RepoMirrors
/
ceph
mirror of https://github.com/ceph/ceph
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
ceph/systemd/ceph-immutable-object-cache...

29 lines
733 B
SYSTEMD
Raw Normal View History

tools: adding ceph level immutable obj cache daemon The daemon is built for future integration with both RBD and RGW cache. The key components are: - domain socket based simple IPC - simple LRU policy based promotion/demotion for the cache - simple file based caching store for RADOS objs with sync IO interface - systemd service/target files for the daemon Signed-off-by: Dehao Shang <dehao.shang@intel.com> Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2018-12-13 21:36:36 +00:00
[Unit]
Description=Ceph immutable object cache daemon
After=network-online.target local-fs.target
Wants=network-online.target local-fs.target
PartOf=ceph-immutable-object-cache.target
[Service]
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
EnvironmentFile=-@SYSTEMD_ENV_FILE@
tools: adding ceph level immutable obj cache daemon The daemon is built for future integration with both RBD and RGW cache. The key components are: - domain socket based simple IPC - simple LRU policy based promotion/demotion for the cache - simple file based caching store for RADOS objs with sync IO interface - systemd service/target files for the daemon Signed-off-by: Dehao Shang <dehao.shang@intel.com> Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2018-12-13 21:36:36 +00:00
ExecReload=/bin/kill -HUP $MAINPID
systemd: do not pass --cluster option we do not encourage user to run multiple cluster using different cluster name since 8fe460e7562b28e007179eeb533ef68a3e99b4c8, and the recommended way is to use cephadm. see also https://docs.ceph.com/en/latest/rados/configuration/common/#naming-clusters-deprecated, so let's stop passing `--cluster` in systemd service units. there are more places where we are still feeding this optoin to command line tools or services. we should do the cleanup piecemeal to reduce the potential risk. FWIW, if not specified, the cluster name is "ceph" by default. Signed-off-by: Kefu Chai <tchaikov@gmail.com>
2024-02-13 07:00:58 +00:00
ExecStart=/usr/bin/ceph-immutable-object-cache -f --id %i --setuser ceph --setgroup ceph
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
tools: adding ceph level immutable obj cache daemon The daemon is built for future integration with both RBD and RGW cache. The key components are: - domain socket based simple IPC - simple LRU policy based promotion/demotion for the cache - simple file based caching store for RADOS objs with sync IO interface - systemd service/target files for the daemon Signed-off-by: Dehao Shang <dehao.shang@intel.com> Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2018-12-13 21:36:36 +00:00
PrivateDevices=yes
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
PrivateTmp=true
ProtectControlGroups=true
tools: adding ceph level immutable obj cache daemon The daemon is built for future integration with both RBD and RGW cache. The key components are: - domain socket based simple IPC - simple LRU policy based promotion/demotion for the cache - simple file based caching store for RADOS objs with sync IO interface - systemd service/target files for the daemon Signed-off-by: Dehao Shang <dehao.shang@intel.com> Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2018-12-13 21:36:36 +00:00
ProtectHome=true
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
tools: adding ceph level immutable obj cache daemon The daemon is built for future integration with both RBD and RGW cache. The key components are: - domain socket based simple IPC - simple LRU policy based promotion/demotion for the cache - simple file based caching store for RADOS objs with sync IO interface - systemd service/target files for the daemon Signed-off-by: Dehao Shang <dehao.shang@intel.com> Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2018-12-13 21:36:36 +00:00
ProtectSystem=full
Restart=on-failure
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
RestrictSUIDSGID=true
tools: adding ceph level immutable obj cache daemon The daemon is built for future integration with both RBD and RGW cache. The key components are: - domain socket based simple IPC - simple LRU policy based promotion/demotion for the cache - simple file based caching store for RADOS objs with sync IO interface - systemd service/target files for the daemon Signed-off-by: Dehao Shang <dehao.shang@intel.com> Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2018-12-13 21:36:36 +00:00
StartLimitBurst=3
[Install]
WantedBy=ceph-immutable-object-cache.target