keepalived (keepalived)
Holds the virtual IP of an HAProxy pair with VRRP: the address moves to the standby host when HAProxy or its host fails.
Generated from catalog/services/keepalived.yaml: do not edit by hand.
Summary
| Version | 2.4.3 |
| Use | install and configure |
| Layer | infrastructure (shown apart) |
| Category | Network |
| Installation methods | package |
| External connection | no |
| Sandbox only | no |
Licence
| SPDX identifier | GPL-2.0-or-later |
| Licence policy | licence exception |
| Licence exception | LEX-005 (pending, awaiting the client) |
| Platform component | keepalived |
Packages and artifacts
A package the project of the service publishes (its image, its binary archive, its Python or OS package) carries the licence of the service; a third-party package carries the licence written on its row, read from the official upstream metadata.
| Kind | Package | Version | Licence | Details |
|---|---|---|---|---|
| OS package | keepalived | version of the configured repository | GPL-2.0-or-later | RHEL family (dnf) |
| OS package | curl | version of the configured repository | GPL-2.0-or-later | RHEL family (dnf) |
| OS package | keepalived | version of the configured repository | GPL-2.0-or-later | Debian family (apt) |
| OS package | curl | version of the configured repository | GPL-2.0-or-later | Debian family (apt) |
Supported systems and architectures
| Method | Operating systems | Architectures |
|---|---|---|
package | RHEL family (dnf), Debian family (apt) | x86_64, aarch64 (not restricted by the descriptor) |
Certified host systems: RHEL 8/9/10, Rocky Linux 8/9/10, AlmaLinux 8/9/10, Oracle Linux 8/9, CentOS Stream 9/10, Ubuntu 22.04/24.04, Debian 12, Arch Linux (rolling). The host preflight accepts these systems (other releases of a known family give a warning, end of life releases are refused) and the x86_64 and aarch64 architectures.
Prerequisites
Host
- an operating system of the families rhel, debian, arch (blocking,
os).
Programs the commands and checks of the service start on the host, outside the managed roots: add them to allowed_commands of the agent (see Security of the Navin agent), else the agent refuses them with command_not_allowed: /usr/bin/pgrep, /usr/sbin/ip.
Network and ports
None.
Kernel parameters
| Parameter | Value |
|---|---|
net.ipv4.ip_nonlocal_bind | 1 |
Services and connections needed
haproxy:haproxy(optional).
Details and resolution: see Dependencies.
Installation methods and modes
| Method | Default | What the method uses |
|---|---|---|
package | yes | the OS packages of the descriptor, installed by the package manager of the host |
Components
| Component | Kind | Installation methods | Ports |
|---|---|---|---|
keepalived (keepalived) | master | package | - |
Pair (pair) (default)
Two hosts, the first is the master.
What the mode deploys:
| Component | Placement |
|---|---|
keepalived | min 2, max 2 |
Install this service
The install wizard of the Navin Manager plans, validates and runs the installation; you need the services:install permission on the cluster.
-
Open the wizard. In Clusters, choose the row action Install services of the target cluster. The wizard opens on its first step, Service.
-
Choose the service. On the Service step, select keepalived. The card shows the licence
GPL-2.0-or-laterand the dependencies the installation needs. -
Choose the hosts and the mode. On the Hosts step, tick the hosts, then choose the Mode:
pair(default). Each mode deploys the components listed in Installation methods and modes. -
Bind the dependencies. On the Bindings step, choose for each dependency (
haproxy) Install with the platform or Use an existing connection; an optional dependency can stay on No binding. -
Configure. On the Configure step, review the parameters (see Configuration parameters); the required ones are
virtual_ip. Passwords left empty with a generated default are generated and sealed by the Manager. -
Review and install. On the Install step the Manager validates the plan and shows the installation order; when it says "The plan is valid. Ready to install.", choose Install. A highly available mode is installed only when its HA checks pass.
-
Verify. The operation ends when the health checks of every instance pass (see Health checks); the service then shows as running in Services.
High availability
| Cluster | native (native) |
| High availability | native (native) |
| Failover | virtual IP (vip) |
| Replication | none (none) |
| Quorum | VRRP (vrrp) |
| Discovery | static (static) |
| Entry point | virtual IP (vip) |
| Official documentation | https://keepalived.readthedocs.io/en/latest/ |
| Cluster status command | show_vip |
Topology per mode
| Modes | Highest catalog level | Distribution | Quorum component | Fault domains | Description |
|---|---|---|---|---|---|
pair | ha (ha) | active-passive (active-passive) | - | 2 | Two hosts in VRRP: the master holds the virtual IP, the backup takes it over when the master stops answering. |
Notes
- Both hosts must be on the same layer 2 network (or allow unicast VRRP) and the virtual IP must be reserved.
Configuration parameters
VRRP
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|---|---|---|---|---|---|---|
Virtual IP (virtual_ip) | string | - | ^\d{1,3}(\.\d{1,3}){3}/\d{1,2}$ | yes | no | no | Virtual address with its prefix, for example 10.0.0.100/24. |
Interface (interface) | string | eth0 | - | no | no | no | Network interface that carries the virtual IP. (scope host) |
Virtual router id (virtual_router_id) | int | 51 | min 1, max 255 | no | no | no | VRRP id, unique on the network segment. |
VRRP password (auth_pass) | password | generated | - | no | yes | no | Shared password of the pair (first 8 characters are used by VRRP). |
HAProxy health port (haproxy_stats_port) | port | 8404 | - | no | no | no | Port of the HAProxy /health endpoint tracked by the VRRP script, used only without the haproxy binding (the bound port wins). |
HAProxy health over TLS (haproxy_tls) | bool | false | - | no | no | yes | Set it when the tracked HAProxy serves its statistics port over TLS (tls_enabled of haproxy): the VRRP script then probes https on the host name and verifies the certificate with the Manager CA. Used only without the haproxy binding (the bound scheme wins). |
Dependencies
For each active dependency the Manager takes the first of: the binding chosen in the wizard; a service of the same installation that provides it; a service already installed in the cluster; the only connection of the expected type. Otherwise an optional dependency stays unbound, and a required one is added to the installation in its default mode (the column below names the catalog service added).
| Binding | Provided by | Connection type | Endpoint | Optional | When nothing is bound | Description |
|---|---|---|---|---|---|---|
haproxy | haproxy | - | stats | yes | stays unbound (optional) | HAProxy tracked by the VRRP script: the port and the scheme (http or https) of its stats endpoint come from it; haproxy_stats_port and haproxy_tls are used only without this binding. |
Commands
| Command | Component | Target | Description |
|---|---|---|---|
Show the addresses (show_vip) | keepalived | every host | Shows which host holds the virtual IP. |
Health checks
Liveness (per instance)
| Component | Check | Details |
|---|---|---|
keepalived | /usr/bin/pgrep -f keepalived.*{{ paths.etc }}/keepalived.conf | 10 retries; interval 2 s; timeout 3 s |
Preflight checks
| Check | Type | Meaning | Severity | Components |
|---|---|---|---|---|
os | os {} | an operating system of the families rhel, debian, arch | blocking | every component |
Uninstall
Paths removed when the data is purged: {{ paths.log }}.
Upstream documentation
- Homepage: https://www.keepalived.org
- Source: https://github.com/acassen/keepalived
- High availability: https://keepalived.readthedocs.io/en/latest/