Skip to Content
DocsServerHigh Availability

High Availability Basics

High Availability (HA) ensures that services remain operational even when a single point of failure occurs. This article introduces three common HA solutions: keepalived (VIP failover), HAProxy (load balancing), and Pacemaker/Corosync (cluster resource management).

keepalived (Virtual IP Failover)

keepalived uses the VRRP protocol to enable automatic virtual IP address failover. When the primary node fails, the backup node automatically takes over the VIP.

Installation

# Install on all nodes
sudo apt update
sudo apt install keepalived -y

Architecture Example

Node 1 (MASTER): 192.168.1.11
Node 2 (BACKUP): 192.168.1.12
Virtual IP (VIP): 192.168.1.100

Primary Node Configuration

sudo tee /etc/keepalived/keepalived.conf << 'EOF'
global_defs {
    router_id LVS_NODE1
    script_user root
    enable_script_security
}
 
# Health check script
vrrp_script check_nginx {
    script "/usr/bin/curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1 | grep -q 200"
    interval 5
    weight -20
    fall 3
    rise 2
}
 
vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
 
    authentication {
        auth_type PASS
        auth_pass MyS3cretP@ss
    }
 
    virtual_ipaddress {
        192.168.1.100/24 dev eth0
    }
 
    track_script {
        check_nginx
    }
 
    # Notification scripts (optional)
    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault  "/etc/keepalived/notify.sh fault"
}
EOF

Backup Node Configuration

sudo tee /etc/keepalived/keepalived.conf << 'EOF'
global_defs {
    router_id LVS_NODE2
    script_user root
    enable_script_security
}
 
vrrp_script check_nginx {
    script "/usr/bin/curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1 | grep -q 200"
    interval 5
    weight -20
    fall 3
    rise 2
}
 
vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 51
    priority 90
    advert_int 1
 
    authentication {
        auth_type PASS
        auth_pass MyS3cretP@ss
    }
 
    virtual_ipaddress {
        192.168.1.100/24 dev eth0
    }
 
    track_script {
        check_nginx
    }
}
EOF

Notification Script

sudo tee /etc/keepalived/notify.sh << 'SCRIPT'
#!/bin/bash
STATE=$1
DATETIME=$(date '+%Y-%m-%d %H:%M:%S')
echo "${DATETIME} - State changed to: ${STATE}" >> /var/log/keepalived-notify.log
 
case $STATE in
    master)
        echo "${DATETIME} - This node became MASTER" >> /var/log/keepalived-notify.log
        # You can send alert notifications here
        ;;
    backup)
        echo "${DATETIME} - This node became BACKUP" >> /var/log/keepalived-notify.log
        ;;
    fault)
        echo "${DATETIME} - This node entered FAULT state" >> /var/log/keepalived-notify.log
        ;;
esac
SCRIPT
 
sudo chmod +x /etc/keepalived/notify.sh

Starting the Service

# Start on all nodes
sudo systemctl enable --now keepalived
 
# Check status
sudo systemctl status keepalived
 
# Verify VIP
ip addr show eth0 | grep 192.168.1.100
 
# View logs
sudo journalctl -u keepalived -f
 
# Test failover
# Stop keepalived on the primary node
sudo systemctl stop keepalived
# Observe whether the backup node takes over the VIP

HAProxy (Load Balancing)

HAProxy is a high-performance TCP/HTTP load balancer supporting multiple scheduling algorithms and health checks.

Installation

sudo apt update
sudo apt install haproxy -y
 
# Check version
haproxy -v

Basic Configuration

sudo tee /etc/haproxy/haproxy.cfg << 'EOF'
global
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon
 
    # Performance tuning
    maxconn 50000
    tune.ssl.default-dh-param 2048
 
defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    option  forwardfor
    option  http-server-close
    timeout connect 5000
    timeout client  50000
    timeout server  50000
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http
 
# Statistics page
listen stats
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 10s
    stats admin if LOCALHOST
    stats auth admin:haproxy_pass
 
# HTTP frontend
frontend http_front
    bind *:80
    # HTTPS redirect
    # redirect scheme https code 301 if !{ ssl_fc }
    default_backend http_back
 
# HTTPS frontend
frontend https_front
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem
    http-request set-header X-Forwarded-Proto https
 
    # Domain-based routing
    acl host_app1 hdr(host) -i app1.example.com
    acl host_app2 hdr(host) -i app2.example.com
 
    use_backend app1_back if host_app1
    use_backend app2_back if host_app2
    default_backend http_back
 
# Backend server group
backend http_back
    balance roundrobin
    option httpchk GET /health
    http-check expect status 200
 
    server web1 192.168.1.21:80 check inter 5s fall 3 rise 2
    server web2 192.168.1.22:80 check inter 5s fall 3 rise 2
    server web3 192.168.1.23:80 check inter 5s fall 3 rise 2 backup
 
backend app1_back
    balance leastconn
    option httpchk GET /health
    server app1a 192.168.1.31:8080 check
    server app1b 192.168.1.32:8080 check
 
backend app2_back
    balance source
    server app2a 192.168.1.41:8080 check
    server app2b 192.168.1.42:8080 check
EOF

TCP Load Balancing (Databases, etc.)

# Append to haproxy.cfg
cat << 'EOF' | sudo tee -a /etc/haproxy/haproxy.cfg
 
# MySQL load balancing
listen mysql_cluster
    bind *:3306
    mode tcp
    option mysql-check user haproxy
    balance roundrobin
    server mysql1 192.168.1.51:3306 check inter 5s
    server mysql2 192.168.1.52:3306 check inter 5s backup
 
# Redis Sentinel
listen redis
    bind *:6379
    mode tcp
    option tcp-check
    balance first
    server redis1 192.168.1.61:6379 check inter 3s
    server redis2 192.168.1.62:6379 check inter 3s
EOF

Load Balancing Algorithms

AlgorithmDescriptionUse Case
roundrobinRound-robinDefault; servers have similar performance
leastconnLeast connectionsLong connections, uneven processing times
sourceSource IP hashSession persistence required
uriURI hashCache servers
firstFill up the first before using the secondResource conservation

Startup and Verification

# Check configuration
sudo haproxy -c -f /etc/haproxy/haproxy.cfg
 
# Start service
sudo systemctl enable --now haproxy
 
# View stats page
curl http://localhost:8404/stats
 
# Firewall
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 8404/tcp

keepalived + HAProxy Combination

The most common HA solution is keepalived + HAProxy: two HAProxy instances in active-standby mode, with keepalived managing the VIP.

# keepalived configuration to check HAProxy status
sudo tee /etc/keepalived/keepalived.conf << 'EOF'
global_defs {
    router_id HAPROXY_NODE1
    script_user root
    enable_script_security
}
 
vrrp_script check_haproxy {
    script "/usr/bin/killall -0 haproxy"
    interval 2
    weight -30
    fall 3
    rise 2
}
 
vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
 
    authentication {
        auth_type PASS
        auth_pass HAProxy_HA
    }
 
    virtual_ipaddress {
        192.168.1.100/24
    }
 
    track_script {
        check_haproxy
    }
}
EOF

Pacemaker / Corosync (Cluster Resource Management)

Pacemaker and Corosync provide enterprise-grade cluster resource management, supporting complex resource dependencies and failure policies.

Installation

# Install on all nodes
sudo apt update
sudo apt install pacemaker corosync pcs resource-agents -y
 
# Set hacluster user password (same on all nodes)
sudo passwd hacluster
 
# Start the pcs management service
sudo systemctl enable --now pcsd

Configuring the Cluster

# Authenticate all nodes from one node
sudo pcs host auth node1 node2 -u hacluster -p yourpassword
 
# Create the cluster
sudo pcs cluster setup ha-cluster node1 node2
 
# Start the cluster
sudo pcs cluster start --all
sudo pcs cluster enable --all
 
# Check cluster status
sudo pcs cluster status
sudo pcs status
 
# For two-node clusters, disable quorum policy
sudo pcs property set no-quorum-policy=ignore
# Disable STONITH (test environments; production should configure fencing devices)
sudo pcs property set stonith-enabled=false

Configuring Cluster Resources

# Add a virtual IP resource
sudo pcs resource create cluster_vip ocf:heartbeat:IPaddr2 \
  ip=192.168.1.100 \
  cidr_netmask=24 \
  nic=eth0 \
  op monitor interval=10s
 
# Add an Nginx resource
sudo pcs resource create web_server ocf:heartbeat:nginx \
  configfile=/etc/nginx/nginx.conf \
  op monitor interval=10s timeout=30s \
  op start timeout=60s \
  op stop timeout=60s
 
# Ensure VIP and Nginx are on the same node
sudo pcs constraint colocation add web_server with cluster_vip INFINITY
 
# Ensure VIP starts before Nginx
sudo pcs constraint order cluster_vip then web_server
 
# Create a resource group (simpler approach)
sudo pcs resource group add web_group cluster_vip web_server
 
# View resource status
sudo pcs resource status
sudo pcs constraint show

Resource Management

# Manually migrate resources
sudo pcs resource move web_group node2
 
# Clear migration constraints (must run after migration)
sudo pcs resource clear web_group
 
# Enable/disable resources
sudo pcs resource disable web_server
sudo pcs resource enable web_server
 
# Clear resource error state
sudo pcs resource cleanup web_server
 
# Maintenance mode
sudo pcs node standby node1       # Put node in standby
sudo pcs node unstandby node1     # Restore node
sudo pcs property set maintenance-mode=true   # Global maintenance mode
sudo pcs property set maintenance-mode=false

Cluster Monitoring

# Real-time cluster status monitoring
sudo crm_mon -1
 
# View cluster configuration
sudo pcs config show
 
# View cluster logs
sudo journalctl -u pacemaker -f
sudo journalctl -u corosync -f
 
# Corosync membership status
sudo corosync-cmapctl | grep members

Solution Comparison

FeaturekeepalivedHAProxyPacemaker/Corosync
Primary FunctionVIP failoverLoad balancingCluster resource management
Configuration ComplexitySimpleMediumMore complex
Resource TypesVIP onlyHTTP/TCP balancingAny (VIP, services, filesystems, etc.)
Health ChecksScript-basedRich protocol checksResource agent-based
Scale2 nodesLarge scale2-32 nodes
Typical UseActive-standby failoverTraffic distributionEnterprise HA

Recommendation Guide

  • Simple active-standby: keepalived is sufficient
  • Web load balancing: HAProxy (can be combined with keepalived for HA)
  • Complex clusters: Pacemaker/Corosync (multiple resources, complex dependencies)
  • Most common combination: keepalived + HAProxy — simple and effective
Last updated on
VirtualizationKubernetes