Skip to content

Instantly share code, notes, and snippets.

@pabloopez

pabloopez/attack-path-demo.yaml

Created February 12, 2024 12:02
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save pabloopez/0d740b97a2046368fa0a49a66505d059 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save pabloopez/0d740b97a2046368fa0a49a66505d059 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
attack-path-demo.yaml
---
apiVersion: v1 # Namespace
kind: Namespace
metadata:
name: sock-shop
---
apiVersion: apps/v1 # Deployment - Carts
kind: Deployment
metadata:
name: carts
labels:
name: carts
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: carts
template:
metadata:
labels:
name: carts
spec:
containers:
- name: carts
image: weaveworksdemos/carts:0.4.8
env:
- name: JAVA_OPTS
value: -Xms64m -Xmx128m -XX:+UseG1GC -Djava.security.egd=file:/dev/urandom -Dspring.zipkin.enabled=false
resources:
limits:
cpu: 300m
memory: 500Mi
requests:
cpu: 100m
memory: 200Mi
ports:
- containerPort: 80
securityContext:
runAsNonRoot: true
runAsUser: 10001
capabilities:
drop:
- all
add:
- NET_BIND_SERVICE
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /tmp
name: tmp-volume
volumes:
- name: tmp-volume
emptyDir:
medium: Memory
---
apiVersion: v1 # Service - Carts
kind: Service
metadata:
name: carts
labels:
name: carts
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 80
targetPort: 80
selector:
name: carts
---
apiVersion: apps/v1 # Deployment - carts-db
kind: Deployment
metadata:
name: carts-db
labels:
name: carts-db
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: carts-db
template:
metadata:
labels:
name: carts-db
spec:
containers:
- name: carts-db
image: mongo
resources:
limits:
cpu: 300m
memory: 500Mi
requests:
cpu: 100m
memory: 100Mi
ports:
- name: mongo
containerPort: 27017
securityContext:
capabilities:
drop:
- all
add:
- CHOWN
- SETGID
- SETUID
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /tmp
name: tmp-volume
volumes:
- name: tmp-volume
emptyDir:
medium: Memory
---
apiVersion: v1 # Service carts-db
kind: Service
metadata:
name: carts-db
labels:
name: carts-db
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 27017
targetPort: 27017
selector:
name: carts-db
---
apiVersion: apps/v1 # Deployment - catalogue
kind: Deployment
metadata:
name: catalogue
labels:
name: catalogue
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: catalogue
template:
metadata:
labels:
name: catalogue
spec:
containers:
- name: catalogue
image: weaveworksdemos/catalogue:0.3.5
command: ["/app"]
args:
- -port=80
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 100m
memory: 20Mi
ports:
- containerPort: 80
securityContext:
runAsNonRoot: true
runAsUser: 10001
capabilities:
drop:
- all
add:
- NET_BIND_SERVICE
readOnlyRootFilesystem: true
livenessProbe:
httpGet:
path: /health
port: 80
initialDelaySeconds: 300
periodSeconds: 3
readinessProbe:
httpGet:
path: /health
port: 80
initialDelaySeconds: 180
periodSeconds: 3
---
apiVersion: v1 # Service - catalogue
kind: Service
metadata:
name: catalogue
labels:
name: catalogue
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 80
targetPort: 80
selector:
name: catalogue
---
apiVersion: apps/v1 # Deployment - catalogue-db
kind: Deployment
metadata:
name: catalogue-db
labels:
name: catalogue-db
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: catalogue-db
template:
metadata:
labels:
name: catalogue-db
spec:
containers:
- name: catalogue-db
image: weaveworksdemos/catalogue-db:0.3.0
resources:
limits:
cpu: 300m
memory: 500Mi
requests:
cpu: 100m
memory: 200Mi
env:
- name: MYSQL_ROOT_PASSWORD
value: fake_password
- name: MYSQL_DATABASE
value: socksdb
ports:
- name: mysql
containerPort: 3306
---
apiVersion: v1 # Service - catalogue-db
kind: Service
metadata:
name: catalogue-db
labels:
name: catalogue-db
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 3306
targetPort: 3306
selector:
name: catalogue-db
---
apiVersion: apps/v1 # Deployment - front-end
kind: Deployment
metadata:
name: front-end
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: front-end
template:
metadata:
labels:
name: front-end
spec:
containers:
- name: front-end
image: weaveworksdemos/front-end:0.3.12
resources:
limits:
cpu: 300m
memory: 1000Mi
requests:
cpu: 100m
memory: 100Mi
ports:
- containerPort: 8079
env:
- name: SESSION_REDIS
value: "true"
securityContext:
runAsNonRoot: true
runAsUser: 10001
capabilities:
drop:
- all
readOnlyRootFilesystem: true
livenessProbe:
httpGet:
path: /
port: 8079
initialDelaySeconds: 300
periodSeconds: 3
readinessProbe:
httpGet:
path: /
port: 8079
initialDelaySeconds: 30
periodSeconds: 3
---
apiVersion: v1 # Service - front-end
kind: Service
metadata:
name: front-end
labels:
name: front-end
namespace: sock-shop
spec:
type: NodePort
ports:
- port: 80
targetPort: 8079
nodePort: 30001
selector:
name: front-end
---
apiVersion: apps/v1 # Deployment - orders
kind: Deployment
metadata:
name: orders
labels:
name: orders
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: orders
template:
metadata:
labels:
name: orders
spec:
containers:
- name: orders
image: sysdigtraining/orders:0.4.7
imagePullPolicy: IfNotPresent
env:
- name: JAVA_OPTS
value: -Xms64m -Xmx350m -XX:PermSize=32m -XX:MaxPermSize=64m -XX:+UseG1GC -Djava.security.egd=file:/dev/urandom
resources:
limits:
cpu: 500m
memory: 500Mi
requests:
cpu: 100m
memory: 300Mi
ports:
- containerPort: 80
protocol: TCP
securityContext:
privileged: true
runAsNonRoot: true
runAsUser: 10001
capabilities:
drop:
- all
add:
- NET_BIND_SERVICE
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /tmp
name: tmp-volume
volumes:
- name: tmp-volume
emptyDir:
medium: Memory
---
apiVersion: v1 # Service - orders
kind: Service
metadata:
name: orders
labels:
name: orders
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 80
targetPort: 80
selector:
name: orders
---
apiVersion: apps/v1 # Deployment - orders-db
kind: Deployment
metadata:
name: orders-db
labels:
name: orders-db
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: orders-db
template:
metadata:
labels:
name: orders-db
spec:
containers:
- name: orders-db
image: mongo
resources:
limits:
cpu: 300m
memory: 500Mi
requests:
cpu: 100m
memory: 150Mi
ports:
- name: mongo
containerPort: 27017
securityContext:
capabilities:
drop:
- all
add:
- CHOWN
- SETGID
- SETUID
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /tmp
name: tmp-volume
volumes:
- name: tmp-volume
emptyDir:
medium: Memory
---
apiVersion: v1 # Service - orders-db
kind: Service
metadata:
name: orders-db
labels:
name: orders-db
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 27017
targetPort: 27017
selector:
name: orders-db
---
apiVersion: apps/v1 # Deployment - payment
kind: Deployment
metadata:
name: payment
labels:
name: payment
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: payment
template:
metadata:
labels:
name: payment
spec:
containers:
- name: payment
image: weaveworksdemos/payment:0.4.3
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 100m
memory: 20Mi
ports:
- containerPort: 80
securityContext:
runAsNonRoot: true
runAsUser: 10001
capabilities:
drop:
- all
add:
- NET_BIND_SERVICE
readOnlyRootFilesystem: true
livenessProbe:
httpGet:
path: /health
port: 80
initialDelaySeconds: 300
periodSeconds: 3
readinessProbe:
httpGet:
path: /health
port: 80
initialDelaySeconds: 180
periodSeconds: 3
---
apiVersion: v1 # Service - payment
kind: Service
metadata:
name: payment
labels:
name: payment
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 80
targetPort: 80
selector:
name: payment
---
apiVersion: apps/v1 # Deployment - queue-master
kind: Deployment
metadata:
name: queue-master
labels:
name: queue-master
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: queue-master
template:
metadata:
labels:
name: queue-master
spec:
containers:
- name: queue-master
image: weaveworksdemos/queue-master:0.3.1
env:
- name: JAVA_OPTS
value: -Xms64m -Xmx128m -XX:+UseG1GC -Djava.security.egd=file:/dev/urandom -Dspring.zipkin.enabled=false
resources:
limits:
cpu: 300m
memory: 500Mi
requests:
cpu: 100m
memory: 300Mi
ports:
- containerPort: 80
---
apiVersion: v1 # Service - queue-master
kind: Service
metadata:
name: queue-master
labels:
name: queue-master
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 80
targetPort: 80
selector:
name: queue-master
---
apiVersion: apps/v1 # Deployment - rabbitmq
kind: Deployment
metadata:
name: rabbitmq
labels:
name: rabbitmq
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: rabbitmq
template:
metadata:
labels:
name: rabbitmq
spec:
containers:
- name: rabbitmq
image: rabbitmq:3.6.8-management
resources:
limits:
cpu: 300m
memory: 500Mi
requests:
cpu: 100m
memory: 100Mi
ports:
- containerPort: 15672
name: management
- containerPort: 5672
name: rabbitmq
securityContext:
capabilities:
drop:
- all
add:
- CHOWN
- SETGID
- SETUID
- DAC_OVERRIDE
readOnlyRootFilesystem: true
---
apiVersion: v1 # Service - rabbitmq
kind: Service
metadata:
name: rabbitmq
labels:
name: rabbitmq
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 5672
name: rabbitmq
targetPort: 5672
- port: 9090
name: exporter
targetPort: exporter
protocol: TCP
selector:
name: rabbitmq
---
apiVersion: apps/v1 # Deployment - session-db
kind: Deployment
metadata:
name: session-db
labels:
name: session-db
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: session-db
template:
metadata:
labels:
name: session-db
spec:
containers:
- name: session-db
image: redis:alpine
resources:
limits:
cpu: 300m
memory: 500Mi
requests:
cpu: 100m
memory: 20Mi
ports:
- name: redis
containerPort: 6379
securityContext:
capabilities:
drop:
- all
add:
- CHOWN
- SETGID
- SETUID
readOnlyRootFilesystem: true
nodeSelector:
beta.kubernetes.io/os: linux
---
apiVersion: v1 # Service - session-db
kind: Service
metadata:
name: session-db
labels:
name: session-db
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 6379
targetPort: 6379
selector:
name: session-db
---
apiVersion: apps/v1 # Deployment - shipping
kind: Deployment
metadata:
name: shipping
labels:
name: shipping
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: shipping
template:
metadata:
labels:
name: shipping
spec:
containers:
- name: shipping
image: weaveworksdemos/shipping:0.4.8
env:
- name: ZIPKIN
value: zipkin.jaeger.svc.cluster.local
- name: JAVA_OPTS
value: -Xms64m -Xmx128m -XX:+UseG1GC -Djava.security.egd=file:/dev/urandom -Dspring.zipkin.enabled=false
resources:
limits:
cpu: 300m
memory: 500Mi
requests:
cpu: 100m
memory: 300Mi
ports:
- containerPort: 80
securityContext:
runAsNonRoot: true
runAsUser: 10001
capabilities:
drop:
- all
add:
- NET_BIND_SERVICE
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /tmp
name: tmp-volume
volumes:
- name: tmp-volume
emptyDir:
medium: Memory
nodeSelector:
beta.kubernetes.io/os: linux
---
apiVersion: v1 # Service - shipping
kind: Service
metadata:
name: shipping
labels:
name: shipping
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 80
targetPort: 80
selector:
name: shipping
---
apiVersion: apps/v1 # Deployment - user
kind: Deployment
metadata:
name: user
labels:
name: user
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: user
template:
metadata:
labels:
name: user
spec:
containers:
- name: user
image: weaveworksdemos/user:0.4.7
resources:
limits:
cpu: 300m
memory: 200Mi
requests:
cpu: 100m
memory: 20Mi
ports:
- containerPort: 80
env:
- name: mongo
value: user-db:27017
securityContext:
runAsNonRoot: true
runAsUser: 10001
capabilities:
drop:
- all
add:
- NET_BIND_SERVICE
readOnlyRootFilesystem: true
livenessProbe:
httpGet:
path: /health
port: 80
initialDelaySeconds: 300
periodSeconds: 3
readinessProbe:
httpGet:
path: /health
port: 80
initialDelaySeconds: 180
periodSeconds: 3
nodeSelector:
beta.kubernetes.io/os: linux
---
apiVersion: v1 # Service - user
kind: Service
metadata:
name: user
labels:
name: user
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 80
targetPort: 80
selector:
name: user
---
apiVersion: apps/v1 # Deployment - user-db
kind: Deployment
metadata:
name: user-db
labels:
name: user-db
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: user-db
template:
metadata:
labels:
name: user-db
spec:
containers:
- name: user-db
image: weaveworksdemos/user-db:0.3.0
resources:
limits:
cpu: 300m
memory: 500Mi
requests:
cpu: 100m
memory: 50Mi
ports:
- name: mongo
containerPort: 27017
securityContext:
capabilities:
drop:
- all
add:
- CHOWN
- SETGID
- SETUID
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /tmp
name: tmp-volume
volumes:
- name: tmp-volume
emptyDir:
medium: Memory
---
apiVersion: v1 # Service - user-db
kind: Service
metadata:
name: user-db
labels:
name: user-db
namespace: sock-shop
spec:
ports:
# the port that this service should serve on
- port: 27017
targetPort: 27017
selector:
name: user-db
---
apiVersion: apps/v1 # Deployment - load-gen
kind: Deployment
metadata:
name: load-gen
labels:
name: load-gen
namespace: sock-shop
spec:
replicas: 1
selector:
matchLabels:
name: load-gen
template:
metadata:
labels:
name: load-gen
spec:
containers:
- name: load-gen
image: weaveworksdemos/load-test
args:
- "-d"
- "60" # Wait time
- "-h"
- "front-end"
- "-c"
- "1" # Number of clients
- "-r"
- "1000000" # Number of requests
resources:
limits:
cpu: 300m
memory: 200Mi
requests:
cpu: 100m
memory: 50Mi
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment