chore: import upstream snapshot with attribution

scripts/volcengine/network.go

@@ -0,0 +1,339 @@
+/*
+ * Copyright 2025 coze-dev Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package main
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/volcengine/volcengine-go-sdk/service/vpc"
+	"github.com/volcengine/volcengine-go-sdk/volcengine"
+)
+
+func CreatePrivateNetwork(vName, ts, zoneID string) (string, error) {
+	if os.Getenv("VE_VPC_ID") != "" {
+		return os.Getenv("VE_VPC_ID"), nil
+	}
+
+	svc := vpc.New(sess)
+
+	reqTags := &vpc.TagForCreateVpcInput{
+		Key:   volcengine.String("opencoze"),
+		Value: volcengine.String("1"),
+	}
+
+	newVpcName := vName + ts
+	createVpcInput := &vpc.CreateVpcInput{
+		CidrBlock:   volcengine.String("172.16.0.0/12"),
+		ClientToken: volcengine.String(newVpcName),
+		ProjectName: volcengine.String(projectName),
+		Tags:        []*vpc.TagForCreateVpcInput{reqTags},
+		VpcName:     volcengine.String(newVpcName),
+	}
+
+	resp, err := svc.CreateVpc(createVpcInput)
+	if err != nil {
+		return "", err
+	}
+
+	if resp.VpcId == nil {
+		return "", errors.New("[VPC] VpcId is empty")
+	}
+
+	return *resp.VpcId, nil
+}
+
+func CheckVpcStatus(vpcID string) {
+	svc := vpc.New(sess)
+
+	describeVpcAttributesInput := &vpc.DescribeVpcAttributesInput{
+		VpcId: volcengine.String(vpcID),
+	}
+
+	for {
+		resp, err := svc.DescribeVpcAttributes(describeVpcAttributesInput)
+		if resp.Status != nil && *resp.Status != "Available" {
+			fmt.Printf("[VPC] VPC(%s) is %s, waiting for it to become ready... \n", vpcID, *resp.Status)
+			time.Sleep(retryTime)
+			continue
+		}
+		if err != nil {
+			fmt.Printf("[VPC] get vpc id = %s failed, err= %s will retry\n", vpcID, err.Error())
+			time.Sleep(retryTime)
+			continue
+		}
+
+		if resp.Status == nil {
+			fmt.Printf("[VPC] get vpc id = %s failed, status is nil will retry\n", vpcID)
+			time.Sleep(retryTime)
+			continue
+		}
+
+		if *resp.Status == "Available" {
+			break
+		}
+	}
+}
+
+func CreateSubnet(vName, ts, vpcID, zoneID string) (string, error) {
+	if os.Getenv("VE_SUBNET_ID") != "" {
+		return os.Getenv("VE_SUBNET_ID"), nil
+	}
+
+	reqSubTags := &vpc.TagForCreateSubnetInput{
+		Key:   volcengine.String("opencoze"),
+		Value: volcengine.String("1"),
+	}
+
+	newSubnetName := vName + "-subnet-" + ts
+	createSubnetInput := &vpc.CreateSubnetInput{
+		CidrBlock:   volcengine.String("172.16.0.0/24"),
+		ClientToken: volcengine.String(newSubnetName),
+		SubnetName:  volcengine.String(newSubnetName),
+		Tags:        []*vpc.TagForCreateSubnetInput{reqSubTags},
+		VpcId:       volcengine.String(vpcID),
+		ZoneId:      volcengine.String(zoneID),
+	}
+
+	svc := vpc.New(sess)
+	resp, err := svc.CreateSubnet(createSubnetInput)
+	if err != nil {
+		return "", err
+	}
+
+	if resp.SubnetId == nil {
+		return "", errors.New("[Subnet] SubnetId is empty")
+	}
+
+	return *resp.SubnetId, nil
+}
+
+func CreateNetworkACL(vName, ts, vpcID string) (string, error) {
+	if os.Getenv("VE_ACL_ID") != "" {
+		return os.Getenv("VE_ACL_ID"), nil
+	}
+
+	svc := vpc.New(sess)
+
+	reqTags := &vpc.TagForCreateNetworkAclInput{
+		Key:   volcengine.String("opencoze"),
+		Value: volcengine.String("1"),
+	}
+
+	newACLName := vName + "-acl-" + ts
+
+	createNetworkAclInput := &vpc.CreateNetworkAclInput{
+		NetworkAclName: volcengine.String(newACLName),
+		ProjectName:    volcengine.String(projectName),
+		Tags:           []*vpc.TagForCreateNetworkAclInput{reqTags},
+		VpcId:          volcengine.String(vpcID),
+	}
+
+	resp, err := svc.CreateNetworkAcl(createNetworkAclInput)
+	if err != nil {
+		return "", err
+	}
+
+	if resp.NetworkAclId == nil {
+		return "", errors.New("NetworkAclId is empty")
+	}
+
+	return *resp.NetworkAclId, nil
+}
+
+func CheckACLStatus(aclID string) {
+	svc := vpc.New(sess)
+
+	describeNetworkAclAttributesInput := &vpc.DescribeNetworkAclAttributesInput{
+		NetworkAclId: volcengine.String(aclID),
+	}
+
+	for {
+		resp, err := svc.DescribeNetworkAclAttributes(describeNetworkAclAttributesInput)
+		if resp.NetworkAclAttribute != nil && resp.NetworkAclAttribute.Status != nil && *resp.NetworkAclAttribute.Status != "Available" {
+			fmt.Printf("[ACL] ACL(%s) is %s, waiting for it to become ready... \n", aclID, *resp.NetworkAclAttribute.Status)
+			time.Sleep(retryTime)
+			continue
+		}
+
+		if err != nil {
+			fmt.Printf("[ACL] will retry get acl = %s failed, err= %s\n", aclID, err.Error())
+			time.Sleep(retryTime)
+			continue
+		}
+
+		if resp.NetworkAclAttribute == nil || resp.NetworkAclAttribute.Status == nil {
+			fmt.Printf("[ACL] ACL(%s) Status is nil, will retry\n", aclID)
+			time.Sleep(retryTime)
+			continue
+		}
+
+		if *resp.NetworkAclAttribute.Status == "Available" {
+			break
+		}
+	}
+}
+
+func AttachSubnetToACL(aclID, subnetID string) error {
+	svc := vpc.New(sess)
+
+	reqResource := &vpc.ResourceForAssociateNetworkAclInput{
+		ResourceId: volcengine.String(subnetID),
+	}
+	associateNetworkAclInput := &vpc.AssociateNetworkAclInput{
+		NetworkAclId: volcengine.String(aclID),
+		Resource:     []*vpc.ResourceForAssociateNetworkAclInput{reqResource},
+	}
+
+	resp, err := svc.AssociateNetworkAcl(associateNetworkAclInput)
+	if resp.Metadata != nil && resp.Metadata.Error != nil &&
+		resp.Metadata.Error.Code == "InvalidResource.Associated" {
+		return nil
+	}
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func CreateSafeGroup(ts, vpcID string) (string, error) {
+	if os.Getenv("VE_SAFE_GROUP_ID") != "" {
+		return os.Getenv("VE_SAFE_GROUP_ID"), nil
+	}
+
+	svc := vpc.New(sess)
+	reqTags := &vpc.TagForCreateSecurityGroupInput{
+		Key:   volcengine.String("opencoze"),
+		Value: volcengine.String("1"),
+	}
+	createSecurityGroupInput := &vpc.CreateSecurityGroupInput{
+		ProjectName:       volcengine.String(projectName),
+		SecurityGroupName: volcengine.String("opencoze-sg-" + ts),
+		Tags:              []*vpc.TagForCreateSecurityGroupInput{reqTags},
+		VpcId:             volcengine.String(vpcID),
+	}
+
+	resp, err := svc.CreateSecurityGroup(createSecurityGroupInput)
+	if err != nil {
+		return "", err
+	}
+
+	if resp.SecurityGroupId == nil {
+		return "", errors.New("SecurityGroupId is empty")
+	}
+
+	return *resp.SecurityGroupId, nil
+}
+
+func CheckSafeGroupStatus(sgID string) {
+	for {
+		svc := vpc.New(sess)
+		describeSecurityGroupAttributesInput := &vpc.DescribeSecurityGroupAttributesInput{
+			SecurityGroupId: volcengine.String(sgID),
+		}
+
+		// Copy the code to run the example, please print the API return value yourself.
+		resp, err := svc.DescribeSecurityGroupAttributes(describeSecurityGroupAttributesInput)
+		if err != nil {
+			fmt.Printf("[SafeGroup] will retry get safe group = %s failed, err= %s\n", sgID, err.Error())
+			time.Sleep(retryTime)
+			continue
+		}
+
+		if resp.Status == nil || *resp.Status != "Available" {
+			fmt.Printf("[SafeGroup] safe group(%s) is %s, waiting for it to become ready... \n", sgID, *resp.Status)
+			time.Sleep(retryTime)
+			continue
+		}
+
+		break
+	}
+}
+
+func CreateSafeGroupRule(sgID string) error {
+	svc := vpc.New(sess)
+
+	type Rule struct {
+		PortStart int64
+		PortEnd   int64
+		Protocol  string
+	}
+
+	defaultRules := []Rule{
+		{
+			PortStart: 8000,
+			PortEnd:   10000,
+			Protocol:  "tcp",
+		},
+		{
+			PortStart: 80,
+			PortEnd:   80,
+			Protocol:  "tcp",
+		},
+		{
+			PortStart: 22,
+			PortEnd:   22,
+			Protocol:  "tcp",
+		},
+		{
+			PortStart: 443,
+			PortEnd:   443,
+			Protocol:  "tcp",
+		},
+		{
+			PortStart: 3389,
+			PortEnd:   3389,
+			Protocol:  "tcp",
+		},
+
+		{
+			PortStart: -1,
+			PortEnd:   -1,
+			Protocol:  "ALL",
+		},
+	}
+
+	for _, rule := range defaultRules {
+		authorizeSecurityGroupIngressInput := &vpc.AuthorizeSecurityGroupIngressInput{
+			CidrIp:          volcengine.String("0.0.0.0/0"),
+			PortEnd:         volcengine.Int64(rule.PortEnd),
+			PortStart:       volcengine.Int64(rule.PortStart),
+			Protocol:        volcengine.String(rule.Protocol),
+			SecurityGroupId: volcengine.String(sgID),
+		}
+
+		if rule.PortStart == -1 {
+			authorizeSecurityGroupIngressInput.SourceGroupId = &sgID
+			authorizeSecurityGroupIngressInput.CidrIp = nil
+		}
+
+		resp, err := svc.AuthorizeSecurityGroupIngress(authorizeSecurityGroupIngressInput)
+		if resp != nil && resp.Metadata != nil && resp.Metadata.Error != nil &&
+			resp.Metadata.Error.Code == "InvalidSecurityRule.Conflict" {
+			continue
+		}
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}