RepoMirrors
/
ceph
mirror of https://github.com/ceph/ceph
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
ceph/systemd/ceph-mgr@.service.in

36 lines
1002 B
SYSTEMD
Raw Normal View History

systemd: add ceph-mgr service and target files Signed-off-by: Tim Serong <tserong@suse.com>
2016-09-07 05:39:58 +00:00
[Unit]
Description=Ceph cluster manager daemon
systemd/ceph-mgr: remove automagic mgr creation hack For kraken we auto-created mgr daemons next to mon daemons with some systemd hackery. This is awkward (you can't not get a new mgr daemon when you deploy a mon), systemd-specific (not implemented for upstart on trusty), and mostly unexpected. Since ceph-mgr daemons are now first-class citizens and required for every cluster, make their deployment explicit and transparent to the administrator. Major upgrades are a rare opportunity to have the administrator's full attention so take advantage of it. This effectively reverts 61d779345e9efbe9a2e3f215af1f1dcf6630f04a and 082199f69dd0bd4c18a5f4baea67a88782586657 (and follow-on fixes). Fixes/avoids: http://tracker.ceph.com/issues/19994 Signed-off-by: Sage Weil <sage@redhat.com>
2017-06-29 17:39:28 +00:00
PartOf=ceph-mgr.target
systemd: Support Graceful Reboot for AIO Node Ceph AIO installation with single/multiple node is not friendly for loopback mount, especially always get deadlock issue during graceful system reboot. We already have `rbdmap.service` with graceful system reboot friendly as below: [Unit] After=network-online.target Before=remote-fs-pre.target Wants=network-online.target remote-fs-pre.target [Service] ExecStart=/usr/bin/rbdmap map ExecReload=/usr/bin/rbdmap map ExecStop=/usr/bin/rbdmap unmap-all This PR introduce: - `ceph-mon.target`: Ensure startup after `network-online.target` and before `remote-fs-pre.target` - `ceph-*.target`: Ensure startup after `ceph-mon.target` and before `remote-fs-pre.target` - `rbdmap.service`: Once all `_netdev` get unmount by `remote-fs.target`, ensure unmap all RBD BEFORE any Ceph components under `ceph.target` get stopped during shutdown The logic is concept proof by <https://github.com/alvistack/ansible-role-ceph_common/tree/develop>; also works as expected with Ceph + Kubernetes deployment by <https://github.com/alvistack/ansible-collection-kubernetes/tree/develop>. No more deadlock happened during graceful system reboot, both AIO single/multiple no de with loopback mount. Also see: - <https://github.com/ceph/ceph/pull/36776> - <https://github.com/etcd-io/etcd/pull/12259> - <https://github.com/cri-o/cri-o/pull/4128> - <https://github.com/kubernetes/release/pull/1504> Fixes: https://tracker.ceph.com/issues/47528 Signed-off-by: Wong Hoi Sing Edison <hswong3i@gmail.com>
2020-08-25 04:16:54 +00:00
After=network-online.target local-fs.target time-sync.target
Before=remote-fs-pre.target ceph-mgr.target
Wants=network-online.target local-fs.target time-sync.target remote-fs-pre.target ceph-mgr.target
systemd: add ceph-mgr service and target files Signed-off-by: Tim Serong <tserong@suse.com>
2016-09-07 05:39:58 +00:00
[Service]
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
EnvironmentFile=-@SYSTEMD_ENV_FILE@
systemd: add ceph-mgr service and target files Signed-off-by: Tim Serong <tserong@suse.com>
2016-09-07 05:39:58 +00:00
ExecReload=/bin/kill -HUP $MAINPID
systemd: do not pass --cluster option we do not encourage user to run multiple cluster using different cluster name since 8fe460e7562b28e007179eeb533ef68a3e99b4c8, and the recommended way is to use cephadm. see also https://docs.ceph.com/en/latest/rados/configuration/common/#naming-clusters-deprecated, so let's stop passing `--cluster` in systemd service units. there are more places where we are still feeding this optoin to command line tools or services. we should do the cleanup piecemeal to reduce the potential risk. FWIW, if not specified, the cluster name is "ceph" by default. Signed-off-by: Kefu Chai <tchaikov@gmail.com>
2024-02-13 07:00:58 +00:00
ExecStart=/usr/bin/ceph-mgr -f --id %i --setuser ceph --setgroup ceph
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
LimitNOFILE=1048576
LimitNPROC=1048576
systemd: lock down privileges more Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2019-02-01 19:48:00 +00:00
LockPersonality=true
NoNewPrivileges=true
PrivateDevices=yes
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
PrivateTmp=true
systemd: lock down privileges more Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2019-02-01 19:48:00 +00:00
ProtectControlGroups=true
ProtectHome=true
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
ProtectHostname=true
ProtectKernelLogs=true
systemd: lock down privileges more Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2019-02-01 19:48:00 +00:00
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=full
systemd: add ceph-mgr service and target files Signed-off-by: Tim Serong <tserong@suse.com>
2016-09-07 05:39:58 +00:00
Restart=on-failure
systemd: Wait 10 seconds before restarting ceph-mgr We do this for the MON and OSD as well, wait for a few seconds before we try to attempt a restart. On boot in IPv6 networks it might take a few seconds longer before a IP-address is usable and this does not allow the mgr to start right away. Fixes: http://tracker.ceph.com/issues/23083 Signed-off-by: Wido den Hollander <wido@42on.com>
2018-02-22 10:53:41 +00:00
RestartSec=10
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
RestrictSUIDSGID=true
systemd: add ceph-mgr service and target files Signed-off-by: Tim Serong <tserong@suse.com>
2016-09-07 05:39:58 +00:00
StartLimitBurst=3
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
StartLimitInterval=30min
# We need to disable this protection as some python libraries generate
# dynamic code, like python-cffi, and require mmap calls to succeed
MemoryDenyWriteExecute=false
systemd: add ceph-mgr service and target files Signed-off-by: Tim Serong <tserong@suse.com>
2016-09-07 05:39:58 +00:00
[Install]
WantedBy=ceph-mgr.target