mir/ovs
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-08-22 01:51:26 +00:00
Code Issues Releases Wiki Activity
ovs/rhel/usr_lib_systemd_system_ovs-vswitchd.service.in

33 lines
1.1 KiB
SYSTEMD
Raw Permalink Normal View History

rhel: Improved Systemd Integration This commit builds upon some of the recent ovs-ctl changes to build a more integrated systemd setup. A new service (ovs-vswitchd) is added to track the ovs-vswitchd, and ovsdb-server service is reserved for the ovsdb-server daemon. The systemd scripts still use ovs-ctl to actually initialize the daemons. Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-by: Markos Chandras <mchandras@suse.de> Acked-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2016-07-25 14:03:53 -04:00
[Unit]
Description=Open vSwitch Forwarding Unit
rhel-systemd: start vswitchd after udev It's possible to race with the udev service, such that dpdk ports are not finished being bound until after ovs-vswitchd has been started. This means that attempts to use the port will fail. While it is possible to work around this for some NICs using port hotplug, not all port types are supported (for instance vfio), and it requires manual intervention. Fixes: 36af136b690c ("rhel-systemd: Delay shutting down the services") Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1397299 Suggested-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Aaron Conole <aconole@redhat.com> Tested-by: Karthik Sundaravel <ksundara@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2017-04-18 11:13:49 -04:00
After=ovsdb-server.service network-pre.target systemd-udev-settle.service
rhel-systemd: Delay shutting down the services During testing it was found that systemd would consider the openvswitch service as a part of networking component, but the dependent services of ovs-vswitchd and ovsdb-server were not likewise considered. This leads to some strange race conditions, observed when using NFS over TCP, while shutting down systems. Fixes: 84ad12083491 ("rhel: Improved Systemd Integration") Co-authored-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2016-10-07 13:36:45 -04:00
Before=network.target network.service
rhel: Improved Systemd Integration This commit builds upon some of the recent ovs-ctl changes to build a more integrated systemd setup. A new service (ovs-vswitchd) is added to track the ovs-vswitchd, and ovsdb-server service is reserved for the ovsdb-server daemon. The systemd scripts still use ovs-ctl to actually initialize the daemons. Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-by: Markos Chandras <mchandras@suse.de> Acked-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2016-07-25 14:03:53 -04:00
Requires=ovsdb-server.service
ReloadPropagatedFrom=ovsdb-server.service
rhel: Use /run instead of /var/run. Systemd unit file generates warnings about PID file path since /var/run is a legacy path so just use /run instead of /var/run. /var/run is a symlink of /run starting from RHEL7 (and any other distribution that uses systemd). Reported-at: https://bugzilla.redhat.com/1952081 Signed-off-by: Timothy Redaelli <tredaelli@redhat.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2021-05-12 17:08:08 +02:00
AssertPathIsReadWrite=/run/openvswitch/db.sock
rhel: Improved Systemd Integration This commit builds upon some of the recent ovs-ctl changes to build a more integrated systemd setup. A new service (ovs-vswitchd) is added to track the ovs-vswitchd, and ovsdb-server service is reserved for the ovsdb-server daemon. The systemd scripts still use ovs-ctl to actually initialize the daemons. Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-by: Markos Chandras <mchandras@suse.de> Acked-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2016-07-25 14:03:53 -04:00
PartOf=openvswitch.service
[Service]
Type=forking
rhel: Use /run instead of /var/run. Systemd unit file generates warnings about PID file path since /var/run is a legacy path so just use /run instead of /var/run. /var/run is a symlink of /run starting from RHEL7 (and any other distribution that uses systemd). Reported-at: https://bugzilla.redhat.com/1952081 Signed-off-by: Timothy Redaelli <tredaelli@redhat.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2021-05-12 17:08:08 +02:00
PIDFile=/run/openvswitch/ovs-vswitchd.pid
rhel-systemd: Restart openvswitch service if a daemon crashes Currently if either ovsdb-server or ovs-vswitchd is crashing the daemon is not restarting leaving the system in faulty state. This patch will detect the daemon crash and will restart the openvswitch service. Here is a (bit to wide) table showing the behavior before and after the patch. Note that only the Crash behavior has changed: Before patch: | Process Status | systemctl <> status | | ovs-vswitchd | ovsdb-server | openvswitch | ovs-vswitchd | ovsdb-server | +--------------+--------------+--------------+--------------+--------------+ systemctl start openvswitch* | started | started |active,exited |active,running|active,running| Crash vswitchd | crashed | stopped |inactive, dead|failed |inactive,dead | Crash ovsdb | stopped | crashed |inactive, dead|inactive,dead |failed | systemctl restart openvswitch | re-started | re-started |active,exited |active,running|active,running| systemctl restart ovs-vswitchd | re-started | re-started |active,exited |active,running|active,running| systemctl restart ovsdb-server | re-started | re-started |active,exited |active,running|active,running| systemctl stop openvswitch | stopped | stopped |inactive, dead|inactive,dead |inactive,dead | systemctl stop ovs-vswitchd | stopped | stopped |inactive, dead|inactive,dead |inactive,dead | systemctl stop ovsdb-server | stopped | stopped |inactive, dead|inactive,dead |inactive,dead | systemctl start ovs-vswitchd* | started | started |inactive, dead|active,running|active,running| systemctl start ovsdb-server* | not started | started |inactive, dead|inactive, dead|active,running| With patch: | Process Status | systemctk <> status | | ovs-vswitchd | ovsdb-server | openvswitch | ovs-vswitchd | ovsdb-server | +--------------+--------------+--------------+--------------+--------------+ systemctl start openvswitch* | started | started |active,exited |active,running|active,running| Crash vswitchd | crash,started| re-started |active,exited |active,running|active,running| Crash ovsdb | re-started | crash,started|active,exited |active,running|active,running| systemctl restart openvswitch | re-started | re-started |active,exited |active,running|active,running| systemctl restart ovs-vswitchd | re-started | re-started |active,exited |active,running|active,running| systemctl restart ovsdb-server | re-started | re-started |active,exited |active,running|active,running| systemctl stop openvswitch | stopped | stopped |inactive, dead|inactive,dead |inactive,dead | systemctl stop ovs-vswitchd | stopped | stopped |inactive, dead|inactive,dead |inactive,dead | systemctl stop ovsdb-server | stopped | stopped |inactive, dead|inactive,dead |inactive,dead | systemctl start ovs-vswitchd* | started | started |inactive, dead|active,running|active,running| systemctl start ovsdb-server* | not started | started |inactive, dead|inactive, dead|active,running| * These commands where executed when no ovs related processes where running. All other commands where executed when OVS was successfully running. Signed-off-by: Eelco Chaudron <echaudro@redhat.com> Acked-by: Markos Chandras <mchandras@suse.de> Acked-by: Aaron Conole <aconole@redhat.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Russell Bryant <russell@ovn.org>
2017-02-27 15:56:41 -05:00
Restart=on-failure
rhel: Use /run instead of /var/run. Systemd unit file generates warnings about PID file path since /var/run is a legacy path so just use /run instead of /var/run. /var/run is a symlink of /run starting from RHEL7 (and any other distribution that uses systemd). Reported-at: https://bugzilla.redhat.com/1952081 Signed-off-by: Timothy Redaelli <tredaelli@redhat.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2021-05-12 17:08:08 +02:00
Environment=XDG_RUNTIME_DIR=/run/openvswitch
redhat: allow arbitrary user:group Under rpm based distributions, the only user:group that the rhel daemons run as is 'root:root'. This is fine as a default, but as part of a security procedure, users may want to run as an alternate uid/gid. This commit adds an OVS_USER_ID environment variable for systemd, which defaults to root:root, but can be overridden by changing the /etc/sysconfig/openvswitch environment file. Acked-by: Markos Chandras <mchandras@suse.de> Signed-off-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2017-08-04 13:00:53 -04:00
EnvironmentFile=/etc/openvswitch/default.conf
rhel: Improved Systemd Integration This commit builds upon some of the recent ovs-ctl changes to build a more integrated systemd setup. A new service (ovs-vswitchd) is added to track the ovs-vswitchd, and ovsdb-server service is reserved for the ovsdb-server daemon. The systemd scripts still use ovs-ctl to actually initialize the daemons. Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-by: Markos Chandras <mchandras@suse.de> Acked-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2016-07-25 14:03:53 -04:00
EnvironmentFile=-/etc/sysconfig/openvswitch
rhel: secure openvswitch useropts The openvswitch useropts file is being stored in a directory where the openvswitch user has write permissions. The openvswitch user can then manipulate the file to change the user under which switchd daemon runs. This patch changes the file to /var/openvswitch.useropts preventing any manipulation. Signed-off-by: Jaime Caamaño Ruiz <jcaamano@suse.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
2019-05-08 13:53:47 +02:00
EnvironmentFile=-/run/openvswitch.useropts
rhel: limit stack size to 2M. The default stack size in Fedora/RHEL is 8M, which means when ovs-vswitchd daemon starts and uses --mlockall (default), it will dirty all memory regions for all threads which is proportionally to the number of CPUs. On a big host this increases memory usage to many hundreds of megabytes while OVS actually requires much less. This patch relies on systemd to limit to 2M/thread. That is much more than the minimum documented at function ovs_thread_create(): /* Some small systems use a default stack size as small as 80 kB, but OVS * requires approximately 384 kB according to the following analysis: * https://mail.openvswitch.org/pipermail/ovs-dev/2016-January/308592.html * * We use 512 kB to give us some margin of error. */ Acked-By: Timothy Redaelli <tredaelli@redhat.com> Tested-By: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Ben Pfaff <blp@ovn.org>
2019-02-28 13:13:57 -03:00
LimitSTACK=2M
redhat: allow dpdk to also run as non-root user After this commit, users may start a dpdk-enabled ovs setup as a non-root user. This is accomplished by exporting the $HOME directory, which dpdk uses to fill in it's semi-persistent RTE configuration. This change may be a bit controversial since it modifies /dev/hugepages as part of starting the ovs-vswitchd to set a hugetlbfs group ownership. This is used to enable writing to /dev/hugepages so that the dpdk_init will successfully complete. There is an alternate way of accomplishing this - namely to initialize DPDK before dropping privileges. However, this would mean that if DPDK ever grows an uninit / reinit function, non-root ovs likely could never use it. This does not change OvS+DPDK's SELinux requirements. It still must be disabled. Signed-off-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2017-08-04 13:00:57 -04:00
@begin_dpdk@
rhel: Fix literal dollar sign usage in systemd service files Currently (at least on RHEL 7.5) openvswitch fails to start (with DPDK enabled) as non-root, since chown fails and "/dev/hugepages" group is not changed. Commit tested on Fedora 28 and RHEL 7.5, both as root as non-root user. From man 5 systemd.service: To pass a literal dollar sign, use "$$". Variables whose value is not known at expansion time are treated as empty strings. Note that the first argument (i.e. the program to execute) may not be a variable. CC: Aaron Conole <aconole@redhat.com> Fixes: 4299145c1095 ("rhel: don't drop capabilities when running as root") Signed-off-by: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Aaron Conole <aconole@redhat.com> Acked-by: Eelco Chaudron <echaudro@redhat.com>
2018-04-16 17:15:47 +02:00
ExecStartPre=-/bin/sh -c '/usr/bin/chown :$${OVS_USER_ID##*:} /dev/hugepages'
redhat: fix upgrades where group doesn't exist The upgrade from older Open vSwitch versions on RHEL will try, as much as possible, to preserve the system. This means no new users or groups are created. As an effect, it's possible for the chown to fail, because the hugetlbfs group may not exist. While it did on my systems, it was not there on others. This change allows the ExecStartPre commands to fail. In the case that the user doesn't use DPDK, it won't matter anyway. Fixes: e3e738a3d058 ('redhat: allow dpdk to also run as non-root user') Signed-off-by: Aaron Conole <aconole@redhat.com> Reported-by: Jean-Tsung Hsiao <jhsiao@redhat.com> Tested-by: Jean-Tsung Hsiao <jhsiao@redhat.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Russell Bryant <russell@ovn.org>
2017-08-14 16:18:14 -04:00
ExecStartPre=-/usr/bin/chmod 0775 /dev/hugepages
redhat: allow dpdk to also run as non-root user After this commit, users may start a dpdk-enabled ovs setup as a non-root user. This is accomplished by exporting the $HOME directory, which dpdk uses to fill in it's semi-persistent RTE configuration. This change may be a bit controversial since it modifies /dev/hugepages as part of starting the ovs-vswitchd to set a hugetlbfs group ownership. This is used to enable writing to /dev/hugepages so that the dpdk_init will successfully complete. There is an alternate way of accomplishing this - namely to initialize DPDK before dropping privileges. However, this would mean that if DPDK ever grows an uninit / reinit function, non-root ovs likely could never use it. This does not change OvS+DPDK's SELinux requirements. It still must be disabled. Signed-off-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2017-08-04 13:00:57 -04:00
@end_dpdk@
rhel: Improved Systemd Integration This commit builds upon some of the recent ovs-ctl changes to build a more integrated systemd setup. A new service (ovs-vswitchd) is added to track the ovs-vswitchd, and ovsdb-server service is reserved for the ovsdb-server daemon. The systemd scripts still use ovs-ctl to actually initialize the daemons. Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-by: Markos Chandras <mchandras@suse.de> Acked-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2016-07-25 14:03:53 -04:00
ExecStart=/usr/share/openvswitch/scripts/ovs-ctl \
--no-ovsdb-server --no-monitor --system-id=random \
rhel: run ovn with the same user as ovs Both ovn and ovs share the same log and run directories which are owned by the user running ovs so it makes sense that ovn runs under that user too to diminish security concerns and possible problems with log rotation. Signed-off-by: Jaime Caamaño Ruiz <jcaamano@suse.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
2019-05-08 13:53:48 +02:00
${OVS_USER_OPT} \
rhel: Improved Systemd Integration This commit builds upon some of the recent ovs-ctl changes to build a more integrated systemd setup. A new service (ovs-vswitchd) is added to track the ovs-vswitchd, and ovsdb-server service is reserved for the ovsdb-server daemon. The systemd scripts still use ovs-ctl to actually initialize the daemons. Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-by: Markos Chandras <mchandras@suse.de> Acked-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2016-07-25 14:03:53 -04:00
start $OPTIONS
ExecStop=/usr/share/openvswitch/scripts/ovs-ctl --no-ovsdb-server stop
ExecReload=/usr/share/openvswitch/scripts/ovs-ctl --no-ovsdb-server \
--no-monitor --system-id=random \
rhel: run ovn with the same user as ovs Both ovn and ovs share the same log and run directories which are owned by the user running ovs so it makes sense that ovn runs under that user too to diminish security concerns and possible problems with log rotation. Signed-off-by: Jaime Caamaño Ruiz <jcaamano@suse.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
2019-05-08 13:53:48 +02:00
${OVS_USER_OPT} \
rhel: Improved Systemd Integration This commit builds upon some of the recent ovs-ctl changes to build a more integrated systemd setup. A new service (ovs-vswitchd) is added to track the ovs-vswitchd, and ovsdb-server service is reserved for the ovsdb-server daemon. The systemd scripts still use ovs-ctl to actually initialize the daemons. Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-by: Markos Chandras <mchandras@suse.de> Acked-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2016-07-25 14:03:53 -04:00
restart $OPTIONS
rhel/systemd: Set ovs-vswitchd timeout to 5 minutes During initialization, it's possible that the startup time takes longer than the systemd default provided. Set this to be 5 minutes. If we take longer than 5 minutes, maybe something is wrong. As an example of long initialization, enable DPDK, and allocate large numbers of hugepages before starting ovs-vswitchd. The vswitchd can take two or more minutes to start. During that time, systemd will decide that the startup time took too long, and kill the parent process, leading eventually to an error like: ovs|00011|daemon_unix|EMER|pipe write failed (Broken pipe) And a systemd log like: ovs-vswitchd.service start operation timed out. Terminating. The 5 minutes setting has been observed to work on a system where 400G of hugepages were allocated. Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-by: Markos Chandras <mchandras@suse.de> Acked-by: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Russell Bryant <russell@ovn.org>
2017-07-13 10:51:34 -04:00
TimeoutSec=300
Reference in New Issue Copy Permalink