pl4nty / ctfcli-deploy-kubernetes Goto Github PK

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

This repository currently has no open or pending branches.

Detected dependencies

• Check this box to trigger a request for Renovate to run again on this repository

https://registry.terraform.io/modules/KNOXDEV/ctf-chal/kubernetes/latest has some cool features. could implement, or provide README guidance (eg nsjail)

process and player isolation (via nsjail)
sandbox filesystems (via ssh tunnelling)
hardware resource restrictions
autoscaling to meet fluctuating demand
healthchecks (catch pod degradation)

kompose supports network policies with --generate-network-policies, but they'll need testing to make sure the first app is available. Outbound access is a difficult tradeoff too, maybe allowed by default with something in compose.yaml or CI-level to block?

Will also need a README update to mention CNI support

They've done a ton of k8s hardening that should probably be copied. Especially basics like serviceAccountToken

ctfcli has an optional healthcheck field for a shell command. This could be applied to the first compose.yaml service. We have a few options:

• Spawn a separate container like kCTF, eg CronJob. But how could we automatically restart unhealthy chals?
• Execute in the chal container with native k8s exec healthcheck. But this requires bundled deps (shell, pwntools, etc) and risks leaking the solution in logs

I prefer the latter since dep management might end up easier. Alternative would be a static healtcheck image, or author having to define an additional image. Plus log leaking is problematic regardless for most chals (shared between teams), and wasn't an issue for PeCan 2023

Currently --template uses a generic YAML merge, but turns out the spec defines merging and is implemented in kompose. We should migrate to it if possible