mir/ovs
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-08-22 09:58:01 +00:00
Code Issues Releases Wiki Activity
ovs/debian/openvswitch-ipsec.service

17 lines
491 B
SYSTEMD
Raw Normal View History

debian: Update packaging source from Debian/Ubuntu. * Update upstream OVS debian packaging to be on par with package source in Debian/Ubuntu: - Provide a openvswitch-switch-dpdk package that integrates with the dpdk package in the distributions so that end users can opt into a DPDK-enabled Open vSwitch binary. - Provide systemd service files. - Provide openvswitch-source package for reproducible integrated build of for example OVN. - Stop building shared library and subsequently remove libopenvswitch and libopenvswitch-dev binary packages. Co-authored-by: Luca Boccassi <bluca@debian.org> Signed-off-by: Luca Boccassi <bluca@debian.org> Co-authored-by: Christian Ehrhardt <christian.ehrhardt@canonical.com> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com> Co-authored-by: James Page <james.page@ubuntu.com> Signed-off-by: James Page <james.page@ubuntu.com> Co-authored-by: Corey Bryant <corey.bryant@canonical.com> Signed-off-by: Corey Bryant <corey.bryant@canonical.com> Signed-off-by: Frode Nordahl <frode.nordahl@canonical.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2022-07-14 17:55:40 +02:00
[Unit]
Description=Open vSwitch IPsec daemon
Requires=openvswitch-switch.service
After=openvswitch-switch.service
[Service]
Type=forking
PIDFile=/run/openvswitch/ovs-monitor-ipsec.pid
rhel, debian: Add missing restart policy to ipsec service. Currently, if openvswitch-ipsec service will die for any reason it will not be restarted. At the same time, that will prevent updating tunnel configuration and prohibit adding new nodes in OVN clusters, for example. Add the 'on-failure' restart policy, so it behaves the same as all other OVS daemons. Acked-by: Frode Nordahl <fnordahl@ubuntu.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2025-01-15 15:00:14 +01:00
Restart=on-failure
ovs-ctl: Fix inability to set custom options for ovs-monitor-ipsec. Commit in the fixes tag added support for using custom ipsec.conf with ovs-monitor-ipsec, but it didn't provide a way to use those options via ovs-ctl. This makes it not possible to use these options from a systemd unit, for example. Fix that by adding --ovs-monitor-ipsec-options knob to ovs-ctl and allowing OPTIONS to be passed via sysconfig. Our Debian units are using StrongSwan, so they do not need these Libreswan-specific options, however, it's better to keep systemd integration similar to Fedora/RHEL. There is at least one other option that can be used with StrongSwan. Only the Debian init file is updated, because we don't have IPsec support for init in Fedora/RHEL. There is a line length warning in the example, but it's hard to split it into multiple lines, and I think, it's a good configuration example to provide. Fixes: 09d7c5ac0054 ("ipsec: Add support for using non-root ipsec.conf.") Acked-by: Frode Nordahl <fnordahl@ubuntu.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2025-01-15 15:00:15 +01:00
EnvironmentFile=-/etc/default/openvswitch-ipsec
rhel, debian: Fix systemd monitoring wrong pid for ovs-monitor-ipsec. Other services are running without monitors, so systemd can properly track the pid. But ovs-monitor-ipsec is running with a monitor, so there is one more fork and systemd complains about the pid file: systemd[1]: openvswitch-ipsec.service: Supervising process 1037185 which is not our child. We'll most likely not notice when it exits. This is also causing some spurious kills sent to the child on service stop. Fix by running ovs-monitor-ipsec without a monitor as all other OVS services. We can't use start_daemon, that would take care of this, because the script is not on the PATH and we don't want to accidentally change permissions for OVS directories (ipsec runs as root), but we can mimic the behavior. Debian package had a custom patch for this issue, removing now. Fixes: f385abded520 ("rhel: Use PIDFile on forking systemd service files") Fixes: 9990322610f6 ("debian: Update packaging source from Debian/Ubuntu.") Acked-by: Frode Nordahl <fnordahl@ubuntu.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2025-01-15 15:00:13 +01:00
ExecStart=/usr/share/openvswitch/scripts/ovs-ctl --no-monitor \
ovs-ctl: Fix inability to set custom options for ovs-monitor-ipsec. Commit in the fixes tag added support for using custom ipsec.conf with ovs-monitor-ipsec, but it didn't provide a way to use those options via ovs-ctl. This makes it not possible to use these options from a systemd unit, for example. Fix that by adding --ovs-monitor-ipsec-options knob to ovs-ctl and allowing OPTIONS to be passed via sysconfig. Our Debian units are using StrongSwan, so they do not need these Libreswan-specific options, however, it's better to keep systemd integration similar to Fedora/RHEL. There is at least one other option that can be used with StrongSwan. Only the Debian init file is updated, because we don't have IPsec support for init in Fedora/RHEL. There is a line length warning in the example, but it's hard to split it into multiple lines, and I think, it's a good configuration example to provide. Fixes: 09d7c5ac0054 ("ipsec: Add support for using non-root ipsec.conf.") Acked-by: Frode Nordahl <fnordahl@ubuntu.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2025-01-15 15:00:15 +01:00
--ike-daemon=strongswan start-ovs-ipsec $OVS_CTL_OPTS
debian: Update packaging source from Debian/Ubuntu. * Update upstream OVS debian packaging to be on par with package source in Debian/Ubuntu: - Provide a openvswitch-switch-dpdk package that integrates with the dpdk package in the distributions so that end users can opt into a DPDK-enabled Open vSwitch binary. - Provide systemd service files. - Provide openvswitch-source package for reproducible integrated build of for example OVN. - Stop building shared library and subsequently remove libopenvswitch and libopenvswitch-dev binary packages. Co-authored-by: Luca Boccassi <bluca@debian.org> Signed-off-by: Luca Boccassi <bluca@debian.org> Co-authored-by: Christian Ehrhardt <christian.ehrhardt@canonical.com> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com> Co-authored-by: James Page <james.page@ubuntu.com> Signed-off-by: James Page <james.page@ubuntu.com> Co-authored-by: Corey Bryant <corey.bryant@canonical.com> Signed-off-by: Corey Bryant <corey.bryant@canonical.com> Signed-off-by: Frode Nordahl <frode.nordahl@canonical.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
2022-07-14 17:55:40 +02:00
ExecStop=/usr/share/openvswitch/scripts/ovs-ctl stop-ovs-ipsec
[Install]
WantedBy=multi-user.target
Reference in New Issue Copy Permalink