全部产品
云市场

审批ACS::Approve

更新时间:2020-02-04 10:41:48

用途

在自动化运维的一些场景中,有些特殊的操作需要被特殊关注,例如删除重要资源,或使用费用较高的实例等。如果把这些操作也纳入自动化的范畴,您可能会担心失去控制,超过预算。若不纳入自动化的范畴,又会导致这些操作退化到手工执行或其他非自动化方式。审批动作能够让您在自动化和特殊关注之间寻找一个平衡。

当执行一个模板中包括审批动作,且执行到审批动作这一步时,OOS执行引擎会暂停执行,执行进入等待中状态,并发送一个包含通知的审批链接到管理员用户。在访问审批链接后,管理员可根据业务需求做出决定,同意或拒绝,同意后则OOS引擎继续执行后续任务,拒绝后引擎停止执行,执行状态为取消(Cancelled)。

语法

Webhook

对于钉钉,可以通过Webhook的方式支持。

  • YAML格式
  1. Tasks:
  2. - Name: approvalTask
  3. Action: ACS::Approve
  4. Properties:
  5. AppendExecutionLink: 'true' # 是否附加执行详情链接,可选项true和false。ACS::Approve动作默认为'true'。
  6. Approvers: ["user1", "user2" "user3"] # 待审批的RAM子账号名字。
  7. MinRequiredApprovals: 2 # 审批通过时至少需要赞同的人数。
  8. NotifyType: WebHook
  9. WebHook:
  10. URI: url # 必填,webhook地址,如https://oapi.dingtalk.com/robot/send?access_token=xxxxxx
  11. Headers: # 可选,Http请求的Headers,如Content-Type
  12. Content-Type: 'application/json; charset=utf-8'
  13. Content: # 必填,根据具体的Webhook要求提供,如钉钉webhook要求如下:https://open-doc.dingtalk.com/docs/doc.htm?treeId=257&articleId=105735&docType=1
  14. msgtype: text
  15. text:
  16. content: 'the approve notify to user' # 必填,发送审批通知的内容。
  17. at: # 在钉钉群中@的用户
  18. atMobiles: # 可选,@群里面的指定用户,此处的手机号为用户注册钉钉的手机号。
  19. - 138albb1234
  20. - 130albb1234
  21. isAtAll: 'false' # 可选,是否@所有用户,可选true 或 false,默认为false。
  • JSON格式(请参照YAML注释说明)
  1. {
  2. "Tasks": [
  3. {
  4. "Name": "approvalTask",
  5. "Action": "ACS::Approve",
  6. "Properties": {
  7. "AppendExecutionLink": "true",
  8. "Approvers": [
  9. "user1",
  10. "user2",
  11. "user3"
  12. ],
  13. "MinRequiredApprovals": 2,
  14. "NotifyType": "WebHook",
  15. "WebHook": {
  16. "URI": "url",
  17. "Headers": {
  18. "Content-Type": "application/json; charset=utf-8"
  19. },
  20. "Content": {
  21. "msgtype": "text",
  22. "text": {
  23. "content": "the approve notify to user"
  24. },
  25. "at": {
  26. "atMobiles": [
  27. "138albb1234",
  28. "130albb1234"
  29. ],
  30. "isAtAll": "false"
  31. }
  32. }
  33. }
  34. }
  35. }
  36. ]
  37. }

示例

以下模板:在删除实例前需要审批。

  • YAML格式:
  1. ---
  2. FormatVersion: OOS-2019-06-01
  3. Description:
  4. en: Bulky restarts the ECS instances with Approval.
  5. zh-cn: 批量重启ECS实例带审批。
  6. name-en: BulkyRebootInstancesWithApproval
  7. name-zh-cn: 批量重启ECS实例带审批
  8. Parameters:
  9. targets:
  10. Type: Json
  11. AssociationProperty: Targets
  12. AssociationPropertyMetadata:
  13. ResourceType: 'ALIYUN::ECS::Instance'
  14. rateControl:
  15. Description:
  16. en: Concurrency ratio of task execution.
  17. zh-cn: 任务执行的并发比率。
  18. Type: Json
  19. AssociationProperty: RateControl
  20. Default:
  21. Mode: Concurrency
  22. MaxErrors: 0
  23. Concurrency: 100%
  24. webHookUrl:
  25. Description:
  26. en: >-
  27. The webHook url of dingtalk group assistant,
  28. e.g.https://oapi.dingtalk.com/robot/send?access_token=1234zxcvaksdq31414.
  29. zh-cn: >-
  30. 钉钉群助手的webhook地址,形如https://oapi.dingtalk.com/robot/send?access_token=1234zxcvaksdq31414。
  31. Type: String
  32. atMobiles:
  33. Description:
  34. en: >-
  35. The telephone numbers of member in dingtalk group assistant @, when
  36. notify comes.
  37. zh-cn: 当群助手向钉钉群中发送审批通知时,要被@的群成员注册钉钉所用手机号。
  38. Type: List
  39. Default:
  40. - '12345678901'
  41. atAll:
  42. Description:
  43. en: 'assistant @ all members in dingtalk group or not, when notify comes.'
  44. zh-cn: 当群助手向钉钉群中发送审批通知时是否@所有人。
  45. Type: String
  46. Default: 'false'
  47. OOSAssumeRole:
  48. Description:
  49. en: The RAM role to be assumed by OOS.
  50. zh-cn: OOS扮演的RAM角色。
  51. Type: String
  52. Default: OOSServiceRole
  53. RamRole: '{{ OOSAssumeRole }}'
  54. Tasks:
  55. - Name: getInstance
  56. Description:
  57. en: Views the ECS instances.
  58. zh-cn: 获取ECS实例。
  59. Action: 'ACS::SelectTargets'
  60. Properties:
  61. ResourceType: 'ALIYUN::ECS::Instance'
  62. Filters:
  63. - '{{ targets }}'
  64. Outputs:
  65. instanceIds:
  66. Type: List
  67. ValueSelector: 'Instances.Instance[].InstanceId'
  68. instanceNames:
  69. Type: List
  70. ValueSelector: 'Instances.Instance[].InstanceName'
  71. - Name: approveRestart
  72. Action: 'ACS::Approve'
  73. Properties:
  74. NotifyType: WebHook
  75. WebHook:
  76. URI: '{{webhookUrl}}'
  77. Headers:
  78. Content-Type: application/json
  79. Content:
  80. msgtype: text
  81. text:
  82. content: >-
  83. Notify: please approve instances restart, instance names to
  84. approve are {{getInstance.instanceNames}}, sent by
  85. {{ACS::RegionId}} oos {{ACS::ExecutionId}}.
  86. at:
  87. atMobiles: '{{atMobiles}}'
  88. isAtAll: '{{atAll}}'
  89. - Name: rebootInstance
  90. Action: 'ACS::ECS::RebootInstance'
  91. Description:
  92. en: Restarts the ECS instances.
  93. zh-cn: 重启实例。
  94. Properties:
  95. instanceId: '{{ ACS::TaskLoopItem }}'
  96. Loop:
  97. RateControl: '{{ rateControl }}'
  98. Items: '{{ getInstance.instanceIds }}'
  99. Outputs:
  100. instanceIds:
  101. Type: List
  102. Value: '{{ getInstance.instanceIds }}'
  • JSON格式:
  1. {
  2. "FormatVersion": "OOS-2019-06-01",
  3. "Description": {
  4. "en": "Bulky restarts the ECS instances with Approval.",
  5. "zh-cn": "批量重启ECS实例带审批。",
  6. "name-en": "BulkyRebootInstancesWithApproval",
  7. "name-zh-cn": "批量重启ECS实例带审批"
  8. },
  9. "Parameters": {
  10. "targets": {
  11. "Type": "Json",
  12. "AssociationProperty": "Targets",
  13. "AssociationPropertyMetadata": {
  14. "ResourceType": "ALIYUN::ECS::Instance"
  15. }
  16. },
  17. "rateControl": {
  18. "Description": {
  19. "en": "Concurrency ratio of task execution.",
  20. "zh-cn": "任务执行的并发比率。"
  21. },
  22. "Type": "Json",
  23. "AssociationProperty": "RateControl",
  24. "Default": {
  25. "Mode": "Concurrency",
  26. "MaxErrors": 0,
  27. "Concurrency": "100%"
  28. }
  29. },
  30. "webHookUrl": {
  31. "Description": {
  32. "en": "The webHook url of dingtalk group assistant, e.g.https://oapi.dingtalk.com/robot/send?access_token=1234zxcvaksdq31414.",
  33. "zh-cn": "钉钉群助手的webhook地址,形如https://oapi.dingtalk.com/robot/send?access_token=1234zxcvaksdq31414。"
  34. },
  35. "Type": "String"
  36. },
  37. "atMobiles": {
  38. "Description": {
  39. "en": "The telephone numbers of member in dingtalk group assistant @, when notify comes.",
  40. "zh-cn": "当群助手向钉钉群中发送审批通知时,要被@的群成员注册钉钉所用手机号。"
  41. },
  42. "Type": "List",
  43. "Default": [
  44. "12345678901"
  45. ]
  46. },
  47. "atAll": {
  48. "Description": {
  49. "en": "assistant @ all members in dingtalk group or not, when notify comes.",
  50. "zh-cn": "当群助手向钉钉群中发送审批通知时是否@所有人。"
  51. },
  52. "Type": "String",
  53. "Default": "false"
  54. },
  55. "OOSAssumeRole": {
  56. "Description": {
  57. "en": "The RAM role to be assumed by OOS.",
  58. "zh-cn": "OOS扮演的RAM角色。"
  59. },
  60. "Type": "String",
  61. "Default": "OOSServiceRole"
  62. }
  63. },
  64. "RamRole": "{{ OOSAssumeRole }}",
  65. "Tasks": [
  66. {
  67. "Name": "getInstance",
  68. "Description": {
  69. "en": "Views the ECS instances.",
  70. "zh-cn": "获取ECS实例。"
  71. },
  72. "Action": "ACS::SelectTargets",
  73. "Properties": {
  74. "ResourceType": "ALIYUN::ECS::Instance",
  75. "Filters": [
  76. "{{ targets }}"
  77. ]
  78. },
  79. "Outputs": {
  80. "instanceIds": {
  81. "Type": "List",
  82. "ValueSelector": "Instances.Instance[].InstanceId"
  83. },
  84. "instanceNames": {
  85. "Type": "List",
  86. "ValueSelector": "Instances.Instance[].InstanceName"
  87. }
  88. }
  89. },
  90. {
  91. "Name": "approveRestart",
  92. "Action": "ACS::Approve",
  93. "Properties": {
  94. "NotifyType": "WebHook",
  95. "WebHook": {
  96. "URI": "{{webhookUrl}}",
  97. "Headers": {
  98. "Content-Type": "application/json"
  99. },
  100. "Content": {
  101. "msgtype": "text",
  102. "text": {
  103. "content": "Notify: please approve instances restart, instance names to approve are {{getInstance.instanceNames}}, sent by {{ACS::RegionId}} oos {{ACS::ExecutionId}}."
  104. },
  105. "at": {
  106. "atMobiles": "{{atMobiles}}",
  107. "isAtAll": "{{atAll}}"
  108. }
  109. }
  110. }
  111. }
  112. },
  113. {
  114. "Name": "rebootInstance",
  115. "Action": "ACS::ECS::RebootInstance",
  116. "Description": {
  117. "en": "Restarts the ECS instances.",
  118. "zh-cn": "重启实例。"
  119. },
  120. "Properties": {
  121. "instanceId": "{{ ACS::TaskLoopItem }}"
  122. },
  123. "Loop": {
  124. "RateControl": "{{ rateControl }}",
  125. "Items": "{{ getInstance.instanceIds }}"
  126. }
  127. }
  128. ],
  129. "Outputs": {
  130. "instanceIds": {
  131. "Type": "List",
  132. "Value": "{{ getInstance.instanceIds }}"
  133. }
  134. }
  135. }