Week 05: 性能调优与企业级自动化

# ansible.cfg
[defaults]
forks = 50

总内存 ≈ 主进程 + (Forks × 单进程内存) + (活跃连接 × 连接内存)
例: 50 Forks ≈ 100 + (50 × 40) + (50 × 7) ≈ 2.5 GB

# ansible.cfg
[ssh_connection]
ssh_args = -o ControlMaster=auto -o ControlPersist=60s
control_path = /tmp/ansible-ssh-%%h-%%p-%%r

[ssh_connection]
pipelining = True

# /etc/sudoers
Defaults    !requiretty

- hosts: all
  strategy: free
  tasks:
    - name: 独立任务
      package:
        name: nginx
        state: present

# ansible.cfg
[defaults]
gathering = smart
fact_caching = jsonfile
fact_caching_connection = /tmp/ansible_facts
fact_caching_timeout = 86400

fact_caching = redis
fact_caching_connection = redis://localhost:6379/0
fact_caching_timeout = 3600

- hosts: all
  gather_facts: yes
  gather_subset:
    - network
    - hardware
    - "!facter"  # 排除 facter

- name: 长时间运行的任务
  command: /usr/bin/long_running_script.sh
  async: 3600    # 最大运行时间 (秒)
  poll: 10       # 轮询间隔 (秒)

- name: 启动后台任务
  command: /usr/bin/backup.sh
  async: 7200
  poll: 0
  register: backup_job

- name: 继续执行其他任务
  debug:
    msg: "备份已在后台运行"

- name: 稍后检查状态
  async_status:
    jid: "{{ backup_job.ansible_job_id }}"
  register: job_result
  until: job_result.finished
  retries: 60
  delay: 30

# callback_plugins/slack_notify.py
from ansible.plugins.callback import CallbackBase
import requests

class CallbackModule(CallbackBase):
    CALLBACK_VERSION = 2.0
    CALLBACK_TYPE = 'notification'
    CALLBACK_NAME = 'slack_notify'
    
    def __init__(self):
        super().__init__()
        self.failed_hosts = []
    
    def v2_runner_on_failed(self, result, ignore_errors=False):
        if not ignore_errors:
            self.failed_hosts.append(result._host.get_name())
    
    def v2_playbook_on_stats(self, stats):
        if self.failed_hosts:
            self._send_slack_alert(self.failed_hosts)
    
    def _send_slack_alert(self, hosts):
        webhook_url = "https://hooks.slack.com/..."
        payload = {"text": f"Ansible 失败: {', '.join(hosts)}"}
        requests.post(webhook_url, json=payload)

import re

class CallbackModule(CallbackBase):
    SENSITIVE_PATTERNS = [
        r'password["\']?\s*[:=]\s*["\']?[^"\'}\s]+',
        r'-----BEGIN[A-Z ]+-----[\s\S]+?-----END[A-Z ]+-----',
        r'api[_-]?key["\']?\s*[:=]\s*["\']?[A-Za-z0-9]{20,}',
    ]
    
    def _sanitize(self, data):
        if isinstance(data, dict):
            return {k: self._sanitize(v) for k, v in data.items()}
        elif isinstance(data, str):
            for pattern in self.SENSITIVE_PATTERNS:
                data = re.sub(pattern, '[REDACTED]', data, flags=re.IGNORECASE)
            return data
        return data
    
    def v2_runner_on_ok(self, result):
        sanitized = self._sanitize(result._result)
        # 发送 sanitized 数据到日志系统

- name: 从 Vault 获取密码
  debug:
    msg: "{{ lookup('hashi_vault', 'secret/data/db:password') }}"

- name: 读取文件内容
  debug:
    msg: "{{ lookup('file', '/path/to/file') }}"

- name: 查询环境变量
  debug:
    msg: "{{ lookup('env', 'HOME') }}"

# ansible.cfg
[defaults]
callbacks_enabled = profile_tasks, timer
callback_whitelist = profile_tasks, timer

PLAY RECAP ******************************************************
Friday 17 January 2025  10:23:45 +0000 (0:00:05.123)    0:02:34.567 ******
===============================================================================
Install packages ------------------------------------------ 45.23s
Deploy configuration -------------------------------------- 12.45s
Restart service -------------------------------------------- 5.12s
Gathering Facts -------------------------------------------- 3.21s

callbacks_enabled = profile_tasks, profile_roles, timer

# 显示详细执行信息
ansible-playbook site.yml -vvv

# 显示 SSH 连接详情
ansible-playbook site.yml -vvvv

# 仅对特定任务启用调试
ansible-playbook site.yml -v --start-at-task="Deploy configuration"

#!/usr/bin/env python3
# analyze_timing.py - 分析 Ansible JSON 日志

import json
import sys
from collections import defaultdict

def analyze_log(log_file):
    with open(log_file) as f:
        data = json.load(f)
    
    task_times = defaultdict(list)
    host_times = defaultdict(float)
    
    for play in data.get('plays', []):
        for task in play.get('tasks', []):
            task_name = task.get('task', {}).get('name', 'Unknown')
            for host, result in task.get('hosts', {}).items():
                duration = result.get('duration', {})
                elapsed = duration.get('end', 0) - duration.get('start', 0)
                task_times[task_name].append(elapsed)
                host_times[host] += elapsed
    
    print("=== Top 10 Slowest Tasks ===")
    sorted_tasks = sorted(
        [(name, sum(times)/len(times)) for name, times in task_times.items()],
        key=lambda x: x[1],
        reverse=True
    )[:10]
    for name, avg_time in sorted_tasks:
        print(f"  {avg_time:.2f}s - {name}")
    
    print("\n=== Slowest Hosts ===")
    sorted_hosts = sorted(host_times.items(), key=lambda x: x[1], reverse=True)[:10]
    for host, total_time in sorted_hosts:
        print(f"  {total_time:.2f}s - {host}")

if __name__ == "__main__":
    analyze_log(sys.argv[1])

# ansible.cfg
[defaults]
callbacks_enabled = json
log_path = /var/log/ansible/ansible.json

- name: Monitor controller resources
  local_action:
    module: shell
    cmd: "ps -o rss,vsz,pid,comm -p {{ ansible_pid }} | tail -1"
  register: controller_mem
  run_once: true
  delegate_to: localhost
  tags: [debug]

# 测量到每个主机的 SSH 延迟
- name: Measure SSH latency
  shell: "echo 'latency test'"
  register: latency_test
  changed_when: false

- name: Report slow hosts
  debug:
    msg: "Host {{ inventory_hostname }} response time: {{ latency_test.delta }}"
  when: latency_test.delta | float > 2.0

# 模块传输大小 (典型)
# - 小模块 (ping, debug): ~10KB
# - 中等模块 (yum, apt): ~50KB
# - 大模块 (包含复杂逻辑): ~200KB

# 带宽计算
# 500 hosts * 50KB * 10 tasks = 250MB 数据传输
# 在 100Mbps 网络上约需 20 秒

# 工作流示例: 蓝绿部署
graph TD
    Backup["备份当前环境"] --> Deploy["部署新版本"]
    Deploy --> Test["运行测试"]
    Test --> |成功| Switch["切换流量"]
    Test --> |失败| Rollback["回滚"]

# inventory/aws_ec2.yml
plugin: amazon.aws.aws_ec2
regions:
  - us-east-1
  - us-west-2
filters:
  tag:Environment: production
keyed_groups:
  - key: tags.Role
    prefix: role
  - key: placement.availability_zone
    prefix: az

# inventory/consul.yml
plugin: community.general.consul
host: consul.example.com
port: 8500
services:
  - web
  - api
  - database