為 Compute Engine VM 設定準確時間

許多軟體系統都依賴事件的仔細排序，因此需要穩定一致的系統時鐘，並使用含有時間戳記的系統記錄檔，確保時間同步，並在發生問題時進行偵錯。為確保系統時鐘保持同步，Compute Engine 虛擬機器 (VM) 執行個體已預先設定為使用網路時間通訊協定 (NTP)，這是時間同步硬體和軟體的組合解決方案。如果確保時間同步的準確性，以及監控時間同步的準確性對您的目標來說很重要，您可以設定準確時間，而非 NTP，使用 chrony 和 ptp_kvm 將 VM 的時鐘與主機時鐘同步。這項設定的目的是在支援的設定中，達到 1 毫秒內的準確度。

支援的機型

下列機型支援精確時間：

支援的作業系統

下列作業系統支援精確時間：

OS 版本 圖片
CentOS Stream 9 centos-stream-9
Container-Optimized OS COS 105 LTS、 COS 109 LTS、 COS 113 LTS、 COS 117 LTS cos-105-lts、cos-109-lts、 cos-113-lts、cos-117-lts
Debian 11 (Bullseye)、 12 (Bookworm) debian-11、debian-12
Fedora Cloud 39 fedora-cloud-39
RHEL <0x 8、9 rhel-8-4-sap-ha、 rhel-8-6-sap-ha、 rhel-8-8-sap-ha、 rhel-8-10-sap-ha、 rhel-9、rhel-9-0-sap-ha、 rhel-9-2-sap-ha、 rhel-9-4-sap-ha
Rocky Linux 8、9 rocky-linux-8、 rocky-linux-8-optimized-gcp、 rocky-linux-9-optimized-gcp、 rocky-linux-9-optimized-gcp
SLES <0x 15 <0x sles-15、sles-15-sp2-byos、 sles-15-sp2-sap、 sles-15-sp3-byos、 sles-15-sp3-sap、 sles-15-sp4-byos、 sles-15-sp4-sap、 sles-15-sp5-byos、 sles-15-sp5-sap
Ubuntu <0x0 22.04 LTS (Jammy Jellyfish)、 24.04 LTS (Noble Numbat) ubuntu-2204-lts, ubuntu-2404-lts-amd64
Ubuntu Pro 2004 ubuntu-pro-2004-lts, ubuntu-pro-2004-lts-amd64

支援的區域

所有標準公開 Google Cloud 區域和可用區都支援精確時間同步功能，但僅限支援的機型和作業系統。

設定精確的時間同步

如要為專案的 VM 設定準確的時間同步，請為每個 VM 完成下列工作：

  • 將 chrony 設為使用 ptp-kvm 做為時間來源。
  • 設定 Google Cloud Ops Agent，收集及分析資料。

完成這兩項工作後，專案中的 VM 就會設定為準確的時間同步。

如需建立 VM 並完成兩項工作來設定精確時間同步的範例指令碼，請參閱 GitHub 上的 VM 建立指令碼。

設定 chrony 使用 ptp-kvm

如要將 chrony 設定為使用 ptp-kvm 做為時間來源，請在每個專案的 VM 中執行下列指令碼： Google Cloud 

#!/bin/bash

# Install chrony as needed
if ! command -v chronyc &>/dev/null; then
    # Detect the package manager and install chrony
    if command -v apt &>/dev/null; then
        # Debian, Ubuntu, and derivatives
        echo "Detected apt. Installing chrony..."
        apt-get update
        apt-get install -y chrony
    elif command -v dnf &>/dev/null; then
        # Fedora, RHEL 8+, CentOS 8+
        echo "Detected dnf. Installing chrony..."
        dnf install -y chrony
    elif command -v yum &>/dev/null; then
        # RHEL 7, CentOS 7
        echo "Detected yum. Installing chrony..."
        yum install -y chrony
    elif command -v zypper &>/dev/null; then
        # openSUSE, SLES
        echo "Detected zypper. Installing chrony..."
        zypper install -y chrony
    else
        echo "Please install chrony manually."
        exit 1
    fi
fi

# Different distros place chrony config in
# different locations, detect this.
if [ -f "/etc/chrony/chrony.conf" ]; then
    CHRONY_CONF="/etc/chrony/chrony.conf"
else
    CHRONY_CONF="/etc/chrony.conf"
fi

# Load PTP-KVM clock for high-accuracy clock synchronization
# PTP-KVM allows the VM to read a cross time-stamp of a platform
# provided clock and the VM CPU Clock (CycleCounter), providing
# resiliency from network and virtualization variability when
# synchronizing the realtime/wall clock
/sbin/modprobe ptp_kvm
echo "ptp_kvm" >/etc/modules-load.d/ptp_kvm.conf

# NTP servers might indicate the wrong time due to chrony
# greatly reducing the polling frequency, resulting in
# overall negative impact to the clock synchronization
# achieved, especially after live migration events.
#
# We disable NTP servers to prevent these issues.
#
# Customers interested in monitoring the clock accuracy compared to NTP sources
# should run a second instance of chrony in a no-change mode to do so.

# Disable NTP servers:
sed -i '/^server /d' $CHRONY_CONF
sed -i '/^pool /d' $CHRONY_CONF
sed -i '/^include /d' $CHRONY_CONF

#Disable DHCP based NTP config:
sed -i 's/^NETCONFIG_NTP_POLICY="auto"/NETCONFIG_NTP_POLICY=""/' /etc/sysconfig/network/config
truncate -s 0 /var/run/netconfig/chrony.servers
echo PEERNTP=no | sudo tee -a /etc/sysconfig/network
service NetworkManager restart
systemctl disable systemd-timesyncd.service
timedatectl set-ntp false

# Configure PTP-KVM based HW refclock, with leap second smearing
# Google's clocks are doing leap second smearing, and therefore chrony shouldn't attempt to adjust
# the time received from PTP-KVM to adjust for leap seconds.
sed "s/^leapsectz/#leapsectz/" -i $CHRONY_CONF
echo "refclock PHC /dev/ptp_kvm poll -1" >>$CHRONY_CONF
# For extra debugging logging, uncomment the following line
#echo "log measurements statistics tracking" >> $CHRONY_CONF
# Enable chrony's clock accuracy tracking log,
# for monitoring and auditing.
echo "log tracking" >>$CHRONY_CONF

# Restart chrony (Ubuntu named it differently)
systemctl restart chronyd
systemctl restart chrony

在 VM 上 Google Cloud 設定 Ops Agent

如要設定 Google Cloud 作業套件代理程式來收集及分析資料，請在每個 Google Cloud 專案的 VM 中執行下列指令碼：

#!/bin/bash

# From https://cloud.google.com/stackdriver/docs/solutions/agents/ops-agent/installation#install-latest-version
curl -sSO https://dl.google.com/cloudagents/add-google-cloud-ops-agent-repo.sh
bash add-google-cloud-ops-agent-repo.sh --also-install

OPS_AGENT_CONF="
logging:
    receivers:
        chrony_tracking_receiver:
            type: files
            include_paths:
                - /var/log/chrony/tracking.log
    processors:
        chrony_tracking_processor:
            type: parse_regex
            regex: \"^.*PHC0.*  (?<max_error>[-\d\.eE]+)$\"
    service:
        pipelines:
            chrony_tracking_pipeline:
                receivers: [chrony_tracking_receiver]
                processors: [chrony_tracking_processor]
"

OPS_AGENT_CONF_PATH="/etc/google-cloud-ops-agent/config.yaml"
echo "$OPS_AGENT_CONF" >"$OPS_AGENT_CONF_PATH"
systemctl restart google-cloud-ops-agent

設定時間同步監控

如要為專案的 VM 設定時間同步監控功能，請為專案執行記錄和資訊主頁設定指令碼。 Google CloudGoogle Cloud 這項指令碼可協助您完成 Google Cloud 專案的下列工作：

  • 並為與 VM Google Cloud 專案相關聯的服務帳戶設定適當權限。
  • 這項服務會建立記錄指標，chrony用來確保 VM 和主機伺服器上的時鐘時間一致。
  • 系統會結合下列指標，建立資訊主頁來測量 VM 時鐘對 UTC 的追溯性：

如要完成上述工作，請執行下列指令碼：

#!/bin/bash

if [ -z "$1" ]; then
    echo "Usage: time-sync-logging-dashboard.sh <project_id>" >&2
    exit 1
fi

PROJECT_ID="$1"
PROJECT_NUMBER=$(gcloud projects describe "$PROJECT_ID" --format="value(projectNumber)")
SERVICE_ACCOUNT_EMAIL=${PROJECT_NUMBER}-compute@developer.gserviceaccount.com

gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
    --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
    --role="roles/compute.instanceAdmin"

gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
    --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
    --role="roles/monitoring.metricWriter"

gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
    --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
    --role="roles/logging.logWriter"

cp clock-error-metric.json /tmp/clock-error-metric.json
sed -i "s/PROJECT_ID/${PROJECT_ID}/" /tmp/clock-error-metric.json

gcloud logging metrics create --project "${PROJECT_ID}" phc-clock-max-error-gce --config-from-file=/tmp/clock-error-metric.json
gcloud monitoring dashboards create --project "${PROJECT_ID}" --config-from-file=metric-dashboard.json

指令碼執行完畢後，即可使用指令碼建立的資訊主頁，查看專案 VM 的時鐘準確度資料。

後續步驟