Howto setup High-Available HAProxy with Keepalived

Summary

This blog post explains how to setup HAProxy and Keepalived for use with for example the MariaDB Galera cluster setup described here.

The combination of HAProxy and Keepalived will make the MariaDB Galera cluster more resilient and high-available by adding load balancing and transparent failover when a MariaDB cluster node goes down. HAProxy also allows you to separate read and write actions to the MariaDB Galera cluster which is very useful if you want to loadbalance read actions across all MariaDB nodes but want to write to only one MariaDB node.

Since only one of anything is a Single Point of Failure (SPoF) I’ll be using two HAProxy nodes in a high-availability setup. Should the primary HAProxy node fail then Keepalived will initiate an automatic and transparent failover to the secondary HAProxy node.

Requirements

This tutorial requires the MariaDB Galera cluster setup mentioned above. You will also need 2 nodes (VMs or bare metal) called haproxy1 and haproxy2 each with one IP address. In addition you will also need a third IP address that will be used as the floating Virtual IP (VIP) address between the two HAProxy nodes. The HAProxy nodes don’t need a lot of power, memory or storage. One CPU with 512MB to 1GB memory and an 8GB disk are fine.

Let’s get started.

Install HAProxy and Keepalived on both HAProxy nodes

On haproxy1 install HAProxy and Keepalived.

Now make sure both services start at boot:

Check if both services are properly activated:

That looks good so on to the next node.

Do the same on haproxy2:

Now make sure both services start at boot:

Check if both services are properly activated:

That looks good so on to the next step.

Allow non-local Virtual IPs on all HAProxy nodes

Make binding to non-local Virtual IPs on all nodes:

Add HAProxy user to the MariaDB database

Make sure a HAProxy user exists on all MAriaDB nodes so HAProxy can access all the MariaDB nodes to check if they are still up. I’m using the user ‘haproxy’ and use the IPs of all the ethernet interfaces on the two HAProxy nodes (not the VIP address):

Since this information is automatically replicated to db2 and db3 we only
have to do this on db1. You can check if the information was replicated
with:

That looks good. On to the next step.

Setup rsyslog logging for HAProxy

By default HAProxy does not do any logging which obviously needs fixing. To enable HAProxy to log to rsyslog we need to add a rsyslog config file on both HAProxy nodes.

On node haproxy1:

Make sure the SELinux label is ok:

And restart the rsyslog service:

On node haproxy2:

Make sure the SELinux label is ok:

And restart the rsyslog service:

Add HAProxy config

HAProxy is extremely flexible and you can make it do a ton of cool things. Check out the HAProxy website for a taste what it’s capable of. The goal in this tutorial is to put the two HAProxy nodes in front of the MariaDB cluster nodes to loadbalance and when a MariaDB node fails to transparently redirect DB queries to the remaining operational MariaDB nodes.

On node haproxy1 first save the default configuration:

On node haproxy1 create the HAProxy configuration file:

Make sure the SELinux label is ok:

Now let’s do the same for the second haproxy node.

On node haproxy2 first save the default configuration:

On node haproxy2 create the HAProxy configuration file again or copy it from node haproxy1 as they are the same.

Make sure the SELinux label is ok:

Understanding the configuration of a HAProxy node is best done with the HAProxy docs. Look up each settings to get an understanding of what they mean.

The two sections called listen mariadb-galera-writes and listen mariadb-galera-reads are the importants ones.

The listen mariadb-galera-writes section has a check if the MariaDB nodes are still available and defines three MariaDB nodes with only one active and two as backup nodes. Should one MariaDB node fail then HAProxy will automatically ignore it and send write queries to the first backup node (db2 in this case). So this section limits writing to any database on the cluster to a single MariaDB node.

The listen mariadb-galera-reads section also has a check if the MariaDB nodes are still available. Since all three MariaDB nodes are active, all three MariaDB nodes can receive read queries. Should one MariaDB node fail then HAProxy will automatically ignore it and send queries to the other two MariaDB nodes where priority is given to the MariaDB node with the least connections. So this section allows reading from all three MariaDB nodes.

Make HAProxy high-available with Keepalived

What is Keepalived? Paraphrased from the Keepalive website: Keepalived provides simple and robust facilities for loadbalancing and high-availability to Linux system and Linux based infrastructures. Loadbalancing framework relies on the well-known and widely used Linux Virtual Server (IPVS) kernel module providing Layer4 loadbalancing while high-availability is achieved by the VRRP protocol.

Add Keepalived config

On node haproxy1 first save the default Keepalived configuration:

On node haproxy1 create the Keepalived configuration file:

Important: change the following parameters (if required) for your environment:

notification_email:
Change the ‘cluster-admin@example.org’ email address to the email address where you want the notifications to be sent.

notification_email_from:
Change the ‘haproxy-noreply@example.org’ email address to the your preferred ‘From:’ value.

smtp_server:
Change smtp.example.org to the DNS name or IP address of the MTA that your haproxy nodes use.

interface:
If the Virtual IP address (VIP) is not attached to eth0 then change it to the interface where it is attached.

auth_pass:
Change the ‘‘ password to a proper password of 8 characters.

virtual_ipaddress:
Change the VIP from ‘10.0.0.25’ to the Virtual IP address reserved for HAProxy.

Make sure the SELinux label is ok:

Let’s setup the Keepalived config on the second haproxy node (haproxy2):

On node haproxy2 first save the default Keepalived configuration:

On node haproxy2 create the Keepalived configuration file:

Make sure the SELinux label is ok:

Important – change the following parameters for your environment (if required) as you previously did for node haproxy1:

– notification_email
– notification_email_from
– smtp_server
– interface
– virtual_router_id (which should be the same on both nodes)
– auth_pass (which should be the same on both nodes)
– virtual_ipaddress (which should be the same on both nodes)

Important – note the differences and similarities between the Keepalived config file on haproxy1 and haproxy2:

Keepalived Priorities and Weight or How Failover Works

haproxy1 has a base priority of 101 + a weight of 2 when HAProxy is running = 103
haproxy2 has a base priority of 100 + a weight of 2 when HAProxy is running = 102

Since haproxy1’s 103 is bigger than haproxy2’s 102 haproxy2 is not allowed to initiate a failover and grab the VIP.

Here’s what happens when HAProxy goes down on node haproxy1?

haproxy1 has a base priority of 101 + 0 because HAProxy is no longer running = 101
haproxy2 has a base priority of 100 + a weight of 2 because HAProxy is running = 102

Since haproxy1’s 101 is smaller than haproxy2’s 102 haproxy2 is allowed to initiate a failover and grab the VIP.

ProTip: check the priority that the ACTIVE node is broadcasting by sniffing the traffic with the following tcpdump command:

Firewall Setup: Enable Multicast in IPtables

By default Keepalived uses multicast to send out its VRRP advertisements. You can configure Keepalived to use Unicast too if you prefer that. Here is an example multicast rule to allow multicast packets between the two haproxy nodes:

Since Keepalived is using vrrp.mcast.net (224.0.0.18) you could further tighten the rule above with:

As an example here is the first rule applied to the default CentOS 6 firewall:

And if you want to manually add those rules and add a rule for protocol 112 (VRRP), here are the commands that you could use on both nodes:

Change your interface and tighten the source and/or destination networks to your requirements.

Troubleshooting Multicast

Here are some commands which show you the status of various interfaces and multicast groups those interfaces are member of:

ProTip: if multicast is disabled (but enabled in the kernel) you can manually enable it with the following command:

One thought on “Howto setup High-Available HAProxy with Keepalived”

  1. The HAProxy config is incorrect. You cannot have:
    bind 0.0.0.0:3306
    and
    server db1 10.0.0.9:3306 check
    server db2 10.0.0.11:3306 check backup
    server db3 10.0.0.13:3306 check backup

    on the same port ans you will have binding errors while either restarting database or haproxy

Leave a Reply

Your email address will not be published. Required fields are marked *