@ydkn/pulumi-components 0.4.2 → 0.4.3

package/lib/samba/deployment.ts

@@ -0,0 +1,305 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import * as crypto from "crypto";
+import { ComponentResource } from "../common";
+import * as kubernetes from "../kubernetes";
+import { AvahiService } from "./avahiService";
+
+export interface User {
+  name: string;
+  uid: number;
+}
+
+export interface SambaArgs {
+  namespace?: pulumi.Input<string>;
+  serverName: pulumi.Input<string>;
+  workgroup: pulumi.Input<string>;
+  deviceModel: pulumi.Input<string>;
+  hostname: pulumi.Input<string>;
+  users: pulumi.Input<pulumi.Input<User>[]>;
+  volumes?: { [key: string]: pulumi.Input<string> };
+  serviceType?: pulumi.Input<string>;
+  avahiLabelName?: pulumi.Input<string>;
+  storageClassName?: pulumi.Input<string>;
+  protect?: boolean;
+}
+
+export class Samba extends ComponentResource {
+  private static readonly vetoFiles = [
+    ".apdisk",
+    ".DS_Store",
+    "._.DS_Store",
+    ".TemporaryItems",
+    "._.TemporaryItems",
+    ".Trashes",
+    "desktop.ini",
+    "ehthumbs.db",
+    "Network Trash Folder",
+    "Temporary Items",
+    "Thumbs.db",
+  ];
+
+  private readonly settings: k8s.core.v1.ConfigMap;
+  private readonly dataVolumeClaim: k8s.core.v1.PersistentVolumeClaim;
+  private readonly deployment: k8s.apps.v1.Deployment;
+  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
+  private readonly service: k8s.core.v1.Service;
+  private readonly avahiService?: AvahiService;
+  public readonly namespace: pulumi.Output<string>;
+  public readonly hostname: pulumi.Output<string>;
+
+  /**
+   * Create a new Samba resource.
+   * @param name The name of the Samba resource.
+   * @param args A bag of arguments to control the Samba creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: SambaArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("samba", name, args, opts);
+
+    if (args.serviceType === undefined) {
+      args.serviceType = "LoadBalancer";
+    }
+
+    opts = this.opts(k8s.Provider);
+
+    this.hostname = pulumi.output(args.hostname);
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "samba",
+        "app.kubernetes.io/component": "samba",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    const sambaConfig = [
+      "[global]",
+      `workgroup = ${args.workgroup}`,
+      `server string = ${args.serverName}`,
+      `netbios name = ${args.serverName}`,
+      "server role = standalone server",
+      "log file = /dev/stdout",
+      "max log size = 50",
+      "dns proxy = no",
+      "map to guest = bad user",
+      "usershare allow guests = no",
+      "client ipc min protocol = SMB2",
+      "client ipc max protocol = SMB3",
+      "client min protocol = SMB2",
+      "client max protocol = SMB3",
+      "server min protocol = SMB2",
+      "server max protocol = SMB3",
+      "follow symlinks = yes",
+      "load printers = no",
+      "printing = bsd",
+      "printcap name = /dev/null",
+      "disable spoolss = yes",
+      "aio read size = 0",
+      "aio write size = 0",
+      "posix locking = no",
+      "strict locking = no",
+      "follow symlinks = yes",
+      "unix extensions = yes",
+      "wide links = no",
+      "mangled names = no",
+      "unix charset = UTF-8",
+      "acl allow execute always = yes",
+      "vfs objects = catia fruit",
+      "fruit:aapl = yes",
+      "fruit:delete_empty_adfiles = yes",
+      "fruit:time machine = yes",
+      "fruit:veto_appledouble = yes",
+      "fruit:wipe_intentionally_left_blank_rfork = yes",
+      `fruit:model = ${args.deviceModel}`,
+      "fruit:locking = none",
+      "ea support = no",
+      "kernel oplocks = no",
+      "oplocks = no",
+      "level2 oplocks = no",
+    ];
+
+    const shareVolumes: any[] = [];
+    const shareVolumeMounts: any[] = [];
+
+    if (args.volumes !== undefined) {
+      for (const shareName in args.volumes) {
+        // eslint-disable-next-line security/detect-object-injection
+        const volume = args.volumes[shareName];
+
+        const shasum = crypto.createHash("sha1");
+        shasum.update(shareName);
+        const volumeName = shasum.digest("hex");
+
+        shareVolumes.push(
+          pulumi.all([volume]).apply((o) => {
+            return { name: volumeName, persistentVolumeClaim: { claimName: o[0] } };
+          })
+        );
+
+        const mountPath = `/shares/${volumeName}`;
+
+        shareVolumeMounts.push({ name: volumeName, mountPath });
+
+        sambaConfig.push(
+          `[${shareName}]`,
+          `comment = ${shareName}`,
+          `path = ${mountPath}`,
+          "browseable = yes",
+          "read only = no",
+          "guest ok = no",
+          `veto files = /${Samba.vetoFiles.join("/")}/`,
+          "delete veto files = yes"
+        );
+      }
+    }
+
+    const containerArgs = pulumi.all([args.users]).apply((o) => {
+      const cmds = ["mkdir -p /var/lib/samba/private"];
+
+      for (const user of o[0]) {
+        cmds.push(`adduser -s /bin/false -D -u ${user.uid} "${user.name}"`);
+      }
+
+      cmds.push("/usr/bin/samba.sh -n");
+
+      return ["-c", cmds.join(" && ")];
+    });
+
+    this.settings = new k8s.core.v1.ConfigMap(
+      `${name}-config`,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-config` },
+        data: {
+          "smb.conf": sambaConfig.join("\n"),
+        },
+      },
+      opts
+    );
+
+    const dataVolumeClaimName = pulumi.interpolate`${name}-data`;
+
+    this.dataVolumeClaim = new k8s.core.v1.PersistentVolumeClaim(
+      `${name}-data`,
+      {
+        metadata: { ...metadata, name: dataVolumeClaimName },
+        spec: {
+          storageClassName: args.storageClassName,
+          accessModes: ["ReadWriteOnce"],
+          resources: { requests: { storage: "128Mi" } },
+        },
+      },
+      { ...opts, protect: args.protect }
+    );
+
+    this.deployment = new k8s.apps.v1.Deployment(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: { matchLabels: metadata.labels },
+          strategy: { type: "Recreate" },
+          replicas: 1,
+          template: {
+            metadata: {
+              labels: metadata.labels,
+              annotations: { "backup.velero.io/backup-volumes": "data" },
+            },
+            spec: {
+              containers: [
+                {
+                  name: "samba",
+                  image: "dperson/samba:latest",
+                  imagePullPolicy: "Always",
+                  command: ["/bin/sh"],
+                  args: containerArgs,
+                  ports: [
+                    { containerPort: 137, protocol: "UDP", name: "netbios-ns" },
+                    { containerPort: 138, protocol: "UDP", name: "netbios-dgm" },
+                    { containerPort: 139, protocol: "TCP", name: "netbios-ssn" },
+                    { containerPort: 445, protocol: "TCP", name: "microsoft-ds" },
+                  ],
+                  readinessProbe: {
+                    exec: { command: ["smbclient", "-L", "\\\\localhost", "-U", "%", "-m", "SMB3"] },
+                    periodSeconds: 20,
+                    failureThreshold: 3,
+                    successThreshold: 1,
+                    timeoutSeconds: 10,
+                  },
+                  livenessProbe: {
+                    exec: { command: ["smbclient", "-L", "\\\\localhost", "-U", "%", "-m", "SMB3"] },
+                    periodSeconds: 20,
+                    failureThreshold: 3,
+                    successThreshold: 1,
+                    timeoutSeconds: 10,
+                  },
+                  resources: {
+                    requests: { memory: "256Mi" },
+                    limits: { memory: "512Mi" },
+                  },
+                  volumeMounts: [
+                    { name: "config", mountPath: "/etc/samba" },
+                    { name: "data", mountPath: "/var/lib/samba" },
+                  ].concat(shareVolumeMounts),
+                },
+              ],
+              volumes: [
+                { name: "config", configMap: { name: this.settings.metadata.name } },
+                { name: "data", persistentVolumeClaim: { claimName: dataVolumeClaimName } },
+              ].concat(shareVolumes),
+            },
+          },
+        },
+      },
+      opts
+    );
+
+    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
+      name,
+      {
+        metadata,
+        spec: {
+          minAvailable: 1,
+          selector: { matchLabels: metadata.labels },
+        },
+      },
+      opts
+    );
+
+    this.service = new kubernetes.v1.Service(
+      name,
+      {
+        metadata,
+        spec: {
+          type: args.serviceType,
+          selector: metadata.labels,
+          ports: [{ name: "microsoft-ds", protocol: "TCP", port: 445, targetPort: "microsoft-ds" }],
+        },
+        hostnames: [args.hostname],
+      },
+      { ...opts, dependsOn: [this.deployment] }
+    );
+
+    if (args.avahiLabelName !== undefined) {
+      this.avahiService = new AvahiService(
+        name,
+        {
+          labelName: args.avahiLabelName,
+          metadata,
+          serverName: args.serverName,
+          hostname: args.hostname,
+          deviceModel: args.deviceModel,
+        },
+        opts
+      );
+    }
+
+    this.registerOutputs();
+  }
+}

package/lib/samba/index.ts

@@ -0,0 +1,5 @@
+import { User, SambaArgs, Samba } from "./deployment";
+import { AvahiServiceArgs, AvahiService } from "./avahiService";
+import { localPathVolumesFromConfig, nfsVolumesFromConfig } from "./volumes";
+
+export { User, SambaArgs, Samba, AvahiServiceArgs, AvahiService, localPathVolumesFromConfig, nfsVolumesFromConfig };

package/lib/samba/volumes.ts

@@ -0,0 +1,70 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import * as kubernetes from "../kubernetes";
+
+export interface Volumes {
+  [key: string]: pulumi.Output<string>;
+}
+
+export interface LocalPathVolumesArgs {
+  name: string;
+}
+
+export interface LocalPathArgs {
+  metadata: pulumi.Input<k8s.types.input.meta.v1.ObjectMeta>;
+  volumes: { [key: string]: LocalPathVolumesArgs };
+  storageClassName?: pulumi.Input<string>;
+}
+
+export function localPathVolumesFromConfig(args: LocalPathArgs, opts?: pulumi.CustomResourceOptions): Volumes {
+  const volumes: Volumes = {};
+
+  for (const name in args.volumes) {
+    // eslint-disable-next-line security/detect-object-injection
+    const config = args.volumes[name];
+
+    // eslint-disable-next-line no-unused-vars
+    const pvc = new k8s.core.v1.PersistentVolumeClaim(
+      name,
+      {
+        metadata: { ...args.metadata, name },
+        spec: {
+          storageClassName: args.storageClassName ?? "local-path",
+          accessModes: ["ReadWriteOnce"],
+          resources: { requests: { storage: "1Gi" } },
+        },
+      },
+      opts
+    );
+
+    volumes[config.name] = pulumi.output(name);
+  }
+
+  return volumes;
+}
+
+export interface NfsVolumeArgs extends kubernetes.v1.NfsVolumeConfig {
+  name: string;
+}
+
+export interface NfsArgs {
+  metadata: pulumi.Input<k8s.types.input.meta.v1.ObjectMeta>;
+  volumes: { [key: string]: NfsVolumeArgs };
+  storageClassName?: pulumi.Input<string>;
+}
+
+export function nfsVolumesFromConfig(args: NfsArgs, opts?: pulumi.CustomResourceOptions): Volumes {
+  const volumes: Volumes = {};
+
+  for (const name in args.volumes) {
+    // eslint-disable-next-line security/detect-object-injection
+    const config = args.volumes[name];
+
+    // eslint-disable-next-line no-unused-vars
+    const pvc = kubernetes.v1.NfsVolume.fromConfig(name, { metadata: { ...args.metadata, name }, config }, opts);
+
+    volumes[config.name] = pulumi.output(name);
+  }
+
+  return volumes;
+}

package/lib/ssh/exec.ts

@@ -0,0 +1,162 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as ssh from "ssh2";
+import { ConnectionArgs, ConnectionArgsInternal } from "./types";
+
+interface ExecResult {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+}
+
+function sshCommand(connection: pulumi.Unwrap<ConnectionArgs>, cmd: string, finishDelay?: number): Promise<ExecResult> {
+  const connectionRetryFactor = connection.retryBackoffFactor || 1.2;
+  const initialDelay = connection.initialDelay || 0;
+  let connectionFailCount = connection.retries || 10;
+  let connectionRetryDelay = connection.retryIntialBackoff || 500;
+
+  return new Promise((resolve, reject) => {
+    const sshConnection = new ssh.Client();
+
+    function retryFunc() {
+      sshConnection
+        .on("ready", () => {
+          sshConnection.exec(cmd, (err, stream) => {
+            if (err) {
+              reject(err);
+
+              return;
+            }
+
+            let stdout = "";
+            let stderr = "";
+
+            stream
+              .on("close", (exitCode: number, signal: any) => {
+                sshConnection.end();
+
+                if (exitCode) {
+                  reject(new Error("Command exited with " + exitCode));
+                } else {
+                  setTimeout(function () {
+                    resolve({ exitCode, stdout, stderr });
+                  }, finishDelay || 0);
+                }
+              })
+              .on("data", (data: any) => {
+                stdout += data.toString("utf8");
+              })
+              .stderr.on("data", (data) => {
+                stderr += data.toString("utf8");
+              });
+          });
+        })
+        .on("error", (err) => {
+          connectionFailCount--;
+          connectionRetryDelay *= connectionRetryFactor;
+
+          if (connectionFailCount < 0) {
+            reject(err);
+          } else {
+            setTimeout(retryFunc, Math.round(connectionRetryDelay));
+          }
+        })
+        .connect({
+          host: connection.host,
+          port: connection.port ?? 22,
+          username: connection.username,
+          password: connection.password,
+          privateKey: connection.privateKey,
+          passphrase: connection.privateKeyPassphrase,
+        });
+    }
+
+    setTimeout(retryFunc, initialDelay);
+  });
+}
+
+export interface ExecArgs {
+  /**
+   * SSH connection details
+   */
+  connection: pulumi.Input<ConnectionArgs>;
+  /**
+   * Command to run
+   */
+  command: pulumi.Input<string>;
+  /**
+   * Optional: Change token
+   */
+  changeToken?: pulumi.Input<string>;
+  /**
+   * Optional: Finish delay
+   */
+  finishDelay?: pulumi.Input<number>;
+}
+
+interface ProviderInputs {
+  connection: ConnectionArgsInternal;
+  command: string;
+  changeToken?: string;
+  finishDelay?: number;
+}
+
+export class Exec extends pulumi.dynamic.Resource {
+  public readonly exitCode!: pulumi.Output<number>;
+  public readonly stdout!: pulumi.Output<string>;
+  public readonly stderr!: pulumi.Output<string>;
+
+  /**
+   * Create a new SSH exec resource.
+   * @param name The name of the SSH exec resource.
+   * @param args A bag of arguments to control the SSH exec creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: ExecArgs, opts?: pulumi.ComponentResourceOptions) {
+    const provider: pulumi.dynamic.ResourceProvider = {
+      async diff(id: pulumi.ID, olds: ProviderInputs, news: ProviderInputs): Promise<pulumi.dynamic.DiffResult> {
+        const replaces = [];
+
+        for (const [nKey, nValue] of Object.entries(news)) {
+          if (nKey === "__provider") {
+            continue;
+          }
+
+          let keyFound = false;
+
+          for (const [oKey, oValue] of Object.entries(olds)) {
+            if (oKey === "__provider") {
+              continue;
+            }
+
+            if (nKey === oKey) {
+              keyFound = true;
+
+              if (JSON.stringify(nValue) !== JSON.stringify(oValue)) {
+                replaces.push(nKey);
+              }
+            }
+          }
+
+          if (!keyFound) {
+            replaces.push(nKey);
+          }
+        }
+
+        return { changes: replaces.length > 0, replaces, deleteBeforeReplace: true };
+      },
+      async create(inputs: ProviderInputs): Promise<pulumi.dynamic.CreateResult> {
+        return sshCommand(inputs.connection, inputs.command, inputs.finishDelay).then((r) => {
+          return {
+            id: require("uuid").v4(),
+            outs:
+              r.exitCode === 0
+                ? { exitCode: r.exitCode, stdout: "", stderr: "", ...inputs }
+                : { exitCode: r.exitCode, stdout: r.stdout, stderr: r.stderr, ...inputs },
+          };
+        });
+      },
+    };
+
+    super(provider, name, { exitCode: undefined, stdout: undefined, stderr: undefined, ...args }, opts);
+  }
+}

package/lib/ssh/file.ts

@@ -0,0 +1,165 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as Sftp from "ssh2-sftp-client";
+import * as crypto from "crypto";
+import * as fs from "fs";
+import { ConnectionArgs, ConnectionArgsInternal } from "./types";
+
+function sshFileCreate(
+  connection: pulumi.Unwrap<ConnectionArgs>,
+  dst: string,
+  srcFile?: string,
+  srcData?: string | Buffer
+): Promise<boolean> {
+  const connectionRetryFactor = connection.retryBackoffFactor || 1.2;
+  const initialDelay = connection.initialDelay || 0;
+  let connectionFailCount = connection.retries || 10;
+  let connectionRetryDelay = connection.retryIntialBackoff || 500;
+
+  return new Promise((resolve, reject) => {
+    function retryFunc() {
+      if (srcFile === undefined && srcData === undefined) {
+        reject(new Error("Must provide either srcFile or srcData"));
+      }
+
+      const client = new Sftp();
+
+      client
+        .connect({
+          host: connection.host,
+          port: connection.port ?? 22,
+          username: connection.username,
+          password: connection.password,
+          privateKey: connection.privateKey,
+          passphrase: connection.privateKeyPassphrase,
+        })
+        .then(() => {
+          if (srcFile !== undefined) {
+            return client.put(srcFile, dst);
+          } else {
+            if (srcData instanceof Buffer) {
+              return client.put(srcData, dst);
+            }
+
+            return client.put(Buffer.from(srcData as string), dst);
+          }
+        })
+        .then(() => {
+          client.end();
+
+          resolve(true);
+        })
+        .catch((err) => {
+          connectionFailCount--;
+          connectionRetryDelay *= connectionRetryFactor;
+
+          if (connectionFailCount < 0) {
+            reject(err);
+          } else {
+            setTimeout(retryFunc, Math.round(connectionRetryDelay));
+          }
+        });
+    }
+
+    setTimeout(retryFunc, initialDelay);
+  });
+}
+
+export interface FileSourceArgs {
+  /**
+   * Source file
+   */
+  file?: pulumi.Input<string>;
+  /**
+   * Source data
+   */
+  data?: pulumi.Input<string | Buffer>;
+}
+
+export interface FileArgs {
+  /**
+   * SSH connection details
+   */
+  connection: pulumi.Input<ConnectionArgs>;
+  /**
+   * Source
+   */
+  src: pulumi.Input<FileSourceArgs>;
+  /**
+   * Destination file
+   */
+  dst: pulumi.Input<string>;
+  /**
+   * Optional: Change token
+   */
+  changeToken?: pulumi.Input<string>;
+}
+
+interface ProviderInputs {
+  connection: ConnectionArgsInternal;
+  src: { file?: string; data?: string | Buffer };
+  dst: string;
+  changeToken?: string;
+}
+
+export class File extends pulumi.dynamic.Resource {
+  /**
+   * Create a new SSH file resource.
+   * @param name The name of the SSH file resource.
+   * @param args A bag of arguments to control the SSH file creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: FileArgs, opts?: pulumi.ComponentResourceOptions) {
+    const provider: pulumi.dynamic.ResourceProvider = {
+      async diff(id: pulumi.ID, olds: ProviderInputs, news: ProviderInputs): Promise<pulumi.dynamic.DiffResult> {
+        const replaces = [];
+
+        for (const [nKey, nValue] of Object.entries(news)) {
+          if (nKey === "__provider") {
+            continue;
+          }
+
+          let keyFound = false;
+
+          for (const [oKey, oValue] of Object.entries(olds)) {
+            if (oKey === "__provider") {
+              continue;
+            }
+
+            if (nKey === oKey) {
+              keyFound = true;
+
+              if (JSON.stringify(nValue) !== JSON.stringify(oValue)) {
+                replaces.push(nKey);
+              }
+            }
+          }
+
+          if (!keyFound) {
+            replaces.push(nKey);
+          }
+        }
+
+        return { changes: replaces.length > 0, replaces, deleteBeforeReplace: true };
+      },
+      async create(inputs: ProviderInputs): Promise<pulumi.dynamic.CreateResult> {
+        return sshFileCreate(inputs.connection, inputs.dst, inputs.src.file, inputs.src.data).then((r) => {
+          return {
+            id: require("uuid").v4(),
+            outs: inputs,
+          };
+        });
+      },
+    };
+
+    super(provider, name, args, opts);
+  }
+
+  public static changeToken(str: string): string {
+    return crypto.createHash("sha1").update(str, "utf8").digest("hex");
+  }
+
+  public static fileChangeToken(filename: string): string {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
+    return this.changeToken(fs.readFileSync(filename, "utf-8"));
+  }
+}