|
| 1 | +--- |
| 2 | +title: owasp juice shop > run as kubernetes service |
| 3 | +categories: owasp juice shop |
| 4 | +--- |
| 5 | + |
| 6 | +Hello, we shall run the OWASP juice shop as a deployment, and expose it as a service in a local |
| 7 | +kubernetes cluster launched with kind. Hence, familiarity with kubernetes deployment and service is |
| 8 | +essential to follow along. You can try this with any cluster, though I am using a cluster that was |
| 9 | +launched with kind. For those not aware, kind is a tool that makes launching k8s clusters on your |
| 10 | +local machine easy. |
| 11 | + |
| 12 | +My cluster is ready. |
| 13 | +``` |
| 14 | +$ kubectl get nodes |
| 15 | +NAME STATUS ROLES AGE VERSION |
| 16 | +kind-control-plane Ready control-plane,master 10h v1.21.1 |
| 17 | +``` |
| 18 | + |
| 19 | +Here is the manifest for our deployment. |
| 20 | +``` |
| 21 | +$ cat juice-shop-deployment.yaml |
| 22 | +--- |
| 23 | +kind: Deployment |
| 24 | +apiVersion: apps/v1 |
| 25 | +metadata: |
| 26 | + name: juice-shop |
| 27 | +spec: |
| 28 | + template: |
| 29 | + metadata: |
| 30 | + labels: |
| 31 | + app: juice-shop |
| 32 | + spec: |
| 33 | + containers: |
| 34 | + - name: juice-shop |
| 35 | + image: bkimminich/juice-shop |
| 36 | + selector: |
| 37 | + matchLabels: |
| 38 | + app: juice-shop |
| 39 | +... |
| 40 | +``` |
| 41 | + |
| 42 | +Let's launch it. |
| 43 | +``` |
| 44 | +$ kubectl create -f juice-shop-deployment.yaml |
| 45 | +deployment.apps/juice-shop created |
| 46 | +``` |
| 47 | + |
| 48 | +Boom, the pod is running. |
| 49 | +``` |
| 50 | +$ kubectl get po --watch |
| 51 | +NAME READY STATUS RESTARTS AGE |
| 52 | +juice-shop-699c69578f-fzdfq 0/1 ContainerCreating 0 83s |
| 53 | +juice-shop-699c69578f-fzdfq 1/1 Running 0 91s |
| 54 | +
|
| 55 | +$ kubectl get deployment |
| 56 | +NAME READY UP-TO-DATE AVAILABLE AGE |
| 57 | +juice-shop 1/1 1 1 3m8s |
| 58 | +``` |
| 59 | + |
| 60 | +Time to launch the service. Here is the manifest of it. |
| 61 | +``` |
| 62 | +$ cat juice-shop-service.yaml |
| 63 | +--- |
| 64 | +kind: Service |
| 65 | +apiVersion: v1 |
| 66 | +metadata: |
| 67 | + name: juice-shop |
| 68 | +spec: |
| 69 | + type: NodePort |
| 70 | + selector: |
| 71 | + app: juice-shop |
| 72 | + ports: |
| 73 | + - name: http |
| 74 | + port: 8000 |
| 75 | + targetPort: 3000 |
| 76 | +... |
| 77 | +``` |
| 78 | + |
| 79 | +So we are using the service port as 8000, and the container port for the juice shop image is 3000. |
| 80 | +Let's launch it. |
| 81 | +``` |
| 82 | +$ kubectl create -f juice-shop-service.yaml |
| 83 | +service/juice-shop created |
| 84 | +``` |
| 85 | + |
| 86 | +Let's check the service and endpoints. |
| 87 | +``` |
| 88 | +$ kubectl get svc juice-shop |
| 89 | +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE |
| 90 | +juice-shop NodePort 10.96.119.165 <none> 8000:31167/TCP 21s |
| 91 | +
|
| 92 | +$ kubectl get ep juice-shop |
| 93 | +NAME ENDPOINTS AGE |
| 94 | +juice-shop 10.244.0.5:3000 59s |
| 95 | +``` |
| 96 | + |
| 97 | +The endpoint above should match with the pod, let's validate. |
| 98 | +``` |
| 99 | +$ kubectl get po -o wide |
| 100 | +NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES |
| 101 | +juice-shop-699c69578f-fzdfq 1/1 Running 0 7m23s 10.244.0.5 kind-control-plane <none> <none> |
| 102 | +
|
| 103 | +$ kubectl get po -o wide | awk '{print $6}' |
| 104 | +IP |
| 105 | +10.244.0.5 |
| 106 | +``` |
| 107 | + |
| 108 | +Cool, the IP is matching with the Endpoint. Alright, we can now try accessing the app. |
| 109 | + |
| 110 | +Firts, lets try it via the node's IP as its a node port service. Note that the node port is 31167 which |
| 111 | +we obtained from the kubect get svc command. |
| 112 | +``` |
| 113 | +$ kubectl get no -o wide |
| 114 | +NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME |
| 115 | +kind-control-plane Ready control-plane,master 11h v1.21.1 172.18.0.2 <none> Ubuntu 21.04 5.11.0-25-generic containerd://1.5.2 |
| 116 | +
|
| 117 | +$ kubectl get no -o wide | awk '{print $6}' |
| 118 | +INTERNAL-IP |
| 119 | +172.18.0.2 |
| 120 | +``` |
| 121 | + |
| 122 | +Let's then curl the node IP with the node port. |
| 123 | +``` |
| 124 | +$ curl 172.18.0.2:31167 |
| 125 | +--TRUNCATED-- |
| 126 | +<script src="runtime-es2018.js" type="module"></script><script src="runtime-es5.js" nomodule defer></script><script src="polyfills-es5.js" nomodule defer></script><script src="polyfills-es2018.js" type="module"></script><script src="vendor-es2018.js" type="module"></script><script src="vendor-es5.js" nomodule defer></script><script src="main-es2018.js" type="module"></script><script src="main-es5.js" nomodule defer></script></body> |
| 127 | +</html> |
| 128 | +``` |
| 129 | + |
| 130 | +It works!!!. We can now see it via the browser. |
| 131 | + |
| 132 | + |
| 133 | + |
| 134 | +This time, lets try to port foward the service, and then access it via the localhost port. |
| 135 | +``` |
| 136 | +$ kubectl port-forward svc/juice-shop 8080:8000 |
| 137 | +Forwarding from 127.0.0.1:8080 -> 3000 |
| 138 | +Forwarding from [::1]:8080 -> 3000 |
| 139 | +
|
| 140 | +``` |
| 141 | + |
| 142 | +So we should be to reach the service, if we access the localhost on port 8080. |
| 143 | + |
| 144 | +First via curl. Please open a different terminal for curl, as the kubectl port-forward program is |
| 145 | +running continuously. |
| 146 | +``` |
| 147 | +$ curl localhost:8080 |
| 148 | +--TRUNCATED-- |
| 149 | +<script src="runtime-es2018.js" type="module"></script><script src="runtime-es5.js" nomodule defer></script><script src="polyfills-es5.js" nomodule defer></script><script src="polyfills-es2018.js" type="module"></script><script src="vendor-es2018.js" type="module"></script><script src="vendor-es5.js" nomodule defer></script><script src="main-es2018.js" type="module"></script><script src="main-es5.js" nomodule defer></script></body> |
| 150 | +</html> |
| 151 | +``` |
| 152 | + |
| 153 | +curl works, lets check on the browser. |
| 154 | + |
| 155 | + |
| 156 | +You can close the port forwarding with Ctrl C, when you no longer want to access the juice shop through |
| 157 | +the local host port. |
| 158 | +``` |
| 159 | +$ kubectl port-forward svc/juice-shop 8080:8000 |
| 160 | +Forwarding from 127.0.0.1:8080 -> 3000 |
| 161 | +Forwarding from [::1]:8080 -> 3000 |
| 162 | +Handling connection for 8080 |
| 163 | +Handling connection for 8080 |
| 164 | +Handling connection for 8080 |
| 165 | +Handling connection for 8080 |
| 166 | +Handling connection for 8080 |
| 167 | +Handling connection for 8080 |
| 168 | +Handling connection for 8080 |
| 169 | +^C$ |
| 170 | +``` |
| 171 | + |
| 172 | +Well, so we were able to access the juice shop via the node port and via the local host port. Read |
| 173 | +once more for clarity :). Thank you !!! |
| 174 | + |
| 175 | +--end-of-post-- |
0 commit comments