ipvs

How can we help?

Навигация

R1:

[root@r1 ~]# yum install -y ipvsadm Dependencies Resolved
...
Установлено:
  ipvsadm.x86_64 0:1.27-8.el7
...

[root@r1 ~]# ipvsadm -1
Try `ipvsadm -h' or 'ipvsadm --help' for more information.
[root@r1 ~]# ipvsadm -l
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn

[root@r1 ~]# yum install docker -y
...
Установлено:
  docker.x86_64 2:1.13.1-209.git7d71120.el7.centos
...
[root@r1 ~]# systemctl status docker
● docker.service - Docker Application Container Engine
   Loaded: loaded (/usr/lib/systemd/system/docker.service; disabled; vendor preset: disabled)
   Active: active (running) since Пн 2022-07-25 14:11:04 MSK; 7s ago
     Docs: http://docs.docker.com
 Main PID: 24609 (dockerd-current)
   CGroup: /system.slice/docker.service
           ├─24609 /usr/bin/dockerd-current --add-runtime docker-runc=/usr/libexec/docker/docker-runc-current --d...
           └─24614 /usr/bin/docker-containerd-current -l unix:///var/run/docker/libcontainerd/docker-containerd.s...

июл 25 14:11:04 r1 dockerd-current[24609]: time="2022-07-25T14:11:04.682261170+03:00" level=info msg="libc...614"
июл 25 14:11:04 r1 dockerd-current[24609]: time="2022-07-25T14:11:04.764931362+03:00" level=info msg="Grap...nds"
июл 25 14:11:04 r1 dockerd-current[24609]: time="2022-07-25T14:11:04.765785955+03:00" level=info msg="Load...rt."
июл 25 14:11:04 r1 dockerd-current[24609]: time="2022-07-25T14:11:04.774294093+03:00" level=info msg="Fire...lse"
июл 25 14:11:04 r1 dockerd-current[24609]: time="2022-07-25T14:11:04.832272038+03:00" level=info msg="Defa...ess"
июл 25 14:11:04 r1 dockerd-current[24609]: time="2022-07-25T14:11:04.856979214+03:00" level=info msg="Load...ne."
июл 25 14:11:04 r1 dockerd-current[24609]: time="2022-07-25T14:11:04.887558394+03:00" level=info msg="Daem...ion"
июл 25 14:11:04 r1 dockerd-current[24609]: time="2022-07-25T14:11:04.887581115+03:00" level=info msg="Dock...13.1"
июл 25 14:11:04 r1 dockerd-current[24609]: time="2022-07-25T14:11:04.894462012+03:00" level=info msg="API ...ock"
июл 25 14:11:04 r1 systemd[1]: Started Docker Application Container Engine.
Hint: Some lines were ellipsized, use -l to show in full.

[root@r1 ~]# mkdir /srv/A /srv/B
[root@r1 ~]# echo "This is A" > /srv/A/index.html
[root@r1 ~]# echo "This is B" > /srv/B/index.html

[root@r1 ~]# 
Unable to find image 'nginx:latest' locally
Trying to pull repository docker.io/library/nginx ...
latest: Pulling from docker.io/library/nginx
461246efe0a7: Pull complete
060bfa6be22e: Pull complete
b34d5ba6fa9e: Pull complete
8128ac56c745: Pull complete
44d36245a8c9: Pull complete
ebcc2cc821e6: Pull complete
Digest: sha256:1761fb5661e4d77e107427d8012ad3a5955007d997e0f4a3d41acc9ff20467c7
Status: Downloaded newer image for docker.io/nginx:latest
5106891e4e5cc13c074ce17dcaaad03a4fd8e769fbb62a32dcc85bd8a49dd636

[root@r1 ~]# docker run --rm -d -v "/srv/B:/usr/share/nginx/html" --name nginx-B nginx
7de410bbf95728774430a1a9bfdfa2020002a5dc0dccfa6aa33a725ea1b98f39

[root@r1 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES
7de410bbf957        nginx               "/docker-entrypoin..."   10 seconds ago      Up 9 seconds        80/tcp              nginx-B
5106891e4e5c        nginx               "/docker-entrypoin..."   5 minutes ago       Up 5 minutes        80/tcp              nginx-A

[root@r1 ~]# docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' nginx-A
172.17.0.2
[root@r1 ~]# docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' nginx-B
172.17.0.3

[root@r1 ~]# curl 172.17.0.2                   # forbidden, скорее всего из-за неверного selinux-контекста
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.23.1</center>
</body>
</html>

[root@r1 ~]# ls -laZ /srv/*/index.html
-rw-r--r--. root root unconfined_u:object_r:var_t:s0   /srv/A/index.html
-rw-r--r--. root root unconfined_u:object_r:var_t:s0   /srv/B/index.html

[root@r1 ~]# semanage fcontext -a -t httpd_sys_content_t /srv/A/index.html

[root@r1 ~]# curl 172.17.0.2
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.23.1</center>
</body>
</html>

[root@r1 ~]# restorecon -v /srv/A/index.html
restorecon reset /srv/A/index.html context unconfined_u:object_r:var_t:s0->unconfined_u:object_r:httpd_sys_content_t:s0

[root@r1 ~]# curl 172.17.0.2
This is A

[root@r1 ~]# semanage fcontext -a -t httpd_sys_content_t /srv/B/index.html

[root@r1 ~]# restorecon -v /srv/B/index.html
restorecon reset /srv/B/ index.html context unconfined_u:object_r:var_t:s0->unconfined_u:object_r:httpd_sys_content_t:s0

[root@r1 ~]# curl 172.17.0.3
This is B

[root@r1 ~]# ls -laZ /srv/*/index.html
-rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 /srv/A/index.html
-rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 /srv/B/index.html

[root@r1 ~]# ipvsadm -l -n
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  111.111.111.111:80 rr

[root@r1 ~]# ipvsadm -a -t 111.111.111.111:80 -r 172.17.0.2 -m
[root@r1 ~]# ipvsadm -a -t 111.111.111.111:80 -r 172.17.0.3 -m
[root@r1 ~]# ipvsadm -l -n
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  111.111.111.111:80 rr
  -> 172.17.0.2:80                Masq    1      0          0
  -> 172.17.0.3:80                Masq    1      0          0

[root@r1 ~]# firewall-cmd --zone=public --add-service=http --permanent
success
[root@r1 ~]# firewall-cmd --zone=public --add-service=http
success
[root@r1 ~]# sudo firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp0s3 enp0s8 enp0s9
  sources:
  services: dhcpv6-client http ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

# Проверим работоспособность сгенерировав 1000 запросов
111.1

[root@r3 ~]# for i in `seq 1 1000`; do curl http://111.111.111.111 -s; done | sort | uniq -c
    500 This is A
    500 This is B


[root@r1 ~]# ipvsadm -l -n --rate
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port                 CPS    InPPS   OutPPS    InBPS   OutBPS
  -> RemoteAddress:Port
TCP  111.111.111.111:80                 97      681      486    43847    49873
  -> 172.17.0.2:80                      49      340      243    21924    24937
  -> 172.17.0.3:80                      49      340      243    21923    24937

[root@r1 ~]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES
f9458c7b765f        nginx               "/docker-entrypoin..."   14 hours ago        Up 14 hours         80/tcp              nginx-B
b36c01e4a91c        nginx               "/docker-entrypoin..."   14 hours ago        Up 14 hours         80/tcp              nginx-A

[root@r1 ~]# docker logs f9458c7b765f | awk '{print$1}' | uniq -c
2022/07/25 16:30:56 [notice] 1#1: using the "epoll" event method
2022/07/25 16:30:56 [notice] 1#1: nginx/1.23.1
2022/07/25 16:30:56 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6)
2022/07/25 16:30:56 [notice] 1#1: OS: Linux 3.10.0-1160.el7.x86_64
2022/07/25 16:30:56 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2022/07/25 16:30:56 [notice] 1#1: start worker processes
2022/07/25 16:30:56 [notice] 1#1: start worker process 30
      2 10-listen-on-ipv6-by-default.sh:
      1 111.111.111.111
      2 172.17.0.1
   1751 192.168.23.3
      6 /docker-entrypoint.sh:

# Убрать ошибки
[root@r1 ~]# docker logs f9458c7b765f 2>&1 | grep '192.168.23.3' | awk '{print$1}' | uniq -c
   2885 192.168.23.3
[root@r1 ~]# docker logs f9458c7b765f 2>/dev/null | grep '192.168.23.3' | awk '{print$1}' | uniq -c
   2885 192.168.23.3