Categories
LAN Software

OpenVZ on a Softlayer managed server

A post to record list of changes that were made to the configuration to get networking to work within the VZ containers on a managed hardware node.

Softlayer provisions CentOS machines with two bonded network interfaces: bond0 connected to their private network and bond1 to the public. We got a “portable” private network subnet and got them converted to “routed to subnet” so that all IPs in that subnet are usable (instead of 3 of them getting reserved into a broadcast IP, gateway IP and broadcast IP).

OpenVZ sends ARP requests when it’s trying to initialise a container and the interface to which the requests are to be sent has to be explicitly specified in this multi-network case. So, fix the NEIGHBOUR_DEVS variable in /etc/vz/vz.conf before you pick IPs from your portable subnet pool and start assigning it to your containers.

With that, you should be able to ping these containers from other nodes in your primary private subnet and vice versa. But you won’t be able to ping public IPs from within the containers yet. This doesn’t require you to assign public IPs to the containers too. A NAT rule on the host node should fix this: iptables -t nat -A POSTROUTING -o bond1 -j MASQUERADE

Took me a while to recall/realise that the lack of ARP requests in SL’s network was necessary. The NAT rule was something I found later on on the internet.

Categories
Software

UCARP for IP failover on CentOS 6

At $work – 1, I’ve been familiar with the spread + wackamole combo to float and failover two IPs amongst two hosts.

A typical use-case is when we have a couple (or more) web servers independent of each other (say, webmail web servers: webmail.mydomain.com), I’d add multiple A records for the same domain so that DNS resolution happens in a round-robin manner at the client’s end. i.e.,

dig +short webmail.mydomain.com
184.xx.yy.154
184.xx.yy.155

The client uses the first IP it gets during resolution and as the number of clients that are resolving your domain (and making HTTP requests) grow, you’ll start seeing a more or less equitable distribution of HTTP requests hitting each of your hosts.

These IPs are meant to float and be handled by your spread/wackamole tools. (i.e., they’re not hard-configured into network config files like permanent configs: i.e. /etc/sysconfig/networking/ifcfg-*). Say, the .154 IP was on host A and .155 on host B, host B goes down, spread daemon on host A detects that host B isn’t responding to "are you alive?" requests and instructs wackamole daemon on host A to take over the IP that host B had (.155). Sometimes – depending on the router in your environment – one might have to send a gratuitous ARP packet to the router and hook this up with wackamole’s "post-up" action.

This post is about how I couldn’t find usable RPMs for spread/wackamole (and was in a time crunch to shave that yak) and looked for an alternative.

Pacemaker and Keepalived are known entities in the market. So is UCARP (as userland implementation of BSD’s CARP for Linux). Being on a time crunch and noticing how the former options seemed a little complex at first sight, I settled on deploying UCARP.

The configurations on the Internet typically show how one IP is floated around between two hosts. Now this doesn’t let me have DNS-based round-robin’d "load" balanced incoming requests. So here’s how I configured UCARP on host A (assuming you have installed from EPEL repo as `yum install ucarp’):

[root@web02-dal07 nvenkateshappa]# cat /etc/ucarp/vip-001.conf
# Virtual IP configuration file for UCARP
# The number (from 001 to 255) in the name of the file is the identifier

# In the simple scenario, you want a single virtual IP address from the _same_
# network to be taken over by one of the routers.
ID="001"
VIP_ADDRESS="184.xx.yy.154"
PASSWORD="love"
BIND_INTERFACE="eth1"
SOURCE_ADDRESS="184.xx.yy.179"

# In more complex scenarios, check the "vip-common" file for values to override
# and how to add options.

And on host B:

[root@web01-dal07 nvenkateshappa]# cat /etc/ucarp/vip-001.conf
# Virtual IP configuration file for UCARP
# The number (from 001 to 255) in the name of the file is the identifier

# In the simple scenario, you want a single virtual IP address from the _same_
# network to be taken over by one of the routers.
ID="001"
VIP_ADDRESS="184.xx.yy.154"
PASSWORD="love"
BIND_INTERFACE="eth1"
SOURCE_ADDRESS="184.xx.yy.180"
OPTIONS="--shutdown --preempt --advskew=10"

# In more complex scenarios, check the "vip-common" file for values to override
# and how to add options.

The above vip-001.conf on the two hosts is for managing the first floating IP, and the following are for the second: vip-002.conf

Copy over the same configs on each host, change ID to 002, VIP_ADDRESS to 184.xx.yy.155 and swap the OPTIONS line.

The –advskew option (advertisement skew) is what gives a sense of affinity for your virtual IPs.

Let me know in what other interesting use-cases you’ve used UCARP in.

Categories
Software

rpmbuild behaviour: CentOS5 vs. CentOS6

Those of you who’ve tried building RPMs for c5 on a c6 machine might’ve faced the symptoms described in http://samixblog.blogspot.com/2011/11/yum-errno-3-error-performing-checksum.html

The cause seems to involve a couple of things: 1. c6 having adopted a stronger file digest algorithm (sha256 as opposed to md5 in c5) and 2. compressing the payload with xz (as opposed to nothing in c5).

This is easily remedied by passing relevant options to `rpmbuild’ and `createrepo’.

If you’re using fpm in your CI, you can now append the following to your fpm command invocation:

--rpm-rpmbuild-define '_source_filedigest_algorithm md5' \
--rpm-rpmbuild-define '_binary_filedigest_algorithm md5' \
--rpm-rpmbuild-define '_source_payload nil' \
--rpm-rpmbuild-define '_binary_payload nil' \

And invoke createrepo as `createrepo -d -s sha1 –update /path/to/rpms/for/c5′

UPDATE (2012-04-23):

fpm now supports quick shortcuts to the above:

% fpm --help
[...]
--rpm-digest sha512|md5|sha384|sha256|sha1 (rpm only) Select a digest
algorithm. md5 works on the most platforms. (default: "md5")
--rpm-compression xz|gzip|bzip2 (rpm only) Select a compression method.
gzip works on the most platforms. (default: "gzip")