From 1aa70e88d8b58639121c27bc74d6bc75afd64c81 Mon Sep 17 00:00:00 2001 From: Ben de Haan <6026107+benno001@users.noreply.github.com> Date: Wed, 20 Oct 2021 16:03:27 +0200 Subject: [PATCH 1/3] Add secrets manager with mounts and prepare for challenges --- aws/README.md | 2 +- aws/k8s-vault-aws-start.sh | 26 ++++++- aws/k8s/secret-challenge-vault-deployment.yml | 68 +++++++++++++++++++ aws/k8s/secret-volume.yml | 12 ++++ aws/secrets.tf | 49 ++++++++++++- .../SecretLeakageController.java | 8 +-- .../resources/explanations/challenge10.adoc | 3 + .../resources/explanations/challenge9.adoc | 3 + src/main/resources/templates/challenge.html | 6 +- src/main/resources/templates/index.html | 6 +- src/main/resources/templates/spoil.html | 2 +- 11 files changed, 173 insertions(+), 12 deletions(-) create mode 100644 aws/k8s/secret-challenge-vault-deployment.yml create mode 100644 aws/k8s/secret-volume.yml create mode 100644 src/main/resources/explanations/challenge10.adoc create mode 100644 src/main/resources/explanations/challenge9.adoc diff --git a/aws/README.md b/aws/README.md index ed0c5a656..f82e886a6 100644 --- a/aws/README.md +++ b/aws/README.md @@ -39,7 +39,7 @@ Are you done playing? Please run `terraform destroy` to clean up. ### Test it -Run `k8s-vault-aws-start.sh` and connect to http://localhost:8080 when it's ready to accept connections (you'll the the line `Forwarding from 127.0.0.1:8080 -> 8080` in your console). +Run `AWS_PROFILE= k8s-vault-aws-start.sh` and connect to http://localhost:8080 when it's ready to accept connections (you'll the the line `Forwarding from 127.0.0.1:8080 -> 8080` in your console). ### Clean it up diff --git a/aws/k8s-vault-aws-start.sh b/aws/k8s-vault-aws-start.sh index f8ba9b6c0..4e80100c1 100755 --- a/aws/k8s-vault-aws-start.sh +++ b/aws/k8s-vault-aws-start.sh @@ -3,8 +3,10 @@ # set -o pipefail # set -o nounset +AWS_REGION="eu-west-1" + echo "This is only a script for demoing purposes. You need to have installed: helm, kubectl, jq, vault, grep, cat, sed, and awscli, and is only tested on mac, Debian and Ubuntu" -echo "This script is based on the steps defined in https://learn.hashicorp.com/tutorials/vault/kubernetes-minikube . Vault is awesome!" +echo "This script is based on the steps defined in https://learn.hashicorp.com/tutorials/vault/kubernetes-minikube. Vault is awesome!" kubectl get configmaps | grep 'secrets-file' &>/dev/null if [ $? == 0 ]; then @@ -97,9 +99,29 @@ kubectl exec vault-0 -- vault write auth/kubernetes/role/secret-challenge \ vault kv put secret/secret-challenge vaultpassword.password="$(openssl rand -base64 16)" && vault kv put secret/application vaultpassword.password="$(openssl rand -base64 16)" +echo "Setting up IRSA for the vault service account" kubectl annotate --overwrite sa vault eks.amazonaws.com/role-arn="$(terraform output -raw irsa_role)" -kubectl apply -f../k8s/secret-challenge-vault-deployment.yml +echo "Add secrets manager driver to EKS" +helm repo add secrets-store-csi-driver https://raw.githubusercontent.com/kubernetes-sigs/secrets-store-csi-driver/master/charts + +helm list --namespace kube-system | grep 'csi-secrets-store' &>/dev/null +if [ $? == 0 ]; then + echo "CSI driver is already installed" +else + helm install -n kube-system csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver --set enableSecretRotation=true --set rotationPollInterval=60s +fi + +echo "Install ACSP" +kubectl apply -f https://raw.githubusercontent.com/aws/secrets-store-csi-driver-provider-aws/main/deployment/aws-provider-installer.yaml + +echo "Generate secrets manager challenge secret 2" +aws secretsmanager put-secret-value --secret-id wrongsecret-2 --secret-string "$(openssl rand -base64 24)" --region $AWS_REGION --output json --no-cli-pager + +echo "Apply secretsmanager storage volume" +kubectl apply -f./k8s/secret-volume.yml + +kubectl apply -f./k8s/secret-challenge-vault-deployment.yml while [[ $(kubectl get pods -l app=secret-challenge -o 'jsonpath={..status.conditions[?(@.type=="Ready")].status}') != "True" ]]; do echo "waiting for secret-challenge" && sleep 2; done #kubectl expose deployment secret-challenge --type=LoadBalancer --port=8080 kubectl port-forward \ diff --git a/aws/k8s/secret-challenge-vault-deployment.yml b/aws/k8s/secret-challenge-vault-deployment.yml new file mode 100644 index 000000000..c5504a986 --- /dev/null +++ b/aws/k8s/secret-challenge-vault-deployment.yml @@ -0,0 +1,68 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: secret-challenge + name: secret-challenge + namespace: default +spec: + progressDeadlineSeconds: 600 + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + app: secret-challenge + strategy: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + type: RollingUpdate + template: + metadata: + creationTimestamp: "2020-10-28T20:21:04Z" + labels: + app: secret-challenge + name: secret-challenge + spec: + serviceAccountName: vault + volumes: + - name: secrets-store-inline + csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: "wrongsecrets-aws-secretsmanager" + containers: + - image: jeroenwillemsen/addo-example:0.0.2-k8s-vault + imagePullPolicy: IfNotPresent + ports: + - containerPort: 8080 + protocol: TCP + name: secret-challenge + resources: {} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + env: + - name: SPECIAL_K8S_SECRET + valueFrom: + configMapKeyRef: + name: secrets-file + key: funny.entry + - name: SPECIAL_SPECIAL_K8S_SECRET + valueFrom: + secretKeyRef: + name: funnystuff + key: funnier + - name: VAULT_ADDR + value: "http://vault:8200" + - name: JWT_PATH + value: "/var/run/secrets/kubernetes.io/serviceaccount/token" + volumeMounts: + - name: secrets-store-inline + mountPath: "/mnt/secrets-store" + readOnly: true + dnsPolicy: ClusterFirst + restartPolicy: Always + schedulerName: default-scheduler + securityContext: {} + terminationGracePeriodSeconds: 30 diff --git a/aws/k8s/secret-volume.yml b/aws/k8s/secret-volume.yml new file mode 100644 index 000000000..706ac0d11 --- /dev/null +++ b/aws/k8s/secret-volume.yml @@ -0,0 +1,12 @@ +apiVersion: secrets-store.csi.x-k8s.io/v1alpha1 +kind: SecretProviderClass +metadata: + name: wrongsecrets-aws-secretsmanager +spec: + provider: aws + parameters: + objects: | + - objectName: "wrongsecret" + objectType: "secretsmanager" + - objectName: "wrongsecret-2" + objectType: "secretsmanager" diff --git a/aws/secrets.tf b/aws/secrets.tf index f56180b1c..7faac38a8 100644 --- a/aws/secrets.tf +++ b/aws/secrets.tf @@ -1,8 +1,23 @@ +############################### +# Secrets manager challenge 1 # +############################### + resource "aws_secretsmanager_secret" "secret" { name = "wrongsecret" } -resource "aws_secretsmanager_secret_policy" "name" { +resource "aws_secretsmanager_secret_version" "secret" { + secret_id = aws_secretsmanager_secret.secret.id + secret_string = random_password.password.result +} + +resource "random_password" "password" { + length = 24 + special = true + override_special = "_%@" +} + +resource "aws_secretsmanager_secret_policy" "policy" { block_public_policy = true secret_arn = aws_secretsmanager_secret.secret.arn @@ -24,3 +39,35 @@ resource "aws_secretsmanager_secret_policy" "name" { POLICY } + + +############################### +# Secrets manager challenge 2 # +############################### + +resource "aws_secretsmanager_secret" "secret_2" { + name = "wrongsecret-2" +} + +resource "aws_secretsmanager_secret_policy" "policy_2" { + block_public_policy = true + secret_arn = aws_secretsmanager_secret.secret_2.arn + + policy = <Challenge 6 Challenge 7 Challenge 8 + Challenge 9 + Challenge 10 @@ -49,7 +51,7 @@

-

+

@@ -57,7 +59,7 @@

- There are 8 challenges (/challenge/1-8), can you solve them all?
+ There are 10 challenges (/challenge/1-10), can you solve them all?
Go back to the main page.

diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html index 909177ef6..d905027c6 100644 --- a/src/main/resources/templates/index.html +++ b/src/main/resources/templates/index.html @@ -33,6 +33,8 @@ Challenge 6 Challenge 7 Challenge 8 + Challenge 9 + Challenge 10 @@ -60,8 +62,10 @@

Welcome

Challenge 6
Challenge 7
Challenge 8
+ Challenge 9
+ Challenge 10

-

Don't want to wait with Vault? here is the secret :(.

+

Don't want to wait for Vault? here is the secret :(.

diff --git a/src/main/resources/templates/spoil.html b/src/main/resources/templates/spoil.html index 9e8bf26c7..ac92fa408 100644 --- a/src/main/resources/templates/spoil.html +++ b/src/main/resources/templates/spoil.html @@ -8,6 +8,6 @@

Spoiling secret

-There are 8 challenges (/challenge/1-8), can you solve them all? +There are 10 challenges (/challenge/1-10), can you solve them all? \ No newline at end of file From 6dcbdfa15969e1c0c856358e0c408cd42be0b752 Mon Sep 17 00:00:00 2001 From: Ben de Haan <6026107+benno001@users.noreply.github.com> Date: Wed, 20 Oct 2021 16:08:51 +0200 Subject: [PATCH 2/3] Update test --- .../example/secrettextprinter/SecretLeakageControllerTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/java/com/example/secrettextprinter/SecretLeakageControllerTest.java b/src/test/java/com/example/secrettextprinter/SecretLeakageControllerTest.java index 5c2ef1f5e..f6ed67fda 100644 --- a/src/test/java/com/example/secrettextprinter/SecretLeakageControllerTest.java +++ b/src/test/java/com/example/secrettextprinter/SecretLeakageControllerTest.java @@ -88,7 +88,7 @@ void solveChallenge4() throws Exception { private void solveChallenge(String endpoint, String solution) throws Exception { this.mockMvc.perform(MockMvcRequestBuilders.post("/challenge/1").param("solution", hardcodedPassword)) .andExpect(MockMvcResultMatchers.status().isOk()) - .andExpect(MockMvcResultMatchers.content().string(CoreMatchers.containsString("You're answer is correct!"))); + .andExpect(MockMvcResultMatchers.content().string(CoreMatchers.containsString("Your answer is correct!"))); } private void testSpoil(String endpoint, String soluton) throws Exception { From 88a76b3ecbff95227ff162a63d6d7a508a2739b5 Mon Sep 17 00:00:00 2001 From: Ben de Haan <6026107+benno001@users.noreply.github.com> Date: Wed, 20 Oct 2021 16:27:29 +0200 Subject: [PATCH 3/3] Force immediate destruction of secrets to facilitate spin up/bring down --- aws/secrets.tf | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/aws/secrets.tf b/aws/secrets.tf index 7faac38a8..b093e922d 100644 --- a/aws/secrets.tf +++ b/aws/secrets.tf @@ -3,7 +3,8 @@ ############################### resource "aws_secretsmanager_secret" "secret" { - name = "wrongsecret" + name = "wrongsecret" + recovery_window_in_days = 0 } resource "aws_secretsmanager_secret_version" "secret" { @@ -46,7 +47,8 @@ POLICY ############################### resource "aws_secretsmanager_secret" "secret_2" { - name = "wrongsecret-2" + name = "wrongsecret-2" + recovery_window_in_days = 0 } resource "aws_secretsmanager_secret_policy" "policy_2" {