1
0
mirror of https://github.com/ceph/ceph synced 2024-12-29 23:12:27 +00:00
Commit Graph

4 Commits

Author SHA1 Message Date
Kefu Chai
5659920c7c systemd: do not pass --cluster option
we do not encourage user to run multiple cluster using different
cluster name since 8fe460e756, and
the recommended way is to use cephadm. see also
https://docs.ceph.com/en/latest/rados/configuration/common/#naming-clusters-deprecated,
so let's stop passing `--cluster` in systemd service units. there
are more places where we are still feeding this optoin to command line
tools or services. we should do the cleanup piecemeal to reduce the
potential risk.

FWIW, if not specified, the cluster name is "ceph" by default.

Signed-off-by: Kefu Chai <tchaikov@gmail.com>
2024-02-13 15:07:01 +08:00
Wong Hoi Sing Edison
85bc551b17
systemd: remove ProtectClock=true for ceph-osd@.service
Ceph 16.2.0 Pacific by https://github.com/ceph/ceph/commit/9a84d5a introduce following new systemd restriction:

    ProtectClock=true
    ProtectHostname=true
    ProtectKernelLogs=true
    RestrictSUIDSGID=true

BTW, `ceph-osd@.service` failed with `ProtectClock=true` unexpectly, also see:

  - <https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/thread/TNBGGNN6STGDKARAQTQCIPTU4KLIVJQV/>
  - <https://serverfault.com/questions/1059317/bluestore-var-lib-ceph-osd-ceph-2-block-read-bdev-label-failed-to-open-var-l>

This PR intruduce:

  - Remove `ProtectClock=true` for our systemd service templates

Fixes: https://tracker.ceph.com/issues/50347
Signed-off-by: Wong Hoi Sing Edison <hswong3i@pantarei-design.com>
2021-04-14 22:19:49 +08:00
Patrick Donnelly
9a84d5a09b
systemd: lock down more privileges
Including:

        ProtectClock=true
        ProtectHostname=true
        ProtectKernelLogs=true
        RestrictSUIDSGID=true

Also, alphabetize [service] settings.

Finally, add some protections for
systemd/ceph-immutable-object-cache@.service.in present in our other
service files but not this one.

Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 14:53:05 -07:00
Yuan Zhou
9a7e5e0866 tools: adding ceph level immutable obj cache daemon
The daemon is built for future integration with both RBD and RGW cache.
The key components are:
- domain socket based simple IPC
- simple LRU policy based promotion/demotion for the cache
- simple file based caching store for RADOS objs with sync IO interface
- systemd service/target files for the daemon

Signed-off-by: Dehao Shang <dehao.shang@intel.com>
Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2019-03-22 00:16:25 +08:00