# ============================================================
# VULNERABLE Kubernetes Pod Spec — CTF Challenge Resource
# ============================================================
# This configuration contains INTENTIONAL security weaknesses
# for educational / CTF use only. DO NOT deploy in production.
# ============================================================

apiVersion: v1
kind: Pod
metadata:
  name: ctf-target-app
  namespace: default
  labels:
    app: ctf-target
    environment: production
spec:
  # FINDING: hostPID allows the pod to see all processes on the host node
  hostPID: true

  # FINDING: hostNetwork puts the pod on the node's network namespace
  # — can sniff traffic, access services bound to 127.0.0.1 on the node
  hostNetwork: true

  # FINDING: hostIPC allows the pod to access host inter-process communication
  hostIPC: true

  # FINDING: Service account with cluster-admin privileges
  serviceAccountName: ctf-admin-sa
  automountServiceAccountToken: true

  # FINDING: No DNS policy set — inherits host DNS when hostNetwork is true
  # FINDING: No node selector or affinity — can be scheduled on any node

  containers:
  - name: main-app
    image: ctf-target/webapp:latest
    # FINDING: No image tag pinning — "latest" is mutable and unpredictable
    # FINDING: No image pull policy specified (defaults to Always for :latest)

    securityContext:
      # FINDING: Privileged mode — full access to host devices and kernel
      privileged: true
      # FINDING: Running as root
      runAsUser: 0
      runAsGroup: 0
      # FINDING: Root filesystem is writable (no readOnlyRootFilesystem)
      readOnlyRootFilesystem: false
      # FINDING: Allows privilege escalation via setuid binaries
      allowPrivilegeEscalation: true
      # FINDING: All capabilities added
      capabilities:
        add:
          - ALL
        # Should instead drop ALL and add only what's needed:
        # drop: ["ALL"]
        # add: ["NET_BIND_SERVICE"]

    # FINDING: No resource limits — can consume all node resources (DoS vector)
    # resources:
    #   limits:
    #     cpu: "500m"
    #     memory: "256Mi"
    #   requests:
    #     cpu: "100m"
    #     memory: "128Mi"

    ports:
    - containerPort: 8080
      # FINDING: hostPort exposes directly on the node (bypasses Service/Ingress)
      hostPort: 8080
    - containerPort: 5678
      hostPort: 5678
      # FINDING: Debug port exposed on host

    env:
    # FINDING: Secrets stored as plain-text environment variables
    - name: DB_PASSWORD
      value: "SuperSecret123!"
    - name: API_KEY
      value: "sk-proj-abc123def456ghi789jkl012mno345pqr678"
    - name: JWT_SECRET
      value: "my-jwt-secret-never-change-this"
    # Should use secretKeyRef instead:
    # - name: DB_PASSWORD
    #   valueFrom:
    #     secretKeyRef:
    #       name: app-secrets
    #       key: db-password

    volumeMounts:
    - name: host-root
      mountPath: /host
    - name: docker-sock
      mountPath: /var/run/docker.sock
    - name: host-proc
      mountPath: /host-proc

    # FINDING: No liveness or readiness probes
    # livenessProbe: ...
    # readinessProbe: ...

  - name: sidecar-logger
    image: ctf-target/logger:latest
    securityContext:
      # FINDING: Also running as root with privilege escalation
      runAsUser: 0
      allowPrivilegeEscalation: true
      readOnlyRootFilesystem: false
    # FINDING: No resource limits on sidecar either
    volumeMounts:
    - name: host-root
      mountPath: /host
    - name: host-var-log
      mountPath: /var/log/host

  volumes:
  # FINDING: Host root filesystem mounted — complete host access from container
  - name: host-root
    hostPath:
      path: /
      type: Directory

  # FINDING: Docker socket mounted — can create/control containers on the host
  - name: docker-sock
    hostPath:
      path: /var/run/docker.sock
      type: Socket

  # FINDING: Host /proc mounted — can access host process information
  - name: host-proc
    hostPath:
      path: /proc
      type: Directory

  # FINDING: Host log directory mounted writable
  - name: host-var-log
    hostPath:
      path: /var/log
      type: Directory

  # FINDING: No pod security context (runAsNonRoot, seccompProfile, etc.)
  # securityContext:
  #   runAsNonRoot: true
  #   seccompProfile:
  #     type: RuntimeDefault

  # FINDING: No tolerations/affinity to restrict scheduling
  # FINDING: No PodDisruptionBudget referenced
  # FINDING: No NetworkPolicy restricting ingress/egress

---
# FINDING: ClusterRoleBinding granting cluster-admin to the service account
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ctf-admin-binding
subjects:
- kind: ServiceAccount
  name: ctf-admin-sa
  namespace: default
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

---
# FINDING: ServiceAccount in default namespace with no restrictions
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ctf-admin-sa
  namespace: default
  # FINDING: No annotations restricting workload identity
  # FINDING: No IRSA/Workload Identity federation configured

# ============================================================
# Summary of Findings
# ============================================================
# [CRITICAL] privileged: true — full host kernel access
# [CRITICAL] hostPID: true — can see and signal all host processes
# [CRITICAL] hostNetwork: true — shares host network namespace
# [CRITICAL] hostIPC: true — shares host IPC namespace
# [CRITICAL] Host root filesystem (/) mounted as volume
# [CRITICAL] Docker socket mounted — container escape trivial
# [CRITICAL] Service account has cluster-admin ClusterRoleBinding
# [CRITICAL] Secrets in plain-text env vars
# [HIGH]     Running as root (runAsUser: 0)
# [HIGH]     allowPrivilegeEscalation: true
# [HIGH]     capabilities: ALL added
# [HIGH]     readOnlyRootFilesystem: false
# [HIGH]     No resource limits (CPU/memory) — DoS vector
# [HIGH]     hostPort used — bypasses network policies
# [MEDIUM]   No liveness/readiness probes
# [MEDIUM]   Image tag "latest" — not pinned
# [MEDIUM]   automountServiceAccountToken: true (with powerful SA)
# [MEDIUM]   No NetworkPolicy, no PodDisruptionBudget
# [LOW]      No seccomp profile configured
# [LOW]      No node affinity/anti-affinity rules