Query Company IP Info

Use this skill to answer company IP questions with a fixed ownership pipeline:

CMDB server IP -> LBM VIP -> LBM SNAT pool -> Office egress IP

For two or more IPs, use scripts/query_ips.py first. It queries CMDB, LBM VIP, and LBM SNAT in batch where supported, then groups the output into server IP, VIP, SNAT/load-balancer address, office egress fallback, conflict/multi-use, and not-found sections. Use the single-source scripts only when debugging one source or when the user explicitly asks for raw source output.

Before running the default sequence, match the IP against references/ip-routing.md. A CIDR match only chooses the first system to query. Never use a CIDR match as final ownership without an exact record from CMDB or LBM.

First Step

Before any CMDB or LBM query, remind the user to inject their own Yunwei platform credentials when the current environment does not already provide them:
URL: https://yunwei.eastmoney.com/account/password

export YUNWEI_API_KEY=...
export YUNWEI_API_SECRET=...

Use this shared key/secret pair for both CMDB and LBM. CMDB signs request parameters with _key/_secret; LBM sends the same pair as Authorization: Bearer <key>:<secret>. Do not ask users to configure separate CMDB and LBM credentials unless their environment explicitly requires service-specific overrides.

Required Output Tables

Always present ownership results as Markdown tables with the exact section names and column names below. Do not replace these tables with bullet summaries, and do not rename columns. For batch queries, keep one section per result type; if a batch contains both machine IPs and VIPs, show both sections.

Server IPs - CMDB exact hits:

| CI | 内网IP | IDC | 部门 | 开发负责人 | 运维负责人 |
| --- | --- | --- | --- | --- | --- |

VIPs - LBM exact hits:

| vip | port | isp | department | idc | server_room | device_name | device_type |
| --- | --- | --- | --- | --- | --- | --- | --- |

SNAT/LB addresses - LBM exact hits:

| ip | isp | idc | server_room | purpose | device_type |
| --- | --- | --- | --- | --- | --- |

Office egress fallback:

| 查询IP | 出口IP/网段 | 名称 | 备注 |
| --- | --- | --- | --- |

When an IP has exact records in more than one authoritative source, show it in every matching section and add a conflict or multi-use note. Office egress is a fallback table only after CMDB server, LBM VIP, and LBM SNAT have no exact hit.

Render LBM IP links with these URLs:

VIP:  https://yunwei.eastmoney.com/lbm2/platform/vs-board?vip=<vip>
SNAT: https://yunwei.eastmoney.com/lbm2/lb-address/list?ip=<ip>

Query Workflow

1. Check whether YUNWEI_API_KEY and YUNWEI_API_SECRET are available before CMDB/LBM queries. If not, tell the user to export them first.
2. Normalize the input as a single IP, CIDR, hostname/link, business name, or time-bounded access question.
3. If the input contains multiple IPs, run:
   bash python3 scripts/query_ips.py <ip1> <ip2> ...
   Then present the grouped sections directly, preserving conflicts when an IP has both machine and VIP/SNAT exact records.
4. If the input contains one IP, match it against references/ip-routing.md.
5. Query the routed source first when a route exists:
   - cmdb_server for physical or virtual server IPs.
   - lbm_vip for internal or external VIPs.
   - lbm_snat for HA/F5/load-balancer SNAT pool addresses.
6. If the routed source has no exact hit, still fall back through the remaining default sequence:
   text CMDB server IP -> LBM VIP -> LBM SNAT pool -> Office egress IP
7. If ES evidence is requested or useful, query ES only for access/link relationships. Treat ES as behavior evidence, not ownership evidence.
8. After a CMDB exact server hit, let scripts/query_cmdb.py or scripts/query_ips.py auto-learn that IP's /24 as a cmdb_server route in references/ip-routing.md, unless --no-update-routes is used.
9. After an LBM VIP exact hit, let scripts/query_lbm_vip.py or scripts/query_ips.py auto-learn that IP's /24 as an lbm_vip route, unless --no-update-routes is used.
10. After an LBM SNAT exact hit, let scripts/query_lbm_snat.py or scripts/query_ips.py auto-learn that IP's /24 as an lbm_snat route, unless --no-update-routes is used.
11. If a learned route conflicts with an existing route for the same CIDR, do not overwrite it; report that manual confirmation is required.
12. If CMDB and LBM have no exact hit, query scripts/query_office_egress.py as the final local shared source. This script refreshes the office egress cache first when the local cache is missing or older than its TTL.
13. Merge exact ownership hits and relationship evidence into the standard answer format in references/output-format.md.

Ownership Rules

• Use CMDB as the ownership source for server IPs, including physical machines and virtual machines.
• Use LBM as the ownership source for VIPs, including internal VIPs and external VIPs.
• Use LBM as the ownership source for SNAT pool addresses, including HA and F5 SNAT IPs.
• Use references/office-egress-ips.md as the shared local cache for office egress IPs and CIDRs.
• Present office egress hits as fixed Markdown tables, matching the CMDB virtual server display style. Do not summarize office egress hits as loose bullets.
• Treat /24 or other CIDR routes as query hints only.
• Do not auto-learn office egress entries into ip-routing.md; update them through scripts/update_office_egress.py or the company source.
• Treat ES records as relationship evidence only: source IP, destination IP/VIP, URL/link, port, timestamp, and counts.
• When ES contains an IP whose ownership matters, resolve that IP through CMDB or LBM before stating ownership.
• If more than one ownership system has an exact hit, report all exact hits as a conflict or multi-use condition; do not silently pick one.
• If only a CIDR route matches and no exact record is found, report the IP as "unconfirmed" or "expected type only".

References

Read only the files needed for the current question:

• references/ip-routing.md: Maintain /24 or more specific CIDR routes to choose the first query source.
• references/office-egress-ips.md: Shared local cache for office egress IPs and CIDRs.
• references/query-playbooks.md: Follow the detailed playbooks for single-IP, VIP, SNAT, and access-relationship questions.
• references/data-sources.md: Fill in CMDB, LBM, and ES query/authentication details as they become available.
• references/output-format.md: Use the standard response format and confidence wording.

Scripts

• scripts/signed_api.py: Shared Yunwei key/secret configuration helper. CMDB uses the pair for _key/_secret signing; LBM uses the same pair in the Bearer authorization header.
• scripts/query_ips.py: Batch query multiple IPs across CMDB, LBM VIP, LBM SNAT, and office egress fallback; group exact hits by server IP, VIP, SNAT/load-balancer address, conflict/multi-use, and not-found sections.
• scripts/route_ip.py: Match an IP against the YAML route table in references/ip-routing.md. Use it to verify route-table edits or to quickly see which source should be queried first.
• scripts/query_cmdb.py: Query one or more CMDB server IP ownership records with the company key/secret signature scheme. Successful exact hits update references/ip-routing.md with the IP's /24 route by default.
• scripts/query_lbm_vip.py: Query LBM VIP ownership using the VIP-LBM workflow Authorization header. Supports direct VIP lookup and backend/member IP reverse lookup. Successful exact hits update references/ip-routing.md with the IP's /24 route by default.
• scripts/query_lbm_snat.py: Query LBM SNAT/load-balancer address ownership using the same workflow Authorization header. Successful exact hits update references/ip-routing.md with the IP's /24 route by default.
• scripts/route_learning.py: Shared route-table update helper. Adds new routes, updates same-type routes, and refuses to overwrite conflicting routes.
• scripts/query_office_egress.py: Query the shared office egress IP/CIDR cache as the last fallback source. By default it auto-updates the cache before querying when references/office-egress-ips.md is missing or older than 24 hours.
• scripts/update_office_egress.py: Refresh references/office-egress-ips.md from the default company source URL, an override URL, or a local source file.