Deploying the AGH2 Chart
Relevant source files
The following files were used as context for generating this wiki page:
- charts/agh2/Chart.yaml
- charts/agh2/README.md
- charts/agh2/values.yaml
- charts/agh2/templates/captain/captain-deployment.yml
- charts/agh2/templates/core/core-deployment.yml
- charts/agh2/templates/exploit-manager/exploitmgr-deployment.yml
- charts/agh2/templates/ui/ui-deployment.yml
- charts/agh2/templates/db/postgres-init-configmap.yml
The agh2 Helm chart is designed to deploy the ArgusHack2 (AGH2) application suite on a Kubernetes cluster. It is an 'application' type chart, packaging all necessary Kubernetes resources and configurations to run the various AGH2 microservices. The chart is highly configurable through its values.yaml file, allowing for customization of components, dependencies, and resource settings.
This chart manages the deployment of core AGH2 services including the captain, core, exploitmgr, and ui modules. It also handles the provisioning of dependencies like PostgreSQL, MinIO, and Redis, which can be deployed internally as part of the chart or connected to external instances. The deployment process includes sophisticated database initialization routines that can create databases, users, and even populate data from remote sources.
Architecture Overview
The agh2 chart deploys a microservices-based architecture. The main components interact with each other and with shared data stores.
The following diagram illustrates the high-level architecture of the deployed services and their dependencies.
Chart Dependencies
The agh2 chart relies on several sub-charts for its dependencies, which are conditionally enabled.
| Dependency | Version | Repository | Condition for Enabling |
|---|---|---|---|
postgresql | 12.1.2 | https://charts.bitnami.com/bitnami | db.internal.enabled |
minio | 12.2.4 | https://charts.bitnami.com/bitnami | minio.internal.enabled |
common | 2.2.1 | https://charts.bitnami.com/bitnami | (Always included) |
Sources: charts/agh2/Chart.yaml:22-32
Core Components
The chart deploys several microservices, each with a specific role within the AGH2 ecosystem.
captain
The captain service acts as the main backend and API gateway. It handles user interactions from the UI, communicates with other backend services, and manages data persistence.
- Deployment:
charts/agh2/templates/captain/captain-deployment.yml - Environment Variables: It is configured with connections to PostgreSQL (
DB_Conn), MinIO (MINIO_URL,MINIO_USER,MINIO_PASSWORD), and Redis (ENV_REDIS_CONN). It also has service URLs forcoreandexploitmgr. - Init Containers: The deployment includes init containers to ensure PostgreSQL and Redis are available before the
captaincontainer starts.
Sources: charts/agh2/templates/captain/captain-deployment.yml:11-39, 50-98
core
The core service contains the main business logic of the application.
- Deployment:
charts/agh2/templates/core/core-deployment.yml - Environment Variables: Connects to its own PostgreSQL database (
DB_Conn), theexploitmgrdatabase (EXP_MGR_DB_Conn), MinIO, and Redis. It also knows the URL for theexploitmgrservice. - Init Containers: Similar to
captain, it waits for PostgreSQL and Redis to be ready.
Sources: charts/agh2/templates/core/core-deployment.yml:11-39, 50-89
exploitmgr
The exploitmgr service is responsible for managing exploits.
- Deployment:
charts/agh2/templates/exploit-manager/exploitmgr-deployment.yml - Environment Variables: It connects to its PostgreSQL database (
DB_Conn) and thecoreservice (CORE_URL). - Init Containers: An init container ensures the PostgreSQL database is ready before startup.
Sources: charts/agh2/templates/exploit-manager/exploitmgr-deployment.yml:11-27, 34-45
ui
The ui is the frontend application.
- Deployment:
charts/agh2/templates/ui/ui-deployment.yml - It is a simple deployment serving the user interface on port 80. It does not have complex environment variables defined directly in its deployment template, suggesting configuration might be baked into the image or handled at runtime.
Sources: charts/agh2/templates/ui/ui-deployment.yml:1-20
Configuration
The chart is configured via the values.yaml file. Key configuration sections are detailed below.
Global Configuration
| Parameter | Description | Default Value |
|---|---|---|
global.imageRegistry | Global Docker Image registry | "registry.lkc-lab.com" |
global.imagePullSecrets | Global Docker registry secret names | ["lkc-registry"] |
global.storageClass | Global storage class for dynamic provisioning | "" |
Sources: charts/agh2/values.yaml:8-13
Keygen Configuration
The keygen configuration is used to fetch assets, such as the attack dataset for database initialization.
| Parameter | Description | Required |
|---|---|---|
keygen.apiToken | Keygen API Token for authentication. | Yes, if keygen.enabled is true. |
keygen.accountID | Keygen Account ID. | Yes, if keygen.enabled is true. |
Sources: charts/agh2/values.yaml:31-40, charts/agh2/templates/db/postgres-init-configmap.yml:11-13
Database Configuration (postgresql)
The chart can use an internal, containerized PostgreSQL instance or connect to an external one.
- Internal Mode: When
db.internal.enabledistrue, a PostgreSQL instance is deployed using the Bitnami sub-chart. - Initialization: If
postgresql.primary.initdb.enabledistrue, aConfigMapis created to run initialization scripts when the database first starts.
The database initialization process is a critical part of the deployment, handled by postgres-init-configmap.yml.
The diagram below shows the flow of the database initialization script.
This flow shows that the script can create databases and roles for each application module and optionally download and import a separate attack dataset.
Sources: charts/agh2/values.yaml:104-121, charts/agh2/templates/db/postgres-init-configmap.yml:1-135
Deployment and Startup
The deployment templates for the core services (captain, core, exploitmgr) utilize init containers to manage startup dependencies. This ensures that services do not start until their required backing services (like PostgreSQL and Redis) are available.
The following sequence diagram illustrates the startup process for the captain deployment.
This sequence ensures a graceful startup, preventing connection errors and restart loops in the main application containers.
Sources: charts/agh2/templates/captain/captain-deployment.yml:11-39, charts/agh2/templates/core/core-deployment.yml:11-39, charts/agh2/templates/exploit-manager/exploitmgr-deployment.yml:11-27
Summary
The agh2 Helm chart provides a robust and configurable method for deploying the ArgusHack2 application suite. It effectively manages a complex microservices architecture by defining dependencies, controlling startup order with init containers, and automating database provisioning. The extensive use of values.yaml allows operators to tailor the deployment to various environments, whether using the chart's internal dependencies or integrating with existing external services. The modular design of the chart reflects the microservice-oriented nature of the AGH2 platform itself.