HAproxy implementation from entry to Advanced level 01/19 Update SLTechnology News&Howtos

HAproxy implementation from entry to Advanced level

2025-01-19 Update From: SLTechnology News&Howtos shulou NAV: SLTechnology News&Howtos > Servers >

Shulou(Shulou.com)06/02 Report--

HAproxy

LB Cluster (load balancing Cluster)

Fourth floor

Lvs, nginx (stream module), haproxy

Seventh floor

Http:nginx (http, ngx_http_upstream), haproxy (mode http), httpd,ats, perlbal,pound

Official document: http://cbonte.github.io/haproxy-dconv/

Use yum to install the version included in the haproxy CD.

Take HAProxy 1.5 as an example

Main program: / usr/sbin/haproxy

Main configuration file: / etc/haproxy/haproxy.cfg

The configuration end is divided into 2 segments.

Global: global configuration segment

Parameters related to process and security configuration

Parameters related to performance adjustment

Debug parameter

Proxies: agent configuration segment

Default:frontend,listen,backend provides the default configuration:

Among them

Frontend: front end, equivalent to nginx,server {}

Backend: backend, equivalent to nginx,upstream {}

Listen: for both front and back end

Implementation 1.1 configure a simple load balancing cluster using haproxy

Three hosts are used here

172.18.10.10, install httpd using yum, configure basic web content, and start the httpd service

[root@localhost ~] # yum install-y httpd

[root@localhost ~] # vim / var/www/html/index.html

Server1 172.18.10.10

Root@localhost ~] # ss-tnl

State Recv-Q Send-Q Local Address:Port Peer Address:Port

LISTEN 0 128: 80: *

LISTEN 0 128:: 22: *

LISTEN 0 128 *: 22 *: *

LISTEN 0 100:: 1:25: *

LISTEN 0 100 127.0.0.1:25

172.18.10.11, install httpd using yum, configure basic web content, and start the httpd service

[root@localhost ~] # yum install-y httpd

[root@localhost ~] # vim / var/www/html/index.html

Server1 172.18.10.11

Root@localhost ~] # ss-tnl

State Recv-Q Send-Q Local Address:Port Peer Address:Port

LISTEN 0 128: 80: *

LISTEN 0 128:: 22: *

LISTEN 0 128 *: 22 *: *

LISTEN 0 100:: 1:25: *

LISTEN 0 100 127.0.0.1:25

172.18.200.100, install haproxy using yum and edit haproxy.cfg file

[root@localhost haproxy] # vim haproxy.cfg

Modify the frontend break and the backend segment as follows

Frontend web

Bind *: 80

Default_backend websrvs

Backend websrvs

Balance roundrobin

Server srv1 172.18.10.10:80 check

Server srv2 172.18.10.11:80 check

Start the haproxy service

[root@localhost haproxy] # service haproxy start

Use the curl command to access the test

[root@localhost ~] # for i in {1.. 10}; do curl http://172.18.200.100;done

Server1 172.18.10.10

Server2 172.18.10.11

Server1 172.18.10.10

Server2 172.18.10.11

Server1 172.18.10.10

Server2 172.18.10.11

Server1 172.18.10.10

Server2 172.18.10.11

Server1 172.18.10.10

Server2 172.18.10.11

Conclusion: realize the simple LB Cluster of haproxy. Scheduling rules default to rr (polling) scheduling

Experiment 1.2 add mysql services on the basis of the original, and achieve load balancing scheduling

First, install mysql on two back-end backend servers, start the service, configure mysql-related parameters, and test whether the mysql link is normal.

[root@BYQ ~] # service mysqld start

Starting mysqld: [OK]

Mysql > select user ()

+-+

| | user () |

+-+

| | root@localhost |

+-+

1 row in set (0.00 sec)

Mysql > grant all on mydb.* to 'test'@'%' identified by' testpass'

Query OK, 0 rows affected (0.00 sec)

Test whether the link of mysql is normal on the client host

[root@localhost] # mysql-utest-ptestpass-h272.18.10.10

Welcome to the MySQL monitor. Commands end with; or\ g.

Your MySQL connection id is 5

Server version: 5.1.73 Source distribution

Oracle is a registered trademark of Oracle Corporation and/or its

Affiliates. Other names may be trademarks of their respective

Owners.

Type 'help;' or'\ h' for help. Type'\ c'to clear the current input statement.

Mysql >

[root@localhost] # mysql-utest-ptestpass-h272.18.10.11

Welcome to the MySQL monitor. Commands end with; or\ g.

Your MySQL connection id is 7

Server version: 5.1.73 Source distribution

Oracle is a registered trademark of Oracle Corporation and/or its

Affiliates. Other names may be trademarks of their respective

Owners.

Type 'help;' or'\ h' for help. Type'\ c'to clear the current input statement.

Mysql >

The mysql connections of both backend hosts are normal.

Next, configure on the haproxy server side

[root@localhost ~] # cd / etc/haproxy/

[root@localhost haproxy] # ls

Haproxy.cfg haproxy.cfg.bak

[root@localhost haproxy] # cp haproxy.cfg {, .web}

[root@localhost haproxy] # ls

Haproxy.cfg haproxy.cfg.bak haproxy.cfg.web

[root@localhost haproxy] # vim haproxy.cfg

Frontend web

Mode tcp

Bind *: 3306

Default_backend websrvs

Backend websrvs

Balance leastconn

Server mysql1 172.18.10.10:3306 check

Server mysql2 172.18.10.11:3306 check

Simple configuration completed

Lab 1.3 configuring haproxy rslog

[root@localhost ~] # vim / etc/rsyslog.conf

# Save boot messages also to boot.log

Local7.* / var/log/boot.log

Local2.* / var/log/haproxy.log

# Provides UDP syslog reception # # means to load UDP mode and listen on port 514

$ModLoad imudp

$UDPServerRun 514

Save exit and restart the rsyslog service to see if the log listening port is started

[root@localhost ~] # service rsyslog restart

Shutting down system logger: [OK]

Starting system logger: [OK]

[root@localhost ~] # ss-unl

State Recv-Q Send-Q Local Address:Port Peer Address:Port

UNCONN 0 0 *: 514 *: *

UNCONN 0 0 *: 57263 *: *

UNCONN 0 0: 514:: *

Experiment 1.4 configure source algorithm to implement hash-type binding

Edit the haproxy.cfg to change and add the following configuration

Backend websrvs

Balance source

Server srv1 172.18.10.10:80 check

Server srv2 172.18.10.11:80 check

Hash-type map-based

Restart the service

[root@localhost haproxy] # service haproxy restart

Stopping haproxy: [OK]

Starting haproxy: [OK]

Testing on the client side

[root@localhost ~] # for i in {1.. 10}; do curl http://172.18.200.100;done

Backend Server 2 172.18.10.11

Experiment 1.5 configure the uri algorithm to improve the hit. Binding consistency hash consistent

Edit the haproxy.cfg file

Backend websrvs

Balance uri

Server srv1 172.18.10.10:80 check

Server srv2 172.18.10.11:80 check

Hash-type consistent

Save and exit the restart service. Conclusion No matter which server, as long as the uri is the same, you will access the same backend host. If the uri is different, it is another matter.

For example, 20 page files are randomly generated on two backend hosts.

[root@localhost ~] # for i in {1.. 20}; do echo "Test Page $I (BE 1)" > / var/www/html/test$i.html;done

[root@localhost ~] # for i in {1.. 20}; do echo "Test Page $I (BE 2)" > / var/www/html/test$i.html;done

On the client side request, it is found that test1 is in BE1 and test2 is in BE2

[root@localhost ~] # for i in {1.. 10}; do curl http://172.18.200.100/test1.html;done

Test Page 1 (BE 1)

[root@localhost ~] # for i in {1.. 10}; do curl http://172.18.200.100/test2.html;done

Test Page 2 (BE 1)

Therefore, it is concluded that it has nothing to do with the bound client, but only has to do with the bound uri, so it can greatly improve the cache hit rate.

Experiment 1.6 adopts roundrobin scheduling rules and increases the weight to test.

Edit haproxy.cfg

Backend websrvs

Balance roundrobin

Server srv1 172.18.10.10:80 check weigth 2

Server srv2 172.18.10.11:80 check weigth 1

Hash-type consistent

Save and exit

Restart the service

[root@localhost haproxy] # service haproxy restart

Stopping haproxy: [OK]

Starting haproxy: [OK]

Access the same URL on the client

[root@localhost ~] # for i in {1.. 10}; do curl http://172.18.200.100/test5.html;done

Test Page 5 (BE 2)

Test Page 5 (BE 1)

Test Page 5 (BE 2)

Test Page 5 (BE 1)

Test Page 5 (BE 2)

Test Page 5 (BE 1)

Test Page 5 (BE 2)

Take one of the servers offline and wait 3 seconds to implement fall (default 3 seconds)

[root@localhost ~] # for i in {1.. 10}; do curl http://172.18.200.100/test5.html;done

Test Page 5 (BE 1)

Then put the offline server online and wait 2 seconds for rise (default 2 seconds) to resume polling.

[root@localhost ~] # for i in {1.. 10}; do curl http://172.18.200.100/test5.html;done

Test Page 5 (BE 1)

Test Page 5 (BE 2)

Test Page 5 (BE 1)

Test Page 5 (BE 2)

Test Page 5 (BE 1)

Test Page 5 (BE 2)

Test Page 5 (BE 1)

Conclusion: health status examination can be realized.

You can also set check inter (interval), rise, fall, maxconn (maximum number of concurrent connections), and backlog (if the backup queue does not specify a value, replace it with the value of maxconn), as shown below

Backend websrvs

Balance roundrobin

Server srv1 172.18.10.10:80 check inter 1000 rise 1 fall 2 maxconn 2000 weight 2

Server srv2 172.18.10.11:80 check weight 1

Hash-type consistent

In experiment 1.7, mark the first backend host as backup or disabled, and redirect to Baidu's url using redir on the second backend host.

Backend websrvs

Balance roundrobin

Server srv1 172.18.10.10:80 check inter 1000 rise 1 fall 2 maxconn 2000 weight 2 disabled

Server srv2 172.18.10.11 check weight 80 check weight 1 redir http://www.baidu.com/

Hash-type consistent

Visit 172.18.200.100. The page jumps to the Baidu home page

Lab 1.8 Open the haproxy stats page and debug the parameters

Open the stats page and add stats enable in the backend configuration section

Backend websrvs

Balance roundrobin

Server srv1 172.18.10.10:80 check inter 1000 rise 1 fall 2 maxconn 2000 weight 2 backup

Server srv2 172.18.10.11 check weight 80 check weight 1 redir http://www.baidu.com/

Hash-type consistent

Stats enable

Restart the service

This opens the stats page

The stats page has a default value, which is as follows

-stats uri: / haproxy?stats

-stats realm: "HAProxy Statistics"

-stats auth: no authentication

-stats scope: no restriction

Enter http://172.18.200.100/haproxy?stats in the browser, and the login status page displays

Modify the default value of stats uri

Frontend web

Bind *: 80

Default_backend websrvs

Stats enable

Stats uri / haadim?admin

Backend websrvs

Balance roundrobin

Server srv1 172.18.10.10:80 check inter 1000 rise 1 fall 2 maxconn 2000 weight 2

Server srv2 172.18.10.11:80 check weight 1

Hash-type consistent

Save exit restart service

Enter http://172.18.200.100/haadmin?admin in the browser to display the status page again

Lab 1.9 add user name and password access authentication for stats pages

Frontend web

Bind *: 80

Default_backend websrvs

Stats enable

Stats uri / haadmin?admin

Stats realm "Stats\ Web" # # (prompt title)

Stats auth admin1:admin1

Stats auth admin2:admin2

Stats auth admin3:admin3

Save exit and restart the service

To enter http://172.18.200.100/haadmin?admin in the browser, you need to enter a user name and password to use it.

And login user management can be enabled

Frontend web

Bind *: 80

Default_backend websrvs

Stats enable

Stats uri / haadmin?admin

Stats realm "Stats\ Web"

Stats auth admin1:admin1

Stats auth admin2:admin2

Stats auth admin3:admin3

Stats admin if TRUE

Indicates that if the verification is successful, the corresponding parameters can be set all the time

Save and exit

Restart the haproxy service

Refresh the page just now, and an actionable dialog box will now be displayed under the module at the back end.

Choose the action to perform on the checked servers: Apply

There are many options in the drop-down box of Apply to control the server status of the backend.

You can also define a port directly to let stats listen on one port, and you can only access stats pages through that port.

Frontend web

Bind *: 80

Default_backend websrvs

Listen stats: 10086

Stats enable

Stats uri / haadmin?admin

Stats realm "Stats\ Web"

Stats auth admin1:admin1

Stats auth admin2:admin2

Stats auth admin3:admin3

Stats admin if TRUE

Enter http://172.18.200.100:10086/haadmin?admin in the browser to be authenticated by the user and visit

You can also hide haproxy version information

Stats hide-version

It can also automatically refresh and display specific information.

Stats refresh

Stats show-desc

Stats show-legends

Stats show-node

Lab 2. 0, showing the maximum number of front-end connections maxconn

Frontend web

Bind *: 80

Maxconn 4000

Default_backend websrvs

Lab 2.1.According to the verification of mode tcp pattern implemented by proxy ssh service

Backend app

Balance roundrobin

Server app1 127.0.0.1:5001 check

Server app2 127.0.0.1:5002 check

Server app3 127.0.0.1:5003 check

Server app4 127.0.0.1:5004 check

Listen sshsrvs: 10088

Mode tcp

Maxconn 20

Balance leastconn

Server sshsrv1 172.18.10.10:22 check

Server sshsrv2 172.18.10.11:22 check

Use [root@localhost ~] # ssh-p 10088 root@172.18.200.100 on the client side

Refresh the page

It is found that in the sshsrvs column of the page, there is a connection processing display on the sshsrv1 page, indicating that the agent is successful.

Experiment 2.2, proxy mysql, to implement the verification of mode tcp pattern

Listen sshsrvs: 3306

Mode tcp

Maxconn 20

Balance leastconn

Server sshsrv1 172.18.10.10:3306 check

Server sshsrv2 172.18.10.11:3306 check

Check if the port is listening

[root@localhost haproxy] # ss-tnl

State Recv-Q Send-Q Local Address:Port Peer Address:Port

LISTEN 0 128 *: 10086 *: *

LISTEN 0 20 *: 3306 *: *

LISTEN 0 128 *: 80 *: *

LISTEN 0 128:: 22: *

LISTEN 0 128 *: 22 *: *

LISTEN 0 100:: 1:25: *

LISTEN 0 100 127.0.0.1:25

Test the connection mysql on the client side

[root@localhost] # mysql-utest-ptestpass-h272.18.200.100

Welcome to the MySQL monitor. Commands end with; or\ g.

Your MySQL connection id is 6

Server version: 5.1.73 Source distribution

Oracle is a registered trademark of Oracle Corporation and/or its

Affiliates. Other names may be trademarks of their respective

Owners.

Type 'help;' or'\ h' for help. Type'\ c'to clear the current input statement.

Mysql >

Conclusion: the proxy is successful, and the verification of mode tcp pattern is realized.

Experiment 2.3 implements stickiness processing based on ookie, that is, the implementation of session sticky based on cookie:

Backend websrvs

Balance roundrobin

Cookie WEBSRV insert nocache indirect

Server srv1 172.18.10.10:80 check cookie web1

Server srv2 172.18.10.11:80 check cookie web2

Hash-type consistent

Use the browser to access http://172.18.200.100/, open F12, and view the Request Headers recorded by the browser, as follows

Accept:text/html,application/xhtml+xml,application/xml;q=0.9,p_w_picpath/webp,*/*;q=0.8

Accept-Encoding:gzip, deflate, sdch

Accept-Language:zh-CN,zh;q=0.8

Authorization:Basic YWRtaW4zOmFkbWluMw==

Cache-Control:max-age=0

Connection:keep-alive

Cookie:WEBSRV=web1

Host:172.18.200.100

If-Modified-Since:Wed, 03 May 2017 06:23:57 GMT

If-None-Match: "1e0599-27-54e98b3828057"

Upgrade-Insecure-Requests:1

User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.96 Safari/537.36

You can see that Cookie:WEBSRV=web1 has bound the web1 server based on cookie stickiness, so how many times I dare not visit it is web1.

Experiment 2.4 to add the header "X-Forwarded-For" to the request message sent by option forward to the backend host

First go to the backend server and modify the configuration of the log segment in httpd.

[root@localhost ~] # vim / etc/httpd/conf/httpd.conf

LogFormat "% {X-Forwarded-For} I% l% u% t\"% r\ "% > s% b\"% {Referer} I\ "\"% {User-Agent} I\ "" combined

Start the httpd service from and access it on the client again

[root@localhost ~] # for i in {1.. 10}; do curl http://172.18.200.100/index.html;done

Backend Server 1 172.18.10.10

Backend Server 2 172.18.10.11

Backend Server 1 172.18.10.10

Backend Server 2 172.18.10.11

Backend Server 1 172.18.10.10

Backend Server 2 172.18.10.11

Backend Server 1 172.18.10.10

Backend Server 2 172.18.10.11

Backend Server 1 172.18.10.10

Backend Server 2 172.18.10.11

And view the access log

[root@localhost ~] # tail / var/log/httpd/access_log

172.18.249.57-[10/May/2017:08:08:22 + 0800] "GET / index.html HTTP/1.1" 20039 "" curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.21 Basic ECC zlib/1.2.3 libidn/1.18 libssh3/1.4.2 "

The actual accessed client address will be displayed in the log

Experiment 2.5 implements rspadd [{if | unless}] to add a specified header to the header of the response message

Frontend web

Bind *: 80

Rsadd X-Via:\ HAProxy

Maxconn 4000

Default_backend websrvs

Start the haproxy service from

Refresh browser

Found the added specified header in the header of the response message

Response Headers

Date:Wed, 03 May 2017 16:24:04 GMT

ETag: "1e0599-27-54e98b3828057"

Server:Apache/2.2.15 (CentOS)

Vary:Accept-Encoding

X-Via:HAProxy

Experiment 2.6 makes rspidel [{if | unless}] (ignore case) case insensitive

Frontend web

Bind *: 80

Rspadd X-Via:\ HAProxy

Rspidel Server.*

Maxconn 4000

Default_backend websrvs

Date:Wed, 03 May 2017 16:28:59 GMT

ETag: "1e0599-27-54e98b3828057"

Vary:Accept-Encoding

X-Via:HAProxy

Before comparison, server has been deleted

Lab 2.7 log

[root@localhost haproxy] # tail / var/log/haproxy.log

May 10 12:46:47 localhost haproxy [6628]: 172.18.254.240 May 59220 [10/May/2017:12:46:47.769] web websrvs/srv1 0 peg 0 VN 1 304 173-- VN 1 peg 0 peg 0 "GET / HTTP/1.1"

Experiment 2.8Implementing content type compression compression

Frontend web

Bind *: 80

Rspadd X-Via:\ HAProxy

Rspidel Server.*

Maxconn 4000

Default_backend websrvs

Compression type text/html

Compression algo gzip

Browsers access http://172.18.200.100/test12.html

In the first response headers of the response message

Accept-Ranges:bytes

Content-Encoding:gzip

Content-Length:40

Content-Type:text/html; charset=UTF-8

Date:Wed, 03 May 2017 16:46:10 GMT

ETag: "1e059d-14-54e9c272c1b5f"

Last-Modified:Wed, 03 May 2017 10:31:02 GMT

Vary:Accept-Encoding

X-Via:HAProxy

Found that the content is compressed and the format is gzip

Experiment 2.9 Health status Monitoring of back-end Server http Protocol

Backend websrvs

Balance roundrobin

Cookie WEBSRV insert nocache indirect

Server srv1 172.18.10.10:80 check cookie web1

Server srv2 172.18.10.11:80 check cookie web2

Option httpchk / test20.html

Hash-type consistent

You can view it on the stats page and pass the test normally.

Experiment 3. 0 http-check detection

Backend websrvs

Balance roundrobin

Cookie WEBSRV insert nocache indirect

Server srv1 172.18.10.10:80 check cookie web1

Server srv2 172.18.10.11:80 check cookie web2

Option httpchk / test20.html

Http-check expect rstatus ^ 2

Hash-type consistent

You can view it on the stats page and pass the test normally.

Experiment 3. 1 implement all kinds of access control based on acl

Acl only checks but does not control, and other conditions are needed to realize the control.

Acl needs to be configured before calling

Frontend web

Acl invalid_src src 172.18.254.240

Block if invalid_src

Save to exit the restart service and use your browser to access http://172.18.200.100/

403 Forbidden

Request forbidden by administrative rules.

The client address is exactly 172.18.254.240, so access is denied

And the 403 page can be redirected to our own defined error page, as follows

[root@localhost haproxy] # mkdir / etc/haproxy/errorfiles

[root@localhost haproxy] # vim / etc/haproxy/errorfiles/403.html

OoOo,VIP Source

Edit haproxy profile

Frontend web

Acl invalid_src src 172.18.254.240

Block if invalid_src

Errorfile 403 / etc/haproxy/errorfiles/403.html

Save the exit and restart the haproxy service

Use a browser to access http://172.18.200.100/, which is displayed as follows

OoOo,VIP Source

Or use errorloc to redirect uri to Baidu

Frontend web

Acl invalid_src src 172.18.254.240

Block if invalid_src

Errorloc 403 http://www.baidu.com

Use a browser to access http://172.18.200.100/, which is displayed as follows

Baidu home page.

If acl is curl_agent, use the following server 172.18.10.11 8080

Frontend web

Acl invalid_src src 172.18.254.240

Block if invalid_src

Errorloc 403 http://www.baidu.com

Acl curl_agent hdr_sub (User-Agent)-I curl

Use_backend curlbe if curl_agent

Bind *: 80

Rspadd X-Via:\ HAProxy

Rspidel Server.*

Maxconn 4000

Default_backend websrvs

Compression type text/html

Compression algo gzip

Backend curlbe

Balance roundrobin

Server curlsrv1 172.18.249.57:80 check

And open port 80 on the backend 172.18.249.57

[root@localhost ~] # vim / etc/httpd/conf/httpd.conf

[root@localhost ~] # service httpd restart

Open the browser, enter http://172.18.200.100:10086/haadmin?admin, enter the user name and password to verify

It is found that the curlbe module is running normally and has passed the four-layer detection.

Use the curl command

[root@localhost ~] # curl http://172.18.249.57

Curl server 172.18.249.57

Experiment 3.2 to achieve simple static and dynamic separation

At 172.18.249.57. Install php using yum

Before editing the index.php page

Curl server 172.18.249.57

Use the browse side to access the test page and successfully display the php information

Configure the haproxy.cfg file on the haproxy side. Add the following

Frontend web

# acl invalid_src src 172.18.254.240

# block if invalid_src

Errorloc 403 http://www.baidu.com

# acl curl_agent hdr_sub (User-Agent)-I curl

# use_backend curlbe if curl_agent

Acl phpapp path_end-I. php # # define acl condition

Use_backend dynsrvs if phpapp # # defines the identity of the backend service used

Bind *: 80

Rspadd X-Via:\ HAProxy

Rspidel Server.*

Maxconn 4000

Default_backend websrvs

Compression type text/html

Compression algo gzip

# backend curlbe

# balance roundrobin

# server curlsrv1 172.18.249.57:80 check

Backend dynsrvs # # define the proxy service and identity of the backend

Balance source

Server dynsrv1 172.18.249.57:80 check

Save and exit, restart the service

Use a browser to visit separately

Http://172.18.200.100/index.php

Curl server 172.18.249.57

PHP Logo

PHP Version 5.3.3

Http://172.18.200.100/test1.html

Test Page 1 (BE 1)

To achieve simple separation of movement and movement

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.

*The comments in the above article only represent the author's personal views and do not represent the views and positions of this website. If you have more insights, please feel free to contribute and share.