit.log

Troubleshooting dengan keepalived debug

keepalived -nldD

Referensi: