Skip to content

Commit 63882d3

Browse files
bendehaanbendehaan
committed
fix: ctfd and ebs
1 parent 493887e commit 63882d3

File tree

9 files changed

+122
-118
lines changed

9 files changed

+122
-118
lines changed

‎aws/.terraform.lock.hcl

Lines changed: 68 additions & 72 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎aws/build-and-deploy-aws.sh

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ kubectl apply -f https://raw.githubusercontent.com/aws/secrets-store-csi-driver-
101101

102102
echo "preparing calico via Helm"
103103
helm repo add projectcalico https://docs.projectcalico.org/charts
104-
helm upgrade --install calico projectcalico/tigera-operator --version v3.21.4
104+
helm upgrade --install calico projectcalico/tigera-operator --version v3.28.2
105105

106106
echo "Generate secrets manager challenge secret 2"
107107
aws secretsmanager put-secret-value --secret-id wrongsecret-2 --secret-string "$(openssl rand -base64 24)" --region $AWS_REGION --output json --no-cli-pager
@@ -150,11 +150,8 @@ helm upgrade --install wrongsecrets ../helm/wrongsecrets-ctf-party \
150150
# Install CTFd
151151
echo "Installing CTFd"
152152

153-
export HELM_EXPERIMENTAL_OCI=1
154-
kubectl create namespace ctfd
155-
156153
# Double base64 encoding to prevent weird character errors in ctfd
157-
helm upgrade --install ctfd -n ctfd oci://ghcr.io/bman46/ctfd/ctfd --version 0.6.3\
154+
helm upgrade --install ctfd -n ctfd oci://ghcr.io/bman46/ctfd/ctfd --create-namespace --version v0.9.3\
158155
--set="redis.auth.password=$(openssl rand -base64 24 | base64)" \
159156
--set="mariadb.auth.rootPassword=$(openssl rand -base64 24 | base64)" \
160157
--set="mariadb.auth.password=$(openssl rand -base64 24 | base64)" \

‎aws/main.tf

Lines changed: 30 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,11 @@ module "eks" {
7474
aws-ebs-csi-driver = {
7575
most_recent = true
7676
service_account_role_arn = module.ebs_csi_irsa_role.iam_role_arn
77+
configuration_values = jsonencode({
78+
defaultStorageClass = {
79+
enabled = true
80+
}
81+
})
7782
}
7883
}
7984

@@ -89,32 +94,42 @@ module "eks" {
8994

9095
create_cloudwatch_log_group = true
9196
cluster_enabled_log_types = ["api", "audit", "authenticator"]
92-
cloudwatch_log_group_retention_in_days = 14 #it's a ctf , we don't need non-necessary costs!
97+
cloudwatch_log_group_retention_in_days = 14 #it's a ctf , we don't need unnecessary costs!
9398

9499
# apply when available: iam_role_permissions_boundary = "arn:aws:iam::${local.account_id}:policy/service-user-creation-permission-boundary"
95100
eks_managed_node_group_defaults = {
96-
disk_size = 256
97-
disk_type = "gp3"
98-
disk_throughput = 150
99-
disk_iops = 3000
100-
instance_types = ["t3a.medium"]
101+
instance_types = ["t3a.medium"]
102+
block_device_mappings = [
103+
{
104+
device_name = "/dev/xvda"
105+
ebs = {
106+
volume_size = 20
107+
volume_type = "gp3"
108+
iops = 3000
109+
throughput = 150
110+
delete_on_termination = true
111+
}
112+
}
113+
]
114+
metadata_options = {
115+
http_tokens = "required",
116+
}
101117

102118
iam_role_additional_policies = {
103119
AmazonEKSWorkerNodePolicy : "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
104120
AmazonEKS_CNI_Policy : "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
105121
AmazonEC2ContainerRegistryReadOnly : "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
106122
AmazonSSMManagedInstanceCore : "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
107-
AmazonEKSVPCResourceController : "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
123+
AmazonEKSVPCResourceController : "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
124+
AmazonEBSCSIDriverPolicy : "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
108125
}
109126
}
110127

111128
eks_managed_node_groups = {
112129
bottlerocket_default = {
113-
use_custom_launch_template = false
114-
min_size = 3
115-
max_size = 50
116-
desired_size = 3
117-
130+
min_size = 3
131+
max_size = 50
132+
desired_size = 3
118133
capacity_type = "ON_DEMAND"
119134

120135
ami_type = "BOTTLEROCKET_x86_64"
@@ -144,7 +159,7 @@ module "eks" {
144159
# Cluster Autoscaler IRSA
145160
module "cluster_autoscaler_irsa_role" {
146161
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
147-
version = "~> 5.44.0"
162+
version = "~> 5.46"
148163

149164

150165
role_name = "wrongsecrets-cluster-autoscaler"
@@ -161,7 +176,7 @@ module "cluster_autoscaler_irsa_role" {
161176

162177
module "ebs_csi_irsa_role" {
163178
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
164-
version = "~> 5.44.0"
179+
version = "~> 5.46"
165180

166181
role_name = "wrongsecrets-ebs-csi"
167182
attach_ebs_csi_policy = true
@@ -176,7 +191,7 @@ module "ebs_csi_irsa_role" {
176191

177192
module "load_balancer_controller_irsa_role" {
178193
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
179-
version = "~> 5.44.0"
194+
version = "~> 5.46"
180195

181196
role_name = "wrongsecrets-load-balancer-controller"
182197
attach_load_balancer_controller_policy = true

‎aws/shared-state/.terraform.lock.hcl

Lines changed: 17 additions & 18 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎aws/shared-state/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
required_version = "~> 1.1"
33
required_providers {
44
aws = {
5-
version = "~> 4.0"
5+
version = "~> 5.0"
66
}
77
}
88
}

‎azure/build-and-deploy-azure.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,7 @@ export HELM_EXPERIMENTAL_OCI=1
170170
kubectl create namespace ctfd
171171

172172
# Double base64 encoding to prevent weird character errors in ctfd
173-
helm upgrade --install ctfd -n ctfd oci://ghcr.io/bman46/ctfd/ctfd --version 0.6.3 \
173+
helm upgrade --install ctfd -n ctfd oci://ghcr.io/bman46/ctfd/ctfd --version 0.9.3 \
174174
--values ./k8s/ctfd-values.yaml \
175175
--set="redis.auth.password=$(openssl rand -base64 24 | base64)" \
176176
--set="mariadb.auth.rootPassword=$(openssl rand -base64 24 | base64)" \

‎gcp/build-and-deploy-gcp.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ export HELM_EXPERIMENTAL_OCI=1
122122
kubectl create namespace ctfd
123123

124124
# Double base64 encoding to prevent weird character errors in ctfd
125-
helm upgrade --install ctfd -n ctfd oci://ghcr.io/bman46/ctfd/ctfd --version 0.6.3 \
125+
helm upgrade --install ctfd -n ctfd oci://ghcr.io/bman46/ctfd/ctfd --version 0.9.3 \
126126
--values ./k8s/ctfd-values.yaml \
127127
--set="redis.auth.password=$(openssl rand -base64 24 | base64)" \
128128
--set="mariadb.auth.rootPassword=$(openssl rand -base64 24 | base64)" \

‎helm/wrongsecrets-ctf-party/requirements.lock

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎wrongsecrets-balancer/src/kubernetes.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1835,8 +1835,8 @@ const createDesktopDeploymentForTeam = async ({ team, passcodeHash }) => {
18351835
'ephemeral-storage': '4Gi',
18361836
},
18371837
limits: {
1838-
memory: '3.5G',
1839-
cpu: '1900m',
1838+
memory: '4.0G',
1839+
cpu: '2000m',
18401840
'ephemeral-storage': '8Gi',
18411841
},
18421842
},

0 commit comments

Comments
 (0)