infra4talos/apps-kustomized/sshfs2smb/all.yaml

---
# Source: samba4/templates/secret.yaml
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: sshfs2smb-samba4-users
  labels:
    app.kubernetes.io/name: samba4
    helm.sh/chart: samba4-0.1.2
    app.kubernetes.io/instance: sshfs2smb
    app.kubernetes.io/managed-by: Helm
data:
  create-users: Cm1hcnR5bjo1NjQ2MjgK
---
# Source: samba4/templates/configmap-smbconf.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: sshfs2smb-samba4-smbconf
  labels:
    app.kubernetes.io/name: samba4
    helm.sh/chart: samba4-0.1.2
    app.kubernetes.io/instance: sshfs2smb
    app.kubernetes.io/managed-by: Helm
data:
  smb.conf: |-
      [global]
          workgroup = WORKGROUP
          client min protocol = NT1
          server string = %h server (Samba, Alpine)
          security = user
          map to guest = Bad User
          username map script = /bin/echo
          encrypt passwords = yes
          load printers = no
          printing = bsd
          printcap name = /dev/null
          disable spoolss = yes
          disable netbios = yes
          server role = standalone
          server services = -dns, -nbt
          smb ports = 445
          log level = 3
      
      [data]
          path = /data
          comment = ZFS
          browseable = yes
          writable = yes
      
      [slskd]
          path = /slskd
          comment = ZFS
          browseable = yes
          writable = yes
      
      
      ;EOF way past actual end of file
---
# Source: samba4/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: sshfs2smb-samba4
  labels:
    app.kubernetes.io/name: samba4
    helm.sh/chart: samba4-0.1.2
    app.kubernetes.io/instance: sshfs2smb
    app.kubernetes.io/managed-by: Helm
spec:
  type: LoadBalancer
  ports:
    - port: 445
      targetPort: cifs
      protocol: TCP
      name: cifs
  selector:
    app.kubernetes.io/name: samba4
    app.kubernetes.io/instance: sshfs2smb
---
# Source: samba4/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sshfs2smb-samba4
  labels:
    app.kubernetes.io/name: samba4
    helm.sh/chart: samba4-0.1.2
    app.kubernetes.io/instance: sshfs2smb
    app.kubernetes.io/managed-by: Helm
  annotations:
    checksum/smbconf: 06dca33a92ca86d1fdbe7571c545dda4394b79761c17728fdfece3db66f24ef3
    checksum/users: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: samba4
      app.kubernetes.io/instance: sshfs2smb
  template:
    metadata:
      labels:
        app.kubernetes.io/name: samba4
        app.kubernetes.io/instance: sshfs2smb
      annotations:
        checksum/smbconf: 06dca33a92ca86d1fdbe7571c545dda4394b79761c17728fdfece3db66f24ef3
        checksum/users: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
    spec:
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
      containers:
        - name: samba4
          image: "alpine"
          command:
          - /bin/sh
          - -c
          - "apk add samba sshfs; mkdir /data; mkdir /slskd; mkdir ~/.ssh; cp /keyfile/keyfile ~/.ssh; ssh-keyscan 75.102.10.189 >~/.ssh/known_hosts ; chmod 600 ~/.ssh/keyfile; sed -i s/'^#user_allow_other'/'user_allow_other'/ /etc/fuse.conf ; sshfs debian-transmission@75.102.10.189:/var/lib/transmission-daemon/downloads /data -o IdentityFile=~/.ssh/keyfile,uid=1000,gid=1000,allow_other && sshfs slskd-docker@75.102.10.189:/slskd /slskd -o IdentityFile=~/.ssh/keyfile,uid=1000,gid=1000,allow_other && cd /scripts && sh ./k8s.sh"
          imagePullPolicy: IfNotPresent
          ports:
            - name: cifs
              containerPort: 445
              protocol: TCP
          livenessProbe:
            exec:
              command:
                - /bin/sh
                - -c
                - "echo | smbclient -L 127.0.0.1"
          readinessProbe:
            tcpSocket:
              port: cifs
          resources:
            {}
          volumeMounts:
          - mountPath: /secrets
            name: users
          - mountPath: /etc/samba/smb.conf
            name: smbconf
            subPath: smb.conf
          - mountPath: /privatepersist
            name: private
          - mountPath: /dev/fuse
            name: fusedev
          - mountPath: /keyfile
            name: keyfile
          - mountPath: /scripts
            name: scripts
          securityContext:
            privileged: true
            capabilities:
              add:
              - SYS_ADMIN
      volumes:
      - name: smbconf
        configMap:
          name: sshfs2smb-samba4-smbconf
          defaultMode: 0644
          items:
          - key: smb.conf
            path: smb.conf
      - name: users
        secret:
          secretName: sshfs2smb-samba4-users
          defaultMode: 0600

      - name: private

        emptyDir: {}
      - name: fusedev
        hostPath:
          path: /dev/fuse
      - name: keyfile
        secret:
          secretName: keyfile
          defaultMode: 0600
      - name: scripts
        configMap:
          name: sshfs2smb-samba4-packagescripts
          defaultMode: 0555
          items:
          - key: k8s.sh
            path: k8s.sh
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: sshfs2smb-samba4-packagescripts
  labels:
    app.kubernetes.io/name: samba4
    helm.sh/chart: samba4-0.1.2
    app.kubernetes.io/instance: sshfs2smb
    app.kubernetes.io/managed-by: Helm
data:
  k8s.sh: |-
      #!/bin/sh
      #passwd files need to be stored on the persistent storage
      if [ ! -f /privatepersist/etc/passwd ]; then
        mkdir -p /privatepersist/etc
        cp /etc/passwd /privatepersist/etc/passwd
      fi
      rm -f /etc/passwd
      ln -s /privatepersist/etc/passwd /etc/passwd
      #tdb files need to be stored on the persistent storage
      if [ ! -f /privatepersist/varlibsamba/private/passdb.tdb ]; then
        mkdir /privatepersist/varlibsamba
        tar c -C /var/lib/samba . | tar x -C /privatepersist/varlibsamba
      fi
      rm -rf /var/lib/samba
      ln -s /privatepersist/varlibsamba /var/lib/samba
      #create required users
      if ! md5sum -c /privatepersist/k8s-users-checksum > /dev/null 2>&1; then
        rm /var/lib/samba/private/passdb.tdb
        if [ -s /secrets/create-users ]; then
          for line in $(cat /secrets/create-users); do
            USER=$(echo $line | cut -f1 -d:)
            PASS=$(echo $line | cut -f2 -d:)
            adduser -s /sbin/nologin -h /home/samba -H -D $USER
            yes "$PASS" | smbpasswd -a $USER
          done
        fi
        md5sum /secrets/create-users > /privatepersist/k8s-users-checksum
      fi
      # bug where smbd stops on "end of input"
      ionice -c 3 smbd --foreground < /dev/null