Skip to content

Commit f247bd6

Browse files
bendehaanbendehaan
authored
Merge pull request #314 from osamamagdy/feat--add-azure-support
feat: Add Azure support
2 parents f27f0b1 + 2a3b9ff commit f247bd6

35 files changed

+1883
-6
lines changed

‎.pre-commit-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ repos:
33
rev: v4.3.0
44
hooks:
55
- id: check-yaml
6-
exclude: ^(helm/wrongsecrets-ctf-party/templates/|helm/test.tmp.yaml)
6+
exclude: ^(helm/wrongsecrets-ctf-party/templates/|helm/test.tmp.yaml|azure/k8s/)
77
- id: check-yaml
88
files: ^helm/test.tmp.yaml
99
args:

‎aws/README.md

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ The terraform code is loosely based on [this EKS managed Node Group TF example](
4848
6. Do `terraform apply`. Note: the apply will take 10 to 20 minutes depending on the speed of the AWS backplane.
4949
7. When creation is done, do `aws eks update-kubeconfig --region eu-west-1 --name wrongsecrets-exercise-cluster --kubeconfig ~/.kube/wrongsecrets`
5050
8. Do `export KUBECONFIG=~/.kube/wrongsecrets`
51-
9. Run `./build-an-deploy-aws.sh` to install all the required materials (helm for calico, secrets management, autoscaling, etc.)
51+
9. Run `./build-and-deploy-aws.sh` to install all the required materials (helm for calico, secrets management, autoscaling, etc.)
5252

5353
Your EKS cluster should be visible in [eu-west-1](https://eu-west-1.console.aws.amazon.com/eks/home?region=eu-west-1#/clusters) by default. Want a different region? You can modify `terraform.tfvars` or input it directly using the `region` variable in plan/apply.
5454

@@ -86,6 +86,17 @@ Want to setup your own? You can! Watch out for people finding your key though, s
8686

8787
Want to make the CTFD instance look pretty? Include the fragment located at [./k8s/ctfd_resources/index_fragment.html](/k8s/ctfd_resources/index_fragment.html) in your index.html via the admin panel.
8888

89+
### Configuring the application
90+
91+
In the front page of the application you can edit the description to reference the right urls and the desplayed image. Use the following:
92+
93+
```sh
94+
helm upgrade --install mj ../helm/wrongsecrets-ctf-party \
95+
--set="balancer.env.REACT_APP_MOVING_GIF_LOGO=<>" \
96+
--set="balancer.env.REACT_APP_HEROKU_WRONGSECRETS_URL=<>" \
97+
--set="balancer.env.REACT_APP_CTFD_URL='<>'" \
98+
```
99+
89100
### Clean it up
90101

91102
When you're done:

‎aws/build-an-deploy-aws.sh renamed to ‎aws/build-and-deploy-aws.sh

File renamed without changes.

‎azure/.terraform.lock.hcl

Lines changed: 65 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎azure/README.md

Lines changed: 222 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
# Setup your secrets in Azure
2+
3+
In this setup we integrate the secrets exercise with Azure AKS and let pods consume secrets from an Azure Key Vault. If you want to know more about integrating secrets with AKS, check [this link](https://github.com/Azure/secrets-store-csi-driver-provider-azure).
4+
Please make sure that the account in which you run this exercise has either Log Analytics enabled, or is not linked to your current subscriptions and/or DTAP environment.
5+
6+
## Pre-requisites
7+
8+
Have the following tools installed:
9+
10+
- az CLI - [Installation](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli)
11+
- Tfenv (Optional) - [Installation](https://github.com/tfutils/tfenv)
12+
- Terraform CLI - [Installation](https://learn.hashicorp.com/tutorials/terraform/install-cli)
13+
- Wget - [Installation](https://www.jcchouinard.com/wget/)
14+
- Helm [Installation](https://helm.sh/docs/intro/install/)
15+
- Kubectl [Installation](https://kubernetes.io/docs/tasks/tools/)
16+
- jq [Installation](https://stedolan.github.io/jq/download/)
17+
18+
Make sure you have an active subscription at Azure for which you have configured the credentials on the system where you will execute the steps below.
19+
20+
Please note that this setup relies on bash scripts that have been tested in MacOS and Linux. We have no intention of supporting vanilla Windows at the moment.
21+
22+
## Installation
23+
24+
**Note-I**: We create resources in `east us` by default. You can set the region by editing `terraform.tfvars`.
25+
26+
**Note-II**: The cluster you create has its access bound to the public IP of the creator. In other words: the cluster you create with this code has its access bound to your public IP-address if you apply it locally. If you switched to a different network, you'll need to run `terraform apply` again to update the firewall rules.
27+
28+
### (Optional) Multi-user setup: shared state
29+
30+
If you want to host a multi-user setup, you will probably want to share the state file so that everyone can try related challenges. We have provided a starter to easily do so using an Azure storage container.
31+
32+
First, enable the `Microsoft.Storage` API (if it isn't already) using:
33+
34+
```bash
35+
az provider register --namespace Microsoft.Storage
36+
```
37+
38+
Then, apply the Terraform (optionally add `-var="region=YOUR_DESIRED_REGION"` to the apply to use a region other than the default `East US`):
39+
40+
```bash
41+
cd shared-state
42+
terraform init
43+
terraform apply
44+
```
45+
46+
The storage account name should be in the output. Please use that to configure the Terraform backend in `main.tf` by uncommenting the part on the `backend "azurerm"` inside the `terraform` block. Assign the `storage_account_name` to the one from the output.
47+
48+
**Note**: You'll need to follow the description [below](#wrongsecrets-ctf-party) in step 1 for the "existing resource group" i.e., use the `azurerm_resource_group.default` resource.
49+
50+
### WrongSecrets-ctf-party
51+
52+
1. Set either a new resource group or use an existing resource group in `main.tf` (it defaults to the existing `OWASP-Projects` resource group). Note that you'll need to find/replace references to "azurerm_resource_group.default" to "arurerm_resource_group.default" if you want to create a new one.
53+
2. check whether you have the right project by doing `az account show` (after `az login`). Want to set the project as your default? Use `az account set --subscription <.id here>`.
54+
3. If not yet enabled, register the required services for the subscription, run:
55+
- `az provider register --namespace Microsoft.ContainerService`
56+
- `az provider register --namespace Microsoft.KeyVault`
57+
- `az provider register --namespace Microsoft.ManagedIdentity`
58+
4. Run `terraform init` (if required, use `tfenv` to select TF 0.14.0 or higher )
59+
5. Run `terraform plan` to see what will be created (optional).
60+
6. Run `terraform apply`. Note: the apply will take 5 to 20 minutes depending on the speed of the Azure backplane.
61+
7. Go to the values of the helm chart and replace the wrongsecrets.config with this:
62+
63+
```yaml
64+
K8S_ENV: "azure"
65+
```
66+
67+
and replace the value of wrongsecrets.env having the name 'K8S_ENV' with this:
68+
69+
```yaml
70+
value: "azure"
71+
```
72+
73+
8. Run `./build-and-deploy-azure.sh`. Your kubeconfig file will automatically be updated.
74+
75+
Your AKS cluster should be visible in your resource group. Want a different region? You can modify `terraform.tfvars` or input it directly using the `region` variable in plan/apply.
76+
77+
Are you done playing? Please run `terraform destroy` twice to clean up.
78+
79+
### Test it
80+
81+
When you have completed the installation steps, you can do `kubectl port-forward service/wrongsecrets-balancer 3000:3000` and then go to [http://localhost:3000](http://localhost:3000).
82+
83+
Want to know how well your cluster is holding up? Check with
84+
85+
```sh
86+
kubectl top nodes
87+
kubectl top pods
88+
```
89+
90+
### Configuring CTFd
91+
92+
You can use the [Juiceshop CTF CLI](https://github.com/juice-shop/juice-shop-ctf) to generate CTFd configuration files.
93+
94+
Follow the following steps:
95+
96+
```shell
97+
npm install -g [email protected]
98+
juice-shop-ctf #choose ctfd and https://wrongsecrets-ctf.herokuapp.com as domain. No trailing slash! The key is 'test', by default feel free to enable hints. We do not support snippets or links/urls to code or hints.
99+
```
100+
101+
Now visit the CTFd instance and setup your CTF. To test things locally before setting up a load balancer/ingress, you can use `kubectl port-forward -n ctfd $(kubectl get pods --namespace ctfd -l "app.kubernetes.io/name=ctfd,app.kubernetes.io/instance=ctfd" -o jsonpath="{.items[0].metadata.name}") 8000:8000` and go to `localhost:8000` to visit CTFd.
102+
103+
_!!NOTE:_ **The following can be dangerous if you use CTFd `>= 3.5.0` with wrongsecrets `< 1.5.11`. Check the `challenges.json` and make sure it's 1-indexed - a 0-indexed file will break CTFd!** _/NOTE!!_
104+
105+
Then use the administrative backup function to import the zipfile you created with the juice-shop-ctf command.
106+
After that you will still need to override the flags with their actual values if you do use the 2-domain configuration. For a guide on how to do this see the 2-domain setup steps in the general [README](../readme.md)
107+
Want to setup your own? You can! Watch out for people finding your key though, so secure it properly: make sure the running container with the actual ctf-key is not exposed to the audience, similar to our heroku container.
108+
109+
Want to make the CTFD instance look pretty? Include the fragment located at [./k8s/ctfd_resources/index_fragment.html](/k8s/ctfd_resources/index_fragment.html) in your index.html via the admin panel.
110+
111+
If you want to share with others go to the [When you want to share your environment with others (experimental)](#when-you-want-to-share-your-environment-with-others-experimental) section.
112+
113+
### Configuring the application
114+
115+
In the front page of the application you can edit the description to reference the right urls and the desplayed image. Use the following:
116+
117+
```sh
118+
helm upgrade --install mj ../helm/wrongsecrets-ctf-party \
119+
--set="balancer.env.REACT_APP_MOVING_GIF_LOGO=<>" \
120+
--set="balancer.env.REACT_APP_HEROKU_WRONGSECRETS_URL=<>" \
121+
--set="balancer.env.REACT_APP_CTFD_URL='<>'" \
122+
```
123+
124+
### Clean it up
125+
126+
When you're done:
127+
128+
1. Kill the port forward.
129+
2. Run `terraform destroy` to clean up the infrastructure. Note that you may need to repeat the destroy to fully clean up.
130+
3. If you've used the shared state, `cd` to the `shared-state` folder and run `terraform destroy` there too.
131+
4. Run `rm terraform.tf*` to remove local state files.
132+
133+
### A few things to consider
134+
135+
1. Does your worker node now have access as well?
136+
2. Can you easily obtain the AKS managed identity of the Node?
137+
3. Can you get the secrets in the Key vault? Which paths do you see?
138+
139+
### When you want to share your environment with others (experimental)
140+
141+
We added additional scripts for adding a Load Balancer and ingress so that you can use your cloud setup with multiple people.
142+
Do the following:
143+
144+
1. Follow the installation section first.
145+
2. Run `./k8s-nginx-lb-script.sh` and the script will return the url at which you can reach the application. (Be aware this opens the url's to the internet in general, if you'd like to limit the access please do this using the security groups in Azure)
146+
3. When you are done, before you do cleanup, first run `./k8s-nginx-lb-script-cleanup.sh`.
147+
148+
Note that you might have to do some manual cleanups after that.
149+
150+
## Terraform documentation
151+
152+
The documentation below is auto-generated to give insight on what's created via Terraform.
153+
154+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
155+
## Requirements
156+
157+
| Name | Version |
158+
|------|---------|
159+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.1 |
160+
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | ~> 3.67.0 |
161+
| <a name="requirement_http"></a> [http](#requirement\_http) | ~> 3.4.0 |
162+
| <a name="requirement_random"></a> [random](#requirement\_random) | ~> 3.5.1 |
163+
164+
## Providers
165+
166+
| Name | Version |
167+
|------|---------|
168+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.67.0 |
169+
| <a name="provider_http"></a> [http](#provider\_http) | 3.4.0 |
170+
| <a name="provider_random"></a> [random](#provider\_random) | 3.5.1 |
171+
172+
## Modules
173+
174+
No modules.
175+
176+
## Resources
177+
178+
| Name | Type |
179+
|------|------|
180+
| [azurerm_key_vault.vault](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault) | resource |
181+
| [azurerm_key_vault_access_policy.extra_identity_access](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_access_policy) | resource |
182+
| [azurerm_key_vault_access_policy.identity_access](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_access_policy) | resource |
183+
| [azurerm_key_vault_access_policy.user](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_access_policy) | resource |
184+
| [azurerm_key_vault_secret.wrongsecret_1](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |
185+
| [azurerm_key_vault_secret.wrongsecret_2](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |
186+
| [azurerm_key_vault_secret.wrongsecret_3](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |
187+
| [azurerm_kubernetes_cluster.cluster](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster) | resource |
188+
| [azurerm_resource_group.default](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) | resource |
189+
| [azurerm_role_assignment.aks_extra_identity_operator](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
190+
| [azurerm_role_assignment.aks_identity_operator](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
191+
| [azurerm_role_assignment.aks_vm_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
192+
| [azurerm_user_assigned_identity.aks_extra_pod_identity](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/user_assigned_identity) | resource |
193+
| [azurerm_user_assigned_identity.aks_pod_identity](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/user_assigned_identity) | resource |
194+
| [random_integer.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/integer) | resource |
195+
| [random_password.password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
196+
| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
197+
| [azurerm_client_config.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) | data source |
198+
| [http_http.ip](https://registry.terraform.io/providers/hashicorp/http/latest/docs/data-sources/http) | data source |
199+
200+
## Inputs
201+
202+
| Name | Description | Type | Default | Required |
203+
|------|-------------|------|---------|:--------:|
204+
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | The AKS cluster name | `string` | `"wrongsecrets-exercise-cluster"` | no |
205+
| <a name="input_cluster_version"></a> [cluster\_version](#input\_cluster\_version) | The AKS cluster version to use | `string` | `"1.25"` | no |
206+
| <a name="input_region"></a> [region](#input\_region) | The Azure region to use | `string` | `"East US"` | no |
207+
208+
## Outputs
209+
210+
| Name | Description |
211+
|------|-------------|
212+
| <a name="output_aad_extra_pod_identity_client_id"></a> [aad\_extra\_pod\_identity\_client\_id](#output\_aad\_extra\_pod\_identity\_client\_id) | Client ID for the Managed Identity for AAD Pod Identity |
213+
| <a name="output_aad_extra_pod_identity_resource_id"></a> [aad\_extra\_pod\_identity\_resource\_id](#output\_aad\_extra\_pod\_identity\_resource\_id) | Resource ID for the Managed Identity for AAD Pod Identity |
214+
| <a name="output_aad_pod_identity_client_id"></a> [aad\_pod\_identity\_client\_id](#output\_aad\_pod\_identity\_client\_id) | Client ID for the Managed Identity for AAD Pod Identity |
215+
| <a name="output_aad_pod_identity_resource_id"></a> [aad\_pod\_identity\_resource\_id](#output\_aad\_pod\_identity\_resource\_id) | Resource ID for the Managed Identity for AAD Pod Identity |
216+
| <a name="output_cluster_name"></a> [cluster\_name](#output\_cluster\_name) | AKS Cluster name |
217+
| <a name="output_key_vault_url"></a> [key\_vault\_url](#output\_key\_vault\_url) | Azure KeyVault URI for the Demo Container |
218+
| <a name="output_resource_group"></a> [resource\_group](#output\_resource\_group) | Resource group name |
219+
| <a name="output_tenant_id"></a> [tenant\_id](#output\_tenant\_id) | Azure tenant ID |
220+
| <a name="output_vault_name"></a> [vault\_name](#output\_vault\_name) | Vault name |
221+
| <a name="output_vault_uri"></a> [vault\_uri](#output\_vault\_uri) | Vault URI |
222+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

0 commit comments

Comments
 (0)