1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# 1. 创建 PV 和 VG
# 使用 parted 处理 GPT 分区 (fdisk 不支持 >2TB)
parted /dev/sdb mklabel gpt
parted /dev/sdb mkpart primary 0% 100%
parted /dev/sdb set 1 lvm on

pvcreate /dev/sdb1
vgcreate vg_data /dev/sdb1

# 2. 创建逻辑卷 (LV)
# 修正：不建议初次分配所有空间，预留 20% 给快照或紧急扩容
lvcreate -L 800G -n lv_mysql vg_data
lvcreate -L 200G -n lv_redis vg_data
lvcreate -L 500G -n lv_logs vg_data

# 3. 格式化与挂载
# 修正：CentOS 7/8 推荐 XFS (格式化快、支持大文件)
mkfs.xfs /dev/vg_data/lv_mysql
mkfs.xfs /dev/vg_data/lv_redis

# 4. /etc/fstab 挂载参数优化
# noatime: 读取文件不更新 access time，减少 IO
# nodiratime: 不更新目录 access time
/dev/mapper/vg_data-lv_mysql  /data/mysql   xfs  defaults,noatime,nodiratime,inode64 0 0

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# --- 内存管理 ---
# 尽量少用 Swap，但设为 1 防止 OOM 立即杀进程 (0 在某些内核版本有 Bug)
vm.swappiness = 1
# 允许分配超过物理内存 (Redis RDB 或 Java 应用必备)
vm.overcommit_memory = 1

# --- 网络栈 (防 SYN Flood 与 高并发) ---
# 全连接队列长度 (Socket Listen 队列)
net.core.somaxconn = 65535
# 半连接队列长度 (SYN 队列)
net.ipv4.tcp_max_syn_backlog = 65535

# --- TCP 连接复用 ---
# 允许将 TIME_WAIT socket 用于新的 TCP 连接
net.ipv4.tcp_tw_reuse = 1
# 警告：必须关闭 tcp_tw_recycle，在 NAT 环境下会导致连接失败
net.ipv4.tcp_tw_recycle = 0
# 缩短 FIN 等待时间
net.ipv4.tcp_fin_timeout = 15

# --- 端口范围 ---
net.ipv4.ip_local_port_range = 1024 65535

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# 1. 默认区域设置
firewall-cmd --set-default-zone=public

# 2. 开放 SSH 运维端口 (非 22)
firewall-cmd --permanent --add-port=22888/tcp
firewall-cmd --permanent --remove-service=ssh

# 3. 开放 Web 服务
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https

# 4. 信任内部网段 (如数据库访问)
# 允许 192.168.10.0/24 网段的所有访问
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.10.0/24" accept'

# 5. 生效配置
firewall-cmd --reload

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

user nginx;
# 自动匹配 CPU 核心数，减少进程切换
worker_processes auto;
# 绑定 CPU 亲和性
worker_cpu_affinity auto;

# 文件句柄限制 (需配合 ulimit -n)
worker_rlimit_nofile 65535;

events {
    # Linux 必选 epoll
    use epoll;
    # 单个 Worker 最大连接
    worker_connections 65535;
    # 收到新连接通知时，尽可能多地接受连接
    multi_accept on;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

http {
    upstream backend_server {
        # 负载均衡算法：最少连接数 (适合长连接服务)
        least_conn;
        
        # 生产级被动检查配置：
        # 30秒内失败 3 次，则暂停分发请求 30 秒
        server 192.168.1.101:8080 weight=5 max_fails=3 fail_timeout=30s;
        server 192.168.1.102:8080 weight=5 max_fails=3 fail_timeout=30s;
        
        # Keepalive 连接池 (对后端保持长连接，减少握手消耗)
        keepalive 300;
    }
    
    server {
        location /api/ {
            proxy_pass http://backend_server;
            # 必须配置，否则 keepalive 不生效
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

[mysqld]
# 8.0 默认认证插件改为 caching_sha2_password，旧客户端可能连不上
# 兼容配置：
default_authentication_plugin = mysql_native_password

# Binlog 设置
log_bin = mysql-bin
binlog_format = ROW
# 8.0 新参数，单位秒 (此处为7天)，取代 expire_logs_days
binlog_expire_logs_seconds = 604800
server_id = 101
gtid_mode = ON
enforce_gtid_consistency = ON

# InnoDB 优化
# 物理内存的 70-80%
innodb_buffer_pool_size = 12G
# 刷盘策略：1=最安全(每次提交刷盘)，2=高性能(每秒刷盘，宕机丢1秒)
innodb_flush_log_at_trx_commit = 1
# Redo Log 刷盘方式，Linux 下推荐 O_DIRECT 绕过文件系统缓存
innodb_flush_method = O_DIRECT

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# 定义变量
BACKUP_ROOT="/data/backup"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
TARGET_DIR="${BACKUP_ROOT}/full_${TIMESTAMP}"

# 执行备份 (使用 xtrabackup 命令)
# --no-lock 参数在 8.0 中已变更行为，工具会自动处理锁，通常不需要手动加
xtrabackup --backup \
  --user=backup_ops \
  --password='ComplexPassword123!' \
  --target-dir=${TARGET_DIR} \
  --datadir=/data/mysql/data \
  --compress --parallel=4

# 备份预处理 (Prepare) - 恢复前必须执行，也可在恢复时执行
# xtrabackup --prepare --target-dir=${TARGET_DIR}

1
2
3
4
5
6
7
8

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
  # 关键配置：必须使用 systemd 作为 cgroup 驱动，否则 kubelet 启动失败
  [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
    SystemdCgroup = true

[plugins."io.containerd.grpc.v1.cri"]
  # 替换为国内镜像源 (阿里云/腾讯云)，解决 pause 镜像拉取失败问题
  sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.9"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

#!/bin/bash
# ==========================================
# Description: 生产级自动化脚本模板
# Author: DevOps Team
# ==========================================

# --- 严格模式 (Safety First) ---
set -o errexit   # 遇到任何错误立即退出 (等同 set -e)
set -o nounset   # 使用未定义变量时报错 (等同 set -u)
set -o pipefail  # 管道中只要有一个命令失败，整个管道视为失败

# --- 全局变量 ---
readonly LOG_FILE="/var/log/ops_script.log"
readonly DATE_TAG=$(date +%Y-%m-%d)

# --- 日志函数 ---
log_info() {
    echo "[INFO] $(date '+%Y-%m-%d %H:%M:%S') $1" | tee -a "$LOG_FILE"
}

log_error() {
    echo "[ERROR] $(date '+%Y-%m-%d %H:%M:%S') $1" | tee -a "$LOG_FILE" >&2
}

# --- 错误捕获与清理 ---
cleanup() {
    # 脚本退出时（无论成功失败）都会执行
    rm -f /tmp/script.lock
    log_info "Script finished or interrupted. Cleanup done."
}
trap cleanup EXIT

# --- 主逻辑 ---
main() {
    log_info "Starting backup process..."
    
    # 检查 root 权限
    if [[ $EUID -ne 0 ]]; then
       log_error "This script must be run as root"
       exit 1
    fi
    
    # 业务逻辑...
}

main "$@"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

# 阶段一：构建环境 (Build Stage)
FROM maven:3.8-jdk-11 AS builder
WORKDIR /app
COPY pom.xml .
RUN mvn dependency:go-offline  # 缓存依赖
COPY src ./src
RUN mvn package -DskipTests

# 阶段二：运行时环境 (Runtime Stage)
# 选用轻量级基础镜像 (如 Alpine 或 Distroless)
FROM openjdk:11-jre-slim
WORKDIR /app
# 仅复制构建产物，丢弃编译工具和源码
COPY --from=builder /app/target/app.jar /app/app.jar

# 设置时区与非 root 用户运行 (安全合规)
RUN ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && \
    useradd -m -u 1000 appuser
USER 1000

ENTRYPOINT ["java", "-jar", "app.jar"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

pipeline {
    agent any
    environment {
        HARBOR_REGISTRY = "registry.example.com"
        IMAGE_NAME = "project/backend"
        TAG = "${env.BUILD_NUMBER}"
    }
    stages {
        stage('Checkout') {
            steps { checkout scm }
        }
        stage('Build & Push') {
            steps {
                sh "docker build -t ${HARBOR_REGISTRY}/${IMAGE_NAME}:${TAG} ."
                // 需在 Jenkins 配置好 Harbor 的凭证
                withCredentials([usernamePassword(credentialsId: 'harbor-auth', usernameVariable: 'USER', passwordVariable: 'PASS')]) {
                    sh "docker login ${HARBOR_REGISTRY} -u $USER -p $PASS"
                    sh "docker push ${HARBOR_REGISTRY}/${IMAGE_NAME}:${TAG}"
                }
            }
        }
        stage('Deploy to K8s') {
            steps {
                // 使用 sed 替换 K8s yaml 中的镜像版本并应用
                sh "sed -i 's|IMAGE_TAG|${TAG}|g' k8s/deployment.yaml"
                sh "kubectl apply -f k8s/deployment.yaml"
            }
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

#!/usr/bin/env python3
import pymysql

# 配置数据库连接
db_config = {
    'host': '192.168.1.100',
    'user': 'monitor',
    'password': 'password',
    'db': 'information_schema'
}

def analyze_slow_queries():
    conn = pymysql.connect(**db_config)
    cursor = conn.cursor()
    
    # 1. 查询执行时间超过 2秒 的 TOP 10 SQL
    sql = """
    SELECT sql_text, query_time, rows_examined 
    FROM slow_log 
    WHERE query_time > '00:00:02' 
    ORDER BY query_time DESC LIMIT 10;
    """
    cursor.execute(sql)
    results = cursor.fetchall()
    
    for row in results:
        sql_text = row[0]
        # 2. 简单的 EXPLAIN 分析逻辑 (模拟)
        if "select *" in sql_text.lower():
            print(f"[优化建议] 避免全字段查询: {sql_text[:50]}...")
        if row[2] > 10000: # rows_examined
            print(f"[优化建议] 扫描行数过多({row[2]})，建议添加索引: {sql_text[:50]}...")
            
    conn.close()

if __name__ == "__main__":
    analyze_slow_queries()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

# secure_baseline.yml
- name: 等保三级主机加固
  hosts: all
  tasks:
    # 1. 密码复杂度策略 (pam_pwquality)
    - name: 设置密码复杂度
      lineinfile:
        path: /etc/security/pwquality.conf
        regexp: '^minlen'
        line: 'minlen = 12' # 最小长度12位
    
    # 2. SSH 安全配置
    - name: 禁止 root 远程登录
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PermitRootLogin'
        line: 'PermitRootLogin no'
      notify: restart sshd

    # 3. 设置会话超时 (防挂机)
    - name: 设置 TMOUT
      lineinfile:
        path: /etc/profile
        line: 'export TMOUT=300' # 5分钟无操作自动登出
        
  handlers:
    - name: restart sshd
      service:
        name: sshd
        state: restarted

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  serviceName: "mysql"
  replicas: 1
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
      - name: mysql
        image: mysql:8.0
        volumeMounts:
        - name: mysql-data
          mountPath: /var/lib/mysql
  # 关键：volumeClaimTemplates (自动创建 PVC)
  volumeClaimTemplates:
  - metadata:
      name: mysql-data
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "managed-nfs-storage" # 需提前配置 StorageClass
      resources:
        requests:
          storage: 10Gi