# tenant-namespace-template.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: tenant-{TENANT_ID}          # 由控制器自动渲染
  labels:
    tenant-id: "{TENANT_ID}"
    tier: "{TIER}"                  # standard / professional / enterprise
    isolation-level: "strict"       # 或 relaxed (共享媒体池)
  annotations:
    billing/contact: "admin@tenant.com"
    quota/last-synced: "{TIMESTAMP}"
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-hard-quota
  namespace: tenant-{TENANT_ID}
spec:
  hard:
    # 计算资源
    requests.cpu: "32"              # 核
    requests.memory: 64Gi
    limits.cpu: "64"
    limits.memory: 128Gi
    # 并发业务指标 (需配合 Custom Controller 同步)
    # 此处为示例，实际由 Quota Controller 动态注入
    # concurrent.meetings: "50"
    # concurrent.participants: "500"
    # 存储资源
    requests.storage: "2Ti"
    persistentvolumeclaims: "20"
    # 对象数量防刷
    pods: "200"
    services: "30"
    secrets: "100"
    configmaps: "100"
---
apiVersion: v1
kind: LimitRange
metadata:
  name: container-default-limits
  namespace: tenant-{TENANT_ID}
spec:
  limits:
  - type: Container
    default:           # 等同于 limits
      cpu: "2"
      memory: "4Gi"
    defaultRequest:    # 等同于 requests
      cpu: "500m"
      memory: "1Gi"
    max:
      cpu: "8"         # 单容器上限，防止单会议组件占满配额
      memory: "16Gi"
    min:
      cpu: "100m"
      memory: "256Mi"
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-cross-tenant-default
  namespace: tenant-{TENANT_ID}
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: ingress-nginx   # 仅允许入口网关
    - namespaceSelector:
        matchLabels:
          tenant-id: "{TENANT_ID}"                     # 允许同租户内部互访
    - namespaceSelector:
        matchLabels:
          role: monitoring                             # 允许监控采集
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          role: dns                                    # 允许 DNS 解析
    - namespaceSelector:
        matchLabels:
          role: logging                                # 允许日志采集
    - namespaceSelector:
        matchLabels:
          tenant-id: "{TENANT_ID}"
  # 注：媒体节点需访问公网/STUN/TURN，需额外策略放行目的 IP 段

-- 1. 启用 RLS 扩展 (超级用户执行一次)
CREATE EXTENSION IF NOT EXISTS pgaudit; -- 审计扩展建议同步开启

-- 2. 核心业务表结构示例
CREATE TABLE meeting_records (
    id              BIGSERIAL PRIMARY KEY,
    tenant_id       VARCHAR(64) NOT NULL,          -- 租户标识，不加 UNIQUE 允许分表
    meeting_id      VARCHAR(64) NOT NULL,
    host_user_id    VARCHAR(64) NOT NULL,
    start_time      TIMESTAMPTZ NOT NULL,
    end_time        TIMESTAMPTZ,
    record_status   SMALLINT DEFAULT 0,            -- 0:录制中 1:转码中 2:完成 3:失败
    storage_path    TEXT,                          -- 对象存储全路径
    created_at      TIMESTAMPTZ DEFAULT NOW(),
    updated_at      TIMESTAMPTZ DEFAULT NOW()
);

-- 3. 创建索引：租户维度查询必走索引
CREATE INDEX idx_meeting_records_tenant_time ON meeting_records (tenant_id, start_time DESC);

-- 4. 核心：开启 RLS 并定义策略
ALTER TABLE meeting_records ENABLE ROW LEVEL SECURITY;
-- 强制开启，即使是表所有者 (Owner) 也受策略约束
ALTER TABLE meeting_records FORCE ROW LEVEL SECURITY;

-- 5. 定义通用策略函数 (在公共 schema 下，所有租户共享)
CREATE OR REPLACE FUNCTION public.tenant_isolation_policy() RETURNS boolean
LANGUAGE sql STABLE SECURITY DEFINER AS $$
  -- current_setting 从会话变量读取，由连接池/中间件在建连时注入
  SELECT current_setting('app.current_tenant_id', true) = tenant_id;
$$;

-- 6. 绑定策略：所有操作 (SELECT/INSERT/UPDATE/DELETE) 均生效
CREATE POLICY tenant_isolation ON meeting_records
  USING (public.tenant_isolation_policy())
  WITH CHECK (public.tenant_isolation_policy());

-- 7. 连接池/中间件配置关键点 (以 PgBouncer / ShardingSphere-Proxy 为例)
-- 建连初始化 SQL: SET app.current_tenant_id = 'TENANT_123';
-- 事务结束自动 RESET: RESET app.current_tenant_id;

-- tenant_ratelimit.lua
-- 依赖: lua-resty-redis, cjson
-- Redis Key 设计: ratelimit:{tenant_id}:{api_group}:{window_sec}

local redis = require "resty.redis"
local cjson = require "cjson.safe"
local red = redis:new()
red:set_timeouts(10, 50, 50) -- 连接/读/写超时 ms

local ok, err = red:connect("redis-cluster-vip", 6379)
if not ok then
    ngx.log(ngx.ERR, "Redis connect failed: ", err)
    -- 降级策略：Redis 挂了默认放行(防误杀) 或 拒绝(严格模式)，建议放行并告警
    return
end

-- 1. 从 JWT Token / Header 解析租户 ID (假设已由 auth 插件注入 header)
local tenant_id = ngx.req.get_headers()["X-Tenant-ID"]
if not tenant_id or tenant_id == "" then
    return ngx.exit(401) -- 未认证
end

-- 2. 从共享内存/配置中心获取该租户当前配额 (缓存 10s 刷新)
local quota_key = "quota:" .. tenant_id
local quota_json, err = red:get(quota_key)
local quota = cjson.decode(quota_json) or { qps = 100, concurrent = 50 } -- 默认兜底

-- 3. 并发信号量控制 (基于 Redis 原子操作)
local concur_key = "concurrent:" .. tenant_id
local current_concur, err = red:incr(concur_key)
if current_concur == 1 then red:expire(concur_key, 60) end -- 过期兜底防卡死

if current_concur > quota.concurrent then
    red:decr(concur_key) -- 回滚
    ngx.header["Retry-After"] = "1"
    return ngx.exit(429) -- Too Many Requests
end

-- 4. QPS 滑动窗口限流 (Redis Sorted Set 实现，精度高)
local qps_key = "qps:" .. tenant_id .. ":" .. math.floor(ngx.time())
local now_ms = ngx.now() * 1000
local window_start = now_ms - 1000 -- 1秒窗口

red:zremrangebyscore(qps_key, 0, window_start) -- 清理过期
local count = red:zcard(qps_key)
if count >= quota.qps then
    red:decr(concur_key)
    return ngx.exit(429)
end
red:zadd(qps_key, now_ms, now_ms .. ":" .. math.random(1000000))
red:expire(qps_key, 2)

-- 5. 请求结束后递减并发计数 (放在 log phase 或 balancer phase)
-- 此处简化：利用 ngx.ctx 标记，在 log_by_lua_block 中执行 decr
ngx.ctx.tenant_concur_key = concur_key

-- 放行
red:set_keepalive(10000, 100)

// media_router/federation_decider.go
package media_router

type FederationDecision struct {
    Mode        string // "direct", "relay", "cascade"
    RelayNodes  []string
    Reason      string
}

func DecideMediaPath(ctx context.Context, meeting *Meeting, participants []*Participant) *FederationDecision {
    // 1. 同租户、同可用区、直连策略开启 -> Direct
    if meeting.TenantID == participants[0].TenantID && meeting.EnableDirectConnect {
        if checkNetworkReachability(participants) {
            return &FederationDecision{Mode: "direct", Reason: "intra-tenant direct"}
        }
    }

    // 2. 跨租户场景
    tenantA := meeting.TenantID
    tenantB := participants[0].TenantID // 简化假设双方租户

    // 2.1 检查联邦信任策略 (配置中心维护)
    trustPolicy := GetFederationPolicy(tenantA, tenantB)
    if trustPolicy == nil || trustPolicy.Mode == "block" {
        return &FederationDecision{Mode: "block", Reason: "no federation trust"}
    }

    // 2.2 强制中转场景：安全合规、NAT 穿透失败、带宽成本优化
    if trustPolicy.ForceRelay || !checkNATTraversal(participants) {
        // 选取最近的 Relay 节点组 (部署在 DMZ/边缘节点)
        relays := SelectOptimalRelays(meeting.Region, trustPolicy.AllowedRelayPools)
        return &FederationDecision{
            Mode:       "relay",
            RelayNodes: relays,
            Reason:     "cross-tenant forced relay",
        }
    }

    // 2.3 级联模式：大型跨租户会议，各租户本地 SFU 互联 (级联)
    if meeting.ExpectedParticipants > 200 && trustPolicy.AllowCascade {
        return &FederationDecision{
            Mode:       "cascade",
            RelayNodes: []string{meeting.LocalSFU, participants[0].LocalSFU},
            Reason:     "large scale cascade",
        }
    }

    // 默认兜底：中转
    return &FederationDecision{Mode: "relay", Reason: "default fallback"}
}

graph TB
    subgraph Global_Control_Plane [全球控制面 - SaaS 厂商侧]
        CP_API[API Gateway / Config Center]
        CP_QUOTA[配额中心]
        CP_AUTH[统一认证/联邦网关]
        CP_OBS[全局观测/审计]
        CP_CI[镜像分发/版本发布]
    end

    subgraph Tenant_A_Private_Cloud [租户 A 专有云 - 客户数据中心]
        DP_LB[负载均衡/入口网关]
        DP_SIG[信令集群]
        DP_MEDIA[媒体节点池]
        DP_STORE[对象存储/数据库]
        DP_AGENT[边缘代理 Agent]
    end

    subgraph Tenant_B_Public_Cloud [租户 B 公有云 - 厂商托管]
        DP_LB_B[共享入口]
        DP_SIG_B[共享信令]
        DP_MEDIA_B[共享媒体池]
    end

    CP_API -.->|xDS/gRPC 下发配置/策略| DP_AGENT
    CP_QUOTA -.->|实时同步配额| DP_AGENT
    DP_AGENT -->|心跳/指标/审计日志| CP_OBS
    DP_AGENT -->|镜像拉取/升级指令| CP_CI