Skip to content

Commit bb5dba6

Browse files
osamamagdyosamamagdy
committed
fix: clean balancer
Signed-off-by: osamamagdy <[email protected]>
1 parent c78854c commit bb5dba6

File tree

7 files changed

+702
-89
lines changed

7 files changed

+702
-89
lines changed

‎.pre-commit-config.yaml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,11 @@ repos:
44
rev: v4.3.0
55
hooks:
66
- id: check-yaml
7-
exclude: ^helm/wrongsecrets-ctf-party/templates/
7+
exclude: ^helm/wrongsecrets-ctf-party/templates/|^test.tmp.yaml)
8+
- id: check-yaml
9+
include: ^test.tmp.yaml
10+
args:
11+
- --allow-multiple-documents
812
- id: end-of-file-fixer
913
exclude: ^(src/test/resources/yourkey.txt|src/test/resources/secondkey.txt)
1014
- id: trailing-whitespace

‎helm/package.json

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"name": "charts",
3+
"version": "v1.0.0",
4+
"description": "Wrongsecrets helm chart",
5+
"main": "index.js",
6+
"scripts": {
7+
"build": "helm package ./wrongsecrets-ctf-party",
8+
"subcharts": "helm dependency update ./wrongsecrets-ctf-party",
9+
"lint": "helm lint ./wrongsecrets-ctf-party",
10+
"validate": "npm run lint && npm run test",
11+
"template": "helm template --debug -f ./test-values.yaml myrelease ./wrongsecrets-ctf-party -n myns > test.tmp.yaml",
12+
"dry-run": "helm install --dry-run -f ./test-values.yaml unknown ./wrongsecrets-ctf-party",
13+
"doc": "helm-docs -s file",
14+
"preversion": "git fetch --prune --prune-tags && npm run lint && npm run build",
15+
"version": " export version=v$(node -p -e 'require(`./package.json`).version') && export app_version=$(echo $version | cut -d. -f2-).0 && yq e -i '.version=strenv(version)' ./wrongsecrets-ctf-party/Chart.yaml && yq e -i '.appVersion=strenv(app_version)' ./wrongsecrets-ctf-party/Chart.yaml && git add . ",
16+
"postversion": "git push && git push --tags"
17+
},
18+
"repository": {
19+
"type": "git",
20+
"url": "[email protected]:OWASP/wrongsecrets-ctf-party.git"
21+
},
22+
"author": "Wrongsecrets",
23+
"license": "Apache License 2.0",
24+
"homepage": "https://owasp.org/www-project-wrongsecrets/"
25+
}

‎helm/test-values.yaml

Lines changed: 246 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
# Default values for Wrongecret-ctf-party.
2+
# This is a YAML-formatted file.
3+
# Declare variables to be passed into your templates.
4+
5+
imagePullPolicy: IfNotPresent
6+
nodeSelector: {}
7+
8+
ingress:
9+
# -- If true, Wrongsecrets will create an Ingress object for the balancer service.
10+
# Useful if you want to expose the balancer service externally for example with a loadbalancer in order to view any webpages that are hosted on the balancer service.
11+
enabled: false
12+
# -- Annotations to be added to the ingress object.
13+
annotations: {}
14+
# kubernetes.io/ingress.class: nginx
15+
# kubernetes.io/tls-acme: "true"
16+
# -- Hostnames to your Wrongsecrets balancer installation.
17+
hosts:
18+
- host: wrongsecrets-ctf-party.local
19+
paths:
20+
- "/"
21+
# -- TLS configuration for Wrongsecrets balancer
22+
tls: []
23+
# - secretName: chart-example-tls
24+
# hosts:
25+
# - chart-example.local
26+
27+
service:
28+
type: ClusterIP
29+
port: 3000
30+
31+
balancer:
32+
cookie:
33+
# SET THIS TO TRUE IF IN PRODUCTION
34+
# Sets secure Flag in cookie
35+
# -- Sets the secure attribute on cookie so that it only be send over https
36+
secure: false
37+
# -- Changes the cookies name used to identify teams. Note will automatically be prefixed with "__Secure-" when balancer.cookie.secure is set to `true`
38+
name: balancer
39+
# -- Set this to a fixed random alpa-numeric string (recommended length 24 chars). If not set this get randomly generated with every helm upgrade, each rotation invalidates all active cookies / sessions requirering users to login again.
40+
cookieParserSecret: null
41+
repository: jeroenwillemsen/wrongsecrets-balancer
42+
tag: 1.6.4aws
43+
# -- Number of replicas of the wrongsecrets-balancer deployment. Changing this in a commit? PLEASE UPDATE THE GITHUB WORKLFOWS THEN!(NUMBER OF "TRUE")
44+
replicas: 2
45+
service:
46+
# -- Kubernetes service type
47+
type: ClusterIP
48+
# -- internal cluster service IP
49+
clusterIP: null
50+
# -- IP address to assign to load balancer (if supported)
51+
loadBalancerIP: null
52+
# -- list of IP CIDRs allowed access to lb (if supported)
53+
loadBalancerSourceRanges: null
54+
# -- IP address to assign to load balancer (if supported)
55+
externalIPs: null
56+
resources:
57+
requests:
58+
memory: 256Mi
59+
cpu: 400m
60+
limits:
61+
memory: 1024Mi
62+
cpu: 1000m
63+
# -- Optional Configure kubernetes scheduling affinity for the created wrongsecrets instances (see: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity)
64+
affinity: {}
65+
# -- Optional Configure kubernetes toleration for the created wrongsecrets instances (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
66+
tolerations: []
67+
# -- If set to true this skips setting ownerReferences on the teams wrongsecrets Deployment and Services. This lets MultiJuicer run in older kubernetes cluster which don't support the reference type or the app/v1 deployment type
68+
skipOwnerReference: false
69+
env:
70+
REACT_APP_MOVING_GIF_LOGO: "https://i.gifer.com/9kGQ.gif" #displayed at the frontend when you enter the CTF
71+
REACT_APP_HEROKU_WRONGSECRETS_URL: "https://wrongsecrets-ctf.herokuapp.com" #required for 3 domain setup
72+
REACT_APP_CTFD_URL: "https://ctfd.io" #requierd for 2 and 3 domain setup
73+
REACT_APP_S3_BUCKET_URL: "s3://funstuff" #the s3 bucket you use for teh aws challenges, don't forget to make it accessible!
74+
K8S_ENV: "k8s" #or 'aws'
75+
REACT_APP_ACCESS_PASSWORD: "" #DEFAULT NO PASSWORD, PLAYING THIS IN PUBLIC? PUT A FANCY STRING HERE, BUT BE GENTLE: USERS NEED TO BE ABLE TO COPY THAT STUFF...
76+
REACT_APP_CREATE_TEAM_HMAC_KEY: "hardcodedkey"
77+
IRSA_ROLE: arn:aws:iam::233483431651:role/wrongsecrets-secret-manager #change this in your own AWS role!
78+
SECRETS_MANAGER_SECRET_ID_1: "wrongsecret" #only change if you need non-default AWS SM entries
79+
SECRETS_MANAGER_SECRET_ID_2: "wrongsecret-2" #only change if you need non-default AWS SM entries
80+
metrics:
81+
# -- enables prometheus metrics for the balancer. If set to true you should change the prometheus-scraper password
82+
enabled: true
83+
dashboards:
84+
# -- if true, creates a Grafana Dashboard Config Map. (also requires metrics.enabled to be true). These will automatically be imported by Grafana when using the Grafana helm chart, see: https://github.com/helm/charts/tree/main/stable/grafana#sidecar-for-dashboards
85+
enabled: false
86+
serviceMonitor:
87+
# -- If true, creates a Prometheus Operator ServiceMonitor (also requires metrics.enabled to be true). This will also deploy a servicemonitor which monitors metrics from the Juice Shop instances
88+
enabled: false
89+
basicAuth:
90+
username: prometheus-scraper
91+
# -- Should be changed when metrics are enabled.
92+
password: ERzCT4pwBDxfCKRGmfrMa8KQ8sXf8GKy
93+
podSecurityContext:
94+
# -- If true, sets the securityContext on the created pods. This is required for the podSecurityPolicy to work
95+
enabled: true
96+
runAsUser: 1000
97+
runAsGroup: 3000
98+
fsGroup: 2000
99+
seccompProfile:
100+
type: RuntimeDefault
101+
containerSecurityContext:
102+
# -- If true, sets the securityContext on the created containers. This is required for the podSecurityPolicy to work
103+
enabled: true
104+
allowPrivilegeEscalation: false
105+
readOnlyRootFilesystem: true
106+
runAsNonRoot: true
107+
capabilities:
108+
drop:
109+
- ALL
110+
add:
111+
- CAP_NET_ADMIN
112+
- CAP_NET_BIND_SERVICE
113+
seccompProfile:
114+
type: RuntimeDefault
115+
116+
wrongsecrets:
117+
# -- Specifies how many Wrongsecrets instances should start at max. Set to -1 to remove the max Wrongsecrets instance cap
118+
maxInstances: 500
119+
# -- Wrongsecrets Image to use
120+
image: jeroenwillemsen/wrongsecrets
121+
tag: 1.6.4-no-vault
122+
# -- Change the key when hosting a CTF event. This key gets used to generate the challenge flags. See: https://github.com/OWASP/wrongsecrets#ctf
123+
ctfKey: "[email protected]!9uR_K!NfkkTr"
124+
# -- Specify a custom Wrongsecrets config.yaml. See the Wrongsecrets Docs for any needed ENVs: https://github.com/OWASP/wrongsecrets
125+
# @default -- See values.yaml for full details
126+
config: |
127+
K8S_ENV: aws
128+
# "aws" is for using the cluster with eks and "k8s" is for using the cluster with miniKube which will enable specific challenges
129+
# application:
130+
# logo: https://raw.githubusercontent.com/iteratec/multi-juicer/main/images/multijuicer-icon-only-padding.png
131+
# favicon: https://raw.githubusercontent.com/iteratec/multi-juicer/main/wrongsecrets-balancer/ui/public/favicon.ico
132+
# showVersionNumber: false
133+
# showGitHubLinks: false
134+
# challenges:
135+
# showHints: true
136+
# hackingInstructor:
137+
# isEnabled: true
138+
# ctf:
139+
# showFlagsInNotifications: false
140+
# -- Specify a custom NODE_ENV for Wrongsecrets. If value is changed to something other than 'wrongsecrets-ctf-party' it's not possible to set a custom config via `wrongsecrets-balancer-config`.
141+
nodeEnv: "wrongsecrets-ctf-party"
142+
# -- Optional resources definitions to set for each Wrongsecrets instance
143+
resources:
144+
requests:
145+
cpu: 256Mi
146+
memory: 300Mi
147+
# limits:
148+
# cpu: 100m
149+
# memory: 200Mi
150+
# -- Optional securityContext definitions to set for each Wrongsecrets instance
151+
securityContext:
152+
allowPrivilegeEscalation: false
153+
readOnlyRootFilesystem: true
154+
runAsNonRoot: true
155+
capabilities:
156+
drop:
157+
- ALL
158+
seccompProfile:
159+
type: RuntimeDefault
160+
# -- Optional environment variables to set for each Wrongsecrets instance (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
161+
env:
162+
- name: K8S_ENV
163+
value: k8s
164+
- name: SPECIAL_K8S_SECRET
165+
valueFrom:
166+
configMapKeyRef:
167+
name: secrets-file
168+
key: funny.entry
169+
- name: SPECIAL_SPECIAL_K8S_SECRET
170+
valueFrom:
171+
secretKeyRef:
172+
name: funnystuff
173+
key: funnier
174+
# env:
175+
# - name: FOO
176+
# valueFrom:
177+
# secretKeyRef:
178+
# key: FOO
179+
# name: secret-resource
180+
# -- Optional mount environment variables from configMaps or secrets (see: https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#configure-all-key-value-pairs-in-a-secret-as-container-environment-variables)
181+
envFrom: []
182+
# -- Optional Volumes to set for each Wrongsecrets instance (see: https://kubernetes.io/docs/concepts/storage/volumes/)
183+
volumes: []
184+
# -- Optional Configure kubernetes scheduling affinity for the created Wrongsecrets instances (see: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity)
185+
affinity: {}
186+
# -- Optional Configure kubernetes toleration for the created Wrongsecrets instances (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
187+
tolerations: []
188+
189+
# -- Optional Can be used to configure the runtime class for the Wrongsecrets instances pods to add an additional layer of isolation to reduce the impact of potential container escapes. (see: https://kubernetes.io/docs/concepts/containers/runtime-class/)
190+
runtimeClassName: null
191+
192+
# Deletes unused Wrongsecrets instances after a configurable period of inactivity
193+
194+
#the virtual desktop for the deploymebt
195+
virtualdesktop:
196+
# -- Specifies how many Wrongsecrets instances MultiJuicer should start at max. Set to -1 to remove the max Juice Shop instance cap
197+
maxInstances: 500
198+
# -- Juice Shop Image to use
199+
image: jeroenwillemsen/wrongsecrets-desktop-k8s
200+
tag: 1.6.4
201+
repository: commjoenie/wrongSecrets
202+
resources:
203+
request:
204+
memory: 1GB
205+
cpu: 50m
206+
limits:
207+
memory: 2GB
208+
cpu: 1200m
209+
securityContext:
210+
allowPrivilegeEscalation: false
211+
readOnlyRootFilesystem: true
212+
runAsNonRoot: true
213+
capabilities:
214+
drop:
215+
- ALL
216+
seccompProfile:
217+
type: RuntimeDefault
218+
runtimeClassName: {}
219+
affinity: {}
220+
# -- Optional mount environment variables from configMaps or secrets (see: https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#configure-all-key-value-pairs-in-a-secret-as-container-environment-variables)
221+
222+
envFrom: []
223+
tolerations: []
224+
225+
# Deletes unused Wrongsecrets namespaces after a configurable period of inactivity
226+
wrongsecretsCleanup:
227+
repository: jeroenwillemsen/wrongsecrets-ctf-cleaner
228+
tag: 0.4
229+
enabled: true
230+
# -- Specifies when Juice Shop instances will be deleted when unused for that period.
231+
gracePeriod: 2d
232+
# -- Specifies if the clean up job should delete the outdated namespaces or just report them. Set to false to only report outdated namespaces.
233+
SHOULD_DELETE: false
234+
# -- Cron in which the clean up job is run. Defaults to once in a quarter. Change this if your grace period if shorter than 15 minutes. See "https://crontab.guru/#0,15,30,45_*_*_*_*" for more details.
235+
cron: "0,15,30,45 * * * *"
236+
successfulJobsHistoryLimit: 1
237+
failedJobsHistoryLimit: 1
238+
resources:
239+
requests:
240+
memory: 256Mi
241+
limits:
242+
memory: 256Mi
243+
# -- Optional Configure kubernetes scheduling affinity for the wrongsecretsCleanup Job(see: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity)
244+
affinity: {}
245+
# -- Optional Configure kubernetes toleration for the wrongsecretsCleanup Job (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
246+
tolerations: []

0 commit comments

Comments
 (0)