storcli64 show 查一下控制器编号，就是Ctl那一列的数字
storcli64 /c0 show 查看当前版本
然后升级一堆：
storcli64 /c0 download file=HBA_9400-8e_SAS_SATA_Profile.bin
storcli64 /c0 download bios file=mpt35sas_legacy.rom
storcli64 /c2 download efibios file=mpt35sas_x64.rom
storcli64 /c0 show 查看升级后版本，然后重启搞定
交换机上启用LLDP、PFC和DCBx，PFC优先级为3（默认值），DCBx的标准为IEEE（默认值）。
dcb pfc
#
interface 25GE1/0/10
description Host-01
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 125
stp edged-port enable
lldp tlv-enable dcbx
dcb pfc enable mode manual
#
interface 25GE1/0/12
description Host-02
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 125
stp edged-port enable
lldp tlv-enable dcbx
dcb pfc enable mode manual
#
lldp enable
#通过主机-配置-物理适配器确认用于vSAN网卡的设备位置和端口，以下示例中是0000:8a:00的端口2(vmnic3)和0000:8b:00的端口1(vmnic4)，首先查看一下LLDP和DCBx的相关配置。需要先安装MFT才能使用相关命令。
[root@yaoge123:~] /opt/mellanox/bin/mlxconfig -d 0000:8a:00.1 query|grep -iE "dcb|lldp"
LLDP_NB_DCBX_P1 False(0)
LLDP_NB_RX_MODE_P1 OFF(0)
LLDP_NB_TX_MODE_P1 OFF(0)
LLDP_NB_DCBX_P2 False(0)
LLDP_NB_RX_MODE_P2 OFF(0)
LLDP_NB_TX_MODE_P2 OFF(0)
DCBX_IEEE_P1 True(1)
DCBX_CEE_P1 True(1)
DCBX_WILLING_P1 True(1)
DCBX_IEEE_P2 True(1)
DCBX_CEE_P2 True(1)
DCBX_WILLING_P2 True(1)
[root@yaoge123:~] /opt/mellanox/bin/mlxconfig -d 0000:8b:00.0 query|grep -iE "dcb|lldp"
LLDP_NB_DCBX_P1 False(0)
LLDP_NB_RX_MODE_P1 OFF(0)
LLDP_NB_TX_MODE_P1 OFF(0)
LLDP_NB_DCBX_P2 False(0)
LLDP_NB_RX_MODE_P2 OFF(0)
LLDP_NB_TX_MODE_P2 OFF(0)
DCBX_IEEE_P1 True(1)
DCBX_CEE_P1 True(1)
DCBX_WILLING_P1 True(1)
DCBX_IEEE_P2 True(1)
DCBX_CEE_P2 True(1)
DCBX_WILLING_P2 True(1) 发现LLDP没有启动，启用LLDP和DCBx，DCBx IEEE已启用。
[root@yaoge123:~] /opt/mellanox/bin/mlxconfig -d 0000:8a:00.1 set LLDP_NB_DCBX_P2=1 LLDP_NB_RX_MODE_P2=2 LLDP_NB_TX_MODE_P2=2 DCBX_WILLING_P2=1 DCBX_IEEE_P2=1
Device #1:
----------
Device type: ConnectX5
Name: MCX512A-ACU_Ax_Bx
Description: ConnectX-5 EN network interface card; 10/25GbE dual-port SFP28; PCIe3.0 x8; UEFI Enabled (x86/ARM)
Device: 0000:8a:00.1
Configurations: Next Boot New
LLDP_NB_DCBX_P2 False(0) True(1)
LLDP_NB_RX_MODE_P2 OFF(0) ALL(2)
LLDP_NB_TX_MODE_P2 OFF(0) ALL(2)
DCBX_WILLING_P2 True(1) True(1)
DCBX_IEEE_P2 True(1) True(1)
Apply new Configuration? (y/n) [n] : y
Applying... Done!
-I- Please reboot machine to load new configurations.
[root@yaoge123:~] /opt/mellanox/bin/mlxconfig -d 0000:8b:00.0 set LLDP_NB_DCBX_P1=1 LLDP_NB_RX_MODE_P1=2 LLDP_NB_TX_MODE_P1=2 DCBX_WILLING_P1=1 DCBX_IEEE_P1=1
Device #1:
----------
Device type: ConnectX5
Name: MCX512A-ACU_Ax_Bx
Description: ConnectX-5 EN network interface card; 10/25GbE dual-port SFP28; PCIe3.0 x8; UEFI Enabled (x86/ARM)
Device: 0000:8b:00.0
Configurations: Next Boot New
LLDP_NB_DCBX_P1 False(0) True(1)
LLDP_NB_RX_MODE_P1 OFF(0) ALL(2)
LLDP_NB_TX_MODE_P1 OFF(0) ALL(2)
DCBX_WILLING_P1 True(1) True(1)
DCBX_IEEE_P1 True(1) True(1)
Apply new Configuration? (y/n) [n] : y
Applying... Done!
-I- Please reboot machine to load new configurations.
重启后查看网卡当前配置，确认LLDP和DCBx均已启用
[root@yaoge123:~] /opt/mellanox/bin/mlxconfig -d 0000:8a:00.1 query|grep -iE "dcb|lldp"
LLDP_NB_DCBX_P1 False(0)
LLDP_NB_RX_MODE_P1 OFF(0)
LLDP_NB_TX_MODE_P1 OFF(0)
LLDP_NB_DCBX_P2 True(1)
LLDP_NB_RX_MODE_P2 ALL(2)
LLDP_NB_TX_MODE_P2 ALL(2)
DCBX_IEEE_P1 True(1)
DCBX_CEE_P1 True(1)
DCBX_WILLING_P1 True(1)
DCBX_IEEE_P2 True(1)
DCBX_CEE_P2 True(1)
DCBX_WILLING_P2 True(1)
[root@yaoge123:~] /opt/mellanox/bin/mlxconfig -d 0000:8b:00.0 query|grep -iE "dcb|lldp"
LLDP_NB_DCBX_P1 True(1)
LLDP_NB_RX_MODE_P1 ALL(2)
LLDP_NB_TX_MODE_P1 ALL(2)
LLDP_NB_DCBX_P2 False(0)
LLDP_NB_RX_MODE_P2 OFF(0)
LLDP_NB_TX_MODE_P2 OFF(0)
DCBX_IEEE_P1 True(1)
DCBX_CEE_P1 True(1)
DCBX_WILLING_P1 True(1)
DCBX_IEEE_P2 True(1)
DCBX_CEE_P2 True(1)
DCBX_WILLING_P2 True(1)
查看网卡的DCB状态，模式为IEEE，PFC已启用且优先级为3（0 0 0 1 0 0 0 0）
[root@2288Hv6-05:~] esxcli network nic dcb status get -n vmnic3
Nic Name: vmnic3
Mode: 3 - IEEE Mode
Enabled: true
Capabilities:
Priority Group: true
Priority Flow Control: true
PG Traffic Classes: 8
PFC Traffic Classes: 8
PFC Enabled: true
PFC Configuration: 0 0 0 1 0 0 0 0
IEEE ETS Configuration:
Willing Bit In ETS Config TLV: 1
Supported Capacity: 8
Credit Based Shaper ETS Algorithm Supported: 0x0
TX Bandwidth Per TC: 13 13 13 13 12 12 12 12
RX Bandwidth Per TC: 13 13 13 13 12 12 12 12
TSA Assignment Table Per TC: 2 2 2 2 2 2 2 2
Priority Assignment Per TC: 1 0 2 3 4 5 6 7
Recommended TC Bandwidth Per TC: 13 13 13 13 12 12 12 12
Recommended TSA Assignment Per TC: 2 2 2 2 2 2 2 2
Recommended Priority Assignment Per TC: 1 0 2 3 4 5 6 7
IEEE PFC Configuration:
Number Of Traffic Classes: 8
PFC Configuration: 0 0 0 1 0 0 0 0
Macsec Bypass Capability Is Enabled: 0
Round Trip Propagation Delay Of Link: 0
Sent PFC Frames: 0 0 0 0 0 0 0 0
Received PFC Frames: 0 0 0 0 0 0 0 0
DCB Apps:
[root@2288Hv6-05:~] esxcli network nic dcb status get -n vmnic4
Nic Name: vmnic4
Mode: 3 - IEEE Mode
Enabled: true
Capabilities:
Priority Group: true
Priority Flow Control: true
PG Traffic Classes: 8
PFC Traffic Classes: 8
PFC Enabled: true
PFC Configuration: 0 0 0 1 0 0 0 0
IEEE ETS Configuration:
Willing Bit In ETS Config TLV: 1
Supported Capacity: 8
Credit Based Shaper ETS Algorithm Supported: 0x0
TX Bandwidth Per TC: 13 13 13 13 12 12 12 12
RX Bandwidth Per TC: 13 13 13 13 12 12 12 12
TSA Assignment Table Per TC: 2 2 2 2 2 2 2 2
Priority Assignment Per TC: 1 0 2 3 4 5 6 7
Recommended TC Bandwidth Per TC: 13 13 13 13 12 12 12 12
Recommended TSA Assignment Per TC: 2 2 2 2 2 2 2 2
Recommended Priority Assignment Per TC: 1 0 2 3 4 5 6 7
IEEE PFC Configuration:
Number Of Traffic Classes: 8
PFC Configuration: 0 0 0 1 0 0 0 0
Macsec Bypass Capability Is Enabled: 0
Round Trip Propagation Delay Of Link: 0
Sent PFC Frames: 0 0 0 0 0 0 0 0
Received PFC Frames: 0 0 0 0 0 0 0 0
DCB Apps:
除了某些土豪站用全闪以外，大多数开源镜像站都是以机械盘为主，当带宽充裕的时候IO显然会成为瓶颈，那么采用少量的SSD来提升性能几乎是唯一的办法。加SSD的方法有很多种：
proxy_cache配置在前端nginx上，前端nginx访问SSD，前端nginx需要编译安装ngx_cache_purge以便主动清除缓存。前端nginx反代给后端nginx，后端nginx访问机械盘提供实际的数据。当然也可以一个nginx同时访问SSD和机械盘，这个nginx自己反代给自己，因为只有反代了才能缓存，前端nginx缓存配置如下：
http {
……
map $http_origin $good_origin {
~*([.|/]|^)mirrorz.org$ 1;
~*(/|^)mirrors.cernet.edu.cn$ 1;
default 0;
}
upstream zfs_server {
server 192.168.10.10:80;
keepalive 300;
}
proxy_cache_path /cache levels=1:2 use_temp_path=off keys_zone=mirror:128m inactive=28d max_size=8192g;
……
}
server {
listen 80;
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;
listen *:443 quic;
listen [::]:443 quic;
server_name mirror.nju.edu.cn mirrors.nju.edu.cn;
……
location / {
include conf.d/proxy_zfs;
}
location /.mirrorz/ {
if ($good_origin) {
add_header 'Access-Control-Allow-Origin' "$http_origin" always;
add_header 'Vary' "Origin";
add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-TUNA-MIRROR-ID';
add_header X-Cache-Status $upstream_cache_status;
}
include conf.d/proxy_zfs;
}
……
}proxy_pass http://zfs_server;
proxy_redirect ~*^http://[^/]+(:\d+)?(/.*)$ $2;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_connect_timeout 600s;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
proxy_cache mirror;
proxy_cache_key $uri;
proxy_cache_valid 200 7d;
proxy_cache_valid 301 302 1d;
proxy_cache_valid any 1m;
proxy_cache_lock on;
proxy_cache_lock_timeout 600s;
proxy_cache_lock_age 600s;
proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
proxy_cache_revalidate on;
cache_purge_response_type text;
proxy_cache_purge PURGE from 127.0.0.1 192.168.10.10;
add_header X-Cache-Status $upstream_cache_status;后端nginx可能需要设定某些文件的不缓存：
server {
listen 80;
root /mirror;
……
location ~ ^/no_cache/ {
expires -1;
……
}
……
}编辑 tunasync worker 的配置文件添加一个脚本，使得每个同步作业结束后均清除前端上这个镜像的所有缓存：
#tunasync worker的配置文件
[global]
……
exec_on_success = [ "/home/mirror/postexec.sh" ]
exec_on_failure = [ "/home/mirror/postexec.sh" ]
……
#上述的postexec.sh脚本内容
#!/bin/bash
MIRROR_DIR="/mirror/"
DIR="${TUNASYNC_WORKING_DIR/"$MIRROR_DIR"/}"
/usr/bin/curl --silent --output /dev/null --request PURGE "https://mirror.nju.edu.cn/$DIR/*"
镜像站某些状态文件会频繁的周期更新，每次更新后都用 curl --silent --output /dev/null --request PURGE "https://mirror.nju.edu.cn/status/*" 清除一下缓存。
NVMe over RoCE 存储系统的网络应认真规划，下面以一个简单的系统为例说明：
交换机A的VLAN 123（192.168.123.0/24）用于传输NVMe over RoCE、交换机B用VLAN 124（192.168.124.0/24）用于传输NVMe over RoCE。无论是控制器、交换机、网卡坏任意一个，甚至每类都任意坏一个，均不影响业务连续性
| 接口 | 交换机链接 | VLAN | NVMe over RoCE IP |
| 存储A控A1 | 交换机A | 123 | 192.168.123.101 |
| 存储A控A2 | 交换机A | 123 | 192.168.123.102 |
| 存储A控A3 | 交换机B | 124 | 192.168.124.101 |
| 存储A控A4 | 交换机B | 124 | 192.168.124.102 |
| 存储B控B1 | 交换机A | 123 | 192.168.123.103 |
| 存储B控B2 | 交换机A | 123 | 192.168.123.104 |
| 存储B控B3 | 交换机B | 124 | 192.168.124.103 |
| 存储B控B4 | 交换机B | 124 | 192.168.124.104 |
| 服务器1网卡1A | 交换机A | 123 | 192.168.123.11 |
| 服务器1网卡1B | 交换机B | 99 | 业务网 |
| 服务器1网卡2A | 交换机A | 99 | 业务网 |
| 服务器1网卡1B | 交换机B | 124 | 192.168.124.11 |
| 服务器2网卡1A | 交换机A | 123 | 192.168.123.12 |
| 服务器2网卡1B | 交换机B | 99 | 业务网 |
| 服务器2网卡2A | 交换机A | 99 | 业务网 |
| 服务器2网卡2B | 交换机B | 124 | 192.168.124.12 |
NVMe over RoCE 的相关配置需要在 vCenter Server Client 下面操作，ESXi Host Client 下是没有相关选项的，至少图形界面是这样，用 esxicli 估计可以直接在 ESXi 下面配置。所以需要先用本地的盘部署一套VCSA，精简配置大约150GB就够了，等NVMe配置好再迁移到存储上。
| RDMA适配器 | VMkernel适配器 | VMkernel 适配器 IP | 物理适配器 | 虚拟交换机 | VLAN | 存储适配器 | 存储控制器 IP |
| vmrdma0 | vmk1 | 192.168.123.11 | vmnic2 | vSwitch1 | 123 | vmhba64 | 192.168.123.101-104 |
| vmrdma3 | vmk2 | 192.168.124.11 | vmnic5 | vSwitch2 | 124 | vmhba65 | 192.168.124.101-104 |
NVMe over RoCE 要求无损网络，因此交换机和主机网卡均需要一些配置来保证无损。
QoS标记采用PCP为例，PCP是在VLAN标签中标记优先级，所以流量必须在VLAN中，Dorado 不是所有的前端接口卡都支持DSCP。
dcb pfc nof
priority 3 turn-off threshold 20
#
dcb pfc deadlock-detect timer 1000
dcb pfc deadlock-recovery timer 1500
#
interface 25GE1/0/1
description Dorado-A
port link-type trunk
port trunk allow-pass vlan 123
stp edged-port enable
dcb pfc enable nof mode manual
jumboframe enable 5500
#
interface 25GE1/0/2
description Dorado-A
port link-type trunk
port trunk allow-pass vlan 123
stp edged-port enable
dcb pfc enable nof mode manual
jumboframe enable 5500
#
interface 25GE1/0/3
description Dorado-B
port link-type trunk
port trunk allow-pass vlan 123
stp edged-port enable
dcb pfc enable nof mode manual
jumboframe enable 5500
#
interface 25GE1/0/4
description Dorado-B
port link-type trunk
port trunk allow-pass vlan 123
stp edged-port enable
dcb pfc enable nof mode manual
jumboframe enable 5500
#
interface 25GE1/0/9
description Host-01
port link-type trunk
port trunk allow-pass vlan 123
stp edged-port enable
dcb pfc enable nof mode manual
jumboframe enable 5500
#
interface 25GE1/0/11
description Host-02
port link-type trunk
port trunk allow-pass vlan 123
stp edged-port enable
dcb pfc enable nof mode manual
jumboframe enable 5500
#
lldp enable
#
ai-service
#
ai-ecn
ai-ecn enable
assign queue 3 model ai_ecn_centralizedstorage
#
inof
#
return[root@yaoge123:~] esxcli system module parameters set -m nmlx5_core -p "pfctx=0x08 pfcrx=0x08"[root@yaoge123:~] esxcli system module parameters list -m nmlx5_core | grep pfc
pfcrx int 0x08 Priority based Flow Control policy on RX.
Notes: Must be equal to pfctx.
pfctx int 0x08 Priority based Flow Control policy on TX.
Notes: Must be equal to pfcrx.
NVMe over RoCE 对RoCE网卡的固件兼容性有较高要求
[root@yaoge123:~] esxcfg-nics -l
Name PCI Driver Link Speed Duplex MAC Address MTU Description
vmnic0 0000:19:00.0 igbn Up 1000Mbps Full **:**:**:**:**:** 1500 Intel Corporation I350 Gigabit Network Connection
vmnic1 0000:19:00.1 igbn Up 1000Mbps Full **:**:**:**:**:** 1500 Intel Corporation I350 Gigabit Network Connection
vmnic2 0000:8a:00.0 nmlx5_core Up 25000Mbps Full **:**:**:**:**:** 1500 Mellanox Technologies ConnectX-5 EN NIC; 10/25GbE; dual-port SFP28; PCIe3.0 x8; (MCX512A-ACU)
vmnic3 0000:8a:00.1 nmlx5_core Up 25000Mbps Full **:**:**:**:**:** 1500 Mellanox Technologies ConnectX-5 EN NIC; 10/25GbE; dual-port SFP28; PCIe3.0 x8; (MCX512A-ACU)
vmnic4 0000:8b:00.0 nmlx5_core Up 25000Mbps Full **:**:**:**:**:** 1500 Mellanox Technologies ConnectX-5 EN NIC; 10/25GbE; dual-port SFP28; PCIe3.0 x8; (MCX512A-ACU)
vmnic5 0000:8b:00.1 nmlx5_core Up 25000Mbps Full **:**:**:**:**:** 1500 Mellanox Technologies ConnectX-5 EN NIC; 10/25GbE; dual-port SFP28; PCIe3.0 x8; (MCX512A-ACU)
[root@yaoge123:~] esxcli network nic get -n vmnic2
Advertised Auto Negotiation: true
Advertised Link Modes: Auto, 1000BaseCX-SGMII/Full, 10000BaseKR/Full, 25000BaseTwinax/Full
Auto Negotiation: true
Backing DPUId: N/A
Cable Type: FIBRE
Current Message Level: -1
Driver Info:
Bus Info: 0000:8a:00:0
Driver: nmlx5_core
Firmware Version: 16.32.1010
Version: 4.23.0.36
Link Detected: true
Link Status: Up
Name: vmnic2
PHYAddress: 0
Pause Autonegotiate: false
Pause RX: true
Pause TX: true
Supported Ports: FIBRE, DA
Supports Auto Negotiation: true
Supports Pause: true
Supports Wakeon: false
Transceiver: internal
Virtual Address: **:**:**:**:**:**
Wakeon: None
[root@yaoge123:/tmp] esxcli software component apply -d /tmp/Mellanox-MFT-Tools_4.26.1.101-1OEM.801.0.0.21495797_22944840.zip
Installation Result
Message: Operation finished successfully.
Components Installed: Mellanox-MFT-Tools_4.26.1.101-1OEM.801.0.0.21495797
Components Removed:
Components Skipped:
Reboot Required: false
DPU Results:
[root@yaoge123:/tmp] esxcli software component apply -d /tmp/Mellanox-NATIVE-NMST_4.26.1.101-1OEM.801.0.0.21495797_22944879.zip
Installation Result
Message: The update completed successfully, but the system needs to be rebooted for the changes to be effective.
Components Installed: Mellanox-NATIVE-NMST_4.26.1.101-1OEM.801.0.0.21495797
Components Removed:
Components Skipped:
Reboot Required: true
DPU Results:
[root@yaoge123:/tmp] /opt/mellanox/bin/mlxfwmanager
Querying Mellanox devices firmware ...
Device #1:
----------
Device Type: ConnectX5
Part Number: MCX512A-ACU_Ax_Bx
Description: ConnectX-5 EN network interface card; 10/25GbE dual-port SFP28; PCIe3.0 x8; UEFI Enabled (x86/ARM)
PSID: MT_0000000425
PCI Device Name: mt4119_pciconf0
Base GUID: ***
Base MAC: ***
Versions: Current Available
FW 16.32.1010 16.34.1002
PXE 3.6.0502 3.6.0700
UEFI 14.25.0017 14.27.0014
Status: Update required
Device #2:
----------
Device Type: ConnectX5
Part Number: MCX512A-ACU_Ax_Bx
Description: ConnectX-5 EN network interface card; 10/25GbE dual-port SFP28; PCIe3.0 x8; UEFI Enabled (x86/ARM)
PSID: MT_0000000425
PCI Device Name: mt4119_pciconf1
Base GUID: ***
Base MAC: ***
Versions: Current Available
FW 16.32.1010 16.34.1002
PXE 3.6.0502 3.6.0700
UEFI 14.25.0017 14.27.0014
Status: Update required
---------
Found 2 device(s) requiring firmware update. Please use -u flag to perform the update.
[root@yaoge123:/tmp] /opt/mellanox/bin/mlxfwmanager -u
Querying Mellanox devices firmware ...
Device #1:
----------
Device Type: ConnectX5
Part Number: MCX512A-ACU_Ax_Bx
Description: ConnectX-5 EN network interface card; 10/25GbE dual-port SFP28; PCIe3.0 x8; UEFI Enabled (x86/ARM)
PSID: MT_0000000425
PCI Device Name: mt4119_pciconf0
Base GUID: ***
Base MAC: ***
Versions: Current Available
FW 16.32.1010 16.34.1002
PXE 3.6.0502 3.6.0700
UEFI 14.25.0017 14.27.0014
Status: Update required
Device #2:
----------
Device Type: ConnectX5
Part Number: MCX512A-ACU_Ax_Bx
Description: ConnectX-5 EN network interface card; 10/25GbE dual-port SFP28; PCIe3.0 x8; UEFI Enabled (x86/ARM)
PSID: MT_0000000425
PCI Device Name: mt4119_pciconf1
Base GUID: ***
Base MAC: ***
Versions: Current Available
FW 16.32.1010 16.34.1002
PXE 3.6.0502 3.6.0700
UEFI 14.25.0017 14.27.0014
Status: Update required
---------
Found 2 device(s) requiring firmware update...
Perform FW update? [y/N]: y
Device #1: Updating FW ...
FSMST_INITIALIZE - OK
Writing Boot image component - OK Done
Device #2: Updating FW ...
FSMST_INITIALIZE - OK
Writing Boot image component - OK Done
Restart needed for updates to take effect.
[root@yaoge123:~] esxcli network nic get -n vmnic2
Advertised Auto Negotiation: true
Advertised Link Modes: Auto, 1000BaseCX-SGMII/Full, 10000BaseKR/Full, 25000BaseTwinax/Full
Auto Negotiation: true
Backing DPUId: N/A
Cable Type: FIBRE
Current Message Level: -1
Driver Info:
Bus Info: 0000:8a:00:0
Driver: nmlx5_core
Firmware Version: 16.34.1002
Version: 4.23.0.36
Link Detected: true
Link Status: Up
Name: vmnic2
PHYAddress: 0
Pause Autonegotiate: false
Pause RX: true
Pause TX: true
Supported Ports: FIBRE, DA
Supports Auto Negotiation: true
Supports Pause: true
Supports Wakeon: false
Transceiver: internal
Virtual Address: **:**:**:**:**:**
Wakeon: None
一个非常无语的高危漏洞，任何人都可以重置任意账号的密码然后发送到指定邮箱
对于容器部署来说，直接修改 /var/opt/gitlab/nginx/conf/gitlab-http.conf 文件，在其中添加
location /users/password {
return 444;
}然后重新加载nginx配置文件
gitlab-ctl hup nginx升级至 gitlab-jh v16.5.0 以后，PostgreSQL 数据库的连接数会一直持续上升，直至触碰最大连接数上限，前台报500错误。升级至v16.5.2后恢复和以前版本一样的，连接数约200，峰值不超过500。
在HPC集群中通常有DNS和本地hosts提供解析服务，以便节点间通过主机名互相通信，而不是直接使用IP地址。但是如果在集群外有一个独立服务器中的容器需要与集群内的节点通过主机名通讯，就需要通过DNS来给容器提供解析服务。
通过自动化脚本将集群的hosts拷贝到独立服务器的一个目录下，如 /home/hpc/dns/hosts
自己做一个dnsmasq的容器：
[yaoge123]$ cat dnsmasq/Dockerfile
FROM alpine:latest
RUN apk update \
&& apk upgrade \
&& apk add --no-cache \
dnsmasq \
&& rm -rf /var/cache/apk/*
编写docker-compose.yml：
services:
dnsmasq:
build: ./dnsmasq
image: dnsmasq
container_name: dnsmasq
networks:
default:
ipv4_address: 192.168.100.200
volumes:
- /home/hpc/dns:/etc/dns:ro
command:
- dnsmasq
- --keep-in-foreground
#- --no-daemon
#- --log-queries
- --domain-needed
- --no-hosts
- --cache-size=3000
- --hostsdir=/etc/dns
abc:
image: abc
container_name: abc
dns:
- 192.168.100.200
…………
networks:
default:
driver: bridge
ipam:
driver: default
config:
- subnet: 192.168.100.0/24测试解析和查看 dnsmasq 缓存情况，evictions为0最好
[yaoge123]# run --rm -it --network=docker_default --dns=192.168.100.200 alpine sh
/ # apk add bind-tools
/ # dig +short node_name
/ # for i in "cachesize.bind insertions.bind evictions.bind misses.bind hits.bind auth.bind servers.bind";do dig +short chaos txt $i;done