insecure-kubernetes-deployments/insecure-app.yaml at main · roelanddel/insecure-kubernetes-deployments · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: insecure-app
  namespace: insecure-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: insecure-app
  template:
    metadata:
      labels:
        app: insecure-app
    spec:
      containers:
      - image: confusedcrib/insecure-app:latest
        name: insecure-app
        env:
        - name: AWS_ACCESS_KEY_ID
          value: AKIAIOSFODNN72HYSDD8
        - name: AWS_SECRET_ACCESS_KEY
          value: wJalrXUtnFEMI/K7MDENG/bPxRfiCYeh2g7ykyu8
        securityContext:
          privileged: true
        volumeMounts:
        - name: docker-socket
          mountPath: /var/run/docker.sock
      volumes:
      - name: docker-socket
        hostPath:
          path: /var/run/docker.sock
      serviceAccountName: insecure-app-sa
---
kind: Service
apiVersion: v1
metadata:
  name: insecure-app
  namespace: insecure-app
spec:
  type: NodePort
  selector:
    app: insecure-app
  ports:
  - name: http
    port: 8080
    targetPort: 8080
  - name: ssh
    port: 22
    targetPort: 22
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: insecure-app-role
rules:
- apiGroups: [""]
  resources: ["pods", "serviceaccounts", "serviceaccounts/token"]
  verbs: ["*"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: insecure-app-role-binding
subjects:
- kind: ServiceAccount
  name: insecure-app-sa
  namespace: insecure-app
  apiGroup: ""
roleRef:
  kind: ClusterRole
  name: insecure-app-role
  apiGroup: ""
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: insecure-app-sa
  namespace: insecure-app