ceph/systemd/ceph-radosgw@.service.in

[Unit]
Description=Ceph rados gateway
After=network-online.target local-fs.target time-sync.target
Wants=network-online.target local-fs.target time-sync.target
PartOf=ceph-radosgw.target

[Service]
LimitNOFILE=1048576
LimitNPROC=1048576
EnvironmentFile=-@SYSTEMD_ENV_FILE@
Environment=CLUSTER=ceph
ExecStart=/usr/bin/radosgw -f --cluster ${CLUSTER} --name client.%i --setuser ceph --setgroup ceph
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=yes
ProtectControlGroups=true
ProtectHome=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=full
PrivateTmp=true
TasksMax=infinity
Restart=on-failure
StartLimitInterval=30s
StartLimitBurst=5

[Install]
WantedBy=ceph-radosgw.target
radosgw systemd support Added a radosgw systemd support and associated prestart script. - With improved checking over first revison. - ceph-radosgw-prestart.sh now installed in /usr/lib/ceph-radosgw Signed-off-by: Owen Synge <osynge@suse.com> 2015-03-18 09:17:05 +00:00			`[Unit]`
			`Description=Ceph rados gateway`
systemd: make Ceph daemon units "want" time-sync.target Fixes: http://tracker.ceph.com/issues/15419 Signed-off-by: Nathan Cutler <ncutler@suse.com> 2016-04-07 18:17:44 +00:00			`After=network-online.target local-fs.target time-sync.target`
			`Wants=network-online.target local-fs.target time-sync.target`
fine-grained control systemd to start/stop/restart ceph services at once Signed-off-by: Zhi Zhang <zhangz.david@outlook.com> 2015-10-26 07:13:19 +00:00			`PartOf=ceph-radosgw.target`
radosgw systemd support Added a radosgw systemd support and associated prestart script. - With improved checking over first revison. - ceph-radosgw-prestart.sh now installed in /usr/lib/ceph-radosgw Signed-off-by: Owen Synge <osynge@suse.com> 2015-03-18 09:17:05 +00:00
			`[Service]`
systemd: set nofile limit in unit files Make it big so hopefully nobody has to change it. Signed-off-by: Sage Weil <sage@redhat.com> 2015-09-14 14:54:53 +00:00			`LimitNOFILE=1048576`
systemd: increase nproc ulimit We were observed to be hitting the limit on centos7 (triggering pthread_create failures) on a ~2000 OSD cluster. Increasing this resolves it! Reported-by: Dan van der Ster <daniel.vanderster@cern.ch> Signed-off-by: Sage Weil <sage@redhat.com> 2015-09-17 22:28:38 +00:00			`LimitNPROC=1048576`
cmake,deb: set EnvironmentFile using cmake this change also fix the EnvironmentFile specified in rbdmap.service. without this change EnvironmentFile in rbdmap.service is always /etc/sysconfig/ceph even on debian derived distros. after this change, this variable is /etc/default/ceph in rbdmap.service shipped by the deb packages. Signed-off-by: Kefu Chai <kchai@redhat.com> 2018-02-27 08:42:48 +00:00			`EnvironmentFile=-@SYSTEMD_ENV_FILE@`
radosgw systemd support Added a radosgw systemd support and associated prestart script. - With improved checking over first revison. - ceph-radosgw-prestart.sh now installed in /usr/lib/ceph-radosgw Signed-off-by: Owen Synge <osynge@suse.com> 2015-03-18 09:17:05 +00:00			`Environment=CLUSTER=ceph`
systemd: use --setuser and --setgroup for all daemons Allow all daemons drop privilege themselves, instead of letting systemd do it. Among other things, this means that admins can conditionally not drop prives by setting setuser match path = /var/lib/ceph/$type/$cluster-$id in their ceph.conf to ease the pain of upgrade. Signed-off-by: Sage Weil <sage@redhat.com> Reviewed-by: Boris Ranto <branto@redhat.com> 2015-08-06 15:57:57 +00:00			`ExecStart=/usr/bin/radosgw -f --cluster ${CLUSTER} --name client.%i --setuser ceph --setgroup ceph`
systemd: lock down privileges more Signed-off-by: Patrick Donnelly <pdonnell@redhat.com> 2019-02-01 19:48:00 +00:00			`LockPersonality=true`
			`MemoryDenyWriteExecute=true`
			`NoNewPrivileges=true`
systemd: Add systemd sandboxing to services. This change makes it so the mon/osd/mds/radosgw daemons: o Cannot write to /usr, /etc, and /boot. o Cannot access /home, /root, or /run/user. o Each daemon gets its own private /tmp and /var/tmp. o All daemons get a private /dev without physical devices (exception: osd) I'm not sure if the osd daemon needs access to a full /dev so I left ProtectDevices out for ceph-osd@.service. Signed-off-by: Patrick Donnelly <batrick@batbytes.com> 2016-01-28 02:17:14 +00:00			`PrivateDevices=yes`
systemd: lock down privileges more Signed-off-by: Patrick Donnelly <pdonnell@redhat.com> 2019-02-01 19:48:00 +00:00			`ProtectControlGroups=true`
systemd: Add systemd sandboxing to services. This change makes it so the mon/osd/mds/radosgw daemons: o Cannot write to /usr, /etc, and /boot. o Cannot access /home, /root, or /run/user. o Each daemon gets its own private /tmp and /var/tmp. o All daemons get a private /dev without physical devices (exception: osd) I'm not sure if the osd daemon needs access to a full /dev so I left ProtectDevices out for ceph-osd@.service. Signed-off-by: Patrick Donnelly <batrick@batbytes.com> 2016-01-28 02:17:14 +00:00			`ProtectHome=true`
systemd: lock down privileges more Signed-off-by: Patrick Donnelly <pdonnell@redhat.com> 2019-02-01 19:48:00 +00:00			`ProtectKernelModules=true`
			`ProtectKernelTunables=true`
systemd: Add systemd sandboxing to services. This change makes it so the mon/osd/mds/radosgw daemons: o Cannot write to /usr, /etc, and /boot. o Cannot access /home, /root, or /run/user. o Each daemon gets its own private /tmp and /var/tmp. o All daemons get a private /dev without physical devices (exception: osd) I'm not sure if the osd daemon needs access to a full /dev so I left ProtectDevices out for ceph-osd@.service. Signed-off-by: Patrick Donnelly <batrick@batbytes.com> 2016-01-28 02:17:14 +00:00			`ProtectSystem=full`
			`PrivateTmp=true`
Drop any systemd imposed process/thread limits If systemd has task accounting enabled, a default of 512 tasks will be applied to all systemd units. For ceph, this is way to low even for a modest cluster, so stop this restriction being applied and allow administrators to apply limits using sysctl. Signed-off-by: James Page <james.page@ubuntu.com> 2016-04-05 16:32:59 +00:00			`TasksMax=infinity`
systemd: Use the same restart limits as upstart Currently, the systemd daemons are not restarted on failure. This patch adds this functionality and sets the defaults to those defined in upstart. This resolves to 3 fails per 30 minutes for osd, mon and mds and 5 fails per 30 seconds for radosgw. Signed-off-by: Boris Ranto <branto@redhat.com> 2016-03-17 17:54:47 +00:00			`Restart=on-failure`
			`StartLimitInterval=30s`
			`StartLimitBurst=5`
radosgw systemd support Added a radosgw systemd support and associated prestart script. - With improved checking over first revison. - ceph-radosgw-prestart.sh now installed in /usr/lib/ceph-radosgw Signed-off-by: Owen Synge <osynge@suse.com> 2015-03-18 09:17:05 +00:00
			`[Install]`
fine-grained control systemd to start/stop/restart ceph services at once Signed-off-by: Zhi Zhang <zhangz.david@outlook.com> 2015-10-26 07:13:19 +00:00			`WantedBy=ceph-radosgw.target`