企业内网运维场景：用 n8n 落地端到端 AI Workflow

监控/工单/人工表单
  -> n8n Webhook/Form Trigger
  -> 参数校验与资产信息补全
  -> 只读日志/指标/CMDB 查询
  -> 内网 LLM / AI Agent 结构化诊断
  -> JSON Schema 校验
  -> IF/Switch 风险分级
  -> 企业微信/Slack/Teams 人工审批
  -> 只读报告归档或低风险通知
  -> Error Workflow 统一告警

[告警源/工单系统/人工入口]
  - Prometheus Alertmanager
  - Zabbix / Grafana Alerting
  - 企业微信机器人回调
  - 运维门户表单
  - n8n Form Trigger / Webhook

        |
        v

[n8n 内网编排层]
  - Webhook 或 Form Trigger
  - IF / Switch / Set / Code 节点
  - HTTP Request 查询内部只读 API
  - AI Agent 节点
  - Structured Output Parser
  - Human-in-the-loop / Send and Wait
  - Error Workflow

        |
        v

[只读上下文源]
  - CMDB 只读 API
  - Loki / Elasticsearch 日志查询 API
  - Prometheus 查询 API
  - Kubernetes 只读诊断 API
  - Runbook Markdown 仓库或知识库

        |
        v

[内网模型服务]
  - Ollama / vLLM / LM Studio / 兼容 OpenAI API 的内部网关
  - 第一阶段优先本地或内网模型
  - 禁止把生产日志、客户信息、密钥发送到公网模型

        |
        v

[人工审批与归档]
  - 企业微信 / Slack / Teams
  - 工单系统
  - n8n execution log
  - JSONL 审计文件或内部审计 API

mkdir -p /opt/n8n/local-files
cd /opt/n8n

docker volume create n8n_data

# 生成一个 32 位随机十六进制字符串作为 n8n 凭据加密密钥，并在内网密钥库中安全备份。
# openssl rand -hex 16

# 完全离线内网环境请先将镜像导入企业私有仓库，例如：registry.ops.intra/n8nio/n8n:stable
docker run -d \
  --name n8n \
  --restart unless-stopped \
  -p 127.0.0.1:5678:5678 \
  -e GENERIC_TIMEZONE="Asia/Shanghai" \
  -e TZ="Asia/Shanghai" \
  -e N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true \
  -e N8N_RUNNERS_ENABLED=true \
  -e N8N_ENCRYPTION_KEY="此处替换为生成的32位安全密钥" \
  -e WEBHOOK_URL="http://n8n.ops.intra.example.com/" \
  -v n8n_data:/home/node/.n8n \
  -v /opt/n8n/local-files:/files \
  docker.n8n.io/n8nio/n8n:stable

n8n.ops.intra.example.com {
    reverse_proxy 127.0.0.1:5678
    encode gzip

    @not_allowed not remote_ip 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
    respond @not_allowed "forbidden" 403
}

# 在内网测试机安装 Ollama 后拉取模型
ollama pull qwen2.5:14b
ollama serve

Base URL: http://llm-gateway.ops.intra.example.com/v1
API Key: 使用 n8n Credentials 保存，不写入节点文本
Model: qwen2.5-14b-instruct 或企业内部批准模型

Webhook: Alert Intake
  -> Set: Normalize Alert
  -> IF: Required Fields Valid?
      false -> Respond: Invalid Alert + Notify Submitter
      true  -> HTTP Request: Query CMDB
           -> HTTP Request: Query Metrics
           -> HTTP Request: Query Logs
           -> Set: Build AI Context
           -> AI Agent: Diagnose Incident
           -> Structured Output Parser: IncidentDiagnosisSchema
           -> IF: risk_level == critical OR action_requires_approval == true
                true  -> Human Approval: On-call Lead
                      -> IF: approved?
                           true  -> Create/Update Ticket + Notify Channel
                           false -> Mark Rejected + Notify Channel
                false -> Create Ticket + Notify Channel
           -> Respond: Diagnosis Accepted

{
  "alert_id": "ALERT-20260522-001",
  "source": "prometheus",
  "severity": "warning",
  "service": "payment-api",
  "namespace": "prod-payment",
  "cluster": "k8s-prod-a",
  "summary": "Pod restart count increased",
  "description": "payment-api restarted 5 times in 10 minutes",
  "started_at": "2026-05-22T10:20:00+08:00",
  "runbook_url": "https://wiki.intra/runbooks/payment-api-restart"
}

const input = $json;

return [{
  json: {
    alert_id: input.alert_id || input.labels?.alertname || `manual-${Date.now()}`,
    source: input.source || 'unknown',
    severity: input.severity || input.labels?.severity || 'unknown',
    service: input.service || input.labels?.service || input.app || 'unknown',
    namespace: input.namespace || input.labels?.namespace || 'default',
    cluster: input.cluster || input.labels?.cluster || 'unknown',
    summary: input.summary || input.annotations?.summary || '',
    description: input.description || input.annotations?.description || '',
    started_at: input.started_at || new Date().toISOString(),
    runbook_url: input.runbook_url || input.annotations?.runbook_url || ''
  }
}];

{{ $json.alert_id }} is not empty
AND {{ $json.service }} is not empty
AND {{ $json.summary }} is not empty
AND {{ $json.cluster }} is not empty

{
  "accepted": false,
  "reason": "missing required alert fields",
  "required_fields": ["alert_id", "service", "summary", "cluster"]
}

GET http://cmdb.ops.intra.example.com/api/v1/services/{{ $json.service }}

{
  "service": "payment-api",
  "owner": "payment-sre",
  "tier": "tier1",
  "runtime": "kubernetes",
  "repo": "git.intra/payment/payment-api",
  "dashboard": "https://grafana.intra/d/payment-api",
  "normal_replicas": 6,
  "critical_dependencies": ["postgres-payment", "redis-payment"]
}

GET http://prometheus.ops.intra.example.com/api/v1/query
query=sum(rate(container_cpu_usage_seconds_total{namespace="{{ $json.namespace }}",pod=~"{{ $json.service }}.*"}[5m]))

query=sum(increase(kube_pod_container_status_restarts_total{namespace="{{ $json.namespace }}",pod=~"{{ $json.service }}.*"}[15m]))

GET http://loki.ops.intra.example.com/loki/api/v1/query_range
query={namespace="{{ $json.namespace }}", app="{{ $json.service }}"} |= "ERROR"
limit=50

function maskSecrets(text) {
  return text
    .replace(/Bearer\s+[A-Za-z0-9._\-]+/g, 'Bearer ***')
    .replace(/password=[^\s&]+/gi, 'password=***')
    .replace(/token=[^\s&]+/gi, 'token=***')
    .replace(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, '***@***');
}

return items.map(item => ({
  json: {
    ...item.json,
    sanitized_logs: maskSecrets(JSON.stringify(item.json.logs || []))
  }
}));

你是企业内网运维 AI 助手。你的任务是基于已提供的告警、CMDB、指标、日志和 Runbook 摘要，输出结构化初步诊断。

硬性规则：
1. 不要编造未提供的指标、日志、命令执行结果或生产事实。
2. 不要建议直接执行破坏性操作，例如 delete、drop、truncate、force、批量 kill、生产发布、数据库 DDL。
3. 所有生产变更类动作必须标记 action_requires_approval=true。
4. 如果证据不足，必须输出 confidence<=0.5，并列出 missing_context。
5. 输出必须符合 JSON Schema，不要输出 Markdown。
6. 建议优先级：先止血、再定位、再修复、最后复盘。
7. 如果涉及客户数据、密钥或隐私，必须标记 data_sensitivity="high"。

告警：
{{ JSON.stringify($json.alert, null, 2) }}

CMDB：
{{ JSON.stringify($json.cmdb, null, 2) }}

指标摘要：
{{ JSON.stringify($json.metrics, null, 2) }}

日志摘要：
{{ $json.sanitized_logs }}

Runbook 摘要：
{{ $json.runbook_excerpt }}

请给出结构化诊断、风险等级、建议动作、需要人工确认的地方和下一步检查项。

{
  "type": "object",
  "properties": {
    "incident_type": {
      "type": "string",
      "enum": ["pod_restart", "high_cpu", "high_memory", "db_slow_query", "network_error", "unknown"]
    },
    "risk_level": {
      "type": "string",
      "enum": ["low", "medium", "high", "critical"]
    },
    "confidence": {
      "type": "number",
      "minimum": 0,
      "maximum": 1
    },
    "summary": {
      "type": "string"
    },
    "evidence": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "likely_causes": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "recommended_actions": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "action": { "type": "string" },
          "risk": { "type": "string", "enum": ["read_only", "low", "medium", "high"] },
          "requires_approval": { "type": "boolean" },
          "expected_result": { "type": "string" },
          "rollback": { "type": "string" }
        },
        "required": ["action", "risk", "requires_approval", "expected_result", "rollback"]
      }
    },
    "missing_context": {
      "type": "array",
      "items": { "type": "string" }
    },
    "data_sensitivity": {
      "type": "string",
      "enum": ["low", "medium", "high"]
    },
    "action_requires_approval": {
      "type": "boolean"
    }
  },
  "required": [
    "incident_type",
    "risk_level",
    "confidence",
    "summary",
    "evidence",
    "likely_causes",
    "recommended_actions",
    "missing_context",
    "data_sensitivity",
    "action_requires_approval"
  ]
}

{
  "incident_type": "pod_restart",
  "risk_level": "medium",
  "confidence": 0.78,
  "summary": "payment-api 在 15 分钟内多次重启，日志中出现数据库连接池耗尽，CMDB 显示该服务依赖 postgres-payment。",
  "evidence": [
    "restart increase over 15m = 5",
    "logs contain connection pool exhausted",
    "service tier=tier1 and normal_replicas=6"
  ],
  "likely_causes": [
    "数据库连接池耗尽导致健康检查失败",
    "上游流量突增导致连接占用时间延长"
  ],
  "recommended_actions": [
    {
      "action": "检查 postgres-payment 当前连接数和慢查询，不做写操作",
      "risk": "read_only",
      "requires_approval": false,
      "expected_result": "确认连接数是否接近上限，以及是否存在慢查询堆积",
      "rollback": "无生产变更"
    },
    {
      "action": "如确认连接池耗尽，建议由值班负责人审批后临时扩容 payment-api 副本数",
      "risk": "medium",
      "requires_approval": true,
      "expected_result": "降低单 Pod 连接压力并缓解错误率",
      "rollback": "恢复原 replica 数"
    }
  ],
  "missing_context": [
    "最近一次发布记录",
    "数据库当前 max_connections 配置"
  ],
  "data_sensitivity": "medium",
  "action_requires_approval": true
}

【AI 运维建议待审批】
告警：{{ $json.alert_id }}
服务：{{ $json.service }} / {{ $json.namespace }} / {{ $json.cluster }}
风险等级：{{ $json.risk_level }}
置信度：{{ $json.confidence }}

建议动作：
{{ JSON.stringify($json.recommended_actions, null, 2) }}

证据：
{{ $json.evidence.join('\n') }}

请审批：Approve / Reject

{
  "status": "rejected_by_human",
  "next_step": "请值班人员手动处理，AI 不再继续推进动作",
  "audit_required": true
}

Error Trigger
  -> Set: Normalize Error
  -> HTTP Request: Send to 企业微信/Slack/Teams
  -> HTTP Request: Write Audit Event

【n8n Workflow 执行失败】
Workflow: {{ $json.workflow.name }}
Execution: {{ $env.N8N_EDITOR_BASE_URL }}/workflow/{{ $json.workflow.id }}/executions/{{ $json.execution.id }}
Last node: {{ $json.execution.lastNodeExecuted }}
Error: {{ $json.execution.error.message }}

处理建议：
1. 先打开 execution URL 查看失败节点输入输出。
2. 如果失败在模型节点，检查模型网关超时/限流。
3. 如果失败在 HTTP Request，检查目标系统可达性和凭证有效性。
4. 如果失败在 Structured Output Parser，检查模型是否返回了非 JSON。

{
  "alert_id": "K8S-RESTART-001",
  "source": "prometheus",
  "severity": "warning",
  "service": "order-api",
  "namespace": "prod-order",
  "cluster": "k8s-prod-a",
  "summary": "order-api pod restarted frequently",
  "description": "restart count increased by 6 in 10 minutes",
  "started_at": "2026-05-22T11:00:00+08:00"
}

Webhook
  -> Normalize Alert
  -> HTTP Request: CMDB service lookup
  -> HTTP Request: Prometheus restart query
  -> HTTP Request: Loki error logs query
  -> AI Agent + Structured Output Parser
  -> IF risk high?
  -> Human Approval or Notify Channel

{
  "alert_id": "DB-SLOW-001",
  "source": "grafana",
  "severity": "critical",
  "service": "billing-api",
  "database": "postgres-billing",
  "summary": "database active connections above threshold",
  "description": "active connections > 90% for 5 minutes",
  "started_at": "2026-05-22T11:10:00+08:00"
}

{
  "active_connections": 185,
  "max_connections": 200,
  "top_queries": [
    {
      "query_id": "q123",
      "avg_time_ms": 3200,
      "calls": 142,
      "sample": "select * from invoice where status = ? order by created_at desc"
    }
  ],
  "locks": [],
  "replication_lag_seconds": 0
}

{
  "incident_type": "db_slow_query",
  "risk_level": "critical",
  "confidence": 0.74,
  "summary": "billing-api 连接数接近上限，top query 显示 invoice 查询耗时高且调用频繁。",
  "recommended_actions": [
    {
      "action": "DBA 只读检查 q123 的执行计划和索引命中情况",
      "risk": "read_only",
      "requires_approval": false,
      "expected_result": "确认慢查询是否由缺索引或过滤条件导致",
      "rollback": "无生产变更"
    },
    {
      "action": "暂停低优先级账单批处理任务 15 分钟",
      "risk": "medium",
      "requires_approval": true,
      "expected_result": "释放连接并降低业务请求失败率",
      "rollback": "恢复批处理调度"
    }
  ]
}

{
  "change_id": "CHG-20260522-008",
  "service": "inventory-api",
  "namespace": "prod-inventory",
  "deploy_time": "2026-05-22T22:00:00+08:00",
  "change_summary": "upgrade inventory-api from v1.8.2 to v1.9.0",
  "rollback_plan": "rollback image tag to v1.8.2 and restart deployment",
  "risk_notes": "includes database migration for new column"
}

Form Trigger: Change Review Form
  -> Validate Required Fields
  -> HTTP Request: CMDB service dependencies
  -> HTTP Request: Recent incidents for service
  -> HTTP Request: Deployment freeze calendar
  -> AI Agent: Change Risk Review
  -> Structured Output Parser
  -> IF risk high or missing rollback?
      true -> Human Approval: SRE Lead
      false -> Create Review Comment

{
  "change_risk": "low|medium|high|blocker",
  "release_window_ok": true,
  "rollback_plan_ok": true,
  "dependency_risks": ["string"],
  "required_prechecks": ["string"],
  "approval_required": true,
  "block_reasons": ["string"],
  "summary_for_reviewer": "string"
}

Schedule Trigger: 每天 09:00
  -> HTTP Request: 服务清单
  -> Split In Batches: 每个服务
  -> HTTP Request: 指标摘要
  -> HTTP Request: 最近 24h 告警
  -> AI Agent: Summarize Service Health
  -> Merge: 汇总所有服务
  -> AI Agent: Generate Daily Ops Report
  -> Send Message: 企业微信/Teams
  -> Write Audit: 保存报告

【每日运维巡检】2026-05-22

总体状态：黄色

重点风险：
1. payment-api 昨夜 2 次重启，已恢复，建议检查连接池。
2. billing-db 连接数长期高于 75%，建议 DBA 评估慢查询。
3. search-api P95 延迟较昨日上升 30%，建议观察索引任务。

需要人工跟进：
- CHG-20260522-008 涉及数据库迁移，回滚方案不完整。

无异常服务：
- user-api
- auth-api
- notification-api

// 采用浅拷贝，避免直接修改 n8n Code 节点中的只读 $json Proxy 对象。
const dangerous = /\b(delete|drop|truncate|force|kill\s+-9)\b|kubectl\s+delete/i;
const output = { ...$json };
const text = JSON.stringify(output.recommended_actions || []);

output.policy_violation = dangerous.test(text);
if (output.policy_violation) {
  output.action_requires_approval = true;
  output.risk_level = output.risk_level === 'critical' ? 'critical' : 'high';
}

return [{ json: output }];