mir/ovs
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-08-22 09:58:01 +00:00
Code Issues Releases Wiki Activity
ovs/rhel/usr_lib_systemd_system_openvswitch-ipsec.service

18 lines
504 B
SYSTEMD
Raw Normal View History

debian and rhel: Create IPsec package. Added rules and files to create debian and rpm ovs-ipsec packages. Signed-off-by: Qiuyu Xiao <qiuyu.xiao.qyx@gmail.com> Signed-off-by: Ansis Atteka <aatteka@ovn.org> Co-authored-by: Ansis Atteka <aatteka@ovn.org> Signed-off-by: Ben Pfaff <blp@ovn.org>
2018-09-19 17:15:55 -04:00
[Unit]
Description=OVS IPsec daemon
Requires=openvswitch.service
After=openvswitch.service
[Service]
Type=forking
rhel: Use /run instead of /var/run. Systemd unit file generates warnings about PID file path since /var/run is a legacy path so just use /run instead of /var/run. /var/run is a symlink of /run starting from RHEL7 (and any other distribution that uses systemd). Reported-at: https://bugzilla.redhat.com/1952081 Signed-off-by: Timothy Redaelli <tredaelli@redhat.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2021-05-12 17:08:08 +02:00
PIDFile=/run/openvswitch/ovs-monitor-ipsec.pid
rhel, debian: Add missing restart policy to ipsec service. Currently, if openvswitch-ipsec service will die for any reason it will not be restarted. At the same time, that will prevent updating tunnel configuration and prohibit adding new nodes in OVN clusters, for example. Add the 'on-failure' restart policy, so it behaves the same as all other OVS daemons. Acked-by: Frode Nordahl <fnordahl@ubuntu.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2025-01-15 15:00:14 +01:00
Restart=on-failure
ovs-ctl: Fix inability to set custom options for ovs-monitor-ipsec. Commit in the fixes tag added support for using custom ipsec.conf with ovs-monitor-ipsec, but it didn't provide a way to use those options via ovs-ctl. This makes it not possible to use these options from a systemd unit, for example. Fix that by adding --ovs-monitor-ipsec-options knob to ovs-ctl and allowing OPTIONS to be passed via sysconfig. Our Debian units are using StrongSwan, so they do not need these Libreswan-specific options, however, it's better to keep systemd integration similar to Fedora/RHEL. There is at least one other option that can be used with StrongSwan. Only the Debian init file is updated, because we don't have IPsec support for init in Fedora/RHEL. There is a line length warning in the example, but it's hard to split it into multiple lines, and I think, it's a good configuration example to provide. Fixes: 09d7c5ac0054 ("ipsec: Add support for using non-root ipsec.conf.") Acked-by: Frode Nordahl <fnordahl@ubuntu.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2025-01-15 15:00:15 +01:00
EnvironmentFile=/etc/openvswitch/default.conf
EnvironmentFile=-/etc/sysconfig/openvswitch
rhel, debian: Fix systemd monitoring wrong pid for ovs-monitor-ipsec. Other services are running without monitors, so systemd can properly track the pid. But ovs-monitor-ipsec is running with a monitor, so there is one more fork and systemd complains about the pid file: systemd[1]: openvswitch-ipsec.service: Supervising process 1037185 which is not our child. We'll most likely not notice when it exits. This is also causing some spurious kills sent to the child on service stop. Fix by running ovs-monitor-ipsec without a monitor as all other OVS services. We can't use start_daemon, that would take care of this, because the script is not on the PATH and we don't want to accidentally change permissions for OVS directories (ipsec runs as root), but we can mimic the behavior. Debian package had a custom patch for this issue, removing now. Fixes: f385abded520 ("rhel: Use PIDFile on forking systemd service files") Fixes: 9990322610f6 ("debian: Update packaging source from Debian/Ubuntu.") Acked-by: Frode Nordahl <fnordahl@ubuntu.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2025-01-15 15:00:13 +01:00
ExecStart=/usr/share/openvswitch/scripts/ovs-ctl --no-monitor \
ovs-ctl: Fix inability to set custom options for ovs-monitor-ipsec. Commit in the fixes tag added support for using custom ipsec.conf with ovs-monitor-ipsec, but it didn't provide a way to use those options via ovs-ctl. This makes it not possible to use these options from a systemd unit, for example. Fix that by adding --ovs-monitor-ipsec-options knob to ovs-ctl and allowing OPTIONS to be passed via sysconfig. Our Debian units are using StrongSwan, so they do not need these Libreswan-specific options, however, it's better to keep systemd integration similar to Fedora/RHEL. There is at least one other option that can be used with StrongSwan. Only the Debian init file is updated, because we don't have IPsec support for init in Fedora/RHEL. There is a line length warning in the example, but it's hard to split it into multiple lines, and I think, it's a good configuration example to provide. Fixes: 09d7c5ac0054 ("ipsec: Add support for using non-root ipsec.conf.") Acked-by: Frode Nordahl <fnordahl@ubuntu.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2025-01-15 15:00:15 +01:00
--ike-daemon=libreswan start-ovs-ipsec $OPTIONS
debian and rhel: Create IPsec package. Added rules and files to create debian and rpm ovs-ipsec packages. Signed-off-by: Qiuyu Xiao <qiuyu.xiao.qyx@gmail.com> Signed-off-by: Ansis Atteka <aatteka@ovn.org> Co-authored-by: Ansis Atteka <aatteka@ovn.org> Signed-off-by: Ben Pfaff <blp@ovn.org>
2018-09-19 17:15:55 -04:00
ExecStop=/usr/share/openvswitch/scripts/ovs-ctl stop-ovs-ipsec
[Install]
WantedBy=multi-user.target
Reference in New Issue Copy Permalink