Chapter 4. Basic configuration

1. Install Red Hat Enterprise Linux 8 or 9.

2. Register the nodes.

   [root@haproxy]# subscription-manager register

3. Enable the RHEL server repository.

   Red Hat Enterprise Linux 9

   [root@haproxy]# subscription-manager repos --enable=rhel-9-server-rpms

   Red Hat Enterprise Linux 8

   [root@haproxy]# subscription-manager repos --enable=rhel-8-server-rpms

4. Update the server.

   [root@haproxy]# dnf update -y

5. Install admin tools (e.g., wget, vim, etc.) as needed.

6. Open port 80.

   [root@haproxy]# firewall-cmd --zone=public --add-port 80/tcp --permanent
   [root@haproxy]# firewall-cmd --reload

7. For HTTPS, open port 443.

   [root@haproxy]# firewall-cmd --zone=public --add-port 443/tcp --permanent
   [root@haproxy]# firewall-cmd --reload

Procedure

1. Install keepalived:

   [root@haproxy]# yum install -y keepalived

2. Configure keepalived on both HAProxy nodes:

   [root@haproxy]# vim /etc/keepalived/keepalived.conf

   In the configuration file, there is a script to check the haproxy processes:

   vrrp_script chk_haproxy {
     script "killall -0 haproxy" # check the haproxy process
     interval 2 # every 2 seconds
     weight 2 # add 2 points if OK
   }

   Next, the instance on the primary and backup load balancers uses eno1 as the network interface. It also assigns a virtual IP address, that is, 192.168.1.20.

   Primary load balancer node

   vrrp_instance RGW {
       state MASTER # might not be necessary. This is on the primary LB node.
       @main interface eno1
       priority 100
       advert_int 1
       interface eno1
       virtual_router_id 50
       @main unicast_src_ip 10.8.128.43 80
       unicast_peer {
              10.8.128.53
              }
       authentication {
           auth_type PASS
           auth_pass 1111
       }
       virtual_ipaddress {
           192.168.1.20
       }
       track_script {
         chk_haproxy
       }
   }
   virtual_server 192.168.1.20 80 eno1 { #populate correct interface
       delay_loop 6
       lb_algo wlc
       lb_kind dr
       persistence_timeout 600
       protocol TCP
       real_server 10.8.128.43 80 { # ip address of rgw2 on physical interface, haproxy listens here, rgw listens to localhost:8080 or similar
           weight 100
           TCP_CHECK { # perhaps change these to a HTTP/SSL GET?
               connect_timeout 3
           }
       }
       real_server 10.8.128.53 80 { # ip address of rgw3 on physical interface, haproxy listens here, rgw listens to localhost:8080 or similar
           weight 100
           TCP_CHECK { # perhaps change these to a HTTP/SSL GET?
               connect_timeout 3
           }
       }
   }

   Backup load balancer node

   vrrp_instance RGW {
       state BACKUP # might not be necessary?
       priority 99
       advert_int 1
       interface eno1
       virtual_router_id 50
       unicast_src_ip 10.8.128.53 80
       unicast_peer {
              10.8.128.43
              }
       authentication {
           auth_type PASS
           auth_pass 1111
       }
       virtual_ipaddress {
           192.168.1.20
       }
       track_script {
         chk_haproxy
       }
   }
   virtual_server 192.168.1.20 80 eno1 { #populate correct interface
       delay_loop 6
       lb_algo wlc
       lb_kind dr
       persistence_timeout 600
       protocol TCP
       real_server 10.8.128.43 80 { # ip address of rgw2 on physical interface, haproxy listens here, rgw listens to localhost:8080 or similar
           weight 100
           TCP_CHECK { # perhaps change these to a HTTP/SSL GET?
               connect_timeout 3
           }
       }
       real_server 10.8.128.53 80 { # ip address of rgw3 on physical interface, haproxy listens here, rgw listens to localhost:8080 or similar
           weight 100
           TCP_CHECK { # perhaps change these to a HTTP/SSL GET?
               connect_timeout 3
           }
       }
   }

3. Enable and start the keepalived service:

   [root@haproxy]# systemctl enable keepalived
   [root@haproxy]# systemctl start keepalived

1. Install haproxy.

   [root@haproxy]# dnf install haproxy

2. Configure haproxy for SELinux and HTTP.

   [root@haproxy]# vim /etc/firewalld/services/haproxy-http.xml

   Add the following lines:

   <?xml version="1.0" encoding="utf-8"?>
   <service>
   <short>HAProxy-HTTP</short>
   <description>HAProxy load-balancer</description>
   <port protocol="tcp" port="80"/>
   </service>

   As root, assign the correct SELinux context and file permissions to the haproxy-http.xml file.

   [root@haproxy]# cd /etc/firewalld/services
   [root@haproxy]# restorecon haproxy-http.xml
   [root@haproxy]# chmod 640 haproxy-http.xml

3. If you intend to use HTTPS, configure haproxy for SELinux and HTTPS.

   [root@haproxy]# vim /etc/firewalld/services/haproxy-https.xml

   Add the following lines:

   <?xml version="1.0" encoding="utf-8"?>
   <service>
   <short>HAProxy-HTTPS</short>
   <description>HAProxy load-balancer</description>
   <port protocol="tcp" port="443"/>
   </service>

   As root, assign the correct SELinux context and file permissions to the haproxy-https.xml file.

   # cd /etc/firewalld/services
   # restorecon haproxy-https.xml
   # chmod 640 haproxy-https.xml

4. If you intend to use HTTPS, generate keys for SSL. If you do not have a certificate, you can use a self-signed certificate.

   Finally, put the certificate and key into a PEM file.

   [root@haproxy]# cat example.com.crt example.com.key > example.com.pem
   [root@haproxy]# cp example.com.pem /etc/ssl/private/

5. Configure haproxy.

   [root@haproxy]# vim /etc/haproxy/haproxy.cfg

   The global and defaults may remain unchanged. After the defaults section, you will need to configure frontend and backend sections. For example:

   frontend http_web
     bind *:80
     mode http
     default_backend rgw
   
   frontend rgw­-https
     bind *:443 ssl crt /etc/ssl/private/example.com.pem
     default_backend rgw
   
   backend rgw
       balance roundrobin
       mode http
       server  rgw1 10.0.0.71:80 check
       server  rgw2 10.0.0.80:80 check

   For details on HAProxy configuration, refer to Add an HAProxy Load Balancer chapter in the Red Hat Update Infrastructure System Administrator’s Guide.

6. Enable/start haproxy

   [root@haproxy]# systemctl enable haproxy
   [root@haproxy]# systemctl start haproxy

1. On the HAProxy nodes, check to ensure the virtual IP address from the keepalived configuration appears.

   [root@haproxy]# ip addr show

2. On the node hosting the Red Hat Ceph Dashboard container, see if you can reach the Ceph Object Gateway nodes using the load balancer configuration. For example:

   [root@haproxy]# wget haproxy

   This should return the same result as:

   [root@haproxy]# wget rgw1

   If it returns an index.html file with the following contents:

   <?xml version="1.0" encoding="UTF-8"?>
   	<ListAllMyBucketsResult xmlns="http://s3.amazonaws.com/doc/2020-03-01/">
   		<Owner>
   			<ID>anonymous</ID>
   			<DisplayName></DisplayName>
   		</Owner>
   		<Buckets>
   		</Buckets>
   	</ListAllMyBucketsResult>

   Then, your configuration is working properly.