@leverege/build-tools 2.8.11 → 2.8.12

package/lib/web/service-man/utils/index.js

@@ -0,0 +1,67 @@
+"use strict";
+
+const inquirer = require('inquirer');
+
+const Shell = require('./Shell');
+
+const VersionCheck = require('./VersionCheck');
+/**
+ * Clears the screen and optionally homes the cursor.
+ */
+
+
+const clear = (home = true) => {
+  // console.log( ( home ? '\x1B[0f' : '' ) + '\x1B[2J' )
+  console.log(`${home ? '\x1B[0f' : ''}\x1B[2J`);
+};
+/**
+ * A simple object dumping convenience.
+ */
+
+
+const condir = (log, thing) => {
+  console.dir({
+    log,
+    thing
+  }, {
+    depth: 8,
+    colors: true
+  }); // eslint-disable-line
+};
+/**
+ * General "yes" to proceed function.
+ */
+
+
+const proceed = async (query = 'Do you wish to proceed?') => {
+  await inquirer.prompt([{
+    type: 'confirm',
+    name: 'proceed',
+    message: query,
+    default: true
+  }]).then(answer => {
+    if (!answer.proceed) {
+      process.exit(0);
+    }
+  });
+};
+/**
+ * A simple mS sleeper.
+ */
+
+
+const sleep = (ms = 0) => {
+  return new Promise(resolve => {
+    setTimeout(resolve, ms);
+  });
+};
+
+module.exports = {
+  clear,
+  condir,
+  proceed,
+  sleep,
+  pause: sleep,
+  Shell,
+  VersionCheck
+};

package/lib/web/unleash.js

@@ -8,7 +8,12 @@ const SimpleGit = require('simple-git');
 const git = new SimpleGit();
 
 const getCurrentBranchName = async () => {
-  const branchInfo = await git.branch();
+  const branchInfo = await git.branch(); // first check to see if there are no branches - new repo?
+
+  if (Object.keys(branchInfo.branches).length === 0) {
+    return '';
+  }
+
   return Object.entries(branchInfo.branches).find(([name, info]) => info.current)[0];
 };
 
@@ -27,6 +32,8 @@ const npmRunner = async script => {
   } catch (err) {
     process.exit(1);
   }
+
+  return undefined;
 };
 
 (async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.8.11",
+  "version": "2.8.12",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "scripts": {
@@ -9,8 +9,6 @@
     "compile": "npm run clean && npm run compile_server && npm run compile_web",
     "compile_server": "NODE_ENV=server babel -d lib/server src/ && npm run repo_init_publisher",
     "compile_web": "NODE_ENV=web babel -d lib/web src/",
-    "licenseCheck": "license-checker --summary --failOn GPL",
-    "npm-check-updates": "npm-check-updates -i",
     "postinstall": "src/npm-scripts/postinstall.js",
     "prepublintOnly": "npm run lint && npm run build",
     "prepublishOnly": "npm run compile",
@@ -64,7 +62,6 @@
     "inquirer": "^8.2.0",
     "js-yaml": "^4.1.0",
     "ncp": "^2.0.0",
-    "npm-check-updates": "^12.0.5",
     "npm-registry-fetch": "^11.0.0",
     "open": "^8.4.0",
     "ora": "^5.4.1",
@@ -74,11 +71,11 @@
     "simple-git": "^2.48.0"
   },
   "devDependencies": {
-    "@babel/cli": "^7.16.0",
-    "@babel/core": "^7.16.5",
-    "@babel/node": "^7.16.5",
+    "@babel/cli": "^7.16.8",
+    "@babel/core": "^7.16.7",
+    "@babel/node": "^7.16.8",
     "@leverege/babel-preset-leverege-node": "^2.0.0",
     "@leverege/eslint-config-leverege": "^3.0.1",
-    "npm": "^8.3.0"
+    "npm": "^8.3.1"
   }
 }

package/src/helm-starters/baseline/Chart.yaml

@@ -0,0 +1,4 @@
+name: <service-name>
+version: 0.1.0
+apiVersion: v2
+icon: https://raw.githubusercontent.com/kubernetes/kubernetes/master/logo/logo.svg

package/src/helm-starters/baseline/templates/NOTES.txt

@@ -0,0 +1,52 @@
+-------------------------------------------------------------------------------
+
+Service: {{ .Chart.Name }}
+
+This service relies on the presence of a Service Account (SA) to define its
+permissions on the clusters that it is deployed to. Verify or create an SA
+with the following name and IAM roles:
+
+   SA name   => {{ .Chart.Name }}
+   IAM roles => pubsub.editor
+                secretmanager.secretAccessor
+
+{{- if .Values.workloadIdentity.disabled }}
+
+Workload Identity is disabled for this service, most likely because this is
+running on a legacy cluster which does not support it. In order for this
+service to function properly a set of JSON keys will need to be generated and
+then stored as a secret using this syntax:
+
+  cat <keyfileName> | kubectl create secret generic {{ .Chart.Name }}-sa-key \
+                                    --from-file=key.json=/dev/stdin
+
+{{- else }}
+
+Workload identity is enabled for this service, therefore the SA must have the
+proper IAM policy bound to it. This can be verified by running:
+
+  $ gcloud iam service-accounts get-iam-policy \
+      --project {{ .Values.service.project_id }} \
+      {{ .Chart.Name }}@{{ .Values.service.project_id }}.iam.gserviceaccount.com
+
+which should return something resembling:
+
+  bindings:
+  - members:
+    - serviceAccount:{{ .Values.service.project_id }}.svc.id.goog[default/<service name>]
+    role: roles/iam.workloadIdentityUser
+  etag: <uuencoded tag>
+  version: 1
+
+If the role of roles/iam.workloadIdentityUser does not appear on the SA then
+run the following command to add it:
+
+  $ gcloud iam service-accounts add-iam-policy-binding \
+      --project {{ .Values.service.project_id }} \
+      --role roles/iam.workloadIdentityUser \
+      --member "serviceAccount:{{ .Values.service.project_id }}.svc.id.goog[default/{{ .Chart.Name }}]" \
+      {{ .Chart.Name }}@{{ .Values.service.project_id }}.iam.gserviceaccount.com
+
+{{- end }}
+
+-------------------------------------------------------------------------------

package/src/helm-starters/baseline/templates/configmap.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Chart.Name }}-configs
+data:
+  {{- toYaml .Values.config | nindent 2 }}

package/src/helm-starters/baseline/templates/deployment.yaml

@@ -0,0 +1,97 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Chart.Name }}
+  labels:
+    app: {{ .Chart.Name }}
+    chart/version: {{ .Values.image.tag }}
+    redis-client: {{ .Values.redis.enabled | quote }}
+spec:
+  selector:
+    matchLabels:
+      app: {{ .Chart.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Chart.Name }}
+        chart/version: {{ .Chart.Version }}
+        chart/appVersion: {{ .Values.image.tag }}
+        redis-client: {{ .Values.redis.enabled | quote }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        prometheus.io/port: "5111"
+        prometheus.io/scrape: "true"
+        configmap.reloader.stakater.com/reload: "default-configs"
+    spec:
+      serviceAccountName: {{ .Chart.Name }}
+      volumes:
+      - name: tmpfs
+        emptyDir: {}
+      {{- if .Values.workloadIdentity.disabled }}
+      - name: google-cloud-key
+        secret:
+          secretName: {{ .Chart.Name }}-sa-key
+      {{- end }}
+      {{- if .Values.service.preemptible }}
+      tolerations:
+      - key: "preemptible"
+        operator: "Equal"
+        value: "true"
+        effect: "NoSchedule"
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - preference:
+              matchExpressions:
+              - key: cloud.google.com/gke-preemptible
+                operator: Exists
+            weight: 100
+      {{- end }}
+      containers:
+      - name: {{ .Chart.Name }}
+        imagePullPolicy: IfNotPresent
+        image: {{ .Values.image.registry }}/{{ .Chart.Name }}:{{ .Values.image.tag }}
+        securityContext:
+          readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFs }}
+          runAsNonRoot: true
+          runAsUser: 1000
+          allowPrivilegeEscalation: false
+        {{ if .Values.probes.enabled }}
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: api
+          initialDelaySeconds: 30
+        livenessProbe:
+          httpGet:
+            path: /livenessProbe
+            port: api
+          initialDelaySeconds: 30
+          periodSeconds: 60
+        {{ end }}
+        resources:
+          limits:
+            cpu: "100m"
+            memory: "256Mi"
+#         requests:
+#           cpu: "100m"
+#           memory: "128Mi"
+        ports:
+        - name: api
+          containerPort: {{ .Values.service.port }}
+          protocol: TCP
+        - name: node-metrics
+          containerPort: 5111
+        volumeMounts:
+        - name: tmpfs
+          mountPath: "/tmp"
+        envFrom: 
+        - configMapRef:
+            name: default-configs
+        - configMapRef:
+            name: {{ .Chart.Name }}-configs
+        env:
+        {{- if .Values.workloadIdentity.disabled }}
+        - name: GOOGLE_APPLICATION_CREDENTIALS
+          value: /var/secrets/google/key.json
+        {{- end }}

package/src/helm-starters/baseline/templates/ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Chart.Name }}
+  labels:
+    app: {{ .Chart.Name }}
+  annotations:
+#   kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: {{ .Chart.Name }}
+spec:
+  tls:
+  - secretName: {{ .Values.ingress.secretName }}
+  defaultBackend:
+    service:
+      name: {{ .Chart.Name }}
+      port:
+        number: {{ .Values.service.port }}

package/src/helm-starters/baseline/templates/pdb.yaml

@@ -0,0 +1,9 @@
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ .Chart.Name }}
+spec:
+  minAvailable: 50%
+  selector:
+    matchLabels:
+      app: app

package/src/helm-starters/baseline/templates/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Chart.Name }}
+spec:
+  type: NodePort
+{{- if .Values.loadbalancer.ip }}
+  loadBalancerIP: {{ .Values.loadbalancer.ip }}
+{{- end }}
+  selector:
+    app: {{ .Chart.Name }}
+  ports:
+  - name: {{ .Chart.Name }}
+    protocol: TCP
+    port: {{ .Values.service.port }}
+    targetPort: {{ .Values.service.port }}

package/src/helm-starters/baseline/templates/serviceaccount.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    iam.gke.io/gcp-service-account: {{ .Chart.Name }}@{{ .Values.service.project_id }}.iam.gserviceaccount.com
+  name: {{ .Chart.Name }}
+  labels:
+    app: {{ .Chart.Name }}
+    chart/version: {{ .Chart.Version }}
+    chart/appVersion: {{ .Values.image.tag }}

package/src/helm-starters/baseline/values.yaml

@@ -0,0 +1,57 @@
+image:
+  tag: v0.1.0
+  registry: gcr.io/leverege-docker-images
+
+# define all config values as quoted strings
+config:
+  # server configs
+  LOG_CONFIG: '{"type":"pino","level":"warn"}'
+
+  # imagine configs
+  logExpressRequests: "false"
+  ALIAS_KEY: "needs-to-be-set"
+  BLUEPRINT_ID: "needs-to-be-set"
+  IMAGINE_URL: "http://api-server:8181"
+  INGESTION_TOPIC: "needs-to-be-set"
+  NETWORK_ID: "needs-to-be-set"
+  SYSTEM_ID: "needs-to-be-set"
+
+# overwhelm will auto inject project_id, host and ingress into service
+service:
+  port: 8383
+  preemptible: true
+
+# can be used to set load balancer to registered static IP
+loadbalancer:
+  ip: nil
+
+# liveness and readiness probe to prove k8s health
+probes:
+  enabled: true
+
+# this tells calico that redis access is needed
+redis:
+  enabled: false
+
+# setting to false will allow pod disk to mount read/write
+# setting this to false should only be done for debugging
+securityContext:
+  readOnlyRootFs: true
+
+horizontalScaler:
+  minReplicas: 2
+  maxReplicas: 3
+  maxCPU: 75
+
+affinity: {}
+
+# typically handled by traefik, but not always
+ingress: {}
+
+nodeSelector: {}
+
+podAnnotations: {}
+
+tolerations: []
+
+workloadIdentity: {}

package/src/helm-starters/deprecated/templates/hpa.yaml

@@ -0,0 +1,12 @@
+apiVersion: autoscaling/v1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ .Chart.Name }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ .Chart.Name }}
+  minReplicas: {{ .Values.horizontalScaler.minReplicas }}
+  maxReplicas: {{ .Values.horizontalScaler.maxReplicas }}
+  targetCPUUtilizationPercentage: {{ .Values.horizontalScaler.maxCPU }}

package/src/pkgck

@@ -9,6 +9,10 @@ good() {
   printf "\e[32m✔${C_off}"
 }
 
+meh() {
+  printf "\e[36m✩${C_off}"
+}
+
 bad() {
   printf "\e[31m✘${C_off}"
 }
@@ -31,6 +35,7 @@ check_babel () {
   local C_stat=$(bad)
   [ -f .babelrc ] && grep --silent @leverege/babel-preset-leverege-node .babelrc
   [ $? -eq 0 ] && C_stat=$(good)
+  [ ! -f .babelrc ] && C_stat=$(meh)
   printf $C_stat
 }
 
@@ -48,7 +53,7 @@ check_eslint () {
 }
 
 check_license () {
-  local C_stat=$(bad)
+  local C_stat=$(meh)
   local lic="`node -p \"require('./package.json').scripts.licenseCheck !== undefined\"`"
   [ $lic == true ] && C_stat=$(good)
   printf $C_stat
@@ -93,6 +98,13 @@ check_scope() {
   printf "${result}${C_off}"
 }
 
+check_ESM() {
+  local C_stat=$(bad)
+  jstype="`getjson --file package.json --key type`"
+  [[ "$jstype" == "module" ]] && C_stat=$(good)
+  printf $C_stat
+}
+
 repos=0
 check_repo() {
   local dir=$1
@@ -118,10 +130,11 @@ check_repo() {
   local babel7=$(check_babel)
   local circle=$(check_circle)
   local eslint=$(check_eslint)
+  local esmlib=$(check_ESM)
   local license=$(check_license)
   local scoped=$(check_scope)
-  [ $(( $repos % 15)) -eq 0 ] && printf "\n%35s pkg      git  cln scop cir lic esl bl7\n"
-  printf "%32s: %-8s %-16s %s  %8s  %s   %s   %s   %s  %s\n" $dir $pkgver $(check_git_version $gitver $pkgver) $localmods $scoped $circle $license $eslint $babel7 "$needspush"
+  [ $(( $repos % 15)) -eq 0 ] && printf "\n%35s pkg      git  cln scop cir lic ESM bl7\n"
+  printf "%32s: %-8s %-16s %s  %8s  %s   %s   %s   %s  %s\n" $dir $pkgver $(check_git_version $gitver $pkgver) $localmods $scoped $circle $license $esmlib $babel7 "$needspush"
   let "repos++"
   cd - &> /dev/null
 }

package/src/sa-tools/roles/baseline/leveregeBigQueryReader.json

@@ -0,0 +1,10 @@
+{
+  "description": "Leverege BQ data accessor",
+  "includedPermissions": [
+    "bigquery.jobs.create",
+    "bigquery.tables.create",
+    "bigquery.tables.getData"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Big Query Reader"
+}

package/src/sa-tools/roles/baseline/leveregeBigQueryWriter.json

@@ -0,0 +1,10 @@
+{
+  "description": "Leverege Big Query Writer",
+  "includedPermissions": [
+    "bigquery.datasets.get",
+    "bigquery.tables.get",
+    "bigquery.tables.updateData"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Big Query Writer"
+}

package/src/sa-tools/roles/baseline/leveregeCloudFunctionsAdmin.json

@@ -0,0 +1,12 @@
+{
+  "description": "Leverege limited Cloud Functions Admin",
+  "includedPermissions": [
+    "cloudfunctions.functions.create",
+    "cloudfunctions.functions.delete",
+    "cloudfunctions.functions.get",
+    "cloudfunctions.functions.sourceCodeSet",
+    "cloudfunctions.functions.update"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Cloud Functions Admin"
+}

package/src/sa-tools/roles/baseline/leveregeFirebaseUpdates.json

@@ -0,0 +1,8 @@
+{
+  "description": "Leverege Firebase Updates Access",
+  "includedPermissions": [
+    "firebasedatabase.instances.update"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Firebase Updates"
+}

package/src/sa-tools/roles/baseline/leveregeLogsViewer.json

@@ -0,0 +1,8 @@
+{
+  "description": "Leverege view access to logs",
+  "includedPermissions": [
+    "logging.logEntries.list"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Logs Viewer"
+}

package/src/sa-tools/roles/{LeveregePubSubAccess.json → baseline/leveregePubSub.json}

@@ -1,6 +1,5 @@
 {
-  "title": "Leverege Pub/Sub Access (rw)",
-  "description": "Read/Write access to the Pub/Sub messaging service",
+  "description": "Leverege Pub/Sub",
   "includedPermissions": [
     "pubsub.subscriptions.consume",
     "pubsub.subscriptions.create",
@@ -9,5 +8,6 @@
     "pubsub.topics.list",
     "pubsub.topics.publish"
   ],
-  "stage": "BETA"
+  "stage": "BETA",
+  "title": "Leverege Pub/Sub"
 }

package/src/sa-tools/roles/baseline/leveregeSecretsViewer.json

@@ -0,0 +1,8 @@
+{
+  "description": "Custom Secrets Manager Access",
+  "includedPermissions": [
+    "secretmanager.versions.access"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Secret Viewer"
+}

package/src/sa-tools/roles/baseline/leveregeStorageObjectAccess.json

@@ -0,0 +1,10 @@
+{
+  "description": "Leverege read / write access to Storage Objects",
+  "includedPermissions": [
+    "storage.objects.create",
+    "storage.objects.delete",
+    "storage.objects.get"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Storage Object Admin"
+}

package/src/sa-tools/roles/baseline/leveregeSvcAcctActor.json

@@ -0,0 +1,8 @@
+{
+  "description": "Leverege service account act as other user",
+  "includedPermissions": [
+    "iam.serviceAccounts.actAs"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Svc Acct Impersonation"
+}

package/src/sa-tools/roles/baseline/leveregeSvcAcctTokenCreator.json

@@ -0,0 +1,8 @@
+{
+  "description": "Leverege IAM blob signing access",
+  "includedPermissions": [
+    "iam.serviceAccounts.signBlob"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Svc Acct Token Creator"
+}

package/src/sa-tools/roles/leverege-dev-john/20220113-121423/leveregeBigQueryReader.json

@@ -0,0 +1,10 @@
+{
+  "description": "Leverege BQ data accessor",
+  "includedPermissions": [
+    "bigquery.jobs.create",
+    "bigquery.tables.create",
+    "bigquery.tables.getData"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Big Query Reader"
+}

package/src/sa-tools/roles/leverege-dev-john/20220113-121423/leveregeBigQueryWriter.json

@@ -0,0 +1,10 @@
+{
+  "description": "Leverege Big Query Writer",
+  "includedPermissions": [
+    "bigquery.datasets.get",
+    "bigquery.tables.get",
+    "bigquery.tables.updateData"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Big Query Writer"
+}

package/src/sa-tools/roles/leverege-dev-john/20220113-121423/leveregeCloudFunctionsAdmin.json

@@ -0,0 +1,12 @@
+{
+  "description": "Leverege limited Cloud Functions Admin",
+  "includedPermissions": [
+    "cloudfunctions.functions.create",
+    "cloudfunctions.functions.delete",
+    "cloudfunctions.functions.get",
+    "cloudfunctions.functions.sourceCodeSet",
+    "cloudfunctions.functions.update"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Cloud Functions Admin"
+}

package/src/sa-tools/roles/leverege-dev-john/20220113-121423/leveregeFirebaseUpdates.json

@@ -0,0 +1,8 @@
+{
+  "description": "Leverege Firebase Updates Access",
+  "includedPermissions": [
+    "firebasedatabase.instances.update"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Firebase Updates"
+}

package/src/sa-tools/roles/leverege-dev-john/20220113-121423/leveregeLogsViewer.json

@@ -0,0 +1,8 @@
+{
+  "description": "Leverege view access to logs",
+  "includedPermissions": [
+    "logging.logEntries.list"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Logs Viewer"
+}

package/src/sa-tools/roles/leverege-dev-john/20220113-121423/leveregePubSub.json

@@ -0,0 +1,13 @@
+{
+  "description": "Leverege Pub/Sub",
+  "includedPermissions": [
+    "pubsub.subscriptions.consume",
+    "pubsub.subscriptions.create",
+    "pubsub.topics.attachSubscription",
+    "pubsub.topics.create",
+    "pubsub.topics.list",
+    "pubsub.topics.publish"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Pub/Sub"
+}

package/src/sa-tools/roles/leverege-dev-john/20220113-121423/leveregeSecretsViewer.json

@@ -0,0 +1,8 @@
+{
+  "description": "Custom Secrets Manager Access",
+  "includedPermissions": [
+    "secretmanager.versions.access"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Secret Viewer"
+}