【项目介绍】企业级运维管理平台

# DB 0: 通用缓存（用户登录阻止、速率限制等）
REDIS_DB_CACHE = 0

# DB 1: Django 缓存（ORM 查询缓存、DRF 响应缓存）
REDIS_DB_DJANGO = 1

# DB 2: Celery Broker & Results
REDIS_DB_CELERY = 2

@shared_task
def cmdb_ec2_todb(aws_id=None):
    """同步 AWS EC2 实例到数据库

    流程：
    1. 调用 boto3 describe_instances 获取实例列表
    2. 对比 CMDB 现有数据，识别新增/变更/删除
    3. 批量更新数据库
    4. 同步实例标签到 CMDB 字段
    """
    for aws_config in AWS_ACCOUNTS:
        instances = get_ec2_instances(aws_config)
        for instance in instances:
            CmdbEc2.objects.update_or_create(
                instance_id=instance['InstanceId'],
                defaults={
                    'name': get_tag(instance, 'Name'),
                    'private_ip_address': instance['PrivateIpAddress'],
                    'instance_type': instance['InstanceType'],
                    # ... 更多字段
                }
            )

# Jenkins Pipeline 完成后回调 ops-system
@api_view(['POST'])
def jenkins_callback(request):
    """Jenkins 构建完成回调

    1. 根据 build_number 找到对应的 TicketRecord
    2. 更新步骤状态（Finished/Failed）
    3. 如果配置了自动继续，触发下一步骤
    """
    build_number = request.data.get('build_number')
    status = request.data.get('status')

    record = TicketRecord.objects.get(jenkins_number=build_number)
    record.status = 'Finished' if status == 'SUCCESS' else 'Failed'
    record.save()

    if record.ticket_flow_task.is_next:
        trigger_next_step(record)

# cd2/logic.py
module = {
    "deploy": {
        "record_runtime": task_deploy.get_runtime_info,
        "record_pre_runtime": task_deploy.get_pre_runtime_info,
        "action": task_deploy.flow_action,
        "jenkins_callback": task_deploy.jenkins_callback,
    },
    "pm_deploy_all": {
        "action": task_service_configfile.flow_action_deploy,
        # ...
    },
    "batch_deploy": {
        "action": task_batch_deploy.flow_action,
        # ...
    },
    # ... 更多模块
}

AUTHENTICATION_BACKENDS = (
    'utils.keycloak.MyOIDCBackend',           # 主认证：Keycloak OIDC
    'django.contrib.auth.backends.ModelBackend',  # 降级：本地数据库
)

def set_block(username):
    """阻止用户登录（8小时有效）

    场景：用户登出、账号禁用、安全事件
    """
    redis_client.set(f"block:{username}", 1, ex=8*3600)

def check_is_block(username):
    """检查用户是否被阻止"""
    return redis_client.exists(f"block:{username}")

# 在认证中间件中检查
class TokenAuthenticationMiddleware:
    def authenticate(self, request):
        token = get_token_from_header(request)
        payload = decode_token(token)

        if check_is_block(payload['username']):
            raise AuthenticationFailed('Token has been revoked')

        return payload

class ConfigContext(ModelCreate):
    """配置上下文（配置项的分组）"""
    name = CharField(max_length=255)
    key = CharField(max_length=255, unique=True)

class ConfigInfo(ModelCreate):
    """配置项"""
    context = ForeignKey(ConfigContext)
    key = CharField(max_length=255)
    value = TextField()
    version = IntegerField(default=1)

class Changes(ModelCreate):
    """变更审计日志"""
    model_name = CharField(max_length=64)
    change_type = CharField(choices=['create', 'update', 'delete'])
    before_value = TextField()
    after_value = TextField()

AUTH_LDAP_SERVER_URI = "ldap://ldap.company.com"
AUTH_LDAP_USER_DN_TEMPLATE = "uid=%(user)s,ou=users,dc=company,dc=com"

class MyOIDCBackend(OIDCAuthenticationBackend):
    def create_user(self, claims):
        """根据 OIDC claims 创建用户"""
        user = AuthUserLDAP.objects.create_user(
            username=claims['preferred_username'],
            email=claims.get('email', ''),
            displayname=claims.get('name', ''),
        )
        return user

    def update_user(self, user, claims):
        """根据 OIDC claims 更新用户信息"""
        user.email = claims.get('email', user.email)
        user.displayname = claims.get('name', user.displayname)
        user.save()
        return user

# cmdb/models.py
class CmdbEnvironmentService(ModelCreate):
    cmdb_environments = ForeignKey('cmdb.CmdbEnvironments')
    cmdb_service = ForeignKey('cmdb.CmdbService')

# cd2/models.py
class CdFlowRecord(ModelCreate):
    # 通过 ContentType 实现与 Task 应用的松耦合
    content_type = ForeignKey(ContentType)
    object_id = PositiveIntegerField()
    content_object = GenericForeignKey()

# 同步：用户体验差
def deploy_sync(request):
    result = jenkins_build(job_name, params)  # 可能等待5分钟
    return Response({'result': result})

# 异步：立即返回
def deploy_async(request):
    task = jenkins_build.delay(job_name, params)  # 立即返回
    return Response({'task_id': task.id})

class CmdbEnvironmentService(ModelCreate):
    cmdb_environments = ForeignKey(CmdbEnvironments)  # 环境隔离
    cmdb_service = ForeignKey(CmdbService)

    class Meta:
        unique_together = ('cmdb_environments', 'cmdb_service')

# ops-system/settings.py
LOGGING = {
    'handlers': {
        'main': {'filename': '/data/logs/ops-system.log'},
        'cd_flow': {'filename': '/data/logs/ops-system.cd_flow.log'},
        'commands': {'filename': '/data/logs/ops-system.commands.log'},
    },
}

class ModelCreate(models.Model):
    create_time = DateTimeField(auto_now_add=True)
    create_user = CharField(max_length=255)

    class Meta:
        abstract = True

class ModelModify(ModelCreate):
    modify_time = DateTimeField(auto_now=True)
    modify_user = CharField(max_length=255)

    class Meta:
        abstract = True

# 主账户直接访问
client = boto3.client('ec2', aws_access_key_id=ACCESS_KEY)

# 从账户通过 STS AssumeRole
sts_client = boto3.client('sts')
assumed_role = sts_client.assume_role(
    RoleArn=f'arn:aws:iam::{account_id}:role/{role_name}',
    RoleSessionName='ops-systemSession'
)
credentials = assumed_role['Credentials']

client = boto3.client(
    'ec2',
    aws_access_key_id=credentials['AccessKeyId'],
    aws_secret_access_key=credentials['SecretAccessKey'],
    aws_session_token=credentials['SessionToken']
)