RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2024-12-18 01:16:55 +00:00
Code Issues Packages Projects Releases Wiki Activity
801186f683
ceph/systemd/ceph-radosgw@.service.in

33 lines
844 B
SYSTEMD
Raw Normal View History

radosgw systemd support Added a radosgw systemd support and associated prestart script. - With improved checking over first revison. - ceph-radosgw-prestart.sh now installed in /usr/lib/ceph-radosgw Signed-off-by: Owen Synge <osynge@suse.com>
2015-03-18 09:17:05 +00:00
[Unit]
Description=Ceph rados gateway
fine-grained control systemd to start/stop/restart ceph services at once Signed-off-by: Zhi Zhang <zhangz.david@outlook.com>
2015-10-26 07:13:19 +00:00
PartOf=ceph-radosgw.target
systemd: Support Graceful Reboot for AIO Node Ceph AIO installation with single/multiple node is not friendly for loopback mount, especially always get deadlock issue during graceful system reboot. We already have `rbdmap.service` with graceful system reboot friendly as below: [Unit] After=network-online.target Before=remote-fs-pre.target Wants=network-online.target remote-fs-pre.target [Service] ExecStart=/usr/bin/rbdmap map ExecReload=/usr/bin/rbdmap map ExecStop=/usr/bin/rbdmap unmap-all This PR introduce: - `ceph-mon.target`: Ensure startup after `network-online.target` and before `remote-fs-pre.target` - `ceph-*.target`: Ensure startup after `ceph-mon.target` and before `remote-fs-pre.target` - `rbdmap.service`: Once all `_netdev` get unmount by `remote-fs.target`, ensure unmap all RBD BEFORE any Ceph components under `ceph.target` get stopped during shutdown The logic is concept proof by <https://github.com/alvistack/ansible-role-ceph_common/tree/develop>; also works as expected with Ceph + Kubernetes deployment by <https://github.com/alvistack/ansible-collection-kubernetes/tree/develop>. No more deadlock happened during graceful system reboot, both AIO single/multiple no de with loopback mount. Also see: - <https://github.com/ceph/ceph/pull/36776> - <https://github.com/etcd-io/etcd/pull/12259> - <https://github.com/cri-o/cri-o/pull/4128> - <https://github.com/kubernetes/release/pull/1504> Fixes: https://tracker.ceph.com/issues/47528 Signed-off-by: Wong Hoi Sing Edison <hswong3i@gmail.com>
2020-08-25 04:16:54 +00:00
After=network-online.target local-fs.target time-sync.target
Before=remote-fs-pre.target ceph-radosgw.target
Wants=network-online.target local-fs.target time-sync.target remote-fs-pre.target ceph-radosgw.target
radosgw systemd support Added a radosgw systemd support and associated prestart script. - With improved checking over first revison. - ceph-radosgw-prestart.sh now installed in /usr/lib/ceph-radosgw Signed-off-by: Owen Synge <osynge@suse.com>
2015-03-18 09:17:05 +00:00
[Service]
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
EnvironmentFile=-@SYSTEMD_ENV_FILE@
systemd: do not pass --cluster option we do not encourage user to run multiple cluster using different cluster name since 8fe460e7562b28e007179eeb533ef68a3e99b4c8, and the recommended way is to use cephadm. see also https://docs.ceph.com/en/latest/rados/configuration/common/#naming-clusters-deprecated, so let's stop passing `--cluster` in systemd service units. there are more places where we are still feeding this optoin to command line tools or services. we should do the cleanup piecemeal to reduce the potential risk. FWIW, if not specified, the cluster name is "ceph" by default. Signed-off-by: Kefu Chai <tchaikov@gmail.com>
2024-02-13 07:00:58 +00:00
ExecStart=/usr/bin/radosgw -f --name client.%i --setuser ceph --setgroup ceph
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
LimitNOFILE=1048576
LimitNPROC=1048576
systemd: lock down privileges more Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2019-02-01 19:48:00 +00:00
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
systemd: Add systemd sandboxing to services. This change makes it so the mon/osd/mds/radosgw daemons: o Cannot write to /usr, /etc, and /boot. o Cannot access /home, /root, or /run/user. o Each daemon gets its own private /tmp and /var/tmp. o All daemons get a private /dev without physical devices (exception: osd) I'm not sure if the osd daemon needs access to a full /dev so I left ProtectDevices out for ceph-osd@.service. Signed-off-by: Patrick Donnelly <batrick@batbytes.com>
2016-01-28 02:17:14 +00:00
PrivateDevices=yes
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
PrivateTmp=true
systemd: lock down privileges more Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2019-02-01 19:48:00 +00:00
ProtectControlGroups=true
systemd: Add systemd sandboxing to services. This change makes it so the mon/osd/mds/radosgw daemons: o Cannot write to /usr, /etc, and /boot. o Cannot access /home, /root, or /run/user. o Each daemon gets its own private /tmp and /var/tmp. o All daemons get a private /dev without physical devices (exception: osd) I'm not sure if the osd daemon needs access to a full /dev so I left ProtectDevices out for ceph-osd@.service. Signed-off-by: Patrick Donnelly <batrick@batbytes.com>
2016-01-28 02:17:14 +00:00
ProtectHome=true
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
ProtectHostname=true
ProtectKernelLogs=true
systemd: lock down privileges more Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2019-02-01 19:48:00 +00:00
ProtectKernelModules=true
ProtectKernelTunables=true
systemd: Add systemd sandboxing to services. This change makes it so the mon/osd/mds/radosgw daemons: o Cannot write to /usr, /etc, and /boot. o Cannot access /home, /root, or /run/user. o Each daemon gets its own private /tmp and /var/tmp. o All daemons get a private /dev without physical devices (exception: osd) I'm not sure if the osd daemon needs access to a full /dev so I left ProtectDevices out for ceph-osd@.service. Signed-off-by: Patrick Donnelly <batrick@batbytes.com>
2016-01-28 02:17:14 +00:00
ProtectSystem=full
systemd: Use the same restart limits as upstart Currently, the systemd daemons are not restarted on failure. This patch adds this functionality and sets the defaults to those defined in upstart. This resolves to 3 fails per 30 minutes for osd, mon and mds and 5 fails per 30 seconds for radosgw. Signed-off-by: Boris Ranto <branto@redhat.com>
2016-03-17 17:54:47 +00:00
Restart=on-failure
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
RestrictSUIDSGID=true
systemd: Use the same restart limits as upstart Currently, the systemd daemons are not restarted on failure. This patch adds this functionality and sets the defaults to those defined in upstart. This resolves to 3 fails per 30 minutes for osd, mon and mds and 5 fails per 30 seconds for radosgw. Signed-off-by: Boris Ranto <branto@redhat.com>
2016-03-17 17:54:47 +00:00
StartLimitBurst=5
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
StartLimitInterval=30s
TasksMax=infinity
radosgw systemd support Added a radosgw systemd support and associated prestart script. - With improved checking over first revison. - ceph-radosgw-prestart.sh now installed in /usr/lib/ceph-radosgw Signed-off-by: Owen Synge <osynge@suse.com>
2015-03-18 09:17:05 +00:00
[Install]
fine-grained control systemd to start/stop/restart ceph services at once Signed-off-by: Zhi Zhang <zhangz.david@outlook.com>
2015-10-26 07:13:19 +00:00
WantedBy=ceph-radosgw.target
Reference in New Issue Copy Permalink