Imagine quite a usual scheme - bunch of servers in a cluster for web.
It may be two servers with failover IP (keepalived, heartbeat) or a cluster (corosync).
It may be two servers with failover IP (keepalived, heartbeat) or a cluster (corosync).
In a scheme like that, to avoid scripting, you probably set the following sysctl value:
net.ipv4.ip_nonlocal_bind=1
Awesomely simple and handy, your favorite web server is able to bind to virtual address, even if it is not on the server now. Cool, right?
Rotten apple
Beware debian users and all others whose kernel version is <4.3. And I know, there are many of you out there. Beware, 'cause this trick won't work on IPv6. The same sysctl option for IPv6 (net.ipv6.ip_nonlocal_bind) was introduced just in kernel 4.3.
Here is the commit to Documentation/networking/ip-sysctl.txt: https://github.com/torvalds/linux/commit/35a256fee52c7c207796302681fa95189c85b408 (July 8, 2015)
Interesting thing, almost the same commit was rejected in 2011: http://patchwork.ozlabs.org/patch/130748/
What to do
- Upgrade. Version 4.3 was introduced more then a year ago. Debian pain.
- Use balancers, move all cluster-fancy-party to one level up in your infrastructure. Keepalived + IPVS is a good choice. It does not bind. Well it does, but you don't need to bind to an absent IP.
- Scripting (brrr).

No comments:
Post a Comment