graph LR
    A[会议录制系统] -->|实时写入| B(热层: 高性能对象存储)
    B -->|生命周期规则: 30天| C(温层: 低频存储)
    C -->|生命周期规则: 180天| D(冷层: 归档存储)
    D -->|合规到期/法务指令| E[合规销毁/永久保留]

{
  "id": "hot-to-warm-30d",
  "status": "Enabled",
  "filter": { "prefix": "records/", "tags": { "business": "meeting" } },
  "transition": {
    "days": 30,
    "storageClass": "IA"          // 低频访问存储类
  }
}

{
  "id": "warm-to-cold-180d",
  "status": "Enabled",
  "filter": { "prefix": "records/", "tags": { "business": "meeting" } },
  "transition": {
    "days": 180,
    "storageClass": "Archive"     // 归档存储；7 年以上可用 DeepArchive
  }
}

{
  "id": "expire-old-versions-365d",
  "status": "Enabled",
  "filter": { "prefix": "records/" },
  "noncurrentVersionExpiration": { "noncurrentDays": 365 }
}

{
  "id": "compliance-expire-7y",
  "status": "Enabled",
  "filter": { "prefix": "records/", "tags": { "retention": "7y" } },
  "expiration": { "days": 2555 }  // 7 年 = 2555 天
}

import oss2
from oss2.models import LifecycleRule, Transition, Expiration, Tagging

def apply_lifecycle(bucket_name, endpoint, access_key_id, access_key_secret):
    auth = oss2.Auth(access_key_id, access_key_secret)
    bucket = oss2.Bucket(auth, endpoint, bucket_name)

    rules = [
        LifecycleRule(
            id='hot-to-warm-30d',
            status=LifecycleRule.ENABLED,
            prefix='records/',
            tagging=Tagging({'business': 'meeting'}),
            transition=Transition(days=30, storage_class=oss2.BUCKET_STORAGE_CLASS_IA)
        ),
        LifecycleRule(
            id='warm-to-cold-180d',
            status=LifecycleRule.ENABLED,
            prefix='records/',
            tagging=Tagging({'business': 'meeting'}),
            transition=Transition(days=180, storage_class=oss2.BUCKET_STORAGE_CLASS_ARCHIVE)
        ),
        LifecycleRule(
            id='compliance-expire-7y',
            status=LifecycleRule.ENABLED,
            prefix='records/',
            tagging=Tagging({'retention': '7y'}),
            expiration=Expiration(days=2555)
        )
    ]
    bucket.put_bucket_lifecycle(rules)
    print(f"Lifecycle rules applied to {bucket_name}")

graph TB
    subgraph Control_Plane[控制平面 GitOps]
        A[统一策略定义 YAML] --> B(策略编译器)
        B --> C[阿里云 Adapter]
        B --> D[腾讯云 Adapter]
        B --> E[AWS Adapter]
        B --> F[MinIO/CEPH Adapter]
    end
    subgraph Data_Plane[数据平面]
        C --> G[(OSS Bucket)]
        D --> H[(COS Bucket)]
        E --> I[(S3 Bucket)]
        F --> J[(On-Prem RGW)]
    end
    K[成本/合规审计日志] --> L[统一数据湖]
    G & H & I & J --> K

apiVersion: storage.policy/v1alpha1
kind: LifecyclePolicy
metadata:
  name: meeting-records-global
  labels:
    business: meeting
    compliance-level: L3
spec:
  tiers:
    - name: hot
      storageClassMap:
        aliyun: Standard
        tencent: STANDARD
        aws: STANDARD
        minio: STANDARD
      transitionAfterDays: 0
    - name: warm
      storageClassMap:
        aliyun: IA
        tencent: STANDARD_IA
        aws: STANDARD_IA
        minio: WARM_TIER  # 需配合 ILM 插件
      transitionAfterDays: 30
      minObjectSizeKB: 128  # 统一屏蔽小文件不转 IA 避免额外费用
    - name: cold
      storageClassMap:
        aliyun: Archive
        tencent: ARCHIVE
        aws: GLACIER_IR
        minio: COLD_TIER
      transitionAfterDays: 180
  expiration:
    retentionYears: 7
    legalHoldTag: "legal-hold=true"
  crossRegionReplication:
    - source: cn-hangzhou
      destination: cn-shenzhen
      storageClass: IA
      syncTags: true

class AliyunAdapter:
    def translate(self, unified_policy):
        rules = []
        for tier in unified_policy.spec.tiers[1:]:  # 跳过热层
            # 处理最小对象限制
            filter_cond = {"prefix": "records/"}
            if tier.get("minObjectSizeKB"):
                filter_cond["objectSizeGreaterThan"] = tier["minObjectSizeKB"] * 1024
            
            rules.append({
                "id": f"{unified_policy.metadata.name}-{tier.name}",
                "status": "Enabled",
                "filter": filter_cond,
                "transition": {"days": tier.transitionAfterDays, "storageClass": tier.storageClassMap["aliyun"]}
            })
        # 合规保留锁转换
        if unified_policy.spec.expiration.legalHoldTag:
            rules.append(self._build_worm_rule(unified_policy))
        return rules

graph LR
    A[新增录制 MP4] --> B{异步触发器}
    B --> C[音频抽取 ffmpeg]
    B --> D[关键帧抽取 1fps]
    C --> E[ASR 语音转文字 Whisper/FunASR]
    D --> F[VLM 视觉理解 Qwen-VL/GPT-4o]
    E & F --> G[多模态融合打分模型]
    G --> H[价值评分 0-100]
    H --> I[动态打标签]
    I --> J[生命周期引擎二次判定]

# 热层 - 高性能 SSD (适合实时转码、AI 分析挂载卷)
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: meeting-hot-ssd
  annotations:
    storageclass.kubernetes.io/is-default-class: "false"
provisioner: diskplugin.csi.alibabacloud.com
parameters:
  type: cloud_essd
  performanceLevel: "PL2"  # ESSD PL2/PL3
  encrypted: "true"
reclaimPolicy: Retain
volumeBindingMode: WaitForFirstConsumer
---
# 温层 - 低频 NAS / 对象存储挂载 (适合归档只读挂载)
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: meeting-warm-nas
provisioner: nasplugin.csi.alibabacloud.com
parameters:
  server: "xxxx.cn-hangzhou.nas.aliyuncs.com:/meeting-warm"
  storageType: "Capacity"  # 容量型/性能型
  accessMode: "ReadOnlyMany"  # 归档层多挂载只读
reclaimPolicy: Retain
---
# 冷层 - OSS Bucket 直挂 (通过 fluid/jindo-fuse 实现缓存加速)
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: meeting-cold-oss
provisioner: ossplugin.csi.alibabacloud.com
parameters:
  bucket: "meeting-archive-2024"
  objectPrefix: "records/cold/"
  archivePolicy: "Archive"  # 直写归档类型
reclaimPolicy: Retain

// 控制器核心协调循环伪代码
func (r *MeetingRecordingReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
    rec := &MeetingRecording{}
    if err := r.Get(ctx, req.NamespacedName, rec); err != nil { return ctrl.Result{}, client.IgnoreNotFound(err) }

    // 1. 判断当前阶段
    phase := r.determinePhase(rec) // Hot / Warm / Cold / Expired
    
    // 2. 期望状态计算
    desiredSC := r.storageClassForPhase(phase)
    desiredRetention := r.retentionForPhase(phase)

    // 3. 执行迁移/变更
    if rec.Spec.CurrentStorageClass != desiredSC {
        r.emitEvent(rec, "TierMigrationStarted", phase)
        // 启动迁移 Job，等待完成
        if err := r.runMigrationJob(ctx, rec, desiredSC); err != nil {
            r.emitEvent(rec, "MigrationFailed", err.Error())
            return ctrl.Result{RequeueAfter: 5*time.Minute}, err
        }
        // 更新 PVC StorageClass (需 CSI 驱动支持 VolumeAttributesClass 或 重建 PVC)
        r.updatePVCStorageClass(ctx, rec, desiredSC)
    }

    // 4. 更新状态
    rec.Status.CurrentPhase = phase
    rec.Status.CurrentStorageClass = desiredSC
    return ctrl.Result{RequeueAfter: 24*time.Hour}, r.Status().Update(ctx, rec)
}

graph TB
    subgraph Attack_Surface[攻击面]
        A1[AK/SK 泄露]
        A2[控制台账号劫持]
        A3[内部人员恶意操作]
        A4[供应链投毒 CI/CD]
    end
    subgraph Defense_Layers[防御层]
        L1[账号安全] --> L1a(MFA 强制 + 权限边界 Permission Boundary)
        L1 --> L1b(短期凭证 STS + 策略条件限制 IP/时间)
        L2[数据平面保护] --> L2a(版本控制 + 合规保留锁 WORM)
        L2 --> L2b(跨账号/跨区域 气隙备份)
        L2 --> L2c(对象锁 Object Lock + 法律保留 Legal Hold)
        L3[检测与响应] --> L3a(异常行为分析: 批量 Delete/Overwrite/Restore)
        L3 --> L3b(蜜罐对象 + Canary Token)
        L3 --> L3c(一键冻结账号/撤销 Token API)
    end
    A1 & A2 & A3 & A4 --> L1 & L2 & L3

resource "alicloud_oss_bucket_retention_policy" "meeting_worm" {
  bucket = alicloud_oss_bucket.meeting.id
  retention_period_in_days = 2555
  # 锁定策略需通过控制台或 API 单独调用 LockObjectRetention，Terraform 通常仅创建未锁定策略
}