a13labs.infra/terraform/modules/apps/samba/main.tf

resource "kubernetes_namespace" "samba" {
  metadata {
    name = "samba"
  }
}

resource "kubernetes_service_account" "samba" {

  metadata {
    name      = "samba-sa"
    namespace = kubernetes_namespace.samba.metadata[0].name
  }

  automount_service_account_token = false
}

resource "kubernetes_secret" "samba_secrets" {
  metadata {
    name      = "samba-credentials"
    namespace = kubernetes_namespace.samba.metadata[0].name
  }

  data = {
    USERNAME = var.samba_username
    PASSWORD = var.samba_password
  }
}

resource "kubernetes_config_map" "samba_config" {
  metadata {
    name      = "samba-config"
    namespace = kubernetes_namespace.samba.metadata[0].name
  }

  data = {
    "smb.conf" = local.samba_config
  }

}

resource "kubernetes_deployment" "samba" {
  metadata {
    name      = "samba"
    namespace = kubernetes_namespace.samba.metadata[0].name
    labels = {
      samba = "samba"
    }
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        samba = "samba"
      }
    }

    strategy {
      type = "RollingUpdate"
    }

    template {
      metadata {
        labels = {
          samba = "samba"
        }
        annotations = {
          "smb_conf_checksum" = local.samba_config_hash
        }
      }

      spec {
        service_account_name            = kubernetes_service_account.samba.metadata[0].name
        automount_service_account_token = false

        container {
          name  = "samba"
          image = "dockurr/samba:${local.samba_version}"


          security_context {
            allow_privilege_escalation = false
          }

          port {
            name           = "smb-1"
            container_port = 445
            host_port      = var.host_port_enabled ? 445 : null
            protocol       = "TCP"
          }

          port {
            name           = "smb-2"
            container_port = 139
            host_port      = var.host_port_enabled ? 139 : null
            protocol       = "TCP"
          }

          env {
            name = "USER"
            value_from {
              secret_key_ref {
                name = kubernetes_secret.samba_secrets.metadata[0].name
                key  = "USERNAME"
              }
            }
          }

          env {
            name = "PASS"
            value_from {
              secret_key_ref {
                name = kubernetes_secret.samba_secrets.metadata[0].name
                key  = "PASSWORD"
              }
            }
          }

          volume_mount {
            name       = "samba-config"
            mount_path = "/etc/samba/smb.conf"
            sub_path   = "smb.conf"
            read_only  = true
          }

          dynamic "volume_mount" {
            for_each = var.shares
            content {
              name       = lower("samba-share-${volume_mount.value.name}")
              mount_path = "/host/${volume_mount.value.path}"
            }
          }
        }

        volume {
          name = "samba-config"
          config_map {
            name = kubernetes_config_map.samba_config.metadata[0].name
            items {
              key  = "smb.conf"
              path = "smb.conf"
            }
          }
        }
        dynamic "volume" {
          for_each = var.shares
          content {
            name = lower("samba-share-${volume.value.name}")
            host_path {
              path = volume.value.path
              type = "DirectoryOrCreate"
            }
          }
        }
      }
    }
  }

  lifecycle {
    ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
  }
}

resource "kubernetes_service" "smb" {
  metadata {
    name      = "smb"
    namespace = kubernetes_namespace.samba.metadata[0].name
  }

  spec {
    selector = {
      samba = "samba"
    }

    port {
      name        = "smb"
      port        = 445
      target_port = 445
    }

    type = "ClusterIP"
  }

  lifecycle {
    ignore_changes = [
      metadata[0].annotations
    ]
  }
}

resource "kubernetes_service" "netbios" {
  metadata {
    name      = "netbios"
    namespace = kubernetes_namespace.samba.metadata[0].name
  }

  spec {
    selector = {
      samba = "samba"
    }

    port {
      name        = "netbios"
      port        = 139
      target_port = 139
    }

    type = "ClusterIP"
  }

  lifecycle {
    ignore_changes = [
      metadata[0].annotations
    ]
  }

}