Highly available Load-balancer for Kubernetes Cluster On-Premise - I
In this post, we are going to build highly available HAProxy Load-balancer for our Kubernetes cluster on-premise. For this, HaProxy will be used for external Load-balancer which takes the requests from outside world sends them to Kubernetes worker nodes on which nginx ingress controller listens incoming requests on port 80 and 443.
Another curial software component is Keepalived which provides a highly available HAProxy load-balancer, in case of any of HAProxy loadbalancer is down.
Keepalived is a Robust Virtual Router Redundancy Protocal (VRRP )implementation in GNU/Linux
To build cluster, Ubuntu 18.04.4 used. You can see below diagram how environment looks like.
Installing necessary Software Suits
# sudo apt-get install haproxy
# sudo apt-get install keepalived
# sudo systemctl enable haproxy
# sudo systemctl enable keepalived
Configuring Necessary Kernel Parameters
The below configuration is very important to implement it on both nodes.
In order for the Keepalived service to forward network packets properly to the real servers, each node must have IP forwarding turned on in the kernel. Log in as root and change the line which reads net.ipv4.ip_forward = 0 in /etc/sysctl.conf to the following configuration.
net.ipv4.ip_forward = 1
The changes take effect when you reboot the system. Load balancing in HAProxy and Keepalived at the same time also requires the ability to bind to an IP address that are nonlocal, meaning that it is not assigned to a device on the local system. This allows a running load balancer instance to bind to an IP that is not local for failover. To enable, edit the line in /etc/sysctl.conf that reads net.ipv4.ip_nonlocal_bind to the following configuration.
net.ipv4.ip_nonlocal_bind = 1
The changes take effect when you reboot the system.
Configuring Keepalived on both nodes
Some keepalived settings has to be changed accordingly in the second node. So, check the commented lines in the keepalived.conf
global_defs {
notification_email {
[email protected]
}
notification_email_from [email protected]
smtp_server localhost
smtp_connect_timeout 30
router_id ha1 #router_id ha2 on the second node(ha2)
vrrp_skip_check_adv_addr
vrrp_garp_interval 0.5
vrrp_garp_master_delay 1
vrrp_garp_master_repeat 5
vrrp_gna_interval 0
enable_script_security
script_user root
vrrp_no_swap
checker_no_swap
}
# Script used to check if HAProxy is running
vrrp_script check_haproxy {
script "/usr/bin/pgrep haproxy 2>&1 >/dev/null"
interval 1
fall 2
rise 2
}
# Virtual interface
vrrp_instance VI_01 {
state MASTER #state BACKUP on the second node(ha2)
interface enp1s0
virtual_router_id 120
priority 101 #priority 100 on the second node(ha2). Higher number wins.
nopreempt
advert_int 1
unicast_src_ip 10.5.100.51 #unicast_src_ip 10.5.100.52 on the second node(ha2)
unicast_peer {
10.5.100.52 #unicast_peer 10.5.100.51 on the second (ha2)
}
virtual_ipaddress {
10.5.100.50/24 dev enp1s0 label enp1s0:ha-vip1
}
authentication {
auth_type PASS
auth_pass MANINTHEIT
}
track_script {
check_haproxy
}
}
HAProxy Config
#Default configurations in the haproxy.cfg has been omitted.
frontend stats
bind 10.5.100.51:9000
mode http
maxconn 10
stats enable
stats show-node
stats hide-version
stats realm Haproxy\ Statistics
stats uri /hastats
stats auth haadmin:haadmin
frontend k8s-service-pool
mode tcp
bind 10.5.100.50:80
default_backend k8s-service-backend
backend k8s-service-backend
mode tcp
balance source
server k8s-worker-01 10.5.100.21 check port 80 inter 10s rise 1 fall 2
server k8s-worker-02 10.5.100.22 check port 80 inter 10s rise 1 fall 2
server k8s-worker-03 10.5.100.23 check port 80 inter 10s rise 1 fall 2
Restart the service keepalived and haproxy on both nodes.
# sudo systemctl restart haproxy
# sudo systemctl restart keepalived
Experiment
1- Lets check with tcpdump utility if master node sends VRRP advertisement packets to every second to all members of VRRP group.
tcpdump proto 112 -n
2- Lets check interface IPs; As you see, first node(ha1) looks active node as it register to VIP 10.5.100.50.
Second Part of the Post will be published soon, Stay healthy!