Skip to content

Commit 9a44c85

Browse files
committed
secret access configured
Signed-off-by: osamamagdy <[email protected]>
1 parent 91dea6a commit 9a44c85

File tree

12 files changed

+313
-86
lines changed

12 files changed

+313
-86
lines changed

gcp/README.md

Lines changed: 76 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,18 @@ Please make sure that the account in which you run this exercise has either Clou
77

88
Have the following tools installed:
99

10-
- gcloud CLI - [Installation](https://cloud.google.com/sdk/docs/install)
11-
- Tfenv (Optional) - [Installation](https://github.com/tfutils/tfenv)
12-
- Terraform CLI - [Installation](https://learn.hashicorp.com/tutorials/terraform/install-cli)
13-
- Wget - [Installation](https://www.jcchouinard.com/wget/)
14-
- Helm [Installation](https://helm.sh/docs/intro/install/)
15-
- Kubectl [Installation](https://kubernetes.io/docs/tasks/tools/)
16-
- jq [Installation](https://stedolan.github.io/jq/download/)
10+
- gcloud CLI - [Installation](https://cloud.google.com/sdk/docs/install)
11+
- Tfenv (Optional) - [Installation](https://github.com/tfutils/tfenv)
12+
- Terraform CLI - [Installation](https://learn.hashicorp.com/tutorials/terraform/install-cli)
13+
- Wget - [Installation](https://www.jcchouinard.com/wget/)
14+
- Helm [Installation](https://helm.sh/docs/intro/install/)
15+
- Kubectl [Installation](https://kubernetes.io/docs/tasks/tools/)
16+
- jq [Installation](https://stedolan.github.io/jq/download/)
1717

1818
Make sure you have an active account at GCP for which you have configured the credentials on the system where you will execute the steps below.
1919

2020
Please note that this setup relies on bash scripts that have been tested in MacOS and Linux. We have no intention of supporting vanilla Windows at the moment.
2121

22-
2322
### Multi-user setup: shared state
2423

2524
If you want to host a multi-user setup, you will probably want to share the state file so that everyone can try related challenges. We have provided a starter to easily do so using a Terraform gcs backend.
@@ -51,42 +50,95 @@ The bucket name should be in the output. Please use that to configure the Terraf
5150
6. Run `terraform plan`
5251
7. Run `terraform apply`. Note: the apply will take 10 to 20 minutes depending on the speed of the GCP backplane.
5352
8. Run `export USE_GKE_GCLOUD_AUTH_PLUGIN=True`
54-
9. When creation is done, run `gcloud container clusters get-credentials wrongsecrets-exercise-cluster --region YOUR_REGION`. Note if it errors on a missing plugin to support `kubectl`, then run `gcloud components install gke-gcloud-auth-plugin` and `gcloud container clusters get-credentials wrongsecrets-exercise-cluster` .
55-
10. Run `./k8s-vault-gcp-start.sh`
53+
9. When creation is done, run `gcloud container clusters get-credentials wrongsecrets-exercise-cluster --region YOUR_REGION`. Note if it errors on a missing plugin to support `kubectl`, then run `gcloud components install gke-gcloud-auth-plugin` and `gcloud container clusters get-credentials wrongsecrets-exercise-cluster`.
54+
10. Go to the values of the helm chart and replace the wrongsecrets.config with this:
55+
56+
```yaml
57+
K8S_ENV: "azure"
58+
```
59+
60+
and replace the value of wrongsecrets.env having the name 'K8S_ENV' with this:
5661
57-
### GKE ingres for shared deployment
62+
```yaml
63+
value: "azure"
64+
```
5865
59-
By default the deployment uses a nodePort tunneled to localhost. For a larger audience deployment the wrongsecrets app can deployed with a GKE ingress, run `k8s-vault-gcp-ingress-start.sh`
60-
Please note that the GKE ingress can take a few minues to deploy and is publicly available. A connection URL will be returned once the ingress is available. Note that, after the connection URL is returned, a first lookup might still take a minute, after which it is much faster.
66+
11. Run `./build-and-deploy-gcp.sh`
6167

6268
Your GKE cluster should be visible in [EU-West4](https://console.cloud.google.com/kubernetes?referrer=search&project=wrongsecrets) by default. Want a different region? You can modify `terraform.tfvars` or input it directly using the `region` variable in plan/apply.
6369

6470
Are you done playing? Please run `terraform destroy` twice to clean up.
6571

6672
### Test it
6773

68-
Run `./k8s-vault-gcp-start.sh` and connect to [http://localhost:8080](http://localhost:8080) when it's ready to accept connections (you'll read the line `Forwarding from 127.0.0.1:8080 -> 8080` in your console). Now challenge 9 and 10 should be available as well.
74+
When you have completed the installation steps, you can do `kubectl port-forward service/wrongsecrets-balancer 3000:3000` and then go to [http://localhost:3000](http://localhost:3000).
75+
76+
Want to know how well your cluster is holding up? Check with
77+
78+
```sh
79+
kubectl top nodes
80+
kubectl top pods
81+
```
82+
83+
### Configuring CTFd
84+
85+
You can use the [Juiceshop CTF CLI](https://github.com/juice-shop/juice-shop-ctf) to generate CTFd configuration files.
86+
87+
Follow the following steps:
88+
89+
```shell
90+
npm install -g [email protected]
91+
juice-shop-ctf #choose ctfd and https://wrongsecrets-ctf.herokuapp.com as domain. No trailing slash! The key is 'test', by default feel free to enable hints. We do not support snippets or links/urls to code or hints.
92+
```
93+
94+
Now visit the CTFd instance and setup your CTF. To test things locally before setting up a load balancer/ingress, you can use `kubectl port-forward -n ctfd $(kubectl get pods --namespace ctfd -l "app.kubernetes.io/name=ctfd,app.kubernetes.io/instance=ctfd" -o jsonpath="{.items[0].metadata.name}") 8000:8000` and go to `localhost:8000` to visit CTFd.
6995

70-
### Resume it
96+
_!!NOTE:_ **The following can be dangerous if you use CTFd `>= 3.5.0` with wrongsecrets `< 1.5.11`. Check the `challenges.json` and make sure it's 1-indexed - a 0-indexed file will break CTFd!** _/NOTE!!_
7197

72-
When you stopped the `k8s-vault-gcp-start.sh` script and want to resume the port forward run: `k8s-vault-gcp-resume.sh`. This is because if you run the start script again it will replace the secret in the vault and not update the secret-challenge application with the new secret.
98+
Then use the administrative backup function to import the zipfile you created with the juice-shop-ctf command.
99+
After that you will still need to override the flags with their actual values if you do use the 2-domain configuration. For a guide on how to do this see the 2-domain setup steps in the general [README](../readme.md)
100+
Want to setup your own? You can! Watch out for people finding your key though, so secure it properly: make sure the running container with the actual ctf-key is not exposed to the audience, similar to our heroku container.
101+
102+
Want to make the CTFD instance look pretty? Include the fragment located at [./k8s/ctfd_resources/index_fragment.html](/k8s/ctfd_resources/index_fragment.html) in your index.html via the admin panel.
103+
104+
If you want to share with others go to the [When you want to share your environment with others (experimental)](#when-you-want-to-share-your-environment-with-others-experimental) section.
105+
106+
### Configuring the application
107+
108+
In the front page of the application you can edit the description to reference the right urls and the desplayed image. Use the following:
109+
110+
```sh
111+
helm upgrade --install mj ../helm/wrongsecrets-ctf-party \
112+
--set="balancer.env.REACT_APP_MOVING_GIF_LOGO=<>" \
113+
--set="balancer.env.REACT_APP_HEROKU_WRONGSECRETS_URL=<>" \
114+
--set="balancer.env.REACT_APP_CTFD_URL='<>'" \
115+
```
73116

74117
### Clean it up
75118

76119
When you're done:
77120

78121
1. Kill the port forward.
79-
2. Run `terraform destroy` to clean up the infrastructure.
80-
3. Run `unset KUBECONFIG` to unset the KUBECONFIG env var.
81-
4. Run `rm ~/.kube/wrongsecrets` to remove the kubeconfig file.
82-
5. Run `rm terraform.tfstate*` to remove local state files.
122+
2. Run `terraform destroy` to clean up the infrastructure. Note that you may need to repeat the destroy to fully clean up.
123+
3. If you've used the shared state, `cd` to the `shared-state` folder and run `terraform destroy` there too.
124+
4. Run `rm terraform.tf*` to remove local state files.
83125

84126
### A few things to consider
85127

86128
1. Does your worker node now have access as well?
87-
2. Can you easily obtain the GCP IAM role of the Node?
88-
3. Can you get the secrets in the SSM Parameter Store and Secret Manager easily? Which paths do you see?
89-
4. You should see at the configuration details of the cluster that `databaseEncryption` is `DECRYPTED` (`gcloud container clusters describe wrongsecrets-exercise-cluster --region europe-west4`). What does that mean?
129+
2. Can you easily obtain the AKS managed identity of the Node?
130+
3. Can you get the secrets in the Key vault? Which paths do you see?
131+
132+
### When you want to share your environment with others (experimental)
133+
134+
We added additional scripts for adding a Load Balancer and ingress so that you can use your cloud setup with multiple people.
135+
Do the following:
136+
137+
1. Follow the installation section first.
138+
2. Run `./k8s-nginx-lb-script.sh` and the script will return the url at which you can reach the application. (Be aware this opens the url's to the internet in general, if you'd like to limit the access please do this using the security groups in Azure)
139+
3. When you are done, before you do cleanup, first run `./k8s-nginx-lb-script-cleanup.sh`.
140+
141+
Note that you might have to do some manual cleanups after that.
90142

91143
## Terraform documentation
92144

@@ -126,6 +178,7 @@ No modules.
126178
| [google_compute_subnetwork.node_subnet](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_subnetwork) | resource |
127179
| [google_container_cluster.gke](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster) | resource |
128180
| [google_project_iam_member.wrongsecrets_cluster_sa_roles](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource |
181+
| [google_project_iam_member.wrongsecrets_workload_sa_roles](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource |
129182
| [google_secret_manager_secret.wrongsecret_1](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret) | resource |
130183
| [google_secret_manager_secret.wrongsecret_2](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret) | resource |
131184
| [google_secret_manager_secret.wrongsecret_3](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret) | resource |

gcp/build-and-deploy-gcp.sh

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -68,10 +68,6 @@ echo "Apply secretsmanager storage volume"
6868
kubectl apply -f./k8s/secret-volume.yml
6969

7070

71-
kubectl annotate serviceaccount \
72-
--namespace default wrongsecrets-balancer \
73-
"iam.gke.io/gcp-service-account=wrongsecrets-workload-sa@${GCP_PROJECT}.iam.gserviceaccount.com"
74-
7571
envsubst <./k8s/secret-challenge-vault-deployment.yml.tpl >./k8s/secret-challenge-vault-deployment.yml
7672

7773
echo "Installing metrics api-server"
@@ -113,7 +109,10 @@ helm upgrade --install mj ../helm/wrongsecrets-ctf-party \
113109
--set="balancer.cookie.cookieParserSecret=${COOKIE_PARSER_SECRET}" \
114110
--set="balancer.env.GCP_PROJECT_ID=${GCP_PROJECT}" \
115111
--set="balancer.repository=osamamagdy/wrongsecrets-balancer" \
116-
--set="balancer.tag=v1.1.7"
112+
113+
kubectl annotate serviceaccount \
114+
--namespace default wrongsecrets-balancer \
115+
"iam.gke.io/gcp-service-account=wrongsecrets-workload-sa@${GCP_PROJECT}.iam.gserviceaccount.com"
117116

118117
# Install CTFd
119118
echo "Installing CTFd"

gcp/iam.tf

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,18 @@ resource "google_iam_workload_identity_pool" "pool" {
2020
display_name = "WrongSecrets"
2121
}
2222

23-
# IAM member for the balancer pod. Can be used in a pod.
23+
# Give the balancer pod owner permissions over the project
24+
resource "google_project_iam_member" "wrongsecrets_workload_sa_roles" {
25+
26+
project = var.project_id
27+
role = "roles/owner"
28+
member = "serviceAccount:${google_service_account.wrongsecrets_workload.email}"
29+
}
30+
31+
# Give the service account access to the workload identity of the IAM service account
2432
resource "google_service_account_iam_member" "wrongsecret_wrong_pod_sa" {
2533
service_account_id = google_service_account.wrongsecrets_workload.id
26-
role = "roles/owner"
34+
role = "roles/iam.workloadIdentityUser"
2735
member = "serviceAccount:${var.project_id}.svc.id.goog[default/wrongsecrets-balancer]"
2836
depends_on = [
2937
google_iam_workload_identity_pool.pool,

gcp/k8s/ConfigConnector/IAMPolicy.yaml

Lines changed: 0 additions & 13 deletions
This file was deleted.

gcp/k8s/ConfigConnector/IAMServiceAccount.yaml

Lines changed: 0 additions & 6 deletions
This file was deleted.

gcp/k8s/ConfigConnector/ServiceAccount.yaml

Lines changed: 0 additions & 7 deletions
This file was deleted.

gcp/k8s/ConfigConnector/configConnectorocnfiguration.yaml

Lines changed: 0 additions & 10 deletions
This file was deleted.

gcp/main.tf

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ terraform {
33
# Set the resource group in the backend configuration below, then uncomment and apply!
44
# Note that you probably already create a resource group. Don't forget to set that correctly in this file.
55
backend "gcs" {
6-
bucket = ""
6+
bucket = "tfstate-wrongsecrets-4d4c5bc1"
77
prefix = "terraform/state"
88
}
99
}
@@ -79,11 +79,6 @@ resource "google_container_cluster" "gke" {
7979
gce_persistent_disk_csi_driver_config {
8080
enabled = true
8181
}
82-
83-
config_connector_config {
84-
enabled = false
85-
}
86-
8782
}
8883

8984
timeouts {

0 commit comments

Comments
 (0)