Skip to content

Commit 2ca504f

Browse files
commjoencommjoen
authored
Merge pull request #107 from OWASP/feat/ctfd
Add CTFd via helm chart
2 parents 6e80e82 + 0c45ed5 commit 2ca504f

File tree

16 files changed

+287
-31
lines changed

16 files changed

+287
-31
lines changed

‎.gitignore

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ aws/terraform.tfstate.backup
99
aws/.terraform.tfstate.lock.info
1010
aws/cluster-autoscaler-autodiscover.yaml
1111
aws/cluster-autoscaler-autodiscover.yaml-e
12-
12+
db.zip
1313
.idea
14-
.DS_Store
14+
.DS_Store
15+
.letsencrypt
16+
17+
*.auto.tfvars

‎aws/build-an-deploy-aws.sh

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,4 +112,24 @@ wait
112112
DEFAULT_PASSWORD=thankyou
113113
#TODO: REWRITE ABOVE, REWRITE THE HARDCODED DEPLOYMENT VALS INTO VALUES AND OVERRIDE THEM HERE!
114114
echo "default password is ${DEFAULT_PASSWORD}"
115-
helm upgrade --install mj ../helm/wrongsecrets-ctf-party --set="imagePullPolicy=Always" --set="balancer.env.K8S_ENV=aws" --set="balancer.env.IRSA_ROLE=arn:aws:iam::${ACCOUNT_ID}:role/wrongsecrets-secret-manager" --set="balancer.env.REACT_APP_ACCESS_PASSWORD=${DEFAULT_PASSWORD}" --set="balancer.cookie.cookieParserSecret=thisisanewrandomvaluesowecanworkatit" --set="balancer.repository=jeroenwillemsen/wrongsecrets-balancer" --set="balancer.tag=1.0aws" --set="balancer.replicas=4" --set="wrongsecretsCleanup.repository=jeroenwillemsen/wrongsecrets-ctf-cleaner" --set="wrongsecretsCleanup.tag=0.2"
115+
helm upgrade --install mj ../helm/wrongsecrets-ctf-party \
116+
--set="imagePullPolicy=Always" \
117+
--set="balancer.env.K8S_ENV=aws" \
118+
--set="balancer.env.IRSA_ROLE=arn:aws:iam::${ACCOUNT_ID}:role/wrongsecrets-secret-manager" \
119+
--set="balancer.env.REACT_APP_ACCESS_PASSWORD=${DEFAULT_PASSWORD}" \
120+
--set="balancer.cookie.cookieParserSecret=thisisanewrandomvaluesowecanworkatit" \
121+
--set="balancer.repository=jeroenwillemsen/wrongsecrets-balancer" \
122+
--set="balancer.replicas=4" \
123+
--set="wrongsecretsCleanup.repository=jeroenwillemsen/wrongsecrets-ctf-cleaner" \
124+
--set="wrongsecrets.ctfKey=test"
125+
126+
# Install CTFd
127+
128+
export HELM_EXPERIMENTAL_OCI=1
129+
kubectl create namespace ctfd
130+
helm -n ctfd install ctfd oci://ghcr.io/bman46/ctfd/ctfd \
131+
--set="redis.auth.password=${$(openssl rand -base64 24)}" \
132+
--set="mariadb.auth.rootPassword=${$(openssl rand -base64 24)}" \
133+
--set="mariadb.auth.password=${$(openssl rand -base64 24)}" \
134+
--set="mariadb.auth.replicationPassword=${$(openssl rand -base64 24)}" \
135+
--set="env.open.SECRET_KEY=test"

‎aws/k8s-aws-alb-script.sh

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,9 +102,12 @@ echo "apply -f k8s/wrongsecrets-balancer-ingress.yml in 10 s"
102102
sleep 10
103103
kubectl apply -f k8s/wrongsecrets-balancer-ingress.yml
104104

105+
kubectl apply -f k8s/ctfd-service.yaml
106+
kubectl apply -f k8s/ctfd-ingress.yaml
105107

106108
echo "waiting 10 s for loadBalancer"
107109
sleep 10
108-
echo "http://$(kubectl get ingress wrongsecrets-balancer -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')"
110+
echo "Wrongsecrets ingress: http://$(kubectl get ingress wrongsecrets-balancer -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')"
111+
echo "ctfd ingress: http://$(kubectl get ingress -n ctfd ctfd -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')"
109112

110113
echo "Do not forget to cleanup afterwards! Run k8s-aws-alb-script-cleanup.sh"

‎aws/k8s/ctfd-ingress.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
namespace: ctfd
5+
name: ctfd
6+
annotations:
7+
alb.ingress.kubernetes.io/scheme: internet-facing
8+
alb.ingress.kubernetes.io/target-type: instance
9+
acme.cert-manager.io/http01-edit-in-place: "true"
10+
# cert-manager.io/issue-temporary-certificate: "true"
11+
#uncomment and configure below if you want to use tls, don't forget to override the cookie to a secure value!
12+
# alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:<region>:<account>:certificate/xxxxxx
13+
# alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
14+
# alb.ingress.kubernetes.io/actions.ssl-redirect: '443'
15+
spec:
16+
ingressClassName: alb
17+
rules:
18+
- http:
19+
paths:
20+
- path: /
21+
pathType: Prefix
22+
backend:
23+
service:
24+
name: ctfd
25+
port:
26+
number: 80

‎aws/k8s/ctfd-service.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
namespace: ctfd
5+
name: ctfd
6+
labels:
7+
app: ctfd
8+
spec:
9+
type: NodePort
10+
ports:
11+
- port: 80
12+
name: http
13+
targetPort: 8000
14+
protocol: TCP
15+
selector:
16+
app.kubernetes.io/name: ctfd

‎aws/k8s/ctfd-values.yaml

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
# Default values for ctfd.
2+
# This is a YAML-formatted file.
3+
# Declare variables to be passed into your templates.
4+
5+
replicaCount: 1
6+
7+
image:
8+
repository: ctfd/ctfd
9+
tag: 3.5.0
10+
pullPolicy: IfNotPresent
11+
12+
# Set K8s securityContext for the CTFd deployment:
13+
security:
14+
fsGroup: 1001
15+
runAsNonRoot: true
16+
runAsUser: 1001
17+
18+
# Bitnami helm redis deployment
19+
# See bitnami redis values.yaml for more details
20+
redis:
21+
# Enable Redis server provided by helm:
22+
enabled: True
23+
auth:
24+
enabled: true
25+
password: "ChangeMe!123"
26+
# Redis® architecture. Allowed values: standalone or replication
27+
architecture: standalone
28+
29+
mariadb:
30+
# Enable mariadb server provided by helm:
31+
enabled: True
32+
# Login credentials:
33+
auth:
34+
rootPassword: "ChangeMe!123"
35+
database: ctfd
36+
username: "ctfd"
37+
password: "ChangeMe!123"
38+
39+
replicationUser: "replicate"
40+
replicationPassword: "ChangeMe!123"
41+
42+
persistence:
43+
enabled: true
44+
storageClass: ""
45+
accessModes:
46+
- ReadWriteOnce
47+
size: 15Gi
48+
49+
externalDB:
50+
# (required if mariadb-galera is disabled) External SQL Database URI. Example: mysql+pymysql://root:ctfd@db/ctfd
51+
DATABASE_URL: ""
52+
# (required if redis is disabled) External Redis URI. Example: redis://cache:6379
53+
REDIS_URL: ""
54+
55+
env:
56+
open:
57+
# Required if more than 1 worker (randomly generate)
58+
SECRET_KEY: "ChangeMe!123"
59+
# Amount of CTFd workers
60+
WORKERS: 5
61+
# If behing ingress proxy or nginx:
62+
REVERSE_PROXY: True
63+
secret:
64+
existingSecret:
65+
# Stores Environment Variable to secret key name mappings
66+
existingSecretMappings:
67+
DATABASE_URL:
68+
REDIS_URL:
69+
70+
# For uploads to the CTFd server (images and other content)
71+
# Not for DB
72+
persistence:
73+
uploads:
74+
enabled: true
75+
#ReadWriteMany may be desired here if using multiple CTFd pods
76+
accessMode: ReadWriteOnce
77+
size: 10Gi
78+
labels: {}
79+
# name: value
80+
# existingClaim:
81+
# storageClass: "-"
82+
83+
service:
84+
type: ClusterIP
85+
port: 80
86+
targetPort: 8000
87+
#if service.type = loadbalancer
88+
# loadBalancerSourceRanges: []
89+
# loadBalancerIP: ""
90+
91+
probes:
92+
liveness:
93+
initialDelaySeconds: 25
94+
periodSeconds: 5
95+
timeoutSeconds: 2
96+
successThreshold: 1
97+
failureThreshold: 5
98+
readiness:
99+
initialDelaySeconds: 20
100+
periodSeconds: 5
101+
timeoutSeconds: 2
102+
successThreshold: 1
103+
failureThreshold: 5
104+
105+
# CTFd ingress:
106+
ingress:
107+
enabled: false
108+
annotations:
109+
{}
110+
# kubernetes.io/ingress.class: nginx
111+
# kubernetes.io/tls-acme: "true"
112+
hosts:
113+
- host: ctf.your.domain.com
114+
path: "/"
115+
116+
tls: []
117+
# - secretName: chart-example-tls
118+
# hosts:
119+
# - chart-example.local
120+
121+
resources:
122+
{}
123+
# limits:
124+
# cpu: 100m
125+
# memory: 128Mi
126+
# requests:
127+
# cpu: 100m
128+
# memory: 128Mi
129+
130+
nodeSelector: {}
131+
132+
tolerations: []
133+
134+
affinity: {}
135+
136+
nameOverride: ""
137+
fullnameOverride: ""
138+
139+
metrics:
140+
enabled: false
141+
image:
142+
registry: docker.io
143+
repository: bitnami/mysqld-exporter
144+
tag: 0.12.1-debian-10-r27
145+
pullPolicy: IfNotPresent
146+
resources: {}
147+
annotations:
148+
prometheus.io/scrape: "true"
149+
prometheus.io/port: "9104"
150+
151+
# Enable this if you're using https://github.com/coreos/prometheus-operator
152+
serviceMonitor:
153+
enabled: false
154+
## Specify a namespace if needed
155+
# namespace: monitoring
156+
# fallback to the prometheus default unless specified
157+
# interval: 10s
158+
# scrapeTimeout: 10s
159+
## Defaults to what's used if you follow CoreOS [Prometheus Install Instructions](https://github.com/helm/charts/tree/master/stable/prometheus-operator#tldr)
160+
## [Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#prometheus-operator-1)
161+
## [Kube Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#exporters)
162+
selector:
163+
prometheus: kube-prometheus

‎aws/k8s/wrongsecrets-balancer-ingress.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ metadata:
66
annotations:
77
alb.ingress.kubernetes.io/scheme: internet-facing
88
alb.ingress.kubernetes.io/target-type: instance
9+
acme.cert-manager.io/http01-edit-in-place: "true"
10+
# cert-manager.io/issue-temporary-certificate: "true"
911
#uncomment and configure below if you want to use tls, don't forget to override the cookie to a secure value!
1012
# alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:<region>:<account>:certificate/xxxxxx
1113
# alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
@@ -22,4 +24,3 @@ spec:
2224
name: wrongsecrets-balancer
2325
port:
2426
number: 80
25-

‎aws/main.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -73,12 +73,12 @@ module "eks" {
7373

7474
cluster_endpoint_private_access = true
7575

76-
cluster_endpoint_public_access_cidrs = ["${data.http.ip.body}/32"]
76+
cluster_endpoint_public_access_cidrs = compact(concat(["${data.http.ip.body}/32"], var.extra_allowed_ip_ranges))
7777

7878
enable_irsa = true
7979

80-
create_cloudwatch_log_group = true
81-
cluster_enabled_log_types = ["api", "audit", "authenticator"]
80+
create_cloudwatch_log_group = true
81+
cluster_enabled_log_types = ["api", "audit", "authenticator"]
8282
cloudwatch_log_group_retention_in_days = 14 #it's a ctf , we don't need non-necessary costs!
8383

8484
# apply when available: iam_role_permissions_boundary = "arn:aws:iam::${local.account_id}:policy/service-user-creation-permission-boundary"

‎aws/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,9 @@ variable "cluster_name" {
1515
type = string
1616
default = "wrongsecrets-exercise-cluster"
1717
}
18+
19+
variable "extra_allowed_ip_ranges" {
20+
description = "Allowed IP ranges in addition to creator IP"
21+
type = list(string)
22+
default = []
23+
}

‎helm/wrongsecrets-ctf-party/templates/wrongsecrets-balancer/deployment.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ spec:
6161
- name: WRONGSECRETS_TAG
6262
value: {{ .Values.wrongsecrets.tag}}
6363
- name: WRONGSECRETS_DESKTOP_TAG
64-
value: 1.5.8
64+
value: {{ .Values.virtualdesktop.tag }}
6565
- name: REACT_APP_CREATE_TEAM_HMAC_KEY
6666
value: hardcodedkey
6767
- name: SECRETS_MANAGER_SECRET_ID_1

‎helm/wrongsecrets-ctf-party/values.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ balancer:
3535
# -- Set this to a fixed random alpa-numeric string (recommended length 24 chars). If not set this get randomly generated with every helm upgrade, each rotation invalidates all active cookies / sessions requirering users to login again.
3636
cookieParserSecret: null
3737
repository: jeroenwillemsen/wrongsecrets-balancer
38-
tag: 1.0aws
38+
tag: 1.2aws
3939
# -- Number of replicas of the wrongsecrets-balancer deployment
4040
replicas: 1
4141
service:
@@ -97,7 +97,7 @@ wrongsecrets:
9797
maxInstances: 500
9898
# -- Juice Shop Image to use
9999
image: jeroenwillemsens/wrongsecrets
100-
tag: 1.5.9-no-vault
100+
tag: 1.5.10-no-vault
101101
# -- Change the key when hosting a CTF event. This key gets used to generate the challenge flags. See: https://github.com/OWASP/wrongsecrets#ctf
102102
ctfKey: "[email protected]!9uR_K!NfkkTr"
103103
# -- Specify a custom Juice Shop config.yaml. See the JuiceShop Config Docs for more detail: https://pwning.owasp-juice.shop/part1/customization.html#yaml-configuration-file
@@ -184,7 +184,7 @@ virtualdesktop:
184184
maxInstances: 500
185185
# -- Juice Shop Image to use
186186
image: jeroenwillemsen/wrongsecrets-desktop-k8s
187-
tag: 1.5.9
187+
tag: 1.5.10
188188
repository: commjoenie/wrongSecrets
189189
resources:
190190
request:
@@ -203,10 +203,10 @@ virtualdesktop:
203203
envFrom: [ ]
204204
tolerations: [ ]
205205

206-
# Deletes unused JuiceShop instances after a configurable period of inactivity
206+
# Deletes unused Wrongsecrets namespaces after a configurable period of inactivity
207207
wrongsecretsCleanup:
208208
repository: jeroenwillemsen/wrongsecrets-ctf-cleaner
209-
tag: null
209+
tag: 0.3
210210
enabled: true
211211
# -- Specifies when Juice Shop instances will be deleted when unused for that period.
212212
gracePeriod: 2d

0 commit comments

Comments
 (0)