0

The setup is the following:

host1-ip iface: ens192: 10.100.0.11/16
host1-gateway:  ens192: 10.100.0.1
host1-ip iface: ens224: 10.0.0.11/16
host1-gateway:  ens224: 10.0.0.1

host2-ip iface: ens192: 10.100.0.12/16
host2-gateway:  ens192: 10.100.0.1
host2-ip iface: ens224: 10.0.0.12/16
host2-gateway:  ens224: 10.0.0.1

keepalived-vip1 on iface: ens192: 10.100.100.1
keepalived-vip2 on iface: ens224: 10.0.100.1

dns1: 10.100.0.21
dns2: 10.100.0.22

/etc/netplan/01-netcfg.yaml:

# This file describes the network interfaces available on your system
# For more information, see netplan(5).
network:
  version: 2
  renderer: networkd
  ethernets:
    ens192:
      addresses: [ 10.100.0.11/16 ]
      gateway4: 10.100.0.1
      nameservers:
          search: [ example.com ]
          addresses:
              - "10.100.0.21"
              - "10.100.0.22"
    ens224:
      addresses: [ 10.0.0.11/16 ]
      nameservers:
          search: [ example.com ]
          addresses:
              - "10.100.0.21"
              - "10.100.0.22"

with this config

keepalived-vip1 on iface: ens192: 10.100.100.1 <-- works
keepalived-vip2 on iface: ens224: 10.0.100.1 <-- dead, not pingable

its logical, there is no gateway set for the ens224 interface, so the networkd-dispatcher comes over and sets us the gateway and keepalived address of iface ens224 with the following script:

/usr/lib/networkd-dispatcher/routable.d/00up:

#!/bin/bash
## INITIALISIERUNG
#Diese Werte werden vom netword-dispatcher an das Skript übergeben
set -x
INTERFACE=${IFACE}
ACTION=${STATE}
case "${INTERFACE}" in
("ens224")
        case "${ACTION}" in
        ("routable")
                /bin/ip route add table 2 default via 10.0.0.1
                /bin/ip rule add from 10.0.100.1 table 2
                ;;
        (*)
                ;;
        esac

(*)
        ;;
esac

Can reboot the server and everything works as expected, use my two addresses and reboot, it still works:

keepalived-vip1 on iface: ens192: 10.100.100.1 <-- works
keepalived-vip2 on iface: ens224: 10.0.100.1 <-- works

now i do some of this commands:

netplan apply
systemctl restart systemd-networkd

now the addresses are gone (keepalived healthcheck, still succeeds, so no failover happens, but in this case thats wanted for debugging this netplan // networkd // reboot behaviour)

keepalived-vip1 on iface: ens192: 10.100.100.1 <-- dead, not pingable
keepalived-vip2 on iface: ens224: 10.0.100.1 <-- dead, not pingable

Try to fix it with the manual steps from the script:

ip route add table 2 default via 10.0.0.1
ip rule add from 10.0.100.1 table 2

still:

keepalived-vip1 on iface: ens192: 10.100.100.1 <-- dead, not pingable
keepalived-vip2 on iface: ens224: 10.0.100.1 <-- dead, not pingable

Reboot the server: it comes back up functional:

keepalived-vip1 on iface: ens192: 10.100.100.1 <-- works
keepalived-vip2 on iface: ens224: 10.0.100.1 <-- works

Also tried it plain with netplan, has in Netplan with 2 NICs each connected to a different gateway but with this I can't get the second keepalived-vip to work.

2 Answers 2

0

will answer my own question, after a lot of investigation i stumbeld upon a keepalived issue: https://github.com/acassen/keepalived/issues/836

"systemd-networkd is removing addresses that don't 'belong' to it", which keepalived can't detect in the version which is shipped on ubuntu or rhel,

the solution for me is to build a keepalived container with version 2.0.20 which is able to handle that situation

(keepalived >= v2 can handle that)

0

Another option to is to try adding the "critical" flag to the interfaces:

network:
  version: 2
  renderer: networkd
  ethernets:
    ens192:
      addresses: [ 10.100.0.11/16 ]
      gateway4: 10.100.0.1
      nameservers:
          search: [ example.com ]
          addresses:
              - "10.100.0.21"
              - "10.100.0.22"
      critical: true
    ens224:
      addresses: [ 10.0.0.11/16 ]
      nameservers:
          search: [ example.com ]
          addresses:
              - "10.100.0.21"
              - "10.100.0.22"
      critical: true

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .