cloud-mu 1.9.0.pre.beta

data/modules/mu/config/dnszone.rb

@@ -0,0 +1,327 @@
+# Copyright:: Copyright (c) 2018 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module MU
+  class Config
+    # Basket of Kittens config schema and parser logic. See modules/mu/clouds/*/dnszone.rb
+    class DNSZone
+
+      # Base configuration schema for a DNSZone
+      # @return [Hash]
+      def self.schema
+        {
+          "type" => "object",
+          "additionalProperties" => false,
+          "description" => "Create a DNS zone in Route 53.",
+          "required" => ["name", "cloud"],
+          "properties" => {
+            "name" => {
+                "type" => "string",
+                "description" => "The domain name to create. Must comply with RFC 1123",
+                "pattern" => "^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$"
+            },
+            "scrub_mu_isms" => {
+                "type" => "boolean",
+                "default" => false,
+                "description" => "When 'cloud' is set to 'CloudFormation,' use this flag to strip out Mu-specific artifacts (tags, standard userdata, naming conventions, etc) to yield a clean, source-agnostic template."
+            },
+            "private" => {
+                "type" => "boolean",
+                "default" => true,
+                "description" => "Create as a private internal domain, not publicly resolvable."
+            },
+            "all_account_vpcs" => {
+                "type" => "boolean",
+                "default" => true,
+                "description" => "If this zone is private, make sure it is resolvable from all VPCs in this account. Will supercede the list in {MU::Config::BasketofKittens::dnszones.vpcs} for VPCs in this account."
+            },
+            "records" => records_primitive(),
+            "vpcs" => {
+                "type" => "array",
+                "items" => MU::Config::VPC.reference(MU::Config::VPC::NO_SUBNETS, MU::Config::VPC::NO_NAT_OPTS)
+            }
+          }
+        }
+      end
+
+      # Generate a schema definition for a set of DNS records
+      # @param need_target [Boolean]: Whether the target of the record needs to be a required parameter
+      # @param default_type [String]: The type of record to make default (e.g. An, CNAME, etc)
+      # @param need_zone [Boolean]: Whether to explicitly require a zone be declared
+      # @return [Hash]
+      def self.records_primitive(need_target: true, default_type: nil, need_zone: false)
+        dns_records_primitive = {
+          "type" => "array",
+          "maxItems" => 100,
+          "items" => {
+              "type" => "object",
+              "required" => ["target", "type"],
+              "additionalProperties" => false,
+              "description" => "DNS records to create. If specified inside another resource (e.g. {MU::Config::BasketofKittens::servers}, {MU::Config::BasketofKittens::loadbalancers}, or {MU::Config::BasketofKittens::databases}), the record(s) will automatically target that resource.",
+              "properties" => {
+                  "override_existing" => {
+                      "type" => "boolean",
+                      "description" => "If true, this record will overwrite any existing record of the same name and type.",
+                      "default" => false
+                  },
+                  "type" => {
+                      "type" => "string",
+                      "description" => "The class of DNS record to create. The R53ALIAS type is not traditional DNS, but instead refers to AWS Route53's alias functionality. An R53ALIAS is only valid if the target is an Elastic LoadBalancer, CloudFront, S3 bucket (configured as a public web server), or another record in the same Route53 hosted zone.",
+                      "enum" => ["SOA", "A", "TXT", "NS", "CNAME", "MX", "PTR", "SRV", "SPF", "AAAA", "R53ALIAS"],
+                      "default_if" => [
+                        {
+                          "key_is" => "mu_type",
+                          "value_is" => "loadbalancer",
+                          "set" => "R53ALIAS"
+                        },
+                        {
+                          "key_is" => "mu_type",
+                          "value_is" => "database",
+                          "set" => "CNAME"
+                        },
+                        {
+                          "key_is" => "mu_type",
+                          "value_is" => "server",
+                          "set" => "A"
+                        }
+                      ]
+                  },
+                  "alias_zone" => {
+                      "type" => "string",
+                      "description" => "If using a type of R53ALIAS, this is the hosted zone ID of the target. Defaults to the zone to which this record is being added."
+                  },
+                  "deploy_id" => {
+                    "type" => "string",
+                    "description" => "Look for a resource in another Mu deployment with this id. Requires mu_type",
+                  },
+                  "mu_type" => {
+                    "type" => "string",
+                    "description" => "The Mu resource type to search the deployment for.",
+                      "enum" => ["loadbalancer", "server", "database", "cache_cluster"]
+                  },
+                  "target_type" => {
+                      "description" => "If the target is a public or a private resource. This only applies to servers/server_pools when using automatic DNS registration. If set to public but the target only has a private address, the private address will be used",
+                      "type" => "string",
+                      "enum" => ["public", "private"]
+                  },
+                  "weight" => {
+                      "type" => "integer",
+                      "description" => "Set the proportion of traffic directed to this target, based on the relative weight of other records with the same DNS name and type."
+                  },
+                  "region" => MU::Config.region_primitive,
+                  "failover" => {
+                      "type" => "string",
+                      "description" => "Failover classification",
+                      "enum" => ["PRIMARY", "SECONDARY"]
+                  },
+                  "ttl" => {
+                      "type" => "integer",
+                      "description" => "DNS time-to-live value for query caching.",
+                      "default" => 7200
+                  },
+                  "target" => {
+                      "type" => "string",
+                      "description" => "The value of this record. Must be valid for the 'type' field, e.g. A records must point to an IP address. If creating a record for an existing deployment, specify the mu_name of the resource, you must also specifiy deploy_id and mu_type",
+                  },
+                  "name" => {
+                      "description" => "Name of the record to create. If not specified, will default to the Mu resource name.",
+                      "type" => "string",
+                      "pattern" => "^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$"
+                  },
+                  "append_environment_name" => {
+                      "description" => "If to append the environment name (eg mydnsname.dev.mudomain.com). to the DNS name",
+                      "type" => "boolean",
+                      "default" => false
+                  },
+                  "geo_location" => {
+                      "type" => "object",
+                      "description" => "Set location for location-based routing.",
+                      "additionalProperties" => false,
+                      "properties" => {
+                          "continent_code" => {
+                              "type" => "string",
+                              "description" => "The code for a continent geo location. Note: only continent locations have a continent code. Specifying continent_code with either country_code or subdivision_code returns an InvalidInput error.",
+                              "enum" => ["AF", "AN", "AS", "EU", "OC", "NA", "SA"]
+                          },
+                          "country_code" => {
+                              "type" => "string",
+                              "description" => "The code for a country geo location. The default location uses '' for the country code and will match all locations that are not matched by a geo location. All other country codes follow the ISO 3166 two-character code."
+                          },
+                          "subdivision_code" => {
+                              "type" => "string",
+                              "description" => "The code for a country's subdivision (e.g., a province of Canada). A subdivision code is only valid with the appropriate country code. Specifying subdivision_code without country_code returns an InvalidInput error."
+                          }
+                      }
+                  },
+                  "healthchecks" => {
+                    "type" => "array",
+                    "items" => {
+                        "type" => "object",
+                        "required" => ["method", "name"],
+                        "additionalProperties" => false,
+                        "description" => "Check used to determine instance health for failover routing.",
+                        "properties" => {
+                          "method" => {
+                              "type" => "string",
+                              "description" => "The health check method to use",
+                              "enum" => ["HTTP", "HTTPS", "HTTP_STR_MATCH", "HTTPS_STR_MATCH", "TCP", "CALCULATED", "CLOUDWATCH_METRIC"]
+                          },
+                          "port" => {
+                              "type" => "integer",
+                              "description" => "Port on which this health check should expect to find a working service.  For HTTP and HTTP_STR_MATCH this defaults to 80 if the port is not specified. For HTTPS and HTTPS_STR_MATCH this defaults to 443 if the port is not specified.",
+                          },
+                          "path" => {
+                              "type" => "string",
+                              "description" => "Path to check for HTTP-based health checks."
+                          },
+                          "type" => {
+                            "type" => "string",
+                            "description" => "When using CALCULATED based health checks make sure to set only the CALCULATED health check to primary while setting all other health checks to secondary.",
+                            "default" => "primary",
+                            "enum" => ["primary", "secondary"]
+                          },
+                          "name" => {
+                              "type" => "string",
+                              "description" => "The health check name."
+                          },
+                          "search_string" => {
+                              "type" => "string",
+                              "description" => "Path to check for STR_MATCH-based health checks."
+                          },
+                          "check_interval" => {
+                              "type" => "integer",
+                              "description" => "The frequency of health checks in seconds.",
+                              "default" => 30,
+                              "enum" => [10, 30]
+                          },
+                          "failure_threshold" => {
+                              "type" => "integer",
+                              "description" => "The number of failed health checks before we consider this entry in failure. Values can be between 1-10.",
+                              "default" => 2,
+                              "pattern" => "^([1-9]|10)$"
+                          },
+                          "insufficient_data" => {
+                            "type" => "string",
+                            "description" => "What should the health check status be set to if there is insufficient data return from the CloudWatch alarm. Used only with CLOUDWATCH_METRIC based health checks.",
+                            "enum" => ["Healthy", "Unhealthy", "LastKnownStatus"]
+                          },
+                          "regions" => {
+                            "type" => "array",
+                            "description" => "The cloud provider's regions from which to test the status of the health check. If not specified will use all regions. Used only with HTTP/HTTPS/TCP based health checks.",
+                            "items" => {
+                              "type" => "string"
+                            }
+                          },
+                          "latency" => {
+                            "description" => "If to measure and graph latency between the health checkers and the endpoint. Used only with HTTP/HTTPS/TCP based health checks.",
+                            "type" => "boolean",
+                            "default" => false
+                          },
+                          "inverted" => {
+                            "description" => "If the status of the health check should be inverted, eg. if health check status is healthy but you would like it to be evaluated as not healthy",
+                            "type" => "boolean",
+                            "default" => false
+                          },
+                          "enable_sni" => {
+                            "description" => "Enabled by default on HTTPS or HTTPS_STR_MATCH",
+                            "type" => "boolean",
+                            "default" => false,
+                            "default_if" => [
+                              {
+                                "key_is" => "method",
+                                "value_is" => "HTTPS",
+                                "set" => true
+                              },
+                              {
+                                "key_is" => "method",
+                                "value_is" => "HTTPS_STR_MATCH",
+                                "set" => true
+                              }
+                            ]
+                          },
+                          "health_threshold" => {
+                            "type" => "integer",
+                            "description" => "The minimum number of health checks that must be healthy when configuring a health check of type CALCULATED. Values can be between 0-256.",
+                            "default" => 1,
+                            "pattern" => "^[\\d]?{3}$"
+                          },
+                          "health_check_ids" => {
+                            "type" => "array",
+                            "description" => "The IDs of existing health checks to use when method is set to CALCULATED.",
+                            "items" => {
+                              "type" => "string"
+                            }
+                          },
+                          "alarm_region" => {
+                            "type" => "string",
+                            "description" => "The cloud provider's region the cloudwatch alarm was created in. Used with CLOUDWATCH_METRIC health checks"
+                          },
+                          "alarm_name" => {
+                            "type" => "string",
+                            "description" => "The cloudwatch alarm name. Used with CLOUDWATCH_METRIC health checks"
+                          }
+                        }
+                    }
+                }
+              }
+          }
+        }
+
+        if !need_target
+          dns_records_primitive["items"]["required"].delete("target")
+          dns_records_primitive["items"]["properties"].delete("target")
+        end
+
+        if need_zone
+          dns_records_primitive["items"]["required"] << "zone"
+          dns_records_primitive["items"]["properties"]["zone"] = {
+            "type" => "object",
+            "additionalProperties" => false,
+            "minProperties" => 1,
+            "description" => "The zone to which to add this record, either as a domain name or as a Route53 zone identifier.",
+            "properties" => {
+                "name" => {
+                    "type" => "string",
+                    "description" => "The domain name of the DNS zone to which to add this record."
+                },
+                "id" => {
+                    "type" => "string",
+                    "description" => "The Route53 identifier of the zone to which to add this record."
+                }
+            }
+          }
+        end
+
+        if !default_type.nil?
+          dns_records_primitive["items"]["properties"]["type"]["default"] = default_type
+          dns_records_primitive["items"]["required"].delete("type")
+        end
+
+        return dns_records_primitive
+      end
+
+      # Generic pre-processing of {MU::Config::BasketofKittens::dnszones}, bare and unvalidated.
+      # @param zone [Hash]: The resource to process and validate
+      # @param configurator [MU::Config]: The overall deployment configurator of which this resource is a member
+      # @return [Boolean]: True if validation succeeded, False otherwise
+      def self.validate(zone, configurator)
+        ok = true
+        ok
+      end
+# TODO non-local VPCs are valid, but require an account field, which insertKitten doesn't know anything about
+# if !zone['account'].nil? and zone['account'] != MU.account_number
+
+    end
+  end
+end

data/modules/mu/config/firewall_rule.rb

@@ -0,0 +1,118 @@
+# Copyright:: Copyright (c) 2018 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module MU
+  class Config
+    # Basket of Kittens config schema and parser logic. See modules/mu/clouds/*/firewall_rule.rb
+    class FirewallRule
+
+      # Base configuration schema for a FirewallRule
+      # @return [Hash]
+      def self.schema
+        {
+          "type" => "object",
+          "required" => ["name"],
+          "additionalProperties" => false,
+          "description" => "Create network-level access controls.",
+          "properties" => {
+            "name" => {"type" => "string"},
+            "vpc_name" => {
+                "type" => "string",
+                "description" => "Backwards-compatibility means of identifying a VPC; see {MU::Config::BasketofKittens::firewall_rules::vpc}"
+            },
+            "vpc_id" => {
+                "type" => "string",
+                "description" => "Backwards-compatibility means of identifying a VPC; see {MU::Config::BasketofKittens::firewall_rules::vpc}"
+            },
+            "vpc" => MU::Config::VPC.reference(MU::Config::VPC::NO_SUBNETS, MU::Config::VPC::NO_NAT_OPTS),
+            "tags" => MU::Config.tags_primitive,
+            "optional_tags" => MU::Config.optional_tags_primitive,
+            "self_referencing" => {
+                "type" => "boolean",
+                "default" => false
+            },
+            "admin" => {
+              "type" => "boolean",
+              "description" => "Internal use only. Flag generic administrative firewall rulesets for use by the Mu Master",
+              "default" => false
+            },
+            "rules" => {
+                "type" => "array",
+                "items" => ruleschema
+            }
+          }
+        }
+      end
+
+      # Generate schema for an individual firewall rule
+      # @return [Hash]
+      def self.ruleschema
+        {
+          "type" => "object",
+          "description" => "Network ingress and/or egress rules.",
+          "additionalProperties" => false,
+          "properties" => {
+            "port_range" => {"type" => "string"},
+            "port" => {"type" => "integer"},
+            "proto" => {
+              "enum" => ["udp", "tcp", "icmp"],
+              "default" => "tcp",
+              "type" => "string"
+            },
+            "ingress" => {
+              "type" => "boolean",
+              "default" => true
+            },
+            "egress" => {
+              "type" => "boolean",
+              "default" => false
+            },
+            "hosts" => {
+              "type" => "array",
+              "items" => MU::Config::CIDR_PRIMITIVE
+            }
+          }
+        }
+      end
+
+      # Schema block for other resources to use when referencing a sibling FirewallRule
+      # @return [Hash]
+      def self.reference
+        {
+          "type" => "array",
+          "items" => {
+            "type" => "object",
+            "additionalProperties" => false,
+            "description" => "Apply one or more network rulesets, defined in this stack or pre-existing, to this resource. Note that if you add a pre-existing ACL to your resource, they must be compatible (e.g. if using VPCs, they must reside in the same VPC).",
+            "minProperties" => 1,
+            "properties" => {
+                "rule_id" => {"type" => "string"},
+                "rule_name" => {"type" => "string"}
+            }
+          }
+        }
+      end
+
+      # Generic pre-processing of {MU::Config::BasketofKittens::firewall_rules}, bare and unvalidated.
+      # @param acl [Hash]: The resource to process and validate
+      # @param configurator [MU::Config]: The overall deployment configurator of which this resource is a member
+      # @return [Boolean]: True if validation succeeded, False otherwise
+      def self.validate(acl, configurator)
+        ok = true
+        ok
+      end
+
+    end
+  end
+end

data/modules/mu/config/folder.rb

@@ -0,0 +1,70 @@
+# Copyright:: Copyright (c) 2018 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the folder or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module MU
+  class Config
+    # Basket of Kittens config schema and parser logic. See modules/mu/clouds/*/folder.rb
+    class Folder
+
+      # Base configuration schema for a Folder
+      # @return [Hash]
+      def self.schema
+        {
+          "type" => "object",
+          "additionalProperties" => false,
+          "description" => "Set up a cloud provider folder/OU for containing other account-level resources",
+          "properties" => {
+            "name" => { "type" => "string" },
+          }
+        }
+      end
+
+      # Chunk of schema to reference a folder/OU, here to be embedded
+      # into the schemas of other resources.
+      def self.reference
+        {
+          "type" => "object",
+          "description" => "Deploy into or connect with resources in a specific account/project",
+          "minProperties" => 1,
+          "additionalProperties" => false,
+          "properties" => {
+            "id" => {
+              "type" => "string",
+              "description" => "Discover this folder/OU by looking by its cloud provider identifier "
+            },
+            "name" => {
+              "type" => "string",
+              "description" => "Discover this folder/OU by Mu-internal name; typically the shorthand 'name' field of an Folder object declared elsewhere in the deploy, or in another deploy that's being referenced with 'deploy_id'."
+            },
+            "cloud" => MU::Config.cloud_primitive,
+            "deploy_id" => {
+              "type" => "string",
+              "description" => "Search for this folder in an existing Mu deploy; specify a Mu deploy id (e.g. DEMO-DEV-2014111400-NG)."
+            }
+          }
+        }
+      end
+
+      # Generic pre-processing of {MU::Config::BasketofKittens::folder}, bare and unvalidated.
+      # @param folder [Hash]: The resource to process and validate
+      # @param configurator [MU::Config]: The overall deployment configurator of which this resource is a member
+      # @return [Boolean]: True if validation succeeded, False otherwise
+      def self.validate(folder, configurator)
+        ok = true
+        ok
+      end
+
+    end
+  end
+end

data/modules/mu/config/function.rb

@@ -0,0 +1,140 @@
+# Copyright:: Copyright (c) 2018 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module MU
+  class Config
+    # Basket of Kittens config schema and parser logic. See modules/mu/clouds/*/function.rb
+    class Function
+
+      # Base configuration schema for a Function
+      # @return [Hash]
+      def self.schema
+      {
+        "type" => "object",
+        "title" => "Function",
+        "description" => "Create a cloud function.",
+        "required" => ["name", "cloud","runtime","iam_role","handler","code","region"],
+        "additionalProperties" => false,
+        "properties" => {
+          "cloud" => MU::Config.cloud_primitive,
+          "name" => {"type" => "string"},
+          "runtime" => {
+            "type" => "string",
+            "enum" => %w{nodejs nodejs4.3 nodejs6.10 nodejs8.10 java8 python2.7 python3.6 dotnetcore1.0 dotnetcore2.0 dotnetcore2.1 nodejs4.3-edge go1.x}
+          },
+          "iam_role" => {"type" => "string"},
+          "region" => MU::Config.region_primitive,
+          "vpc" => MU::Config::VPC.reference(MU::Config::VPC::ONE_SUBNET+MU::Config::VPC::MANY_SUBNETS, MU::Config::VPC::NO_NAT_OPTS, "all_private"),
+          "handler" => {
+            "type" => "string",
+            "description" => "The function within your code that Lambda calls to begin execution. For Node.js, it is the module-name.export value in your function. For Java, it can be package.class-name::handler or package.class-name. For more information, see https://docs.aws.amazon.com/lambda/latest/dg/java-programming-model-handler-types.html"
+          }, 
+          "timeout" => {
+            "type" => "integer",
+            "description" => "Maximum run time for an invocation of this function, in seconds",
+            "default" => 3
+          },
+          "tags" => MU::Config.tags_primitive,
+          "optional_tags" => MU::Config.optional_tags_primitive,
+          "memory" => {
+            "type" => "integer",
+            "default" => 128,
+            "description" => "Memory to allocation for function, in MB. The value must be a multiple of 64 MB."
+          },
+          "dependencies" => MU::Config.dependencies_primitive,
+          "triggers" => {
+            "type" => "array",
+            "items" => {
+              "type" => "object",
+              "description" => "Trigger for lambda function",
+              "required" => ["service"],
+              "additionalProperties" => false,
+              "properties" => {
+                "service" => {
+                  "type" => "string",
+                  "enum" => %w{apigateway events s3 sns sqs dynamodb kinesis ses cognito alexa iot},
+                  "description" => "The name of the AWS service that will trigger this function"
+                },
+                "name" => {
+                  "type" => "string",
+                  "description" => "The name of the API Gateway, Cloudwatch Event, or other event trigger object"
+                }
+              }
+            }
+          },
+          "code" => {
+            "type" => "object",  
+            "description" => "Zipped deployment package to upload to Lambda. You must specify either s3_bucket+s3_key or zip_file.", 
+            "additionalProperties" => false,
+            "properties" => {  
+              "s3_bucket" => {
+                "type" => "string",
+                "description" => "An S3 bucket where the deployment package can be found. Must be used in conjunction with s3_key."
+              }, 
+              "s3_key" => {
+                "type" => "string",
+                "description" => "Key in s3_bucket where the deployment package can be found. Must be used in conjunction with s3_bucket."
+              }, 
+              "s3_object_version" => {
+                "type" => "string",
+                "description" => "Specify an S3 object version for the deployment package, instead of the current default"
+              }, 
+              "zip_file" => {
+                "type" => "string",
+                "description" => "Path to a zipped deployment package to upload."
+              } 
+            }
+          },
+          "environment_variable" => {
+            "type" => "array", 
+            "minItems" => 1, 
+            "items" => { 
+              "description" => "environment variables",  
+              "type" => "object",  
+              "title" => "tags", 
+              "required" => ["key", "value"],  
+              "additionalProperties" => false, 
+              "properties" => {  
+                "key" => { 
+                  "type" => "string",  
+                }, 
+                "value" => { 
+                  "type" => "string",  
+                }  
+              }  
+            }  
+          }
+        }
+      } 
+      end
+
+      # Generic pre-processing of {MU::Config::BasketofKittens::functions}, bare and unvalidated.
+      # @param function [Hash]: The resource to process and validate
+      # @param configurator [MU::Config]: The overall deployment configurator of which this resource is a member
+      # @return [Boolean]: True if validation succeeded, False otherwise
+      def self.validate(function, configurator)
+        ok = true
+        if function['code']['zip_file']
+          if !File.readable?(function['code']['zip_file'])
+            MU.log "Can't read deployment package #{function['code']['zip_file']}", MU::ERR
+            ok = false
+          end
+        end
+
+        ok
+      end
+
+    end
+  end
+end