Chapter 6. HAProxy/keepalived Configuration

Register the nodes.

sudo subscription-manager register

Enable the RHEL server repository.

sudo subscription-manager repos --enable=rhel-7-server-rpms

Update the server.

sudo yum update -y

Open port 80.

sudo firewall-cmd --zone=public --add-port 80/tcp --permanent
sudo firewall-cmd --reload

For HTTPS, open port 443.

sudo firewall-cmd --zone=public --add-port 443/tcp --permanent
sudo firewall-cmd --reload

Install keepalived.

sudo yum install -y keepalived

Configure keepalived.

sudo vim /etc/keepalived/keepalived.conf

In the following configuration, there is a script to check the haproxy processes. The instance uses eth0 as the network interface and configures haproxy as the master server and haproxy2 as the backup server. It also assigns a virtual IP address (i.e., 192.168.0.100).

vrrp_script chk_haproxy {
  script "killall -0 haproxy" # check the haproxy process
  interval 2 # every 2 seconds
  weight 2 # add 2 points if OK
}

vrrp_instance VI_1 {
  interface eth0 # interface to monitor
  state MASTER # MASTER on haproxy, BACKUP on haproxy2
  virtual_router_id 51
  priority 101 # 101 on haproxy, 100 on haproxy2
  virtual_ipaddress {
    192.168.0.100 # virtual ip address
  }
  track_script {
    chk_haproxy
  }
}

For a detailed discussion of configuring keepalived, refer to Initial Load Balancer Configuration with Keepalived.

Enable/start keepalived.

sudo systemctl enable keepalived
sudo systemctl start keepalived

Install haproxy.

sudo yum install haproxy

Configure haproxy for SELinux and HTTP.

sudo vim /etc/firewalld/services/haproxy-http.xml

Add the following lines:

<?xml version="1.0" encoding="utf-8"?>
<service>
<short>HAProxy-HTTP</short>
<description>HAProxy load-balancer</description>
<port protocol="tcp" port="80"/>
</service>

As root, assign the correct SELinux context and file permissions to the haproxy-http.xml file.

# cd /etc/firewalld/services
# restorecon haproxy-http.xml
# chmod 640 haproxy-http.xml

If you intend to use HTTPS, configure haproxy for SELinux and HTTPS.

sudo vim /etc/firewalld/services/haproxy-https.xml

Add the following lines:

<?xml version="1.0" encoding="utf-8"?>
<service>
<short>HAProxy-HTTPS</short>
<description>HAProxy load-balancer</description>
<port protocol="tcp" port="443"/>
</service>

As root, assign the correct SELinux context and file permissions to the haproxy-https.xml file.

# cd /etc/firewalld/services
# restorecon haproxy-https.xml
# chmod 640 haproxy-https.xml

If you intend to use HTTPS, generate keys for SSL. If you do not have a certificate, you may use a self-signed certificate. To generate a key, refer to generating a key.

Finally, put the certificate and key into a PEM file.

cat example.com.crt example.com.key > example.com.pem
sudo cp example.com.pem /etc/ssl/private/

Configure haproxy.

sudo vim /etc/haproxy/haproxy.cfg

The global and defaults may remain unchanged. After the defaults section, you will need to configure frontend and backend sections. For example:

frontend http_web *:80
    mode http
    default_backend rgw

frontend rgw­-https
  bind *:443 ssl crt /etc/ssl/private/example.com.pem
  default_backend rgw

backend rgw
    balance roundrobin
    mode http
    server  rgw1 10.0.0.71:80 check
    server  rgw2 10.0.0.80:80 check

For a detailed discussion of HAProxy configuration, refer to HAProxy Configuration.

Enable/start haproxy

sudo systemctl enable haproxy
sudo systemctl start haproxy