Saturday, August 20, 2016

How to Install, Create and Manage LXC (Linux Containers) in RHEL/CentOS 7

Posted by at No comments:

Friday, August 19, 2016

Configure High-Avaliablity Cluster on CentOS 7 / RHEL 7


Configure High-Avaliablity Cluster on CentOS 7 / RHEL 7

High-Availability cluster aka Failover-cluster (active-passive cluster) is one of the most widely used cluster types in the production environment, this cluster provides you the continued availability of services even one of the node from the group of computer fails. If the server running an application has failed for some reason (hardware failure), cluster software (pacemaker) will restart the application on another node.
Mostly in production, you can find this type of cluster is mainly used for databases, custom application and also for file sharing. Fail-over is not just starting an application, it has some series of operations associated with it; like mounting filesystems, configuring networks and starting dependent applications.
CentOS 7 / RHEL 7 supports Fail-over cluster using the pacemaker, we will be looking here about configuring the apache (web) server as a highly available application. As I said, fail-over is a series of operations, so we would need to configure filesystem and networks as a resource. For a filesystem, we would be using a shared storage from iSCSI storage.

Our Environment:

Configure High-Availability Cluster on CentOS 7 – Infrastructure

Cluster Nodes:

node1.itzgeek.local 192.168.12.11
node2.itzgeek.local 192.168.12.12

iSCSI Storage:

server.itzgeek.local 192.168.12.20
All nodes are of CentOS Linux release 7.2.1511 (Core), running on VMware workstation.

Building Infrastructure:

iSCSI shared storage:

Shared storage is one of the important resources in the high-availability cluster, it holds the data of a running application. All the nodes in a cluster will have access to shared storage for recent data, SAN is the most widely used shared storage in the production environment; here, we will configure a cluster with iSCSI storage for a demonstration purpose.
Here, we will create 10GB of LVM disk on the iSCSI server to use as a shared storage for our cluster nodes. Let’s list the available disks attached to the target server using the command.
[root@server ~]# fdisk -l | grep -i sd
 Disk /dev/sda: 107.4 GB, 107374182400 bytes, 209715200 sectors
 /dev/sda1   *        2048     1026047      512000   83  Linux
 /dev/sda2         1026048   209715199   104344576   8e  Linux LVM
 Disk /dev/sdb: 10.7 GB, 10737418240 bytes, 20971520 sectors
From the above output, you can see that my system has a 10GB of disk (/dev/sdb). Create an LVM with /dev/sdb (replace /dev/sdb with your disk name)
[root@server ~]# pvcreate /dev/sdb
[root@server ~]# vgcreate vg_iscsi /dev/sdb
[root@server ~]# lvcreate -l 100%FREE -n lv_iscsi vg_iscsi
Creating iSCSI target:
Install the targetcli package on the server.
[root@server ~]# yum install targetcli -y
Once you installed the package, enter below command to get an iSCSI CLI for an interactive prompt.
[root@server ~]# targetcli
Warning: Could not load preferences file /root/.targetcli/prefs.bin.
targetcli shell version 2.1.fb41
Copyright 2011-2013 by Datera, Inc and others.
For help on commands, type 'help'.

/> cd /backstores/block
/backstores/block> create iscsi_shared_storage /dev/vg_iscsi/lv_iscsi
Created block storage object iscsi_shared_storage using /dev/vg_iscsi/lv_iscsi.
/backstores/block> cd /iscsi
/iscsi> create iqn.2016-03.local.itzgeek.server:cluster
Created target iqn.2016-03.local.itzgeek.server:cluster.
Created TPG 1.
Global pref auto_add_default_portal=true
Created default portal listening on all IPs (0.0.0.0), port 3260.
/iscsi> cd /iscsi/iqn.2016-03.local.itzgeek.server:cluster/tpg1/acls
/iscsi/iqn.20...ter/tpg1/acls> create iqn.2016-03.local.itzgeek.server:node1node2
Created Node ACL for iqn.2016-03.local.itzgeek.server:node1node2
/iscsi/iqn.20...ter/tpg1/acls> cd /iscsi/iqn.2016-03.local.itzgeek.server:cluster/tpg1/
/iscsi/iqn.20...:cluster/tpg1> set attribute authentication=0
Parameter authentication is now '0'.
/iscsi/iqn.20...:cluster/tpg1> set attribute generate_node_acls=1
Parameter generate_node_acls is now '1'.
/iscsi/iqn.20...:cluster/tpg1> cd /iscsi/iqn.2016-03.local.itzgeek.server:cluster/tpg1/luns
/iscsi/iqn.20...ter/tpg1/luns> create /backstores/block/iscsi_shared_storage
Created LUN 0.
Created LUN 0->0 mapping in node ACL iqn.2016-03.local.itzgeek.server:node1node2
/iscsi/iqn.20...ter/tpg1/luns> cd /
/> ls
o- / ......................................................................................................................... [...]
  o- backstores .............................................................................................................. [...]
  | o- block .................................................................................................. [Storage Objects: 1]
  | | o- iscsi_shared_storage .............................................. [/dev/vg_iscsi/lv_iscsi (10.0GiB) write-thru activated]
  | o- fileio ................................................................................................. [Storage Objects: 0]
  | o- pscsi .................................................................................................. [Storage Objects: 0]
  | o- ramdisk ................................................................................................ [Storage Objects: 0]
  o- iscsi ............................................................................................................ [Targets: 1]
  | o- iqn.2016-03.local.itzgeek.server:cluster .......................................................................... [TPGs: 1]
  |   o- tpg1 .................................................................................................. [gen-acls, no-auth]
  |     o- acls .......................................................................................................... [ACLs: 1]
  |     | o- iqn.2016-03.local.itzgeek.server:node1node2 .......................................................... [Mapped LUNs: 1]
  |     |   o- mapped_lun0 .................................................................. [lun0 block/iscsi_shared_storage (rw)]
  |     o- luns .......................................................................................................... [LUNs: 1]
  |     | o- lun0 ............................................................ [block/iscsi_shared_storage (/dev/vg_iscsi/lv_iscsi)]
  |     o- portals .................................................................................................... [Portals: 1]
  |       o- 0.0.0.0:3260 ..................................................................................................... [OK]
  o- loopback ......................................................................................................... [Targets: 0]
/> saveconfig
Last 10 configs saved in /etc/target/backup.
Configuration saved to /etc/target/saveconfig.json
/> exit
Global pref auto_save_on_exit=true
Last 10 configs saved in /etc/target/backup.
Configuration saved to /etc/target/saveconfig.json
Enable and restart the target service.
[root@server ~]# systemctl enable target.service
[root@server ~]# systemctl restart target.service
Configure the firewall to allow iSCSI traffic.
[root@server ~]# firewall-cmd --permanent --add-port=3260/tcp
[root@server ~]# firewall-cmd --reload
Configure Initiator:
It’s the time to configure cluster nodes to make a use of iSCSI storage, perform below steps on all of your cluster nodes.
# yum install iscsi-initiator-utils -y
Discover the target using below command.
# iscsiadm -m discovery -t st -p 192.168.12.20
192.168.12.20:3260,1 iqn.2016-03.local.itzgeek.server:cluster
Edit below file and add iscsi initiator name.
# vi /etc/iscsi/initiatorname.iscsi
InitiatorName=iqn.2016-03.local.itzgeek.server:node1node2
Login to the target.
# iscsiadm -m node -T iqn.2016-03.local.itzgeek.server:cluster -p 192.168.12.20 -l
Logging in to [iface: default, target: iqn.2016-03.local.itzgeek.server:cluster, portal: 192.168.12.20,3260] (multiple)
Login to [iface: default, target: iqn.2016-03.local.itzgeek.server:cluster, portal: 192.168.12.20,3260] successful.
Restart and enable the initiator service.
# systemctl restart iscsid.service
# systemctl enable iscsid.service
List down the hard disks attached to nodes, you would find a new disk (sdb) added to the node; run below command on both nodes.
# fdisk -l | grep -i sd
Disk /dev/sda: 107.4 GB, 107374182400 bytes, 209715200 sectors
/dev/sda1   *        2048     1026047      512000   83  Linux
/dev/sda2         1026048   209715199   104344576   8e  Linux LVM
Disk /dev/sdb: 10.7 GB, 10733223936 bytes, 20963328 sectors
Format the newly detected disk with ext4.
[root@node1 ~]# mkfs.ext4 /dev/sdb

Setup Cluster Nodes:

Make a host entry on each node for all nodes, the cluster will be using the host name to communicate each other. Perform below tasks on all of your cluster nodes.
# vi /etc/hosts
192.168.12.11 node1.itzgeek.local  node1
192.168.12.12 node2.itzgeek.local  node2
Install cluster packages (pacemaker) on all nodes using below command.
# yum install pcs fence-agents-all -y
Allow all high availability application on the firewall to have a proper communication between nodes, you can skip this step if the system doesn’t have firewalld installed.
# firewall-cmd --permanent --add-service=high-availability
# firewall-cmd --add-service=high-availability
Use below command to list down the allowed applications in the firewall.
# firewall-cmd --list-service
dhcpv6-client high-availability ssh
Set password for hacluster user, this is cluster administration account. We suggest you to set the same password for all nodes.
# passwd hacluster
Start the cluster service, also, enable it to start automatically on system startup.
# systemctl start pcsd.service
# systemctl enable pcsd.service
Remember to run the above commands on all of your cluster nodes, in my case; it is two.

Cluster Creation:

Authorize the nodes using below command, run the command in any one of rge node.
[root@node1 ~]# pcs cluster auth node1.itzgeek.local node2.itzgeek.local
Username: hacluster
Password:
node1.itzgeek.local: Authorized
node2.itzgeek.local: Authorized
Create a cluster.
[root@node1 ~]# pcs cluster setup --start --name itzgeek_cluster node1.itzgeek.local node2.itzgeek.local
Shutting down pacemaker/corosync services...
Redirecting to /bin/systemctl stop  pacemaker.service
Redirecting to /bin/systemctl stop  corosync.service
Killing any remaining services...
Removing all cluster configuration files...
node1.itzgeek.local: Succeeded
node2.itzgeek.local: Succeeded
Starting cluster on nodes: node1.itzgeek.local, node2.itzgeek.local...
node2.itzgeek.local: Starting Cluster...
node1.itzgeek.local: Starting Cluster...
Synchronizing pcsd certificates on nodes node1.itzgeek.local, node2.itzgeek.local...
node1.itzgeek.local: Success
node2.itzgeek.local: Success

Restaring pcsd on the nodes in order to reload the certificates...
node1.itzgeek.local: Success
node2.itzgeek.local: Success
Enable the cluster to start at the system startup, else you will need to start the cluster on every time you restart the system.
[root@node1 ~]# pcs cluster enable --all
node1.itzgeek.local: Cluster Enabled
node2.itzgeek.local: Cluster Enabled
Use below command to get the status of the cluster.
[root@node1 ~]# pcs cluster status
Cluster Status:
 Last updated: Fri Mar 25 11:18:52 2016         Last change: Fri Mar 25 11:16:44 2016 by hacluster via crmd on node1.itzgeek.local
 Stack: corosync
 Current DC: node1.itzgeek.local (version 1.1.13-10.el7_2.2-44eb2dd) - partition with quorum
 2 nodes and 0 resources configured
 Online: [ node1.itzgeek.local node2.itzgeek.local ]

PCSD Status:
  node1.itzgeek.local: Online
  node2.itzgeek.local: Online
Run the below command to get a detailed information about the cluster including its resources, pacemaker status and nodes details.
[root@node1 ~]# pcs status
Cluster name: itzgeek_cluster
WARNING: no stonith devices and stonith-enabled is not false
Last updated: Fri Mar 25 11:19:25 2016          Last change: Fri Mar 25 11:16:44 2016 by hacluster via crmd on node1.itzgeek.local
Stack: corosync
Current DC: node1.itzgeek.local (version 1.1.13-10.el7_2.2-44eb2dd) - partition with quorum
2 nodes and 0 resources configured

Online: [ node1.itzgeek.local node2.itzgeek.local ]

Full list of resources:


PCSD Status:
  node1.itzgeek.local: Online
  node2.itzgeek.local: Online

Daemon Status:
  corosync: active/enabled
  pacemaker: active/enabled
  pcsd: active/enabled

Fencing Devices:

The fencing device is a hardware / software device which helps to disconnect the prob;em node by resetting node / disconnecting shared storage from accessing it. My demo cluster is running on top of VMware Virtual machine, so I am not showing you a fencing device setup, but you can follow this guideto setup a fencing device.

Preparing resources:

Apache Web Server:

Install apache server on both nodes.
# yum install -y httpd wget
Edit the configuration file.
# vi /etc/httpd/conf/httpd.conf
Add below content at the end of file on all your cluster nodes.
<Location /server-status>
  SetHandler server-status
  Order deny,allow
  Deny from all
  Allow from 127.0.0.1
</Location>
Now we need to use shared storage for storing the web content (HTML) file. Perform below operation in any one of the node.
[root@node2 ~]# mount /dev/sdb /var/www/
[root@node2 ~]# mkdir /var/www/html
[root@node2 ~]# mkdir /var/www/cgi-bin
[root@node2 ~]# mkdir /var/www/error
[root@node2 ~]# restorecon -R /var/www
[root@node2 ~]# cat <<-END >/var/www/html/index.html
<html>
<body>Hello This Is Coming From ITzGeek Cluster</body>
</html>
END
[root@node2 ~]# umount /var/www
Allow apache service in the firewall on all nodes.
[root@node2 ~]#  firewall-cmd --add-service=http
[root@node2 ~]#  firewall-cmd --permanent --add-service=http

Creating Resources:

Create a filesystem resource for apache server, this is nothing but a shared storage coming from iSCSI server.
# pcs resource create httpd_fs Filesystem device="/dev/mapper/vg_apache-lv_apache" directory="/var/www" fstype="ext4" --group apache
Create an IP address resource, this will act a virtual IP for the apache. Clients will use this ip for accessing the web content instead of individual nodes ip.
# pcs resource create httpd_vip IPaddr2 ip=192.168.12.100 cidr_netmask=24 --group apache
Create an apache resource which will monitor the status of apache server and move the resource to another node in case of any failure.
# pcs resource create httpd_ser apache configfile="/etc/httpd/conf/httpd.conf" statusurl="http://127.0.0.1/server-status" --group apache
Since we are not using fencing, disable it (STONITH). You must disable to start the cluster resources, but disabling STONITH in the production environment is not recommended.
# pcs property set stonith-enabled=false
Check the status of the cluster.
[root@node1 ~]# pcs status
Cluster name: itzgeek_cluster
Last updated: Fri Mar 25 13:47:55 2016          Last change: Fri Mar 25 13:31:58 2016 by root via cibadmin on node1.itzgeek.local
Stack: corosync
Current DC: node2.itzgeek.local (version 1.1.13-10.el7_2.2-44eb2dd) - partition with quorum
2 nodes and 3 resources configured

Online: [ node1.itzgeek.local node2.itzgeek.local ]

Full list of resources:

 Resource Group: apache
     httpd_vip  (ocf::heartbeat:IPaddr2):       Started node1.itzgeek.local
     httpd_ser  (ocf::heartbeat:apache):        Started node1.itzgeek.local
     httpd_fs   (ocf::heartbeat:Filesystem):    Started node1.itzgeek.local

PCSD Status:
  node1.itzgeek.local: Online
  node2.itzgeek.local: Online

Daemon Status:
  corosync: active/enabled
  pacemaker: active/enabled
  pcsd: active/enabled
Once the cluster is up and running, point a web browser to the apache virtual-ip, you should get a web page like below.
Configure High-Avaliablity Cluster on CentOS 7 - Apache Web Server
Configure High-Availability Cluster on CentOS 7 – Apache Web Server
Let’s check the fail over of resource of the node by stopping the cluster on the active node.
[root@node1 ~]# pcs cluster stop node1.itzgeek.local

Important cluster commands:

#  pcs resource move apache node1.itzgeek.local
#  pcs resource stop apache node2.itzgeek.local
#  pcs resource disable apache node2.itzgeek.local
#  pcs resource enable apache node2.itzgeek.local
#  pcs resource restart apache
Thanks everyone for reading, please let us know your thoughts in comment section.
Posted by at No comments:
Subscribe to: Posts (Atom)