![\"twitter\"](\"https:\/\/blog.capdata.fr\/wp-content\/plugins\/social-media-feather\/synved-social\/image\/social\/regular\/48x48\/twitter.png\" "\\"Share")
<\/a><\/a>![\"linkedin\"](\"https:\/\/blog.capdata.fr\/wp-content\/plugins\/social-media-feather\/synved-social\/image\/social\/regular\/48x48\/linkedin.png\" "\\"Share")
<\/a>![\"mail\"](\"https:\/\/blog.capdata.fr\/wp-content\/plugins\/social-media-feather\/synved-social\/image\/social\/regular\/48x48\/mail.png\" "\\"Share")
<\/a>Hello \u00e0 toutes \/ tous, <\/p>\n
Suite \u00e0 l’article de Ludo sur Patroni<\/a>, cette semaine nous allons faire un comparatif des solutions de gestion de VIP dans un cluster. <\/p>\n Car si Patroni g\u00e8re le d\u00e9ploiement et la supervision d’instances PostgreSQL dans un cluster actif \/ passif, il ne g\u00e8re pas les redirections de connexion en cas de bascule. Il faudra donc s’appuyer sur une solution tierce. On travaille toujours \u00e0 partir de conteneurs LXD, comme en t\u00e9moigneront les commandes. Si vous \u00eates en environnement on-prem, simplement ignorer les pr\u00e9fixes type ‘lxc exec node — …’<\/em><\/p>\n C’est la solution la plus courante. Elle consiste \u00e0 d\u00e9marrer un service qui va cr\u00e9er une interface virtuelle en fonction de l’\u00e9tat d’une ressource (en l’occurrence ici un appel REST vers Patroni pour nous indiquer si le noeud local est le leader). <\/p>\n En cas d’erreur sur le test, qui indiquerait que le service n’est pas joignable, keepalived <\/em>tombe l’interface sur le noeud en \u00e9chec et la remonte sur le noeud survivant. Coupl\u00e9 \u00e0 Patroni, qui va g\u00e9rer le promote de l’instance standby, c’est un outil simple pour rediriger automatiquement les connexions. <\/p>\n On utilisera donc un cluster \u00e0 base de conteneurs LXD, \u00e0 3 noeuds pour le quorum ETCD. Patroni \/ PostgreSQL \/ Keepalived seront d\u00e9ploy\u00e9s sur les 2 premiers noeuds seulement. A faire sur pgpat1 et pgpat2:<\/p>\n Le fichier de configuration par d\u00e9faut se trouvera sous \/etc\/keepalived\/keepalived.conf<\/em>, il faudra le cr\u00e9er car il n’existe pas au pr\u00e9alable:<\/p>\n Sur pgpat1: <\/strong><\/p>\n Le script whosprimary <\/em>effectuera la requ\u00eate en REST, et notre VIP portera l’adresse 10.186.157.199<\/strong>. On red\u00e9marre le service \u00e0 l’issue:<\/p>\n On peut alors tester si la VIP est correctement mont\u00e9e sur le noeud pgpat1 et tester une connexion vers l’instance PostgreSQL:<\/p>\n Sur pgpat2:<\/strong><\/p>\n Noter que virtual_router_id<\/em> doit avoir un id unique sur la topologie. Puis m\u00eame chose on red\u00e9marre keepalived <\/em>et on v\u00e9rifie qu’il se positionne bien en off:<\/p>\n Ok on voit bien que sur le noeud pgpat2 la r\u00e9ponse de l’api REST de Patroni est en \u00e9chec ce qui montre que l’instance PostgreSQL a bien le r\u00f4le standby. <\/p>\n Pour v\u00e9rifier que la VIP bascule correctement, on utilisera deux \u00e0 trois fen\u00eatres XTERM: Test 1 : arr\u00eat de Patroni sur le leader:<\/strong><\/p>\n Surveillance de la bascule:<\/p>\n Test de connexion depuis un client tiers:<\/p>\n Test 2 : Failback sur l’ancien primaire :<\/strong> Surveillance de la bascule:<\/p>\n et test de connexion depuis un client tiers:<\/p>\n Si on regarde les traces du ping sur la VIP pour observer le temps de bascule, on verra 2 \u00e0 3 hops perdus \u00e0 chaque fois, ce qui correspond \u00e0 environ 3 secondes d’interruption :<\/p>\n OK nous avons valid\u00e9 qu’en cas de perte du service Patroni, le cluster bascule et notre vip bascule correctement sur le nouveau primary. Je n’ai volontairement pas d\u00e9taill\u00e9 la partie Patroni, je vous renvoie sur l’article de Ludo cit\u00e9 au d\u00e9but. <\/p>\n Prochain \u00e9pisode, nous verrons comment utiliser vip-manager de Cybertec<\/a>, et le comparer \u00e0 keepalived<\/em>. <\/p>\n To be continued…<\/em>. Bonne fin de weekend, \u00e0+ <\/p>\n Hello \u00e0 toutes \/ tous, Suite \u00e0 l’article de Ludo sur Patroni, cette semaine nous allons faire un comparatif des solutions de gestion de VIP dans un cluster. Car si Patroni g\u00e8re le d\u00e9ploiement et la supervision d’instances PostgreSQL dans… Continuer la lecture KEEPALIVED:<\/h2>\n
Sch\u00e9ma:<\/h3>\n
\n![\"\"](\"https:\/\/blog.capdata.fr\/wp-content\/uploads\/2022\/03\/patroni_keepalived-1024x621.png\")
<\/p>\nInstallation et configuration de keepalived sur les 2 noeuds Patroni:<\/h3>\n
\r\nroot@pgpat1:~# apt-get install -y keepalived curl\r\n# Bug https:\/\/bugs.debian.org\/cgi-bin\/bugreport.cgi?bug=878241\r\nroot@pgpat1:~# apt-get install -y libipset-dev\r\n<\/pre>\n
\r\nroot@pgpat1:~# vi \/etc\/keepalived\/keepalived.conf\r\nglobal_defs { \r\n router_id pgpat1\r\n enable_script_security\r\n script_user root\r\n}\r\n\r\nvrrp_script whosprimary {\r\n script "\/usr\/bin\/curl -X GET -I --fail http:\/\/10.186.157.60:8008\/primary"\r\n user root\r\n}\r\n\r\nvrrp_instance PGPAT1 {\r\n state MASTER\r\n interface eth0\r\n virtual_router_id 50\r\n unicast_peer {\r\n 10.186.157.60\r\n 10.186.157.216\r\n }\r\n advert_int 1\r\n authentication {\r\n auth_type PASS\r\n auth_pass ~bG7n)4?\r\n }\r\n virtual_ipaddress {\r\n 10.186.157.199\/24 dev eth0 label eth0:1\r\n }\r\n track_script {\r\n whosprimary\r\n }\r\n no_accept\r\n}\r\n<\/pre>\n\r\nroot@ubuntu20:~# lxc exec pgpat1 -- systemctl restart keepalived.service\r\nroot@ubuntu20:~# lxc exec pgpat1 -- systemctl status keepalived.service\r\n\u25cf keepalived.service - Keepalive Daemon (LVS and VRRP)\r\n Loaded: loaded (\/lib\/systemd\/system\/keepalived.service; enabled; vendor preset: enabled)\r\n Drop-In: \/run\/systemd\/system\/keepalived.service.d\r\n \u2514\u2500zzz-lxc-service.conf\r\n Active: active (running) since Sun 2022-03-06 14:50:49 UTC; 7min ago\r\n Process: 338 ExecStart=\/usr\/sbin\/keepalived $DAEMON_ARGS (code=exited, status=0\/SUCCESS)\r\n Main PID: 346 (keepalived)\r\n Tasks: 2 (limit: 4619)\r\n CGroup: \/system.slice\/keepalived.service\r\n \u251c\u2500346 \/usr\/sbin\/keepalived -P\r\n \u2514\u2500347 \/usr\/sbin\/keepalived -P\r\n\r\n<\/pre>\n
\r\nroot@ubuntu20:~# lxc exec pgpat1 -- ip addr show | grep eth0:1\r\n inet 10.186.157.199\/24 scope global secondary eth0:1\r\n\r\nroot@ubuntu20:~# psql -U postgres -h 10.186.157.199 \\ \r\n-p 5432 postgres -c "\\conninfo"\r\nPassword for user postgres: \r\nYou are connected to database "postgres" as user "postgres" \r\non host "10.186.157.199" at port "5432".\r\n<\/pre>\n
\r\nroot@pgpat2:~# vi \/etc\/keepalived\/keepalived.conf\r\n\r\nglobal_defs { \r\n router_id pgpat2\r\n enable_script_security\r\n script_user root\r\n}\r\n\r\nvrrp_script whosprimary {\r\n script "\/usr\/bin\/curl -X GET -I --fail http:\/\/10.186.157.216:8008\/primary"\r\n user root\r\n}\r\n\r\nvrrp_instance PGPAT2 {\r\n state MASTER\r\n interface eth0\r\n virtual_router_id 51\r\n unicast_peer {\r\n 10.186.157.60\r\n 10.186.157.216\r\n }\r\n advert_int 1\r\n authentication {\r\n auth_type PASS\r\n auth_pass ~bG7n)4?\r\n }\r\n virtual_ipaddress {\r\n 10.186.157.199\/24 dev eth0 label eth0:1\r\n }\r\n track_script {\r\n whosprimary\r\n }\r\n no_accept\r\n}\r\n<\/pre>\n\r\nroot@ubuntu20:~# lxc exec pgpat2 -- systemctl restart keepalived.service\r\nroot@ubuntu20:~# lxc exec pgpat2 -- systemctl status keepalived.service\r\n\u25cf keepalived.service - Keepalive Daemon (LVS and VRRP)\r\n Loaded: loaded (\/lib\/systemd\/system\/keepalived.service; enabled; vendor preset: enabled)\r\n Drop-In: \/run\/systemd\/system\/keepalived.service.d\r\n \u2514\u2500zzz-lxc-service.conf\r\n Active: active (running) since Sun 2022-03-06 14:56:10 UTC; 4min 8s ago\r\n Process: 362 ExecStart=\/usr\/sbin\/keepalived $DAEMON_ARGS (code=exited, status=0\/SUCCESS)\r\n Main PID: 365 (keepalived)\r\n Tasks: 3 (limit: 4619)\r\n CGroup: \/system.slice\/keepalived.service\r\n \u251c\u2500365 \/usr\/sbin\/keepalived\r\n \u251c\u2500366 \/usr\/sbin\/keepalived\r\n \u2514\u2500367 \/usr\/sbin\/keepalived\r\n\r\nMar 06 15:00:09 pgpat2 Keepalived_vrrp[367]: \/usr\/bin\/curl -X GET -I --fail http:\/\/10.186.157.216:8008\/primary exited with status 22\r\nMar 06 15:00:10 pgpat2 Keepalived_vrrp[367]: \/usr\/bin\/curl -X GET -I --fail http:\/\/10.186.157.216:8008\/primary exited with status 22\r\n(...)\r\n<\/pre>\n
Tests de d\u00e9faillance:<\/h3>\n
\n– Une pour tomber et red\u00e9marrer le service Patroni noeud par noeud, et tester la connexion \u00e0 PostgreSQL via la VIP.
\n– Une pour observer les changements de VIP entre conteneurs avec lxc list …<\/em>
\n– Une avec un ping directement sur la VIP pour voir combien de hops sont perdus pendant la bascule.<\/p>\n\r\nroot@ubuntu20:~# lxc exec pgpat1 -- systemctl stop patroni\r\n<\/pre>\n
\r\nroot@ubuntu20:~# watch lxc list pgpat\r\n\r\nEvery 2,0s: lxc list pgpat \r\n\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| pgpat1 | RUNNING | 10.186.157.60 (eth0) | fd42:a4e7:fd78:5160:216:3eff:feaf:c4a5 (eth0) | CONTAINER | 0 |\r\n| | | 10.186.157.199 (eth0:1) | | | |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| pgpat2 | RUNNING | 10.186.157.216 (eth0) | fd42:a4e7:fd78:5160:216:3eff:fe8c:9004 (eth0) | CONTAINER | 0 |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| pgpat3 | RUNNING | 10.186.157.3 (eth0) | fd42:a4e7:fd78:5160:216:3eff:fe8c:fd27 (eth0) | CONTAINER | 0 |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n(...)\r\nEvery 2,0s: lxc list pgpat ubuntu20: Sun Mar 6 16:10:08 2022\r\n\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| pgpat1 | RUNNING | 10.186.157.60 (eth0) | fd42:a4e7:fd78:5160:216:3eff:feaf:c4a5 (eth0) | CONTAINER | 0 |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| pgpat2 | RUNNING | 10.186.157.216 (eth0) | fd42:a4e7:fd78:5160:216:3eff:fe8c:9004 (eth0) | CONTAINER | 0 |\r\n| | | 10.186.157.199 (eth0:1) | | | |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| pgpat3 | RUNNING | 10.186.157.3 (eth0) | fd42:a4e7:fd78:5160:216:3eff:fe8c:fd27 (eth0) | CONTAINER | 0 |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n<\/pre>\n
\r\nroot@ubuntu20:~# psql -U postgres -h 10.186.157.199 -p 5432 postgres \\\r\n-c "\\conninfo"\r\nPassword for user postgres: \r\nYou are connected to database "postgres" as user "postgres" \r\non host "10.186.157.199" at port "5432".\r\n<\/pre>\n
\nRestart de Patroni sur pgpat1 et stop sur pgpat2 :<\/p>\n\r\nroot@ubuntu20:~# lxc exec pgpat1 -- systemctl start patroni\r\nroot@ubuntu20:~# lxc exec pgpat2 -- systemctl stop patroni\r\n<\/pre>\n
\r\nroot@ubuntu20:~# watch lxc list pgpat\r\n\r\nubuntu20: Sun Mar 6 16:10:52 2022\r\n\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| pgpat1 | RUNNING | 10.186.157.60 (eth0) | fd42:a4e7:fd78:5160:216:3eff:feaf:c4a5 (eth0) | CONTAINER | 0 |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| pgpat2 | RUNNING | 10.186.157.216 (eth0) | fd42:a4e7:fd78:5160:216:3eff:fe8c:9004 (eth0) | CONTAINER | 0 |\r\n| | | 10.186.157.199 (eth0:1) | | | |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| pgpat3 | RUNNING | 10.186.157.3 (eth0) | fd42:a4e7:fd78:5160:216:3eff:fe8c:fd27 (eth0) | CONTAINER | 0 |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n(...)\r\nEvery 2,0s: lxc list pgpat ubuntu20: Sun Mar 6 16:10:56 2022\r\n\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| pgpat1 | RUNNING | 10.186.157.60 (eth0) | fd42:a4e7:fd78:5160:216:3eff:feaf:c4a5 (eth0) | CONTAINER | 0 |\r\n| | | 10.186.157.199 (eth0:1) | | | |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| pgpat2 | RUNNING | 10.186.157.216 (eth0) | fd42:a4e7:fd78:5160:216:3eff:fe8c:9004 (eth0) | CONTAINER | 0 |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n| pgpat3 | RUNNING | 10.186.157.3 (eth0) | fd42:a4e7:fd78:5160:216:3eff:fe8c:fd27 (eth0) | CONTAINER | 0 |\r\n+--------+---------+-------------------------+-----------------------------------------------+-----------+-----------+\r\n<\/pre>\n
\r\nroot@ubuntu20:~# psql -U postgres -h 10.186.157.199 -p 5432 postgres \\\r\n-c "\\conninfo"\r\nPassword for user postgres: \r\nYou are connected to database "postgres" as user "postgres" \r\non host "10.186.157.199" at port "5432".\r\n<\/pre>\n
\r\nroot@ubuntu20:~# ping -a 10.186.157.199\r\nPING 10.186.157.199 (10.186.157.199) 56(84) bytes of data.\r\n64 bytes from 10.186.157.199: icmp_seq=1 ttl=64 time=0.053 ms\r\n64 bytes from 10.186.157.199: icmp_seq=2 ttl=64 time=0.089 ms\r\n64 bytes from 10.186.157.199: icmp_seq=3 ttl=64 time=0.050 ms\r\n64 bytes from 10.186.157.199: icmp_seq=4 ttl=64 time=0.112 ms\r\n64 bytes from 10.186.157.199: icmp_seq=5 ttl=64 time=0.051 ms\r\nFrom 10.186.157.216 icmp_seq=6 Redirect Host(New nexthop: 199.157.186.10)\r\nFrom 10.186.157.60 icmp_seq=6 Redirect Host(New nexthop: 199.157.186.10)\r\nFrom 10.186.157.60 icmp_seq=6 Destination Host Unreachable\r\n64 bytes from 10.186.157.199: icmp_seq=10 ttl=64 time=1524 ms\r\n64 bytes from 10.186.157.199: icmp_seq=11 ttl=64 time=504 ms\r\n64 bytes from 10.186.157.199: icmp_seq=12 ttl=64 time=0.052 ms\r\n64 bytes from 10.186.157.199: icmp_seq=13 ttl=64 time=0.094 ms\r\n(...)\r\n<\/pre>\n
<\/a><\/a><\/a>","protected":false},"excerpt":{"rendered":"