RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2024-12-14 07:25:50 +00:00
Code Issues Packages Projects Releases Wiki Activity
d88c834ea4
ceph/systemd/ceph-mgr@.service.in

38 lines
1.0 KiB
SYSTEMD
Raw Normal View History

systemd: add ceph-mgr service and target files Signed-off-by: Tim Serong <tserong@suse.com>
2016-09-07 05:39:58 +00:00
[Unit]
Description=Ceph cluster manager daemon
systemd/ceph-mgr: remove automagic mgr creation hack For kraken we auto-created mgr daemons next to mon daemons with some systemd hackery. This is awkward (you can't not get a new mgr daemon when you deploy a mon), systemd-specific (not implemented for upstart on trusty), and mostly unexpected. Since ceph-mgr daemons are now first-class citizens and required for every cluster, make their deployment explicit and transparent to the administrator. Major upgrades are a rare opportunity to have the administrator's full attention so take advantage of it. This effectively reverts 61d779345e9efbe9a2e3f215af1f1dcf6630f04a and 082199f69dd0bd4c18a5f4baea67a88782586657 (and follow-on fixes). Fixes/avoids: http://tracker.ceph.com/issues/19994 Signed-off-by: Sage Weil <sage@redhat.com>
2017-06-29 17:39:28 +00:00
PartOf=ceph-mgr.target
systemd: Support Graceful Reboot for AIO Node Ceph AIO installation with single/multiple node is not friendly for loopback mount, especially always get deadlock issue during graceful system reboot. We already have `rbdmap.service` with graceful system reboot friendly as below: [Unit] After=network-online.target Before=remote-fs-pre.target Wants=network-online.target remote-fs-pre.target [Service] ExecStart=/usr/bin/rbdmap map ExecReload=/usr/bin/rbdmap map ExecStop=/usr/bin/rbdmap unmap-all This PR introduce: - `ceph-mon.target`: Ensure startup after `network-online.target` and before `remote-fs-pre.target` - `ceph-*.target`: Ensure startup after `ceph-mon.target` and before `remote-fs-pre.target` - `rbdmap.service`: Once all `_netdev` get unmount by `remote-fs.target`, ensure unmap all RBD BEFORE any Ceph components under `ceph.target` get stopped during shutdown The logic is concept proof by <https://github.com/alvistack/ansible-role-ceph_common/tree/develop>; also works as expected with Ceph + Kubernetes deployment by <https://github.com/alvistack/ansible-collection-kubernetes/tree/develop>. No more deadlock happened during graceful system reboot, both AIO single/multiple no de with loopback mount. Also see: - <https://github.com/ceph/ceph/pull/36776> - <https://github.com/etcd-io/etcd/pull/12259> - <https://github.com/cri-o/cri-o/pull/4128> - <https://github.com/kubernetes/release/pull/1504> Fixes: https://tracker.ceph.com/issues/47528 Signed-off-by: Wong Hoi Sing Edison <hswong3i@gmail.com>
2020-08-25 04:16:54 +00:00
After=network-online.target local-fs.target time-sync.target
Before=remote-fs-pre.target ceph-mgr.target
Wants=network-online.target local-fs.target time-sync.target remote-fs-pre.target ceph-mgr.target
systemd: add ceph-mgr service and target files Signed-off-by: Tim Serong <tserong@suse.com>
2016-09-07 05:39:58 +00:00
[Service]
Environment=CLUSTER=ceph
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
EnvironmentFile=-@SYSTEMD_ENV_FILE@
systemd: add ceph-mgr service and target files Signed-off-by: Tim Serong <tserong@suse.com>
2016-09-07 05:39:58 +00:00
ExecReload=/bin/kill -HUP $MAINPID
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
ExecStart=/usr/bin/ceph-mgr -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
LimitNOFILE=1048576
LimitNPROC=1048576
systemd: lock down privileges more Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2019-02-01 19:48:00 +00:00
LockPersonality=true
NoNewPrivileges=true
PrivateDevices=yes
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
PrivateTmp=true
ProtectClock=true
systemd: lock down privileges more Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2019-02-01 19:48:00 +00:00
ProtectControlGroups=true
ProtectHome=true
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
ProtectHostname=true
ProtectKernelLogs=true
systemd: lock down privileges more Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2019-02-01 19:48:00 +00:00
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=full
systemd: add ceph-mgr service and target files Signed-off-by: Tim Serong <tserong@suse.com>
2016-09-07 05:39:58 +00:00
Restart=on-failure
systemd: Wait 10 seconds before restarting ceph-mgr We do this for the MON and OSD as well, wait for a few seconds before we try to attempt a restart. On boot in IPv6 networks it might take a few seconds longer before a IP-address is usable and this does not allow the mgr to start right away. Fixes: http://tracker.ceph.com/issues/23083 Signed-off-by: Wido den Hollander <wido@42on.com>
2018-02-22 10:53:41 +00:00
RestartSec=10
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
RestrictSUIDSGID=true
systemd: add ceph-mgr service and target files Signed-off-by: Tim Serong <tserong@suse.com>
2016-09-07 05:39:58 +00:00
StartLimitBurst=3
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
StartLimitInterval=30min
# We need to disable this protection as some python libraries generate
# dynamic code, like python-cffi, and require mmap calls to succeed
MemoryDenyWriteExecute=false
systemd: add ceph-mgr service and target files Signed-off-by: Tim Serong <tserong@suse.com>
2016-09-07 05:39:58 +00:00
[Install]
WantedBy=ceph-mgr.target
Reference in New Issue Copy Permalink