HAProxy 健康检查

Question

我当前的设置有 2 个配置了 keepalived 以实现高可用性的 HAProxies，这 2 个代理用作虚拟 Web 服务的反向代理和负载均衡器。我知道 HAProxy 可以检查其后端的运行状况（我已经配置了这个），但我的问题是别的。

在我的公司有一个 F5 Big-IP 负载均衡器作为第一道防线，它会在需要时将请求重定向到我的 HAProxies。

我需要知道是否有办法让我的 F5 Big-IP 检查 HAProxies 前端的运行状况，以便在代理启动时不会丢失任何请求。

谢谢

Answer 1

曾经有一个mode health 选项，但在最近的版本中，最简单的方法是在给定端口上使用monitor-uri：

listen health_check_http_url
    bind :8888
    mode http
    monitor-uri /healthz
    option      dontlognull

您可以在前端使用 monitor-uri 并使用 ACL 选择它，但端口版本非常清晰明了。

https://cbonte.github.io/haproxy-dconv/1.6/configuration.html#4.2-mode

https://cbonte.github.io/haproxy-dconv/1.6/configuration.html#4.2-monitor-uri

Answer 2

来自HAProxy Reference Manual：

Health-checking mode
--------------------
This mode provides a way for external components to check the proxy's health.
It is meant to be used with intelligent load-balancers which can use send/expect
scripts to check for all of their servers' availability. This one simply accepts
the connection, returns the word 'OK' and closes it. If the 'option httpchk' is
set, then the reply will be 'HTTP/1.0 200 OK' with no data, so that it can be
tested from a tool which supports HTTP health-checks. To enable it, simply
specify 'health' as the working mode :

Example :
---------
    # simple response : 'OK'
    listen health_check 0.0.0.0:60000
        mode health

    # HTTP response : 'HTTP/1.0 200 OK'
    listen http_health_check 0.0.0.0:60001
        mode health
        option httpchk

Answer 3

来自 HAProxy 文档

Example:
frontend www
    mode http
    acl site_dead nbsrv(dynamic) lt 2
    acl site_dead nbsrv(static)  lt 2
    monitor-uri   /site_alive
    monitor fail  if site_dead

查看参考文档。

http://cbonte.github.io/haproxy-dconv/1.8/configuration.html#4.2-monitor-uri

<uri>     is the exact URI which we want to intercept to return HAProxy's
          health status instead of forwarding the request.

When an HTTP request referencing <uri> will be received on a frontend,
HAProxy will not forward it nor log it, but instead will return either
"HTTP/1.0 200 OK" or "HTTP/1.0 503 Service unavailable", depending on failure
conditions defined with "monitor fail". This is normally enough for any
front-end HTTP probe to detect that the service is UP and running without
forwarding the request to a backend server. Note that the HTTP method, the
version and all headers are ignored, but the request must at least be valid
at the HTTP level. This keyword may only be used with an HTTP-mode frontend.

Monitor requests are processed very early. It is not possible to block nor
divert them using ACLs. They cannot be logged either, and it is the intended
purpose. They are only used to report HAProxy's health to an upper component,
nothing more. However, it is possible to add any number of conditions using
"monitor fail" and ACLs so that the result can be adjusted to whatever check
can be imagined (most often the number of available servers in a backend).