On Tue, Nov 23, 2010 at 11:38:55AM +0100, Michael Rennt wrote:
> I'm trying to implement IP failover from inside a vServer with keepalived. So keepalived inside the
> vserver needs to add and remove ip addresses by itself, without having to restart the vserver.
As herbert says...
We do that by having the keepalived running on a vserver with
enough priviliges in the right network namespace. In your case it
would probably be just the host.
> With CAP_NET_ADMIN and CAP_NET_RAW keepalived seems to work fine from inside the vserver, but the
> assigned ip addresses are not bound to the vserver itself, but to the host system. They also only
> show up on the host system.
You'd better run it on the host, and assign the vip ip addresses
also to the guest with the option nodev to prevent creating them.
Remember that "assigning" ip addresses is not really assigning them
but adding them to a filter that the guest is allowed to see and
use. The vserver <blaat> start will add the ip to the host
interfaces, and add the ip to the network context filter of the
guest.
See:
http://www.nongnu.org/util-vserver/doc/conf/configuration.html
and search for nodev :-).
> Is there another cap that allows keepalived to bind an ip inside the vserver?
It's not a cap, it's the network context ip filter :-). The ip
address is probably brought up, but filtered out by the network
context (you would see the ip on the host). You don't want your
guest to be able to change ip addresses on the host.
Received on Tue Nov 23 13:57:03 2010