Skip to content

pref: 减少redis热key的访问频率 #12488 #12552

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
carlyin0801 wants to merge 4 commits into
base: master
Choose a base branch
from
Open

pref: 减少redis热key的访问频率 #12488 #12552

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ae563dc
pref: 减少redis热key的访问频率 #12488
carlyin0801 Dec 12, 2025
aa5cb14
pref: 减少redis热key的访问频率 #12488
carlyin0801 Dec 17, 2025
d2ff6b0
pref: 减少redis热key的访问频率 #12488
carlyin0801 Dec 30, 2025
47c6972
pref: 减少redis热key的访问频率 #12488
carlyin0801 Dec 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 25 additions & 22 deletions ...eb/src/main/kotlin/com/tencent/devops/common/web/filter/RequestProjectPermissionFilter.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ import com.tencent.devops.common.redis.RedisOperation
import com.tencent.devops.common.web.RequestFilter
import com.tencent.devops.common.web.annotation.BkApiPermission
import com.tencent.devops.common.web.constant.BkApiHandleType
import com.tencent.devops.common.web.utils.BkApiUtil
import com.tencent.devops.common.web.utils.ApiAccessLimitCacheManager
import com.tencent.devops.common.web.utils.I18nUtil
import org.slf4j.LoggerFactory
import org.springframework.beans.factory.annotation.Value
Expand Down Expand Up @@ -105,17 +105,17 @@ class RequestProjectPermissionFilter(
val projectId =
(requestContext.getHeaderString(AUTH_HEADER_PROJECT_ID) ?: uriInfo.pathParameters.getFirst(KEY_PROJECT_ID)
?: uriInfo.queryParameters.getFirst(KEY_PROJECT_ID))?.toString()
// 判断项目是否在限制接口访问的列表中
if (apiProjectPermissionSwitch && !projectId.isNullOrBlank() && redisOperation.isMember(
key = BkApiUtil.getApiAccessLimitProjectsKey(),
item = projectId
)
) {
logger.info("Project[$projectId] does not have access permission for interface[$url]")
throw ErrorCodeException(
errorCode = CommonMessageCode.ERROR_PROJECT_API_ACCESS_NO_PERMISSION,
params = arrayOf(projectId, url)
)
// 判断项目是否在限制接口访问的列表中（使用 Caffeine 本地缓存整个限制列表）
if (apiProjectPermissionSwitch && !projectId.isNullOrBlank()) {
// 从缓存管理器获取整个限制列表（如果缓存未命中，会自动从 Redis 加载）
val limitSet = ApiAccessLimitCacheManager.getProjectLimitSet(redisOperation)
if (limitSet.contains(projectId)) {
logger.info("Project[$projectId] does not have access permission for interface[$url]")
throw ErrorCodeException(
errorCode = CommonMessageCode.ERROR_PROJECT_API_ACCESS_NO_PERMISSION,
params = arrayOf(projectId, url)
)
}
}
}

Expand All @@ -127,17 +127,20 @@ class RequestProjectPermissionFilter(
val pipelineId =
(requestContext.getHeaderString(AUTH_HEADER_PIPELINE_ID) ?: uriInfo.pathParameters.getFirst(KEY_PIPELINE_ID)
?: uriInfo.queryParameters.getFirst(KEY_PIPELINE_ID))?.toString()
// 判断流水线是否在限制接口访问的列表中
if (apiPipelinePermissionSwitch && !pipelineId.isNullOrBlank() && redisOperation.isMember(
key = BkApiUtil.getApiAccessLimitPipelinesKey(),
item = pipelineId
)
) {
logger.info("Pipeline[$pipelineId] does not have access permission for interface[$url]")
throw ErrorCodeException(
errorCode = CommonMessageCode.ERROR_PIPELINE_API_ACCESS_NO_PERMISSION,
params = arrayOf(pipelineId, url)
// 判断流水线是否在限制接口访问的列表中（使用缓存管理器优化）
if (apiPipelinePermissionSwitch && !pipelineId.isNullOrBlank()) {
// 使用缓存管理器检查流水线限制状态（按需缓存单个流水线状态）
val result = ApiAccessLimitCacheManager.checkPipelineLimitStatus(
redisOperation = redisOperation,
pipelineIds = arrayOf(pipelineId)
)
if (result[pipelineId] == true) {
logger.info("Pipeline[$pipelineId] does not have access permission for interface[$url]")
throw ErrorCodeException(
errorCode = CommonMessageCode.ERROR_PIPELINE_API_ACCESS_NO_PERMISSION,
params = arrayOf(pipelineId, url)
)
}
}
}
}
8 changes: 6 additions & 2 deletions ...kotlin/com/tencent/devops/common/web/service/impl/BkApiHandlePipelineAccessServiceImpl.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ import com.tencent.devops.common.api.exception.ErrorCodeException
import com.tencent.devops.common.redis.RedisOperation
import com.tencent.devops.common.service.utils.SpringContextUtil
import com.tencent.devops.common.web.service.BkApiHandleService
import com.tencent.devops.common.web.utils.BkApiUtil
import com.tencent.devops.common.web.utils.ApiAccessLimitCacheManager
import org.slf4j.LoggerFactory
import org.springframework.web.context.request.RequestContextHolder
import org.springframework.web.context.request.ServletRequestAttributes
Expand Down Expand Up @@ -63,7 +63,11 @@ class BkApiHandlePipelineAccessServiceImpl : BkApiHandleService {
}
val redisOperation: RedisOperation = SpringContextUtil.getBean(RedisOperation::class.java)
// 判断流水线是否在限制接口访问的列表中
if (redisOperation.isMember(BkApiUtil.getApiAccessLimitPipelinesKey(), pipelineId)) {
val result = ApiAccessLimitCacheManager.checkPipelineLimitStatus(
redisOperation = redisOperation,
pipelineIds = arrayOf(pipelineId)
)
if (result[pipelineId] == true) {
val requestURI = request.requestURI
logger.info("Pipeline[$pipelineId] does not have access permission for interface[$requestURI]")
throw ErrorCodeException(
Expand Down
7 changes: 4 additions & 3 deletions .../kotlin/com/tencent/devops/common/web/service/impl/BkApiHandleProjectAccessServiceImpl.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ import com.tencent.devops.common.api.exception.ErrorCodeException
import com.tencent.devops.common.redis.RedisOperation
import com.tencent.devops.common.service.utils.SpringContextUtil
import com.tencent.devops.common.web.service.BkApiHandleService
import com.tencent.devops.common.web.utils.BkApiUtil
import com.tencent.devops.common.web.utils.ApiAccessLimitCacheManager
import org.slf4j.LoggerFactory
import org.springframework.web.context.request.RequestContextHolder
import org.springframework.web.context.request.ServletRequestAttributes
Expand Down Expand Up @@ -62,8 +62,9 @@ class BkApiHandleProjectAccessServiceImpl : BkApiHandleService {
return
}
val redisOperation: RedisOperation = SpringContextUtil.getBean(RedisOperation::class.java)
// 判断项目是否在限制接口访问的列表中
if (redisOperation.isMember(BkApiUtil.getApiAccessLimitProjectsKey(), projectId)) {
// 判断项目是否在限制接口访问的列表中（使用缓存管理器优化）
val limitSet = ApiAccessLimitCacheManager.getProjectLimitSet(redisOperation)
if (limitSet.contains(projectId)) {
val requestURI = request.requestURI
logger.info("Project[$projectId] does not have access permission for interface[$requestURI]")
throw ErrorCodeException(
Expand Down
Loading