Home
Relevant source files
The following files were used as context for generating this wiki page:
- charts/agh2/README.md
- charts/agh3/README.md
- charts/agh2/values.yaml
- charts/agh3/values.yaml
- charts/agh2/Chart.yaml
- charts/agh3/Chart.yaml
- charts/agh3/crds/actions.crds.yaml
- charts/agh2/templates/db/postgres-init-configmap.yml
- charts/agh3/templates/db/postgres-init-configmap.yml
- charts/agh3/templates/captain/captain-deployment.yml
- charts/agh2/templates/captain/captain-deployment.yml
- charts/playground/values.yaml
- charts/playground/templates/playground-deployment.yml
- charts/agh2/templates/base/shared-configmap.yml
- charts/agh3/templates/validations/index.yaml
This repository provides Helm charts for deploying different versions and components of the ArgusHack (agh) application suite. The primary charts are agh2, agh3, and agh3-playground, each serving a distinct purpose in the ArgusHack ecosystem. The agh2 and agh3 charts manage full-stack application deployments, while agh3-playground is a specialized chart for a standalone UI module.
These charts are designed as application type charts, meaning they are collections of templates that can be packaged and deployed as versioned archives. They manage not only the custom ArgusHack components but also their third-party dependencies like databases, message queues, and object storage, providing a comprehensive solution for setting up the ArgusHack environment in Kubernetes.
ArgusHack 3 (agh3) Chart
The agh3 chart is a comprehensive Helm chart for deploying the ArgusHack3 platform. It functions as a meta-chart, orchestrating the deployment of numerous microservices and their required backing services.
Sources: charts/agh3/Chart.yaml:2-12, charts/agh3/README.md:3
Architecture and Dependencies
The agh3 chart manages a complex stack of services through its dependencies. The deployment of these dependencies is conditional and can be enabled or disabled via the values.yaml file. Key dependencies include PostgreSQL, Minio, RabbitMQ, and Redis, which form the core infrastructure for the application.
The following diagram illustrates the dependencies managed by the agh3 chart.
This diagram shows the conditional dependencies of the agh3 chart.
Sources: charts/agh3/Chart.yaml:13-48
Core Components
The agh3 chart deploys several custom application components, including captain, actionLoop, controller, ui, and report.
Sources: charts/agh3/values.yaml:705-950
Captain Deployment
The captain component is a central part of the agh3 deployment. Its deployment manifest includes several init containers to ensure that its dependencies (Redis, Minio, RabbitMQ, PostgreSQL) are ready before the main container starts. This pattern ensures a graceful startup sequence.
This diagram shows the startup sequence for the captain deployment, including its init containers.
Sources: charts/agh3/templates/captain/captain-deployment.yml:12-61
Action Custom Resource (CRD)
A key feature of agh3 is the Action Custom Resource Definition (actions.agh.lkc-lab.com). This CRD allows users to define custom, container-based actions that can be executed within the cluster. The ActionSpec defines the desired state, including init containers, main containers, environment variables, and triggers. The current served and storage version is v3alpha2.
The structure of the ActionSpec is visualized below.
This diagram outlines the main fields within the ActionSpec of the v3alpha2 CRD.
Sources: charts/agh3/crds/actions.crds.yaml:945-1510
Database Initialization
When using the internal PostgreSQL instance, the agh3 chart uses a ConfigMap (db-init-scripts) to run initialization scripts. This script dynamically creates database roles and databases for each enabled module (e.g., captain) by iterating through the chart's values. This ensures that each component has its dedicated database and credentials.
The following SQL snippet is generated by the template to create a new role and database:
-- Create Role agh-captain
CREATE ROLE "agh-captain" WITH
LOGIN
NOSUPERUSER
INHERIT
NOCREATEDB
NOCREATEROLE
NOREPLICATION
PASSWORD '...';
-- Create DB captain-db
CREATE DATABASE "captain-db" WITH
OWNER = 'agh-captain'
ENCODING = 'UTF8'
CONNECTION LIMIT = -1;
Sources: charts/agh3/templates/db/postgres-init-configmap.yml:10-53
Configuration and Validation
Configuration is managed through charts/agh3/values.yaml. The chart includes a validation step that checks for required values before rendering templates. For example, if keygen.enabled is true, then keygen.accountID and keygen.apiToken must be provided.
| Path | Required Fields | Condition |
|---|---|---|
keygen | accountID, apiToken | keygen.enabled is true |
customRegistrySecret.auth | registry, username, password | customRegistrySecret.enabled is true |
ingress.tls | cert, key | ingress.tls.enabled is true |
db.connection | host, port | db.connection.type is "external" |
rabbitmq.connection | host, port | rabbitmq.connection.type is "external" |
captain.secret.oidc | url, clientID, clientSecret, realm | captain.secret.oidc.enabled is true |
Sources: charts/agh3/templates/validations/index.yaml:3-70, charts/agh3/values.yaml
ArgusHack 2 (agh2) Chart
The agh2 chart deploys an older version of the ArgusHack platform. It has a simpler architecture with fewer dependencies compared to agh3.
Sources: charts/agh2/Chart.yaml:2, charts/agh2/README.md:3
Architecture and Dependencies
The agh2 chart depends on PostgreSQL and Minio. Unlike agh3, it does not include dependencies for RabbitMQ, Redis, or the observability stack.
This diagram shows the dependencies of the agh2 chart.
Sources: charts/agh2/Chart.yaml:19-28
Core Components
The main components of agh2 are captain, core, exploitmgr, and ui. It also defines a shared ConfigMap to centralize worker image definitions.
Sources: charts/agh2/values.yaml:244-460
Shared Images ConfigMap
The agh2 chart uses a ConfigMap named system-image to store references to various worker images. This allows components like core and captain to reference these images using environment variables, decoupling the application logic from specific image tags.
Example ConfigMap data:
data:
POSTER: registry.lkc-lab.com/leukocyte-lab/argushack2/worker/poster:v2.0.0
CRONJOB: registry.lkc-lab.com/leukocyte-lab/argushack2/worker/cronjob:v1.0.0
REPORT_INIT: registry.lkc-lab.com/leukocyte-lab/argushack2/worker/report-init:v0.0.8
...
Sources: charts/agh2/templates/base/shared-configmap.yml:1-10, charts/agh2/templates/core/core-deployment.yml:38-41
Database Initialization
The agh2 database initialization script is more complex than its agh3 counterpart. In addition to creating roles and databases, it includes a step to download and import attack.sql.tgz datasets using curl and jq if db.helpers.init.attack.enabled is true. It also supports installing the pgroonga extension.
The flow for initializing the attack dataset is as follows:
This diagram shows the process of initializing the attack dataset in agh2.
Sources: charts/agh2/templates/db/postgres-init-configmap.yml:8-21, [charts/agh2/values.yaml:121-122]
Playground (agh3-playground) Chart
The agh3-playground chart is a small, focused chart for deploying the AGH3-CTR-Playground module. This is a frontend application that relies on external backend and AI services for its functionality.
Sources: charts/playground/Chart.yaml:2, charts/playground/values.yaml:45-48
Configuration and Integration
The Playground UI is configured to connect to a backend service and an AI service. The backend is specified via playground.service.backendRef, which can point to an in-cluster Service or an ExternalService. The AI endpoint is a simple URL.
The deployment mounts secrets for Firebase and AI service tokens from Kubernetes Secrets into the Nginx container, making them available to the frontend application.
| Parameter | Description | Default Value |
|---|---|---|
playground.service.backendRef.name | Name of the backend service. | captain |
playground.service.backendRef.port | Port of the backend service. | 8080 |
playground.service.ai.endpoint | Full URL of the AI service endpoint. | "" (required) |
playground.secret.firebase.enabled | Enable mounting of Firebase secrets. | true |
playground.secret.ai.enabled | Enable mounting of AI workflow secrets. | true |
Sources: charts/playground/values.yaml:104-120, charts/playground/templates/playground-deployment.yml:20-25, 34-49
Summary Comparison: agh2 vs. agh3
| Feature | agh2 | agh3 |
|---|---|---|
| Dependencies | PostgreSQL, Minio | PostgreSQL, Minio, RabbitMQ, Redis, Observability Stack |
| Core Components | core, captain, exploitmgr | captain, actionLoop, controller, report |
| Extensibility | Pre-defined worker images | Action CRD for custom container jobs |
| DB Initialization | Includes attack dataset loading and pgroonga | Focused on role/DB creation per module |
| Observability | Not included | Integrated via optional Vector, Grafana, Loki, Tempo dependencies |
Sources: charts/agh2/Chart.yaml, charts/agh3/Chart.yaml, charts/agh2/values.yaml, charts/agh3/values.yaml, charts/agh3/crds/actions.crds.yaml