From f25bf60d46d18100de6edf89517683baebf0c4b7 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Fri, 9 Apr 2021 17:12:55 +0200 Subject: [PATCH] =?UTF-8?q?=E2=99=BB=EF=B8=8F=20Replace=20the=20Tomcat=20e?= =?UTF-8?q?xample=20with=20the=20OWASP=20Juice=20Shop?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- slides/k8s/helm-chart-format.md | 40 +++++--- slides/k8s/helm-intro.md | 165 ++++++++++++++++++-------------- slides/k8s/helm-secrets.md | 43 ++++++--- 3 files changed, 149 insertions(+), 99 deletions(-) diff --git a/slides/k8s/helm-chart-format.md b/slides/k8s/helm-chart-format.md index c0a5ada0..a3352f3d 100644 --- a/slides/k8s/helm-chart-format.md +++ b/slides/k8s/helm-chart-format.md @@ -40,7 +40,22 @@ - a `Chart.yaml` file, containing metadata (name, version, description ...) -- Let's look at a simple chart, `stable/tomcat` +- Let's look at a simple chart for a basic demo app + +--- + +## Adding the repo + +- If you haven't done it before, you need to add the repo for that chart + +.exercise[ + +- Add the repo that holds the chart for the OWASP Juice Shop: + ```bash + helm repo add juice https://charts.securecodebox.io + ``` + +] --- @@ -50,17 +65,17 @@ .exercise[ -- Download the tarball for `stable/tomcat`: +- Download the tarball for `juice/juice-shop`: ```bash - helm pull stable/tomcat + helm pull juice/juice-shop ``` - (This will create a file named `tomcat-X.Y.Z.tgz`.) + (This will create a file named `juice-shop-X.Y.Z.tgz`.) -- Or, download + untar `stable/tomcat`: +- Or, download + untar `juice/juice-shop`: ```bash - helm pull stable/tomcat --untar + helm pull juice/juice-shop --untar ``` - (This will create a directory named `tomcat`.) + (This will create a directory named `juice-shop`.) ] @@ -68,13 +83,13 @@ ## Looking at the chart's content -- Let's look at the files and directories in the `tomcat` chart +- Let's look at the files and directories in the `juice-shop` chart .exercise[ - Display the tree structure of the chart we just downloaded: ```bash - tree tomcat + tree juice-shop ``` ] @@ -93,12 +108,11 @@ We see the components mentioned above: `Chart.yaml`, `templates/`, `values.yaml` (using the standard Go template library) - .exercise[ -- Look at the template file for the tomcat Service resource: +- Look at the template file for the Service resource: ```bash - cat tomcat/templates/appsrv-svc.yaml + cat juice-shop/templates/service.yaml ``` ] @@ -190,7 +204,7 @@ We see the components mentioned above: `Chart.yaml`, `templates/`, `values.yaml` - At the top-level of the chart, it's a good idea to have a README -- It will be viewable with e.g. `helm show readme stable/tomcat` +- It will be viewable with e.g. `helm show readme juice/juice-shop` - In the `templates/` directory, we can also have a `NOTES.txt` file diff --git a/slides/k8s/helm-intro.md b/slides/k8s/helm-intro.md index 66385ab8..c6e02fbb 100644 --- a/slides/k8s/helm-intro.md +++ b/slides/k8s/helm-intro.md @@ -229,71 +229,95 @@ fine for personal and development clusters.) --- -## Managing repositories - -- Let's check what repositories we have, and add the `stable` repo - - (the `stable` repo contains a set of official-ish charts) - -.exercise[ - -- List our repos: - ```bash - helm repo list - ``` - -- Add the `stable` repo: - ```bash - helm repo add stable https://charts.helm.sh/stable - ``` - -] - -Adding a repo can take a few seconds (it downloads the list of charts from the repo). - -It's OK to add a repo that already exists (it will merely update it). - ---- - class: extra-details -## Deprecation warning +## How to find charts, the old way -- That "stable" is being deprecated, in favor of a more decentralized approach +- Helm 2 came with one pre-configured repo, the "stable" repo - (each community / company / group / project hosting their own repository) + (located at https://charts.helm.sh/stable) -- We're going to use it here for educational purposes +- Helm 3 doesn't have any pre-configured repo -- But if you're looking for production-grade charts, look elsewhere! +- The "stable" repo mentioned above is now being deprecated - (namely, on the Helm Hub) +- The new approach is to have fully decentralized repos + +- Repos can be indexed in the Artifact Hub + + (which supersedes the Helm Hub) --- -## Search available charts +## How to find charts, the new way -- We can search available charts with `helm search` +- Go to the [Artifact Hub](https://artifacthub.io/packages/search?kind=0) (https://artifacthub.io) -- We need to specify where to search (only our repos, or Helm Hub) +- Or use `helm search hub ...` from the CLI -- Let's search for all charts mentioning tomcat! +- Let's try to find a Helm chart for something called "OWASP Juice Shop"! + + (it is a famous demo app used in security challenges) + +--- + +## Finding charts from the CLI + +- We can use `helm search hub ` .exercise[ -- Search for tomcat in the repo that we added earlier: +- Look for the OWASP Juice Shop app: ```bash - helm search repo tomcat + helm search hub owasp juice ``` -- Search for tomcat on the Helm Hub: +- Since the URLs are truncated, try with the YAML output: ```bash - helm search hub tomcat + helm search hub owasp juice -o yaml ``` ] -[Helm Hub](https://hub.helm.sh/) indexes many repos, using the [Monocular](https://github.com/helm/monocular) server. +Then go to → https://artifacthub.io/packages/helm/seccurecodebox/juice-shop + +--- + +## Finding charts on the web + +- We can also use the Artifact Hub search feature + +.exercise[ + +- Go to https://artifacthub.io/ + +- In the search box on top, enter "owasp juice" + +- Click on the "juice-shop" result (not "multi-juicer" or "juicy-ctf") + +] + +--- + +## Installing the chart + +- Click on the "Install" button, it will show instructions + +.exercise[ + +- First, add the repository for that chart: + ```bash + helm repo add juice https://charts.securecodebox.io + ``` + +- Then, install the chart: + ```bash + helm install my-juice-shop juice/juice-shop + ``` + +] + +Note: it is also possible to install directly a chart, with `--repo https://...` --- @@ -301,22 +325,22 @@ class: extra-details - "Installing a chart" means creating a *release* -- We need to name that release +- In the previous exemple, the release was named "my-juice-shop" - (or use the `--generate-name` to get Helm to generate one for us) +- We can also use `--generate-name` to ask Helm to generate a name for us .exercise[ -- Install the tomcat chart that we found earlier: - ```bash - helm install java4ever stable/tomcat - ``` - - List the releases: ```bash helm list ``` +- Check that we have a `my-juice-shop-...` Pod up and running: + ```bash + kubectl get pods + ``` + ] --- @@ -329,13 +353,13 @@ class: extra-details - The `helm search` command only takes a search string argument - (e.g. `helm search tomcat`) + (e.g. `helm search juice-shop`) - With Helm 2, the name is optional: - `helm install stable/tomcat` will automatically generate a name + `helm install juice/juice-shop` will automatically generate a name - `helm install --name java4ever stable/tomcat` will specify a name + `helm install --name my-juice-shop juice/juice-shop` will specify a name --- @@ -349,12 +373,12 @@ class: extra-details - List all the resources created by this release: ```bash - kubectl get all --selector=release=java4ever + kubectl get all --selector=app.kubernetes.io/instance=my-juice-shop ``` ] -Note: this `release` label wasn't added automatically by Helm. +Note: this label wasn't added automatically by Helm.
It is defined in that chart. In other words, not all charts will provide this label. @@ -362,11 +386,11 @@ It is defined in that chart. In other words, not all charts will provide this la ## Configuring a release -- By default, `stable/tomcat` creates a service of type `LoadBalancer` +- By default, `juice/juice-shop` creates a service of type `ClusterIP` - We would like to change that to a `NodePort` -- We could use `kubectl edit service java4ever-tomcat`, but ... +- We could use `kubectl edit service my-juice-shop`, but ... ... our changes would get overwritten next time we update that chart! @@ -386,14 +410,14 @@ It is defined in that chart. In other words, not all charts will provide this la .exercise[ -- Look at the README for tomcat: +- Look at the README for the app: ```bash - helm show readme stable/tomcat + helm show readme juice/juice-shop ``` - Look at the values and their defaults: ```bash - helm show values stable/tomcat + helm show values juice/juice-shop ``` ] @@ -410,18 +434,19 @@ The `readme` may or may not have (accurate) explanations for the values. - Values can be set when installing a chart, or when upgrading it -- We are going to update `java4ever` to change the type of the service +- We are going to update `my-juice-shop` to change the type of the service .exercise[ -- Update `java4ever`: +- Update `my-juice-shop`: ```bash - helm upgrade java4ever stable/tomcat --set service.type=NodePort + helm upgrade my-juice-shop juice/my-juice-shop \ + --set service.type=NodePort ``` ] -Note that we have to specify the chart that we use (`stable/tomcat`), +Note that we have to specify the chart that we use (`juice/my-juice-shop`), even if we just want to update some values. We can set multiple values. If we want to set many values, we can use `-f`/`--values` and pass a YAML file with all the values. @@ -430,25 +455,21 @@ All unspecified values will take the default values defined in the chart. --- -## Connecting to tomcat +## Connecting to the Juice Shop -- Let's check the tomcat server that we just installed - -- Note: its readiness probe has a 60s delay - - (so it will take 60s after the initial deployment before the service works) +- Let's check the app that we just installed .exercise[ - Check the node port allocated to the service: ```bash - kubectl get service java4ever-tomcat - PORT=$(kubectl get service java4ever-tomcat -o jsonpath={..nodePort}) + kubectl get service my-juice-shop + PORT=$(kubectl get service my-juice-shop -o jsonpath={..nodePort}) ``` -- Connect to it, checking the demo app on `/sample/`: +- Connect to it: ```bash - curl localhost:$PORT/sample/ + curl localhost:$PORT/ ``` ] diff --git a/slides/k8s/helm-secrets.md b/slides/k8s/helm-secrets.md index 032ad0e4..8d613b54 100644 --- a/slides/k8s/helm-secrets.md +++ b/slides/k8s/helm-secrets.md @@ -12,22 +12,37 @@ --- +## Adding the repo + +- If you haven't done it before, you need to add the repo for that chart + +.exercise[ + +- Add the repo that holds the chart for the OWASP Juice Shop: + ```bash + helm repo add juice https://charts.securecodebox.io + ``` + +] + +--- + ## We need a release - We need to install something with Helm -- Let's use the `stable/tomcat` chart as an example +- Let's use the `juice/juice-shop` chart as an example .exercise[ -- Install a release called `tomcat` with the chart `stable/tomcat`: +- Install a release called `orange` with the chart `juice/juice-shop`: ```bash - helm upgrade tomcat stable/tomcat --install + helm upgrade orange juice/juice-shop --install ``` - Let's upgrade that release, and change a value: ```bash - helm upgrade tomcat stable/tomcat --set ingress.enabled=true + helm upgrade orange juice/juice-shop --set ingress.enabled=true ``` ] @@ -42,7 +57,7 @@ - View the history for that release: ```bash - helm history tomcat + helm history orange ``` ] @@ -82,11 +97,11 @@ We should see a number of secrets with TYPE `helm.sh/release.v1`. .exercise[ -- Examine the secret corresponding to the second release of `tomcat`: +- Examine the secret corresponding to the second release of `orange`: ```bash - kubectl describe secret sh.helm.release.v1.tomcat.v2 + kubectl describe secret sh.helm.release.v1.orange.v2 ``` - (`v1` is the secret format; `v2` means revision 2 of the `tomcat` release) + (`v1` is the secret format; `v2` means revision 2 of the `orange` release) ] @@ -102,7 +117,7 @@ There is a key named `release`. - Dump the secret: ```bash - kubectl get secret sh.helm.release.v1.tomcat.v2 \ + kubectl get secret sh.helm.release.v1.orange.v2 \ -o go-template='{{ .data.release }}' ``` @@ -120,7 +135,7 @@ Secrets are encoded in base64. We need to decode that! - Decode the secret: ```bash - kubectl get secret sh.helm.release.v1.tomcat.v2 \ + kubectl get secret sh.helm.release.v1.orange.v2 \ -o go-template='{{ .data.release | base64decode }}' ``` @@ -144,7 +159,7 @@ Let's try one more round of decoding! - Decode it twice: ```bash - kubectl get secret sh.helm.release.v1.tomcat.v2 \ + kubectl get secret sh.helm.release.v1.orange.v2 \ -o go-template='{{ .data.release | base64decode | base64decode }}' ``` @@ -164,7 +179,7 @@ Let's try one more round of decoding! - Pipe the decoded release through `file -`: ```bash - kubectl get secret sh.helm.release.v1.tomcat.v2 \ + kubectl get secret sh.helm.release.v1.orange.v2 \ -o go-template='{{ .data.release | base64decode | base64decode }}' \ | file - ``` @@ -185,7 +200,7 @@ Gzipped data! It can be decoded with `gunzip -c`. - Rerun the previous command, but with `| gunzip -c > release-info` : ```bash - kubectl get secret sh.helm.release.v1.tomcat.v2 \ + kubectl get secret sh.helm.release.v1.orange.v2 \ -o go-template='{{ .data.release | base64decode | base64decode }}' \ | gunzip -c > release-info ``` @@ -211,7 +226,7 @@ If we inspect that JSON (e.g. with `jq keys release-info`), we see: - `config` (contains the values that we've set) - `info` (date of deployment, status messages) - `manifest` (YAML generated from the templates) -- `name` (name of the release, so `tomcat`) +- `name` (name of the release, so `orange`) - `namespace` (namespace where we deployed the release) - `version` (revision number within that release; starts at 1)