Shiftleft_AzureDevOps/aks.tf at master · CheckPointSW-Community/Shiftleft_AzureDevOps · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
#Provision AKS cluster in Azure

resource "azurerm_kubernetes_cluster" "vuln_k8_cluster" {
  name                = "${var.victim_company}-kubecluster"
  location            = azurerm_resource_group.victim-network-rg.location
  resource_group_name = azurerm_resource_group.victim-network-rg.name
  dns_prefix          = "${var.victim_company}-k8"

  default_node_pool {
    name       = "default"
    node_count = var.nodecount
    vm_size    = "Standard_D2_v2"
  }

 service_principal {
    client_id     = var.client_id
    client_secret = var.client_secret
  }

  network_profile {
    network_plugin     = "azure"
    network_policy     = "calico"     # Options are calico or azure - only if network plugin is set to azure
    dns_service_ip     = "172.16.0.10" # Required when network plugin is set to azure, must be in the range of service_cidr and above 1
    docker_bridge_cidr = "172.17.0.1/16"
    service_cidr       = "172.16.0.0/16" # Must not overlap any address from the VNEt
  }

  lifecycle {
    ignore_changes = [
      windows_profile,
    ]
 }
}


#Authenticate to Terraform Kubernetes Module

#Provider for K8, used after built
provider "kubernetes" {
    host                   = azurerm_kubernetes_cluster.vuln_k8_cluster.kube_config.0.host
    client_certificate     = base64decode(azurerm_kubernetes_cluster.vuln_k8_cluster.kube_config.0.client_certificate)
    client_key             = base64decode(azurerm_kubernetes_cluster.vuln_k8_cluster.kube_config.0.client_key)
    cluster_ca_certificate = base64decode(azurerm_kubernetes_cluster.vuln_k8_cluster.kube_config.0.cluster_ca_certificate)
    load_config_file = false
}


#Perform Configuration on K8 cluster itself


resource "kubernetes_namespace" "vulnk8" {
  metadata {
    name                   = "vulnk8"
  }
}


resource "kubernetes_deployment" "vuln-k8-deployment" {
  metadata {
    name                   = "vulnk8"
    namespace              = kubernetes_namespace.vulnk8.metadata.0.name
    labels                 = {
      app                  = "vulnk8"
    }
  }

  spec {
    replicas               = 2

    selector {
      match_labels         = {
        app                = "vulnk8"
      }
    }

    template {
      metadata {
        labels             = {
          app              = "vulnk8"
        }
      }

      spec {
        container {
          image            = "bkimminich/juice-shop"
          name             = "user-app"
          port {
            container_port = "80"
          }
          security_context {
            capabilities {
              add          = ["SYS_ADMIN"]
            }
          }
        }
      }
    }
  }

}


resource "kubernetes_service" "vuln-k8-service" {
  metadata {
    name                   = "vulnk8"
    namespace              = kubernetes_namespace.vulnk8.metadata.0.name
  }
  spec {
    selector               = {
      app                  = "vulnk8"
    }
    port {
      port                 = 80
    }

    type                   = "LoadBalancer"
  }
}