Re: build a cluster of two LEAF Bering host

Hi ET

Il 09/03/2022 11:10, Erich Titl ha scritto:
> Hi Graziano
>
> Am 09.03.2022 um 10:08 schrieb Graziano Brioschi:
>> Hi all,
>>
>> i'm trying to build a simple 2 hosts leaf bering uclibc 7.1.x cluster 
>> for one of our installation.
>> In similar installation built with a full linux distribution, I'm 
>> using keepalived (vrrp protocol) and csync2 (to sync some 
>> configuration files).
>>
>> Is there someone that has build a similar LEAF ucLibc installation?
>>
>> I have found kpalived.lrp package but nothing about csync2. Is there 
>> someone that can build a csync2 package? I'm not a developer and I 
>> never have built a package for leaf, or have you some suggestions for 
>> mantaining in sync  configuration files in a 2 hosts cluster?
>
> AFAIK there is actually no csysnc2 package and I am not sure about its 
> usefulness for LEAF.
>
> What exactly do you want to achieve with this cluster? Failover or 
> distributed processing?
i'm looking for a failover solution with 2 hosts running  at the same 
time; every host connected to LAN and NET and the switch from the active 
one to the spare one automatically running. Some services (as internet 
access) are running on one "cluster" ip (alias) that is managed by 
VRRP/Kpalived.

My idea is to manage some configuration files (for examples, shorewall 
config files or openvpn config files) using csync2 from one node to the 
other one in bidirectional way: this will help me in case of failover 
from master to slave


> In the past I was running a cluster of LEAF firewalls, one external 
> one internal and one as a spare. On the spare box I had separate boot 
> entries for itself and the two active firewalls. I did not do 
> automatic failover as we did not feel it was necessary. Keeping the 
> configurations up to date was as simple as copying the respective 
> congiguration package to the spare installation.
>
> Our assumption was that the failed machine would loose its 
> connecitvity, e.g. the IP configuration, anyway and so using the same 
> addresses was not that critical.
>
> I would think using vrrp would be the better approach. I see problems 
> in the area of configuration settings. On LEAF the configuration is 
> saved in one simple configdb.lrp file which also holds the IP and 
> routing configuration. You probably want to avoid this. You also want 
> to have these systems to survive a reboot. You probably have to 
> synchronize a subset of what is held in configdb.lrp, so the 
> include/exclude mechanism of csync2 appears appropriate. You still 
> need to know what exactly you need to synchronize as this may be a 
> dynamic decision, e.g. you need to do what apkg -o (not very well 
> documented) does, deciding what goes into a configdb and use this as a 
> template for the synchronization tool.
>
> I would guess you explored this in your previous installation using a 
> fully blown linux distro. There the configuration is _not_ held in a 
> single package as is in LEAF, also the config files are hard written 
> to a disk and will survive a reboot. You probably want to use the 
> synchronization mechanism for the vrrp configuration files so the 
> scope is not that big.
>
> What is the advantage of csync2 over rsync in your set up?

The main advantage using csync2 is related to its ability of syncing 
files in bidirectional mode, handle file deletions and simple detect 
conflits; at last but not the least, csync2 have the ability to run some 
commands or scripts when a file is updated (for example running 
"shorewall restart" or other usefull command to run a backup of the 
configuration).

I think your suggestions are valid, so i will make a revision about my 
original idea; perhaps a master/slave configuration with manual 
intervention in case of fail can be a simplest solution

thanks a lot

Ciao

G.

>
> cheers
>
> ET
>
>
> ------------------------------------------------------------------------
> leaf-user mailing list: [email protected]
> https://lists.sourceforge.net/lists/listinfo/leaf-user
> Support Request -- http://leaf-project.org/

-- 

Graziano Brioschi

Outland s.a.s.
sede operativa:
Via A. Don Rocca, 13
20030, Senago (MI)
tel: 02 9948 6014
mobile: 328 8382622
email: [email protected]
--> U4E <--



------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/