docs: replace architecture diagrams with Mermaid from architecture doc
This commit is contained in:
+94
-223
@@ -72,10 +72,12 @@ layout: default
|
||||
|
||||
### 五、架构图
|
||||
|
||||
- 平台分层
|
||||
- 总体分层
|
||||
- 主系统功能
|
||||
- 子系统集成
|
||||
- 自动化执行
|
||||
- 部署架构
|
||||
- 监控告警
|
||||
- 安全认证
|
||||
- 监控数据流
|
||||
|
||||
</div>
|
||||
<div>
|
||||
@@ -546,100 +548,88 @@ layout: center
|
||||
|
||||
# 四、架构设计
|
||||
|
||||
<div class="text-gray-400 mt-2">平台分层 · 部署 · 监控 · 安全</div>
|
||||
|
||||
---
|
||||
|
||||
# 平台分层架构 — 总体分层
|
||||
|
||||
<div class="mt-2">
|
||||
<div class="mt-4">
|
||||
|
||||
```mermaid
|
||||
graph LR
|
||||
User["用户层<br/>LDAP SSO 统一认证"] --> Main["主系统层<br/>统一门户 + 功能模块"]
|
||||
Main --> Sub["子系统层<br/>独立部署，各自授权"]
|
||||
Main --> Infra["基础设施层<br/>计算 · 网络 · 存储 · 自动化"]
|
||||
graph TB
|
||||
User["用户层<br/>LDAP SSO 统一认证"] --> Main["XINFRA 主系统层<br/>统一入口 + 资源纳管 + 交付 + 审计"]
|
||||
Main --> Sub["专业子系统层<br/>Wayne / Apollo / CloudDM / 夜莺"]
|
||||
Main --> Auto["自动化执行层<br/>Ansible 控制中心"]
|
||||
Main --> Infra["基础设施层<br/>计算 · 网络 · 存储 · 监控源"]
|
||||
Sub --> Infra
|
||||
Auto --> Infra
|
||||
|
||||
style User fill:#f3e8fd,stroke:#9333ea
|
||||
style Main fill:#e0f2fe,stroke:#0284c7
|
||||
style Sub fill:#e8f0fe,stroke:#4285f4
|
||||
style Infra fill:#ecfdf5,stroke:#059669
|
||||
style Auto fill:#ecfdf5,stroke:#059669
|
||||
style Infra fill:#fff7ed,stroke:#f97316
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
<div class="mt-4 text-sm text-gray-400">
|
||||
|
||||
> 四层模型：用户层 → 主系统层 → 子系统层 → 基础设施层，主系统是统一入口，子系统各司其职。
|
||||
|
||||
</div>
|
||||
|
||||
---
|
||||
|
||||
# 平台分层架构 — 主系统功能
|
||||
# 平台分层架构 — 主系统功能架构
|
||||
|
||||
<div class="mt-2">
|
||||
<div class="mt-4">
|
||||
|
||||
```mermaid
|
||||
graph TB
|
||||
Portal["统一门户<br/>LDAP SSO 跳转入口"]
|
||||
Portal["统一入口<br/>SSO 登录 + 菜单聚合"]
|
||||
|
||||
subgraph 全局视图
|
||||
DashBoard["资源大盘<br/>集群拓扑 · 节点方格图"]
|
||||
MonitorView["资源状态看板<br/>物理机/虚机/服务三层告警"]
|
||||
subgraph 自建能力
|
||||
Resource["资源纳管<br/>物理机 / 虚机 / 云主机 / K8s"]
|
||||
Cluster["K8s 集群管理<br/>Namespace / 节点 / 配额 / 业务线"]
|
||||
Delivery["基础服务交付<br/>标准模板 + Ansible 下发"]
|
||||
SqlReview["数据库审核<br/>SQL 工单"]
|
||||
Task["任务中心<br/>执行状态 / 日志 / 历史"]
|
||||
Audit["审计中心<br/>登录 / 跳转 / 操作 / 审批"]
|
||||
Monitor["监控概览<br/>夜莺聚合 + 业务线隔离"]
|
||||
RBAC["权限中心<br/>业务线 / 角色 / 人员绑定"]
|
||||
Config["配置接入<br/>Apollo 统一配置入口"]
|
||||
end
|
||||
|
||||
subgraph 运维能力
|
||||
TaskCenter["任务中心<br/>Ansible/Wayne 实时日志"]
|
||||
OpsTerminal["运维终端<br/>Ansible / SSH<br/>仅管理员"]
|
||||
subgraph 外部跳转
|
||||
Biz["业务交付<br/>Wayne / CloudDM / Apollo"]
|
||||
end
|
||||
|
||||
subgraph 治理能力
|
||||
AuditDash["审计面板<br/>登录记录 · 运维操作日志"]
|
||||
CMDB["资源台账<br/>CMDB 多云同步"]
|
||||
SvcDir["服务目录<br/>Consul 只读聚合"]
|
||||
end
|
||||
|
||||
Portal --> DashBoard & MonitorView & TaskCenter & AuditDash & CMDB & SvcDir
|
||||
Portal --> Resource & Cluster & Delivery & SqlReview & Task & Audit & Monitor & RBAC & Config & Biz
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
<div class="mt-2 text-sm text-gray-400">
|
||||
|
||||
> 主系统不替代子系统，只自建子系统无法覆盖的能力：全局视图、运维兜底、审计、资源台账。
|
||||
|
||||
</div>
|
||||
|
||||
---
|
||||
|
||||
# 平台分层架构 — 子系统集成
|
||||
# 平台分层架构 — 子系统集成关系
|
||||
|
||||
<div class="mt-2" style="transform: scale(0.5); transform-origin: top left; height: 50vh;">
|
||||
<div class="mt-4">
|
||||
|
||||
```mermaid
|
||||
graph LR
|
||||
Portal["XINFRA 主系统"]
|
||||
Main["XINFRA 主系统"]
|
||||
|
||||
subgraph 子系统
|
||||
Wayne["Wayne<br/>容器发布与配额管理"]
|
||||
CloudDM["CloudDM<br/>SQL 审核"]
|
||||
CacheCloud["CacheCloud<br/>Redis 全生命周期"]
|
||||
subgraph 跳转子系统
|
||||
Wayne["Wayne<br/>业务服务交付"]
|
||||
CloudDM["CloudDM<br/>数据库开发管理"]
|
||||
Apollo["Apollo<br/>配置中心"]
|
||||
QPass["qpass<br/>七牛运维平台"]
|
||||
Grafana["Grafana<br/>指标可视化"]
|
||||
Superset["Superset<br/>日志可视化"]
|
||||
end
|
||||
|
||||
Portal -.->|SSO 跳转| Wayne & CloudDM & CacheCloud & Apollo & QPass & Grafana & Superset
|
||||
subgraph 监控与告警
|
||||
Nightingale["夜莺<br/>告警收敛"]
|
||||
end
|
||||
|
||||
Wayne -->|Client-Go| RKE2["RKE2 集群"]
|
||||
CloudDM -->|SQL 审核| MySQL[("MySQL")]
|
||||
CacheCloud -->|Agent| Redis[("Redis")]
|
||||
Apollo -->|ConfigService| RKE2
|
||||
Grafana -->|PromQL| VM["VictoriaMetrics"]
|
||||
Superset -->|SQL| CH["ClickHouse"]
|
||||
subgraph 资源来源
|
||||
CMDB["cndb / CMDB<br/>机器与资产来源"]
|
||||
end
|
||||
|
||||
Main -.->|SSO 跳转| Wayne & CloudDM & Apollo
|
||||
Main -->|资源同步| CMDB
|
||||
Main -->|告警接入| Nightingale
|
||||
```
|
||||
|
||||
</div>
|
||||
@@ -647,31 +637,25 @@ graph LR
|
||||
|
||||
---
|
||||
|
||||
# 平台分层架构 — 基础设施层
|
||||
# 自动化执行架构
|
||||
|
||||
<div class="mt-2" style="transform: scale(0.5); transform-origin: top left; height: 50vh;">
|
||||
<div class="mt-4">
|
||||
|
||||
```mermaid
|
||||
graph TB
|
||||
subgraph 计算
|
||||
RKE2["RKE2 集群 × 7 机房<br/>CIS 安全加固"]
|
||||
Main["XINFRA 主系统"]
|
||||
AC["Ansible 控制中心<br/>独立部署"]
|
||||
|
||||
subgraph 各区域
|
||||
RegionA["区域 A"]
|
||||
RegionB["区域 B"]
|
||||
RegionC["区域 C"]
|
||||
end
|
||||
|
||||
subgraph 网络
|
||||
Calico["Calico BGP<br/>每集群独立 AS 号<br/>跨机房扁平互通"]
|
||||
end
|
||||
|
||||
subgraph 存储
|
||||
Ceph["Ceph RBD<br/>MySQL/Redis 有状态服务 PV"]
|
||||
end
|
||||
|
||||
subgraph 自动化
|
||||
Ansible["Ansible Playbook<br/>节点初始化 · 服务部署<br/>WebSocket 实时日志"]
|
||||
end
|
||||
|
||||
RKE2 --> Calico
|
||||
RKE2 --> Ceph
|
||||
Ansible -->|SSH| RKE2
|
||||
Main -->|任务提交 / 结果查询| AC
|
||||
AC -->|SSH / Playbook| RegionA
|
||||
AC -->|SSH / Playbook| RegionB
|
||||
AC -->|SSH / Playbook| RegionC
|
||||
```
|
||||
|
||||
</div>
|
||||
@@ -681,180 +665,67 @@ graph TB
|
||||
|
||||
# 部署架构
|
||||
|
||||
<div class="mt-2" style="transform: scale(0.45); transform-origin: top left; height: 50vh;">
|
||||
<div class="mt-4">
|
||||
|
||||
```mermaid
|
||||
graph TB
|
||||
subgraph "RKE2 集群（任一机房）"
|
||||
subgraph "xinfra 命名空间"
|
||||
FE["Nginx<br/>前端静态文件 + 反向代理"]
|
||||
BE["Go API Server<br/>Deployment × 2"]
|
||||
WS["WebSocket Gateway<br/>任务日志实时推送"]
|
||||
end
|
||||
|
||||
subgraph "监控命名空间"
|
||||
VM[("VictoriaMetrics")]
|
||||
Grafana["Grafana"]
|
||||
NE["Nightingale"]
|
||||
end
|
||||
|
||||
subgraph "子系统命名空间"
|
||||
Wayne["Wayne"]
|
||||
CloudDM["CloudDM"]
|
||||
CacheCloud["CacheCloud"]
|
||||
Apollo["Apollo"]
|
||||
Superset["Superset"]
|
||||
end
|
||||
subgraph "XINFRA 运行环境"
|
||||
FE["Nginx<br/>静态资源 + 反向代理"]
|
||||
BE["Go API Server<br/>资源 / 交付 / 审核 / 审计"]
|
||||
WS["WebSocket Gateway<br/>任务日志实时推送"]
|
||||
end
|
||||
|
||||
LB["SLB / NodePort"] --> FE
|
||||
FE -->|/api/*| BE
|
||||
FE -->|WebSocket| WS
|
||||
BE --> MySQL[("MySQL 8.0 主从")]
|
||||
BE --> Redis[("Redis 会话缓存")]
|
||||
BE -->|SSH/Ansible| Nodes["业务节点池"]
|
||||
WS --> BE
|
||||
subgraph "数据与状态"
|
||||
DB[("MySQL<br/>主数据 / 审计 / 任务")]
|
||||
Cache[("Redis<br/>会话 / 缓存")]
|
||||
end
|
||||
|
||||
style FE fill:#e0f2fe,stroke:#0284c7
|
||||
style BE fill:#e0f2fe,stroke:#0284c7
|
||||
style WS fill:#e0f2fe,stroke:#0284c7
|
||||
subgraph "外部系统"
|
||||
Wayne["Wayne"]
|
||||
CloudDM["CloudDM"]
|
||||
Apollo["Apollo"]
|
||||
Nightingale["夜莺"]
|
||||
AC["Ansible 控制中心"]
|
||||
end
|
||||
|
||||
LB["SLB / Ingress"] --> FE
|
||||
FE --> BE
|
||||
FE --> WS
|
||||
BE --> DB
|
||||
BE --> Cache
|
||||
BE --> Wayne & CloudDM & Apollo & Nightingale & AC
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
<!--
|
||||
Nginx 托管前端静态文件并反向代理后端 API，Go API Server 无状态水平扩展，WebSocket Gateway 独立处理实时日志推送
|
||||
-->
|
||||
|
||||
---
|
||||
|
||||
# 监控告警数据流
|
||||
# 监控与数据流
|
||||
|
||||
<div class="mt-2" style="transform: scale(0.8); transform-origin: top left; height: 50vh;">
|
||||
<div class="mt-4">
|
||||
|
||||
```mermaid
|
||||
graph LR
|
||||
subgraph 采集源
|
||||
RKE2["RKE2 集群"]
|
||||
Zabbix["Zabbix<br/>硬件监控"]
|
||||
subgraph 资源层
|
||||
K8s["K8s 集群"]
|
||||
Node["物理机 / 虚机"]
|
||||
end
|
||||
|
||||
subgraph 指标存储
|
||||
VM[("VictoriaMetrics<br/>容器/业务指标")]
|
||||
subgraph 监控源
|
||||
Nightingale["夜莺"]
|
||||
end
|
||||
|
||||
subgraph 可视化
|
||||
Grafana["Grafana 仪表盘"]
|
||||
subgraph 展示层
|
||||
Main["XINFRA 监控概览"]
|
||||
end
|
||||
|
||||
subgraph 告警链路
|
||||
Nightingale["夜莺<br/>去重 · 收敛 · 分级"]
|
||||
end
|
||||
|
||||
RKE2 -.->|Metrics| VM
|
||||
VM --> Grafana
|
||||
VM --> Nightingale
|
||||
Zabbix -.->|Webhook| Nightingale
|
||||
Zabbix -->|Zabbix API| Main["XINFRA 主系统<br/>资源状态看板"]
|
||||
K8s -.->|指标| Nightingale
|
||||
Node -.->|指标| Nightingale
|
||||
Nightingale --> Main
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
<div class="mt-58 text-sm text-gray-400">
|
||||
|
||||
> Zabbix 硬件监控分两条链路：告警事件通过 Webhook 推送至夜莺统一聚合；可观测数据（IPMI/温度/电源/风扇等）由主系统直接调用 Zabbix API 采集展示。
|
||||
|
||||
</div>
|
||||
|
||||
---
|
||||
|
||||
# 基础服务交付流程
|
||||
|
||||
<div class="mt-2">
|
||||
|
||||
```mermaid
|
||||
sequenceDiagram
|
||||
actor User as 业务人员
|
||||
participant Portal as XINFRA 服务目录
|
||||
participant Ansible as Ansible Playbook
|
||||
participant Infra as RKE2 / 主机
|
||||
participant Sub as 子系统注册
|
||||
|
||||
User->>Portal: 选择服务卡片，填写业务线、规格
|
||||
Portal->>Portal: 实时预览 playbook 参数（YAML）
|
||||
User->>Portal: 确认部署
|
||||
Portal->>Ansible: 提交 playbook 任务
|
||||
Ansible->>Infra: 内核初始化 · containerd · 加入集群
|
||||
Ansible-->>Portal: 任务状态 → WebSocket 实时日志
|
||||
Portal->>Sub: 自动注册（CloudDM / CacheCloud）
|
||||
Portal-->>User: 部署完成，跳转任务中心
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
---
|
||||
|
||||
# 多租户隔离模型
|
||||
|
||||
<div class="mt-2" style="transform: scale(1); transform-origin: top left; height: 50vh;">
|
||||
|
||||
```mermaid
|
||||
graph LR
|
||||
LDAP["企业 LDAP"] -->|部门 DN| BL["业务线租户<br/>Kodo / LAS / 灵矽 / ..."]
|
||||
|
||||
BL --> NS["Kubernetes Namespace<br/>+ ResourceQuota + LimitRange"]
|
||||
BL --> NP["物理节点池<br/>node-label + taint"]
|
||||
|
||||
NS -.->|Pod 只能调度到<br/>本业务线节点| NP
|
||||
|
||||
style LDAP fill:#f3e8fd,stroke:#9333ea
|
||||
style BL fill:#e0f2fe,stroke:#0284c7
|
||||
style NS fill:#ecfdf5,stroke:#059669
|
||||
style NP fill:#fef3c7,stroke:#d97706
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
<div class="mt-30 text-sm text-gray-400">
|
||||
|
||||
> **双重隔离**：节点层通过 `business-line=xxx` 标签 + Taint 确保 Pod 调度隔离；命名空间层通过 ResourceQuota / LimitRange 限制资源用量上限。
|
||||
|
||||
</div>
|
||||
|
||||
---
|
||||
|
||||
# 安全认证流程
|
||||
|
||||
<div class="mt-2" style="transform: scale(0.65); transform-origin: top left; height: 50vh;">
|
||||
|
||||
```mermaid
|
||||
sequenceDiagram
|
||||
actor User as 用户
|
||||
participant Main as XINFRA 主系统
|
||||
participant LDAP as 企业 LDAP
|
||||
participant Sub as 子系统
|
||||
|
||||
User->>Main: 访问主系统
|
||||
Main->>LDAP: SAML 认证请求
|
||||
LDAP-->>Main: SAML Response（用户身份 + LDAP 组信息）
|
||||
Main->>Main: 签发 JWT Token（含角色 + 业务线）
|
||||
Main-->>User: 登录成功，返回 Token
|
||||
|
||||
User->>Main: 点击子系统卡片
|
||||
Main->>Sub: OAuth 2.0 Authorization Code
|
||||
Sub->>Main: 验证 Token，创建子系统会话
|
||||
Main-->>User: 跳转至子系统（免登录）
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
<div class="mt-60 text-sm text-gray-400">
|
||||
|
||||
> 外部 LDAP 通过 SAML 集成统一认证；子系统 SSO 通过 OAuth 2.0 对接，实现单点登录免跳转。
|
||||
|
||||
</div>
|
||||
|
||||
---
|
||||
section: 对接子系统
|
||||
layout: center
|
||||
|
||||
Reference in New Issue
Block a user