feat(cert-checker): add Kubernetes resources for certificate checking functionality

- Implemented a new module for cert-checker with Kubernetes resources including ServiceAccount, Role, RoleBinding, ConfigMap, and CronJob.
- Added Python script to check certificate expiry and restart deployments if necessary.
- Configured environment variables for deployment name, namespace, and service details.
- Included requirements for the Python environment.

feat(devolo-exporter): introduce Devolo exporter for Prometheus metrics

- Created a new module for Devolo exporter with Kubernetes resources including ServiceAccount, ConfigMap, Deployment, and Service.
- Developed Python scripts to scrape metrics from Devolo devices and expose them to Prometheus.
- Configured environment variables for Devolo device IP, model, and ports.
- Added requirements for the Python environment.

terraform/modules/apps/samba/config.tf

@@ -1,4 +1,9 @@
 locals {
   samba_version = var.tag
+
+  samba_config = templatefile("${path.module}/resources/samba.conf.tpl", {
+    shares = var.shares
+  })
+  samba_config_hash = sha256(local.samba_config)
 }
 

terraform/modules/apps/samba/main.tf

@@ -26,6 +26,18 @@ resource "kubernetes_secret" "samba_secrets" {
   }
 }
 
+resource "kubernetes_config_map" "samba_config" {
+  metadata {
+    name      = "samba-config"
+    namespace = kubernetes_namespace.samba.metadata[0].name
+  }
+
+  data = {
+    "smb.conf" = local.samba_config
+  }
+
+}
+
 resource "kubernetes_deployment" "samba" {
   metadata {
     name      = "samba"
@@ -45,7 +57,7 @@ resource "kubernetes_deployment" "samba" {
     }
 
     strategy {
-      type = "Recreate"
+      type = "RollingUpdate"
     }
 
     template {
@@ -71,14 +83,14 @@ resource "kubernetes_deployment" "samba" {
           port {
             name           = "smb-1"
             container_port = 445
-            host_port      = 445
+            host_port      = var.host_port_enabled ? 445 : null
             protocol       = "TCP"
           }
 
           port {
             name           = "smb-2"
             container_port = 139
-            host_port      = 139
+            host_port      = var.host_port_enabled ? 139 : null
             protocol       = "TCP"
           }
 
@@ -103,15 +115,39 @@ resource "kubernetes_deployment" "samba" {
           }
 
           volume_mount {
-            name       = "storage"
-            mount_path = "/storage"
+            name       = "samba-config"
+            mount_path = "/etc/samba/smb.conf"
+            sub_path   = "smb.conf"
+            read_only  = true
+          }
+
+          dynamic "volume_mount" {
+            for_each = var.shares
+            content {
+              name       = lower("samba-share-${volume_mount.value.name}")
+              mount_path = "/host/${volume_mount.value.path}"
+            }
           }
         }
 
         volume {
-          name = "storage"
-          host_path {
-            path = var.shared_folder
+          name = "samba-config"
+          config_map {
+            name = kubernetes_config_map.samba_config.metadata[0].name
+            items {
+              key  = "smb.conf"
+              path = "smb.conf"
+            }
+          }
+        }
+        dynamic "volume" {
+          for_each = var.shares
+          content {
+            name = lower("samba-share-${volume.value.name}")
+            host_path {
+              path = volume.value.path
+              type = "DirectoryOrCreate"
+            }
           }
         }
       }
@@ -123,9 +159,9 @@ resource "kubernetes_deployment" "samba" {
   }
 }
 
-resource "kubernetes_service" "samba" {
+resource "kubernetes_service" "smb" {
   metadata {
-    name      = "samba-ports"
+    name      = "smb"
     namespace = kubernetes_namespace.samba.metadata[0].name
   }
 
@@ -140,7 +176,7 @@ resource "kubernetes_service" "samba" {
       target_port = 445
     }
 
-    type = "LoadBalancer"
+    type = "ClusterIP"
   }
 
   lifecycle {
@@ -149,3 +185,31 @@ resource "kubernetes_service" "samba" {
     ]
   }
 }
+
+resource "kubernetes_service" "netbios" {
+  metadata {
+    name      = "netbios"
+    namespace = kubernetes_namespace.samba.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      samba = "samba"
+    }
+
+    port {
+      name        = "netbios"
+      port        = 139
+      target_port = 139
+    }
+
+    type = "ClusterIP"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+
+}

terraform/modules/apps/samba/resources/samba.conf.tpl

@@ -0,0 +1,23 @@
+[global]
+        server string = samba
+        idmap config * : range = 3000-7999
+        security = user
+        server min protocol = SMB2
+
+        # disable printing services
+        load printers = no
+        printing = bsd
+        printcap name = /dev/null
+        disable spoolss = yes
+
+%{for share in shares ~}
+[${share.name}]
+        path = /host/${share.path}
+        comment = ${share.comment}
+        valid users = ${join(", ", share.valid_users)}
+        browseable = ${share.browseable}
+        writable = ${share.writable}
+        read only = ${share.read_only}
+        force user = ${share.force_user}
+        force group = ${share.force_group}
+%{endfor ~}

terraform/modules/apps/samba/variables.tf

@@ -4,9 +4,19 @@ variable "tag" {
   default     = "latest"
 }
 
-variable "shared_folder" {
+variable "shares" {
   description = "Path to the shared folder on the host"
-  type        = string
+  type = list(object({
+    name        = string
+    path        = string
+    comment     = string
+    valid_users = optional(list(string), ["@smb"])
+    browseable  = optional(bool, true)
+    writable    = optional(bool, true)
+    read_only   = optional(bool, false)
+    force_user  = optional(string, "root")
+    force_group = optional(string, "root")
+  }))
 }
 
 variable "samba_username" {
@@ -21,3 +31,9 @@ variable "samba_password" {
   default     = "samba"
   sensitive   = true
 }
+
+variable "host_port_enabled" {
+  description = "Enable hostPort for SMB ports (445 and 139). Useful for direct access on the node IP."
+  type        = bool
+  default     = false
+}