Week 07: 事件驱动架构 (EDA) 与混合云编排

# rulebook.yml
---
- name: 监控告警自愈
  hosts: all
  sources:
    - ansible.eda.alertmanager:
        host: 0.0.0.0
        port: 5001
        data_alerts_path: alerts
  
  rules:
    - name: 服务宕机自动重启
      condition: >
        event.alert.labels.alertname == "ServiceDown" and
        event.alert.labels.severity == "critical"
      action:
        run_playbook:
          name: playbooks/restart_service.yml
          extra_vars:
            target_host: "{{ event.alert.labels.instance }}"
            service_name: "{{ event.alert.labels.service }}"
    
    - name: 磁盘空间告警清理
      condition: event.alert.labels.alertname == "DiskSpaceLow"
      action:
        run_playbook:
          name: playbooks/cleanup_disk.yml

{
  "alert": {
    "labels": {
      "alertname": "ServiceDown",
      "instance": "web-01.example.com",
      "service": "nginx",
      "severity": "critical"
    },
    "annotations": {
      "summary": "Nginx 服务宕机"
    }
  }
}

# rulebook.yml - 带去重的规则
---
- name: 带去重的事件处理
  hosts: all
  sources:
    - ansible.eda.alertmanager:
        host: 0.0.0.0
        port: 5001
  
  rules:
    - name: 去重处理服务告警
      condition: event.alert.labels.alertname == "ServiceDown"
      action:
        run_playbook:
          name: playbooks/remediate.yml
          extra_vars:
            alert_fingerprint: "{{ event.alert.fingerprint }}"
      throttle:
        # 相同 fingerprint 的事件在 5 分钟内仅触发一次
        group_by:
          - event.alert.fingerprint
        once_within: 5 minutes

rules:
  - name: 抑制告警风暴
    condition: event.alert.labels.alertname is defined
    throttle:
      group_by:
        - event.alert.labels.alertname
      once_within: 1 minute
      max_events: 10  # 同类告警最多处理 10 个
    action:
      run_playbook:
        name: playbooks/handle_alert.yml

  - name: 聚合告警
    condition: |
      events.host_alerts is defined and
      events.host_alerts | length > 5
    action:
      run_playbook:
        name: playbooks/handle_mass_outage.yml
        extra_vars:
          affected_hosts: "{{ events.host_alerts | map(attribute='labels.instance') | list }}"

# eda-deployment.yaml
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: eda-controller
  labels:
    app: eda
spec:
  replicas: 2
  selector:
    matchLabels:
      app: eda
  template:
    metadata:
      labels:
        app: eda
    spec:
      containers:
        - name: eda
          image: quay.io/ansible/eda-server:latest
          ports:
            - containerPort: 5001
          env:
            - name: EDA_REDIS_HOST
              value: "redis-service"
            - name: EDA_DEDUP_ENABLED
              value: "true"
          volumeMounts:
            - name: rulebooks
              mountPath: /opt/eda/rulebooks
          resources:
            limits:
              memory: "512Mi"
              cpu: "500m"
            requests:
              memory: "256Mi"
              cpu: "100m"
          livenessProbe:
            httpGet:
              path: /health
              port: 5001
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /ready
              port: 5001
            initialDelaySeconds: 5
            periodSeconds: 5
      volumes:
        - name: rulebooks
          configMap:
            name: eda-rulebooks
---
apiVersion: v1
kind: Service
metadata:
  name: eda-service
spec:
  selector:
    app: eda
  ports:
    - protocol: TCP
      port: 5001
      targetPort: 5001
  type: ClusterIP

# Prometheus ServiceMonitor
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: eda-monitor
spec:
  selector:
    matchLabels:
      app: eda
  endpoints:
    - port: metrics
      interval: 30s
      path: /metrics

# 加密 vars 文件
sops --encrypt --age $(age-keygen -y key.txt) vars/secrets.yml > vars/secrets.enc.yml

# 解密并运行
sops --decrypt vars/secrets.enc.yml | ansible-playbook -e @/dev/stdin playbook.yml

# .sops.yaml
creation_rules:
  - path_regex: .*secrets.*\.yml$
    age: age1xxxxxxxxx
    
  - path_regex: .*prod.*\.yml$
    kms: arn:aws:kms:us-east-1:xxx:key/xxx

# lookup 插件方式
- name: 获取加密的数据库密码
  set_fact:
    db_password: "{{ lookup('community.sops.sops', 'secrets.enc.yml') | from_yaml }}"

resource "aws_instance" "web" {
  ami           = "ami-xxx"
  instance_type = "t3.medium"
  
  provisioner "local-exec" {
    command = <<EOT
      ANSIBLE_HOST_KEY_CHECKING=False \
      ansible-playbook -i '${self.public_ip},' \
        --private-key ${var.ssh_key_path} \
        -u ec2-user \
        configure.yml
    EOT
  }
}

# inventory/terraform.yml
plugin: cloud.terraform.terraform_provider
project_path: ../terraform

# 从 Terraform State 生成清单
ansible-inventory -i inventory/terraform.yml --list

# 安装
go install github.com/adammck/terraform-inventory@latest

# 使用
TF_STATE=terraform.tfstate ansible-playbook -i $(which terraform-inventory) playbook.yml

{
  "builders": [{
    "type": "amazon-ebs",
    "ami_name": "app-{{timestamp}}"
  }],
  "provisioners": [{
    "type": "ansible",
    "playbook_file": "configure.yml"
  }]
}

ansible-pull -U https://github.com/org/ansible-config.git local.yml

#cloud-config
packages:
  - git
  - ansible

runcmd:
  - ansible-pull -U https://github.com/org/config.git -C main local.yml

# local.yml
- hosts: localhost
  connection: local
  tasks:
    - name: 配置 ansible-pull cron
      cron:
        name: "Ansible Pull"
        minute: "*/15"
        job: >
          /usr/bin/ansible-pull 
          -U https://github.com/org/config.git 
          -C main 
          local.yml >> /var/log/ansible-pull.log 2>&1

# inventory/all.yml
plugin: constructed
strict: False
groups:
  production: "'prod' in tags"
  staging: "'staging' in tags"
  
compose:
  ansible_host: public_ip | default(private_ip)
  
sources:
  - aws_ec2.yml
  - azure_rm.yml
  - gcp_compute.yml

- name: 多云配置
  hosts: all
  tasks:
    - name: AWS 特定配置
      include_tasks: aws_specific.yml
      when: "'aws' in group_names"
    
    - name: Azure 特定配置
      include_tasks: azure_specific.yml
      when: "'azure' in group_names"
    
    - name: 通用配置
      include_tasks: common.yml