AGH2 Configuration
Relevant source files
The following files were used as context for generating this wiki page:The agh2 Helm chart provides a comprehensive method for deploying the ArgusHack2 application suite on Kubernetes. Configuration is managed primarily through the charts/agh2/values.yaml file, which allows for customization of application modules, backing services, and Kubernetes-specific resources like Ingress and secrets.
This chart orchestrates the deployment of several core components, including Captain, Core, Exploit-Manager, and the UI. It also manages dependencies such as PostgreSQL, Minio, and Redis, which can be provisioned internally as part of the Helm release or connected to external instances. The configuration is designed to be flexible, supporting various deployment scenarios from simple setups to more complex, production-like environments.
Sources: charts/agh2/Chart.yaml, charts/agh2/values.yaml, charts/agh2/README.md
Core Architecture and Dependencies
The AGH2 chart is defined as an 'application' type and bundles several dependencies which are conditionally enabled. The primary dependencies are PostgreSQL and Minio, which are managed by their respective Bitnami Helm charts.
Sources: charts/agh2/Chart.yaml:1-20
This diagram illustrates the main components deployed by the chart and their dependencies.
Global Configuration
Global parameters apply to all components within the chart, including sub-charts, unless overridden at a more specific level.
| Parameter | Description | Default Value |
|---|---|---|
global.imageRegistry | Global Docker Image registry for all container images. | "registry.lkc-lab.com" |
global.imagePullSecrets | An array of secret names for pulling images from a private registry. | ["lkc-registry"] |
global.storageClass | Global storage class for dynamic volume provisioning. | "" |
Sources: charts/agh2/values.yaml:10-14
Backing Services Configuration
PostgreSQL Database
The chart can deploy an internal PostgreSQL instance or connect to an external one. This is controlled by db.connection.type.
Sources: charts/agh2/values.yaml:82-86
Database Initialization
When using the internal database (db.internal.enabled: true), an init-container runs a script to prepare the database. This process is highly configurable via the db.helpers.init section.
The following diagram shows the database initialization flow.
The initialization script performs two main tasks:
- Database and Role Creation: It iterates through the enabled AGH2 modules (
captain,core,exploitmgr), creating a dedicated database and user role for each one as defined in their respectivesecret.dbsections. - Attack Dataset Loading: If
db.helpers.init.attack.enabledis true, it downloadsattack.sql.tgzusing akeygen.apiToken, unpacks it, and loads it into thecaptain-dbdatabase.
A key feature is the ability to install pgroonga extensions for full-text search capabilities, controlled by db.helpers.init.dbs.installPgroongaExtensions.
Sources: charts/agh2/templates/db/postgres-init-configmap.yml:8-100, charts/agh2/values.yaml:113-124
Configuration Parameters
| Parameter | Description | Default Value |
|---|---|---|
db.connection.type | internal or external. | internal |
db.connection.host | Hostname for external DB. | database.example.com |
db.internal.enabled | Enables the internal PostgreSQL sub-chart. | true |
db.helpers.init.dbs.enabled | Enables automatic creation of databases and roles for modules. | true |
db.helpers.init.dbs.installPgroongaExtensions | If true, installs the pgroonga extension in created databases. | true |
db.helpers.init.attack.enabled | If true, downloads and initializes the attack datasets. | true |
postgresql.image.repository | The image for the internal PostgreSQL instance. | leukocyte-lab/postgresql |
postgresql.image.tag | The image tag, which includes PostgreSQL and pgroonga versions. | v0.1.2-postgres-15.1.0-pgroonga-2.4.2-debian |
postgresql.primary.initdb.scriptsConfigMap | Name of the ConfigMap containing the initialization scripts. | db-init-scripts |
Sources: charts/agh2/values.yaml:82-180, charts/agh2/README.md
Minio Object Storage
Minio is used for object storage and follows a similar internal/external configuration pattern as the database.
When minio.provisioning.enabled is true, the chart automatically creates users and policies for the AGH2 modules. A default policy named agh-core-policy is created to grant GetBucketLocation, ListBucket, and GetObject permissions on all buckets.
Sources: charts/agh2/values.yaml:182-252
Configuration Parameters
| Parameter | Description | Default Value |
|---|---|---|
minio.connection.type | internal or external. | internal |
minio.internal.enabled | Enables the internal Minio sub-chart. | true |
minio.provisioning.enabled | Enables automatic provisioning of users and policies. | true |
minio.provisioning.generateUser | Enables automatic user generation for modules. | true |
minio.auth.rootUser | The root user for the internal Minio instance. | argushack |
minio.image.repository | The image for the internal Minio instance. | docker/bitnamilegacy/minio |
Sources: charts/agh2/values.yaml:182-252, charts/agh2/README.md
Redis
Redis is used for caching and as a message broker. Its configuration is simpler, with a single enabled flag.
| Parameter | Description | Default Value |
|---|---|---|
redis.enabled | Enables Redis deployment. | true |
redis.image.repository | Redis image repository. | docker/library/redis |
redis.image.tag | Redis image tag. | 6-alpine |
Sources: charts/agh2/values.yaml:255-268, charts/agh2/README.md
Application Modules
The chart deploys four main application modules. Each module can be enabled or disabled and has its own configuration for image versions and secrets.
Captain (captain)
The Captain module is a core component of AGH2. It includes a checkin-daemon service that runs as a cronjob.
| Parameter | Description | Default Value |
|---|---|---|
captain.enabled | Enables the Captain module. | true |
captain.image.repository | Container image repository. | leukocyte-lab/argushack2/captain |
captain.secret.db.name | Database name for this module. | captain-db |
captain.secret.minio.user | Minio username for this module. | capt-minio-user |
captain.service.checkinDaemon.enabled | Enables the checkin-daemon cronjob. | true |
captain.service.checkinDaemon.schedule | Cron schedule for the checkin-daemon. | "0 0 * * *" |
Sources: charts/agh2/values.yaml:275-348
Core (core)
The Core module is another essential part of the AGH2 backend.
| Parameter | Description | Default Value |
|---|---|---|
core.enabled | Enables the Core module. | true |
core.image.repository | Container image repository. | leukocyte-lab/argushack2/core |
core.secret.db.name | Database name for this module. | core-db |
core.secret.minio.user | Minio username for this module. | core-minio-user |
core.env.REGISTRY_URL | Sets the registry URL environment variable. | registry.lkc-lab.com |
Sources: charts/agh2/values.yaml:355-403
Exploit-Manager (exploitmgr)
The Exploit-Manager module handles exploit-related functionalities.
| Parameter | Description | Default Value |
|---|---|---|
exploitmgr.enabled | Enables the Exploit-Manager module. | true |
exploitmgr.image.repository | Container image repository. | leukocyte-lab/argushack2/exploitmgr |
exploitmgr.secret.db.name | Database name for this module. | exploitmgr-db |
Sources: charts/agh2/values.yaml:409-438
UI (ui)
The UI module provides the web-based frontend for AGH2.
| Parameter | Description | Default Value |
|---|---|---|
ui.enabled | Enables the UI module. | true |
ui.image.repository | Container image repository. | leukocyte-lab/argushack2/frontend |
Sources: charts/agh2/values.yaml:444-454
Shared System Images
The chart uses a shared ConfigMap named system-image to define container images used by various workers and jobs across the system. This centralizes image management for auxiliary tasks.
Sources: charts/agh2/values.yaml:457-459, charts/agh2/templates/base/shared-configmap.yml:3
The system-image ConfigMap contains key-value pairs for different worker images:
data:
POSTER: registry.lkc-lab.com/leukocyte-lab/argushack2/worker/poster:v2.0.0
CRONJOB: registry.lkc-lab.com/leukocyte-lab/argushack2/worker/cronjob:v1.0.0
REPORT_INIT: registry.lkc-lab.com/leukocyte-lab/argushack2/worker/report-init:v0.0.8
REPORT_GENERATER: registry.lkc-lab.com/leukocyte-lab/argushack2/worker/report-generator:v0.0.7
REPORT_TEMPLATE: registry.lkc-lab.com/leukocyte-lab/argushack2/attack-report-template:v0.0.8
Sources: charts/agh2/templates/base/shared-configmap.yml:7-11, charts/agh2/values.yaml:465-471
Authentication and Secrets
Keygen
The keygen configuration is used to provide credentials for downloading licensed artifacts, such as the attack dataset.
| Parameter | Description | Required |
|---|---|---|
keygen.apiToken | The API token from keygen.sh. | Yes |
keygen.accountID | The account ID from keygen.sh. | Yes |
Sources: charts/agh2/values.yaml:47-59, charts/agh2/templates/db/postgres-init-configmap.yml:12-14
Custom Registry Secret
The chart can automatically create a Kubernetes docker-registry secret for pulling images from a private registry.
| Parameter | Description | Required if enabled |
|---|---|---|
customRegistrySecret.enabled | Set to true to generate the secret. | - |
customRegistrySecret.auth.registry | URL of the private registry. | Yes |
customRegistrySecret.auth.username | Username for the registry. | Yes |
customRegistrySecret.auth.password | Password for the registry. | Yes |
Sources: charts/agh2/values.yaml:18-30