Resourcelimits

build-an-deploy-aws.sh

@@ -33,4 +33,4 @@ aws ssm put-parameter --name wrongsecretvalue --overwrite --type SecureString --
 wait
 
 #TODO: REWRITE ABOVE, REWRITE THE HARDCODED DEPLOYMENT VALS INTO VALUES AND OVERRIDE THEM HERE!
-helm upgrade --install mj ./helm/wrongsecrets-ctf-party --set="imagePullPolicy=Always" --set="balancer.env.K8S_ENV=aws" --set="balancer.cookie.cookieParserSecret=thisisanewrandomvaluesowecanworkatit" --set="balancer.repository=jeroenwillemsen/wrongsecrets-balancer" --set="balancer.tag=0.76aws" --set="balancer.replicas=5" --set="wrongsecretsCleanup.repository=jeroenwillemsen/wrongsecrets-ctf-cleaner" --set="wrongsecretsCleanup.tag=0.2"
+helm upgrade --install mj ./helm/wrongsecrets-ctf-party --set="imagePullPolicy=Always" --set="balancer.env.K8S_ENV=aws" --set="balancer.cookie.cookieParserSecret=thisisanewrandomvaluesowecanworkatit" --set="balancer.repository=jeroenwillemsen/wrongsecrets-balancer" --set="balancer.tag=0.77aws" --set="balancer.replicas=5" --set="wrongsecretsCleanup.repository=jeroenwillemsen/wrongsecrets-ctf-cleaner" --set="wrongsecretsCleanup.tag=0.2"

helm/wrongsecrets-ctf-party/values.yaml

@@ -35,7 +35,7 @@ balancer:
     # -- Set this to a fixed random alpa-numeric string (recommended length 24 chars). If not set this get randomly generated with every helm upgrade, each rotation invalidates all active cookies / sessions requirering users to login again.
     cookieParserSecret: null
   repository: jeroenwillemsen/wrongsecrets-balancer
-  tag: 0.76aws
+  tag: 0.77aws
   # -- Number of replicas of the wrongsecrets-balancer deployment
   replicas: 1
   service:
@@ -202,7 +202,7 @@ virtualdesktop:
       cpu: 50m
     limits:
       memory: 2GB
-      cpu: 500m
+      cpu: 1200m
   securityContext:
     allowPrivilegeEscalation: false
     readOnlyRootFilesystem: true

readme.md

@@ -13,6 +13,16 @@ Note that we:
 ## Special thanks
 Special thanks to Madhu Akula, Ben de Haan, and Mike Woudenberg for making this port a reality!
 
+
+## What you need to know
+This environment uses a webtop and an instance of wrongsecrets per user. This means that you need per user:
+- 2.5 CPU (min = 1 , limit = 2.5)
+- 3.5 GB RAM (min 2.5GB, limit = 3.5GB)
+- 8GB HD (min 3 GB, limit = 8GB)
+
+A 6 contestant game can be played on a local minikube with updated cpu & memory settings.
+A 100 contestant game can be played on the AWS setup, which will require at least 200 CPUs, 3500 GB Ram, and 800 GB of storage available in the cluster. 
+
 ## Status
 
 **This is by no means ready for anything, and work in progress.**
@@ -25,7 +35,7 @@ For minikube, run:
 
 ```shell
 
-minikube start --network-plugin=cni --cni=calico
+minikube start  --cpus=6 --memory=10000MB --network-plugin=cni --cni=calico
 eval $(minikube docker-env)
 ./build-an-deploy.sh
 kubectl port-forward service/wrongsecrets-balancer 3000:3000

wrongsecrets-balancer/src/kubernetes.js

@@ -214,10 +214,12 @@ const createK8sDeploymentForTeam = async ({ team, passcodeHash }) => {
                 requests: {
                   memory: '512Mi',
                   cpu: '200m',
+                  'ephemeral-storage': '1Gi',
                 },
                 limits: {
                   memory: '512Mi',
-                  cpu: '200m',
+                  cpu: '500m',
+                  'ephemeral-storage': '2Gi',
                 },
               },
 
@@ -229,7 +231,7 @@ const createK8sDeploymentForTeam = async ({ team, passcodeHash }) => {
                 // },
                 {
                   mountPath: '/tmp',
-                  name: 'cache-volume',
+                  name: 'ephemeral',
                 },
                 // ...get('wrongsecrets.volumeMounts', []),
               ],
@@ -243,7 +245,7 @@ const createK8sDeploymentForTeam = async ({ team, passcodeHash }) => {
             //   },
             // },
             {
-              name: 'cache-volume',
+              name: 'ephemeral',
               emptyDir: {},
             },
             // ...get('wrongsecrets.volumes', []),
@@ -379,7 +381,7 @@ const createAWSDeploymentForTeam = async ({ team, passcodeHash }) => {
               },
             },
             {
-              name: 'cache-volume',
+              name: 'ephemeral',
               emptyDir: {},
             },
           ],
@@ -465,10 +467,12 @@ const createAWSDeploymentForTeam = async ({ team, passcodeHash }) => {
                 requests: {
                   memory: '512Mi',
                   cpu: '200m',
+                  'ephemeral-storage': '1Gi',
                 },
                 limits: {
                   memory: '512Mi',
-                  cpu: '1000m',
+                  cpu: '500m',
+                  'ephemeral-storage': '2Gi',
                 },
               },
               volumeMounts: [
@@ -479,7 +483,7 @@ const createAWSDeploymentForTeam = async ({ team, passcodeHash }) => {
                 // },
                 {
                   mountPath: '/tmp',
-                  name: 'cache-volume',
+                  name: 'ephemeral',
                 },
                 {
                   name: 'secrets-store-inline',
@@ -928,7 +932,19 @@ const createDesktopDeploymentForTeam = async ({ team, passcodeHash }) => {
               //TODO REPLACE HARDCODED BELOW WITH PROPPER GETS: image: `${get('wrongsecrets.image')}:${get('wrongsecrets.tag')}`,
               image: 'jeroenwillemsen/wrongsecrets-desktop:1.5.4RC8',
               imagePullPolicy: get('virtualdesktop.imagePullPolicy'),
-              resources: get('virtualdesktop.resources'),
+              resources: {
+                requests: {
+                  memory: '2G',
+                  cpu: '800m',
+                  'ephemeral-storage': '2Gi',
+                },
+                limits: {
+                  memory: '3G',
+                  cpu: '2000m',
+                  'ephemeral-storage': '4Gi',
+                },
+              },
+              // resources: get('virtualdesktop.resources'),
               securityContext: {
                 // allowPrivilegeEscalation: false,
                 // readOnlyRootFilesystem: true,
@@ -957,10 +973,8 @@ const createDesktopDeploymentForTeam = async ({ team, passcodeHash }) => {
                 initialDelaySeconds: 30,
                 periodSeconds: 15,
               },
-              volumeMounts: [{ mountPath: '/tmp', name: 'cache-volume' }],
             },
           ],
-          volumes: [{ name: 'cache-volume', emptyDir: {} }],
           tolerations: get('virtualdesktop.tolerations'),
           affinity: get('virtualdesktop.affinity'),
           runtimeClassName: get('virtualdesktop.runtimeClassName')