forked from juice-shop/multi-juicer
-
-
Notifications
You must be signed in to change notification settings - Fork 15
fix: clean balancer #249
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
fix: clean balancer #249
Changes from all commits
Commits
Show all changes
9 commits
Select commit
Hold shift + click to select a range
bb5dba6
fix: clean balancer
osamamagdy bf08a1b
fix: update regex
bendehaan b244bd4
[pre-commit.ci lite] apply automatic fixes
pre-commit-ci-lite[bot] 846d298
fix: file pattern for check-yaml
bendehaan 1bef4f6
[pre-commit.ci lite] apply automatic fixes
pre-commit-ci-lite[bot] 192f452
fix: fix path for test.tmp.yaml
bendehaan e20976f
Merge branch 'main' into cleanup-helm-chart
osamamagdy e456c58
Merge branch 'main' into cleanup-helm-chart
osamamagdy 2a269f8
testing and integrating
osamamagdy File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| { | ||
| "name": "charts", | ||
| "version": "v1.0.0", | ||
| "description": "WrongSecrets helm chart", | ||
| "main": "index.js", | ||
| "scripts": { | ||
| "build": "helm package ./wrongsecrets-ctf-party", | ||
| "subcharts": "helm dependency update ./wrongsecrets-ctf-party", | ||
| "lint": "helm lint ./wrongsecrets-ctf-party", | ||
| "validate": "npm run lint && npm run test", | ||
| "template": "helm template --debug -f ./test-values.yaml myrelease ./wrongsecrets-ctf-party -n myns > test.tmp.yaml", | ||
| "dry-run": "helm install --dry-run -f ./test-values.yaml unknown ./wrongsecrets-ctf-party", | ||
| "doc": "helm-docs -s file", | ||
| "preversion": "git fetch --prune --prune-tags && npm run lint && npm run build", | ||
| "version": " export version=v$(node -p -e 'require(`./package.json`).version') && export app_version=$(echo $version | cut -d. -f2-).0 && yq e -i '.version=strenv(version)' ./wrongsecrets-ctf-party/Chart.yaml && yq e -i '.appVersion=strenv(app_version)' ./wrongsecrets-ctf-party/Chart.yaml && git add . ", | ||
| "postversion": "git push && git push --tags" | ||
| }, | ||
| "repository": { | ||
| "type": "git", | ||
| "url": "[email protected]:OWASP/wrongsecrets-ctf-party.git" | ||
| }, | ||
| "author": "WrongSecrets", | ||
| "license": "Apache License 2.0", | ||
| "homepage": "https://owasp.org/www-project-wrongsecrets/" | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,18 +2,23 @@ | |
| # This is a YAML-formatted file. | ||
| # Declare variables to be passed into your templates. | ||
|
|
||
| imagePullPolicy: Always | ||
| imagePullPolicy: IfNotPresent | ||
| nodeSelector: {} | ||
|
|
||
| ingress: | ||
| # -- If true, Wrongsecrets will create an Ingress object for the balancer service. | ||
| # Useful if you want to expose the balancer service externally for example with a loadbalancer in order to view any webpages that are hosted on the balancer service. | ||
| enabled: false | ||
| # -- Annotations to be added to the ingress object. | ||
| annotations: {} | ||
| # kubernetes.io/ingress.class: nginx | ||
| # kubernetes.io/tls-acme: "true" | ||
| # -- Hostnames to your Wrongsecrets balancer installation. | ||
| hosts: | ||
| - host: wrongsecrets-ctf-party.local | ||
| paths: | ||
| - "/" | ||
| # -- TLS configuration for Wrongsecrets balancer | ||
| tls: [] | ||
| # - secretName: chart-example-tls | ||
| # hosts: | ||
|
|
@@ -37,6 +42,8 @@ balancer: | |
| tag: 1.6.5aws | ||
| # -- Number of replicas of the wrongsecrets-balancer deployment. Changing this in a commit? PLEASE UPDATE THE GITHUB WORKLFOWS THEN!(NUMBER OF "TRUE") | ||
| replicas: 2 | ||
| # -- Port to expose on the balancer pods which the container listens on | ||
| containerPort: 3000 | ||
| service: | ||
| # -- Kubernetes service type | ||
| type: ClusterIP | ||
|
|
@@ -48,30 +55,30 @@ balancer: | |
| loadBalancerSourceRanges: null | ||
| # -- IP address to assign to load balancer (if supported) | ||
| externalIPs: null | ||
| # -- Probes settings for the balancer pods | ||
| # -- livenessProbe: Checks if the balancer pod is still alive | ||
| livenessProbe: | ||
| httpGet: | ||
| path: /balancer/ | ||
| port: http # -- Port to expose on the balancer pods which the container listens on. It is named http to be the same as the containerPort | ||
| # -- readinessProbe: Checks if the balancer pod is ready to receive traffic | ||
| readinessProbe: | ||
| httpGet: | ||
| path: /balancer/ | ||
| port: http # -- Port to expose on the balancer pods which the container listens on. It is named http to be the same as the containerPort | ||
| # -- Resource limits and requests for the balancer pods | ||
| resources: | ||
| requests: | ||
| memory: 256Mi | ||
| cpu: 400m | ||
| limits: | ||
| memory: 1024Mi | ||
| cpu: 1000m | ||
| securityContext: | ||
| allowPrivilegeEscalation: false | ||
| readOnlyRootFilesystem: true | ||
| runAsNonRoot: true | ||
| capabilities: | ||
| drop: | ||
| - ALL | ||
| add: | ||
| - CAP_NET_ADMIN | ||
| - CAP_NET_BIND_SERVICE | ||
| seccompProfile: | ||
| type: RuntimeDefault | ||
| # -- Optional Configure kubernetes scheduling affinity for the created JuiceShops (see: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) | ||
| # -- Optional Configure kubernetes scheduling affinity for the created wrongsecrets instances (see: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) | ||
| affinity: {} | ||
| # -- Optional Configure kubernetes toleration for the created JuiceShops (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | ||
| # -- Optional Configure kubernetes toleration for the created wrongsecrets instances (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | ||
| tolerations: [] | ||
| # -- If set to true this skips setting ownerReferences on the teams JuiceShop Deployment and Services. This lets MultiJuicer run in older kubernetes cluster which don't support the reference type or the app/v1 deployment type | ||
| # -- If set to true this skips setting ownerReferences on the teams wrongsecrets Deployment and Services. This lets MultiJuicer run in older kubernetes cluster which don't support the reference type or the app/v1 deployment type | ||
| skipOwnerReference: false | ||
| env: | ||
| REACT_APP_MOVING_GIF_LOGO: "https://i.gifer.com/9kGQ.gif" #displayed at the frontend when you enter the CTF | ||
|
|
@@ -98,11 +105,37 @@ balancer: | |
| username: prometheus-scraper | ||
| # -- Should be changed when metrics are enabled. | ||
| password: ERzCT4pwBDxfCKRGmfrMa8KQ8sXf8GKy | ||
|
|
||
| ##TODO: | ||
| #1. UPDATE WRONGSECRETS TO DEFINITION WHERE K8S IS USED FOR AWS! | ||
| #2. UPDATE VIRTUALDESKTOP TO DEFINITION WHERE IT CN BE USED | ||
| #3. ADD VAULT INSTANCE PER TEAM! | ||
| podSecurityContext: | ||
| # -- If true, sets the securityContext on the created pods. This is required for the podSecurityPolicy to work | ||
| enabled: true | ||
| runAsUser: 1000 | ||
| runAsGroup: 3000 | ||
| fsGroup: 2000 | ||
| seccompProfile: | ||
| type: RuntimeDefault | ||
| containerSecurityContext: | ||
| # -- If true, sets the securityContext on the created containers. This is required for the podSecurityPolicy to work | ||
| enabled: true | ||
| allowPrivilegeEscalation: false | ||
| readOnlyRootFilesystem: true | ||
| runAsNonRoot: true | ||
| capabilities: | ||
| drop: | ||
| - ALL | ||
| add: | ||
| - CAP_NET_ADMIN | ||
| - CAP_NET_BIND_SERVICE | ||
| seccompProfile: | ||
| type: RuntimeDefault | ||
| volumeMounts: | ||
| # -- If true, creates a volumeMount for the created pods. This is required for the podSecurityPolicy to work | ||
| - name: config-volume | ||
| mountPath: /home/app/config/ | ||
| volumes: | ||
| # -- If true, creates a volume for the created pods. This is required for the podSecurityPolicy to work | ||
| - name: config-volume | ||
| configMap: | ||
| name: wrongsecrets-balancer-config | ||
|
|
||
| wrongsecrets: | ||
| # -- Specifies how many Wrongsecrets instances should start at max. Set to -1 to remove the max Wrongsecrets instance cap | ||
|
|
@@ -112,32 +145,22 @@ wrongsecrets: | |
| tag: 1.6.5-no-vault | ||
| # -- Change the key when hosting a CTF event. This key gets used to generate the challenge flags. See: https://github.com/OWASP/wrongsecrets#ctf | ||
| ctfKey: "[email protected]!9uR_K!NfkkTr" | ||
| # -- Specify a custom Juice Shop config.yaml. See the JuiceShop Config Docs for more detail: https://pwning.owasp-juice.shop/part1/customization.html#yaml-configuration-file | ||
| # -- Specify a custom Wrongsecrets config.yaml. See the Wrongsecrets Docs for any needed ENVs: https://github.com/OWASP/wrongsecrets | ||
| # @default -- See values.yaml for full details | ||
| config: | | ||
| K8S_ENV: aws | ||
| # application: | ||
| # logo: https://raw.githubusercontent.com/iteratec/multi-juicer/main/images/multijuicer-icon-only-padding.png | ||
| # favicon: https://raw.githubusercontent.com/iteratec/multi-juicer/main/wrongsecrets-balancer/ui/public/favicon.ico | ||
| # showVersionNumber: false | ||
| # showGitHubLinks: false | ||
| # challenges: | ||
| # showHints: true | ||
| # hackingInstructor: | ||
| # isEnabled: true | ||
| # ctf: | ||
| # showFlagsInNotifications: false | ||
| # -- Specify a custom NODE_ENV for JuiceShop. If value is changed to something other than 'wrongsecrets-ctf-party' it's not possible to set a custom config via `juiceShop.config`. | ||
| # "aws" is for using the cluster with eks and "k8s" is for using the cluster with miniKube which will enable specific challenges | ||
| # -- Specify a custom NODE_ENV for Wrongsecrets. If value is changed to something other than 'wrongsecrets-ctf-party' it's not possible to set a custom config via `wrongsecrets-balancer-config`. | ||
| nodeEnv: "wrongsecrets-ctf-party" | ||
| # -- Optional resources definitions to set for each JuiceShop instance | ||
| # -- Optional resources definitions to set for each Wrongsecrets instance | ||
| resources: | ||
| requests: | ||
| cpu: 256Mi | ||
| memory: 300Mi | ||
| # limits: | ||
| # cpu: 100m | ||
| # memory: 200Mi | ||
| # -- Optional securityContext definitions to set for each JuiceShop instance | ||
| # -- Optional securityContext definitions to set for each Wrongsecrets instance | ||
| securityContext: | ||
| allowPrivilegeEscalation: false | ||
| readOnlyRootFilesystem: true | ||
|
|
@@ -147,7 +170,7 @@ wrongsecrets: | |
| - ALL | ||
| seccompProfile: | ||
| type: RuntimeDefault | ||
| # -- Optional environment variables to set for each JuiceShop instance (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | ||
| # -- Optional environment variables to set for each Wrongsecrets instance (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | ||
| env: | ||
| - name: K8S_ENV | ||
| value: k8s | ||
|
|
@@ -161,43 +184,23 @@ wrongsecrets: | |
| secretKeyRef: | ||
| name: funnystuff | ||
| key: funnier | ||
| # env: | ||
| # - name: FOO | ||
| # valueFrom: | ||
| # secretKeyRef: | ||
| # key: FOO | ||
| # name: secret-resource | ||
| # -- Optional mount environment variables from configMaps or secrets (see: https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#configure-all-key-value-pairs-in-a-secret-as-container-environment-variables) | ||
| envFrom: [] | ||
| # -- Optional Volumes to set for each JuiceShop instance (see: https://kubernetes.io/docs/concepts/storage/volumes/) | ||
| # -- Optional Volumes to set for each Wrongsecrets instance (see: https://kubernetes.io/docs/concepts/storage/volumes/) | ||
| volumes: [] | ||
| # create config map with a custom logo via: kubectl create configmap custom-logo --from-file custom.png=your-logo.png | ||
| # then switch out the logo parameter in the wrongsecrets config section above to the mounted filename. | ||
| # volumes: | ||
| # - name: logo | ||
| # configMap: | ||
| # name: custom-logo | ||
| # -- Optional VolumeMounts to set for each JuiceShop instance (see: https://kubernetes.io/docs/concepts/storage/volumes/) | ||
| volumeMounts: [] | ||
| # volumeMounts: | ||
| # - name: logo | ||
| # mountPath: /wrongsecrets/frontend/dist/frontend/assets/public/images/custom.png | ||
| # subPath: custom.png | ||
| # readOnly: true | ||
|
|
||
| # -- Optional Configure kubernetes scheduling affinity for the created JuiceShops (see: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) | ||
| # -- Optional Configure kubernetes scheduling affinity for the created Wrongsecrets instances (see: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) | ||
| affinity: {} | ||
| # -- Optional Configure kubernetes toleration for the created JuiceShops (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | ||
| # -- Optional Configure kubernetes toleration for the created Wrongsecrets instances (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | ||
| tolerations: [] | ||
|
|
||
| # -- Optional Can be used to configure the runtime class for the JuiceShop pods to add an additional layer of isolation to reduce the impact of potential container escapes. (see: https://kubernetes.io/docs/concepts/containers/runtime-class/) | ||
| # -- Optional Can be used to configure the runtime class for the Wrongsecrets instances pods to add an additional layer of isolation to reduce the impact of potential container escapes. (see: https://kubernetes.io/docs/concepts/containers/runtime-class/) | ||
| runtimeClassName: null | ||
|
|
||
| # Deletes unused JuiceShop instances after a configurable period of inactivity | ||
| # Deletes unused Wrongsecrets instances after a configurable period of inactivity | ||
|
|
||
| #the virtual desktop for the deploymebt | ||
| virtualdesktop: | ||
| # -- Specifies how many JuiceShop instances MultiJuicer should start at max. Set to -1 to remove the max Juice Shop instance cap | ||
| # -- Specifies how many Wrongsecrets instances MultiJuicer should start at max. Set to -1 to remove the max Juice Shop instance cap | ||
| maxInstances: 500 | ||
| # -- Juice Shop Image to use | ||
| image: jeroenwillemsen/wrongsecrets-desktop-k8s | ||
|
|
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.