refactor: directory structure

Dockerfile

@@ -2,6 +2,6 @@ FROM controlplane/simulator:dev
 
 COPY --chown=ubuntu:ubuntu packer packer
 COPY --chown=ubuntu:ubuntu terraform terraform
-COPY --chown=ubuntu:ubuntu scenarios scenarios
+COPY --chown=ubuntu:ubuntu ansible ansible
 
 RUN cd terraform/workspaces/simulator && terraform init -backend=false

terraform/workspaces/simulator/ansible-playbooks.tf → ansible/playbooks/init-cluster.yaml

@@ -1,6 +1,3 @@
-resource "local_file" "init_cluster" {
-  filename = format("%s/%s", var.admin_config_dir, local.ansible_playbook_init_cluster)
-  content = <<EOF
 ---
 
 - name: Initialise the kubernetes cluster
@@ -62,19 +59,3 @@ resource "local_file" "init_cluster" {
       become: no
       run_once: yes
       delegate_to: localhost
-EOF
-}
-
-resource "local_file" "update_known_hosts" {
-  filename = format("%s/%s", var.admin_config_dir, local.ansible_playbook_update_known_hosts)
-  content = <<EOF
----
-
-- hosts: all
-  gather_facts: no
-  become: no
-  tasks:
-    - ansible.builtin.wait_for_connection:
-    - ansible.builtin.ping:
-EOF
-}

ansible/playbooks/update-known-hosts.yaml

@@ -0,0 +1,8 @@
+---
+
+- hosts: all
+  gather_facts: no
+  become: no
+  tasks:
+    - ansible.builtin.wait_for_connection:
+    - ansible.builtin.ping:

controlplane/simulator.go

@@ -12,21 +12,20 @@ import (
 
 const (
 	SimulatorDir = "/simulator"
-	Home         = "config"
-	Scenarios    = "scenarios"
+	Ansible      = "ansible"
 	Packer       = "packer"
 	Terraform    = "terraform"
 )
 
 var (
-	HomeDir         = filepath.Join(SimulatorDir, Home)
-	AdminConfigDir  = filepath.Join(HomeDir, "admin")
-	PlayerConfigDir = filepath.Join(HomeDir, "player")
+	AWSDir             = "/home/ubuntu/.aws"
+	AdminSSHBundleDir  = filepath.Join(SimulatorDir, "admin")
+	PlayerSSHBundleDir = filepath.Join(SimulatorDir, "player")
 
-	AnsibleDir                = filepath.Join(SimulatorDir, Scenarios)
-	AnsiblePlaybookDir string = filepath.Join(AnsibleDir, "playbooks")
+	AnsibleDir         = filepath.Join(SimulatorDir, Ansible)
+	AnsiblePlaybookDir = filepath.Join(AnsibleDir, "playbooks")
 
-	PackerTemplateDir string = filepath.Join(SimulatorDir, Packer)
+	PackerTemplateDir = filepath.Join(SimulatorDir, Packer)
 
 	TerraformDir          = filepath.Join(SimulatorDir, Terraform)
 	TerraformWorkspaceDir = filepath.Join(TerraformDir, "workspaces/simulator")
@@ -71,7 +70,6 @@ func (s simulator) BuildImage(ctx context.Context, name string) error {
 	return commands.PackerBuildCommand(PackerTemplateDir, string(name)).Run(ctx)
 }
 
-// TODO: add state path and config bucket and path to support Kubesim
 func (s simulator) CreateInfrastructure(ctx context.Context, bucket, key, name string) error {
 	slog.Debug("simulator create infrastructure", "bucket", bucket, "key", key, "name", name)
 
@@ -81,6 +79,7 @@ func (s simulator) CreateInfrastructure(ctx context.Context, bucket, key, name s
 	}
 
 	return commands.TerraformCommand(TerraformWorkspaceDir, commands.TerraformApply, terraformVars(name, bucket)).Run(ctx)
+
 }
 
 func (s simulator) DestroyInfrastructure(ctx context.Context, bucket, key, name string) error {
@@ -97,13 +96,13 @@ func (s simulator) DestroyInfrastructure(ctx context.Context, bucket, key, name
 func (s simulator) InstallScenario(ctx context.Context, name string) error {
 	slog.Debug("simulator install", "scenario", name)
 
-	return commands.AnsiblePlaybookCommand(AdminConfigDir, AnsiblePlaybookDir, name).Run(ctx)
+	return commands.AnsiblePlaybookCommand(AdminSSHBundleDir, AnsiblePlaybookDir, name).Run(ctx)
 }
 
 func (s simulator) UninstallScenario(ctx context.Context, name string) error {
 	slog.Debug("simulator uninstall", "scenario", name)
 
-	return commands.AnsiblePlaybookCommand(AdminConfigDir, AnsiblePlaybookDir, name, "state=absent").Run(ctx)
+	return commands.AnsiblePlaybookCommand(AdminSSHBundleDir, AnsiblePlaybookDir, name, "state=absent").Run(ctx)
 }
 
 func backendConfig(bucket, key string) []string {
@@ -122,8 +121,8 @@ func terraformVars(name, bucket string) []string {
 		"-var",
 		fmt.Sprintf("bucket=%s", bucket),
 		"-var",
-		fmt.Sprintf("admin_config_dir=%s", AdminConfigDir),
+		fmt.Sprintf("admin_ssh_bundle_dir=%s", AdminSSHBundleDir),
 		"-var",
-		fmt.Sprintf("player_config_dir=%s", PlayerConfigDir),
+		fmt.Sprintf("player_ssh_bundle_dir=%s", PlayerSSHBundleDir),
 	}
 }

internal/cli/scenario.go

@@ -2,7 +2,6 @@ package cli
 
 import (
 	"context"
-	"fmt"
 	"os"
 	"os/signal"
 
@@ -71,34 +70,7 @@ var scenarioListCmd = &cobra.Command{
 		scenarios, err := scenarios.List()
 		cobra.CheckErr(err)
 
-		table := tablewriter.NewWriter(os.Stdout)
-
-		table.SetHeader([]string{
-			"ID",
-			"Name",
-			"Description",
-			"Category",
-			"Difficulty",
-		})
-
-		table.SetHeaderColor(
-			tablewriter.Colors{tablewriter.Bold},
-			tablewriter.Colors{tablewriter.Bold},
-			tablewriter.Colors{tablewriter.Bold},
-			tablewriter.Colors{tablewriter.Bold},
-			tablewriter.Colors{tablewriter.Bold},
-		)
-
-		for _, s := range scenarios {
-			table.Append([]string{
-				s.ID,
-				s.Name,
-				s.Description,
-				s.Category,
-				s.Difficulty})
-			table.SetRowLine(true)
-		}
-		table.Render()
+		tabulateScenarios(scenarios)
 	},
 }
 
@@ -112,13 +84,41 @@ var scenarioDescribeCmd = &cobra.Command{
 		s, err := scenarios.Find(scenarioID)
 		cobra.CheckErr(err)
 
-		b, err := s.Challenge()
-		cobra.CheckErr(err)
-
-		fmt.Println(string(b))
+		tabulateScenarios([]scenarios.Scenario{s})
 	},
 }
 
+func tabulateScenarios(scenarios []scenarios.Scenario) {
+	table := tablewriter.NewWriter(os.Stdout)
+
+	table.SetHeader([]string{
+		"ID",
+		"Name",
+		"Description",
+		"Category",
+		"Difficulty",
+	})
+
+	table.SetHeaderColor(
+		tablewriter.Colors{tablewriter.Bold},
+		tablewriter.Colors{tablewriter.Bold},
+		tablewriter.Colors{tablewriter.Bold},
+		tablewriter.Colors{tablewriter.Bold},
+		tablewriter.Colors{tablewriter.Bold},
+	)
+
+	for _, s := range scenarios {
+		table.Append([]string{
+			s.ID,
+			s.Name,
+			s.Description,
+			s.Category,
+			s.Difficulty})
+		table.SetRowLine(true)
+	}
+	table.Render()
+}
+
 func init() {
 	scenarioCmd.AddCommand(scenarioInstallCmd)
 	scenarioCmd.AddCommand(scenarioUninstallCmd)

internal/container/runner.go

@@ -28,8 +28,6 @@ var (
 	CreateFailed = errors.New("unable to create simulator container")
 	StartFailed  = errors.New("unable to start simulator container")
 	AttachFailed = errors.New("unable to attach to simulator container")
-
-	containerAwsDir = "/home/ubuntu/.aws"
 )
 
 type Simulator interface {
@@ -52,6 +50,15 @@ func (r simulator) Run(ctx context.Context, command []string) error {
 		return NoHome
 	}
 
+	localAdminSSHBundleDir := filepath.Join(home, ".simulator/admin")
+	localPlayerSSHBundleDir := filepath.Join(home, ".simulator/player")
+	localAWSDir := filepath.Join(home, ".aws")
+
+	err2 := mkdirsIfNotExisting(localAdminSSHBundleDir, localPlayerSSHBundleDir)
+	if err2 != nil {
+		return err2
+	}
+
 	cli, err := client.NewClientWithOpts(client.FromEnv)
 	if err != nil {
 		return NoClient
@@ -60,22 +67,28 @@ func (r simulator) Run(ctx context.Context, command []string) error {
 	mounts := []mount.Mount{
 		{
 			Type:     mount.TypeBind,
-			Source:   filepath.Join(r.Config.BaseDir, controlplane.Home),
-			Target:   controlplane.HomeDir,
+			Source:   localAdminSSHBundleDir,
+			Target:   controlplane.AdminSSHBundleDir,
+			ReadOnly: false,
+		},
+		{
+			Type:     mount.TypeBind,
+			Source:   localPlayerSSHBundleDir,
+			Target:   controlplane.PlayerSSHBundleDir,
 			ReadOnly: false,
 		},
 		{
 			Type:   mount.TypeBind,
-			Source: filepath.Join(home, ".aws"),
-			Target: containerAwsDir,
+			Source: localAWSDir,
+			Target: controlplane.AWSDir,
 		},
 	}
 
 	if r.Config.Cli.Dev {
 		mounts = append(mounts, []mount.Mount{
 			{
 				Type:   mount.TypeBind,
-				Source: filepath.Join(r.Config.BaseDir, controlplane.Scenarios),
+				Source: filepath.Join(r.Config.BaseDir, controlplane.Ansible),
 				Target: controlplane.AnsibleDir,
 			},
 			{
@@ -158,3 +171,15 @@ func (r simulator) Run(ctx context.Context, command []string) error {
 
 	return nil
 }
+
+func mkdirsIfNotExisting(dirs ...string) error {
+	for _, dir := range dirs {
+		if _, err := os.Stat(dir); errors.Is(err, os.ErrNotExist) {
+			err := os.MkdirAll(dir, 0750)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}

scenarios/build-a-backdoor/README.md

@@ -0,0 +1,3 @@
+# Build-a-Backdoor Scenario
+
+Vulnerable company are called "Introspective Insights"

scenarios/build-a-backdoor/_solution/blocked-tests.yaml

@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ii-mgmt-np
+  namespace: ii-prod
+spec:
+  podSelector:
+    matchLabels:
+      app: ii
+  ingress:
+  - {}
+  policyTypes:
+  - Ingress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ii-mgmt-np
+  namespace: ii-prod
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+  ingress:
+  - ports:
+    - port: 8080
+    - port: 5724

scenarios/build-a-backdoor/_solution/solution.yaml

@@ -0,0 +1,59 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ii-prod-mgmt-service
+  namespace: ii-prod
+spec:
+  selector:
+    app: ii
+  ports:
+  - name: mgmt
+    port: 80
+    targetPort: 8080
+    protocol: TCP
+  - name: admin
+    port: 5724
+    targetPort: 5724
+    protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ii-prod-mgmt-np
+  namespace: ii-prod
+spec:
+  podSelector:
+    matchLabels:
+      app: ii
+  policyTypes:
+  - Ingress
+  ingress:
+  - ports:
+    - port: 8080
+    - port: 5724
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ingress-ii-mgmt
+  namespace: ii-prod
+  annotations:
+    kubernetes.io/ingress.class: nginx
+spec:
+  rules:
+  - http:
+      paths:
+      - path: "/"
+        pathType: Prefix
+        backend:
+          service:
+            name: ii-prod-mgmt-service
+            port:
+              number: 80
+      - path: "/backdoor"
+        pathType: Prefix
+        backend:
+          service:
+            name: ii-prod-mgmt-service
+            port:
+              number: 5724

scenarios/cease-and-desist/README.md

@@ -0,0 +1,15 @@
+# Cease and Desist (a.k.a cilium and remote licensing)
+
+Example public valid license: `https://gist.githubusercontent.com/wakeward/b475d1e12c6bd869a70d65c74863f966/raw/049c866f829c3e36f570b013a7b0b58cd026b651/license.json`
+
+Example public invalid license: `https://gist.githubusercontent.com/jpts/41294862cca103cd91545108b4e05e19/raw/3fbc5ed204431056b1954a4b77ba60810d17a9dc/yes.json`
+
+licence server password: `access-2-reform-kube-server`
+
+command for activating trial license: `./reform-kube-licensing-server -trial -password access-2-reform-kube-server`
+
+test command for activating trial license: `./reform-kube-licensing-server -licenseURL https://gist.githubusercontent.com/wakeward/5224313fc51bcfbee5a40e58885aff87/raw/48919f37ddb76a9686bb9c93a8f2a44bc0ca5431/trial.json -password access-2-reform-kube-server`
+
+Blocked Domain command: `./reform-kube-licensing-server -licenseURL https://gitlab.com/crossref/manifold/-/raw/main/.releaserc.json -password access-2-reform-kube-server`
+
+command for activating trial license: `./reform-kube-licensing-server -licenseURL https://gist.githubusercontent.com/wakeward/b475d1e12c6bd869a70d65c74863f966/raw/049c866f829c3e36f570b013a7b0b58cd026b651/license.json -password access-2-reform-kube-server`