CTFd Helm Chart

A modular Helm chart for deploying CTFd (Capture The Flag framework) with MySQL and Redis dependencies on Kubernetes with OpenShift compatibility. This chart uses a library chart pattern for modular, reusable components.

Prerequisites

• Kubernetes 1.16+
• Helm 3.2.0+
• OpenShift 4.x (optional, but the chart is designed with OpenShift security constraints in mind)

Features

• Modular Architecture: Uses Helm library charts for MySQL and Redis components for better maintainability and reusability
• OpenShift Compatible: Runs with non-root security contexts and proper SELinux contexts
• Flexible Database Options: Choose between library chart MySQL, Bitnami MySQL subchart, or external database
• Flexible Cache Options: Choose between library chart Redis, Bitnami Redis subchart, or external cache
• Persistent Storage: Configurable persistent volumes for uploads, logs, and database/cache data
• Security Hardened: Follows security best practices with non-root containers and minimal privileges
• Single Replica Default: MySQL and Redis run as single replicas by default for resource efficiency
• Composable Components: Library charts can be reused in other Helm applications

Quick Start

1. Clone or download this chart
2. Build dependencies:

cd ctfd-helm
helm dependency build

3. Install the chart:

helm install my-ctfd ./ctfd-helm

4. Get the application URL:

kubectl get ingress
# OR if using port-forward
kubectl port-forward svc/my-ctfd 8080:80

5. Access CTFd at http://localhost:8080 and complete the setup wizard

Configuration

Basic Configuration

The following table lists the configurable parameters and their default values:

Parameter	Description	Default
ctfd.replicaCount	Number of CTFd replicas	1
ctfd.image.repository	CTFd image repository	ctfd/ctfd
ctfd.image.tag	CTFd image tag	"" (uses Chart.AppVersion)
ctfd.secretKey	CTFd secret key	"change-me-in-production"
ctfd.service.type	Kubernetes service type	ClusterIP
ctfd.service.port	Service port	80

Database Configuration

The chart provides three database options:

1. Internal MySQL (Default - using library chart)

internalMySQL:
  enabled: true
mysql-library:
  mysql:
    enabled: true
    database: "ctfd"
    username: "ctfd"
    password: "ctfd-password"

2. Bitnami MySQL Subchart

mysql:
  enabled: true
internalMySQL:
  enabled: false

3. External Database

mysql:
  enabled: false
internalMySQL:
  enabled: false
externalDatabase:
  connectionString: "mysql+pymysql://user:pass@host:3306/db"

Cache Configuration

The chart provides three cache options:

1. Internal Redis (Default - using library chart)

internalRedis:
  enabled: true
redis-library:
  redis:
    enabled: true

2. Bitnami Redis Subchart

redis:
  enabled: true
internalRedis:
  enabled: false

3. External Redis

redis:
  enabled: false
internalRedis:
  enabled: false
externalRedis:
  connectionString: "redis://host:6379/0"

OpenShift Configuration

The chart is pre-configured for OpenShift with non-root security contexts and includes an OpenShift Route for external access:

security:
  fsGroup: 1000860000
  runAsGroup: 1000860000
  runAsUser: 1000860000

# OpenShift Route (enabled by default)
route:
  enabled: true
  tls:
    enabled: true
    termination: edge
    insecureEdgeTerminationPolicy: Redirect

External Access Options

OpenShift Route (Recommended for OpenShift)

route:
  enabled: true
  host: "ctfd.apps.cluster.example.com"  # Optional custom hostname
  tls:
    enabled: true
    termination: edge  # edge, passthrough, or reencrypt

Kubernetes Ingress (For standard Kubernetes)

route:
  enabled: false
ingress:
  enabled: true
  hosts:
    - host: ctfd.example.com
      paths:
        - path: /
          pathType: Prefix

Persistence

Configure persistent storage for CTFd uploads and logs:

ctfd:
  persistence:
    uploads:
      enabled: true
      size: 10Gi
      storageClass: ""
    logs:
      enabled: false
      size: 5Gi
      storageClass: ""

Installation Examples

Basic Installation

helm install ctfd ./ctfd-helm

Installation with Custom Values

helm install ctfd ./ctfd-helm \
  --set ctfd.secretKey="my-super-secret-key" \
  --set ctfd.persistence.uploads.size=20Gi

Installation with External Database

helm install ctfd ./ctfd-helm \
  --set mysql.enabled=false \
  --set internalMySQL.enabled=false \
  --set externalDatabase.connectionString="mysql+pymysql://user:pass@host:3306/db"

OpenShift Deployment with Custom Route

helm install ctfd ./ctfd-helm \
  --namespace ctfd \
  --set route.host="ctfd.apps.mycluster.example.com" \
  --set ctfd.secretKey="my-production-secret-key"

Kubernetes Deployment with Ingress

helm install ctfd ./ctfd-helm \
  --set route.enabled=false \
  --set ingress.enabled=true \
  --set ingress.hosts[0].host="ctfd.example.com"

Upgrading

To upgrade the CTFd deployment:

helm upgrade ctfd ./ctfd-helm

Uninstalling

To uninstall/delete the CTFd deployment:

helm uninstall ctfd

Security Considerations

1. Change Default Passwords: Always change the default database passwords and secret key in production
2. Use External Secrets: Consider using Kubernetes secrets or external secret management for sensitive data
3. Network Policies: Implement network policies to restrict traffic between pods
4. HTTPS: Configure ingress with TLS certificates for production deployments

Troubleshooting

Pod Security Issues on OpenShift

If you encounter pod security issues, ensure your project has the appropriate Security Context Constraints (SCC):

oc adm policy add-scc-to-user anyuid -z default

Database Connection Issues

Check the database connectivity:

kubectl logs deployment/ctfd-mysql
kubectl logs deployment/ctfd

Storage Issues

Verify persistent volume claims:

kubectl get pvc
kubectl describe pvc ctfd-uploads

Contributing

1. Fork the repository
2. Create a feature branch
3. Commit your changes
4. Push to the branch
5. Create a Pull Request

Library Chart Architecture

This chart uses Helm library charts for modularity and reusability:

Chart Structure

ctfd-helm/
├── Chart.yaml                    # Main chart metadata
├── values.yaml                   # Main chart values
├── templates/                    # CTFd application templates
│   ├── ctfd-deployment.yaml
│   ├── ctfd-service.yaml
│   └── ...
└── charts/                      # Library charts
    ├── mysql-library/           # MySQL library chart
    │   ├── Chart.yaml           # type: library
    │   ├── values.yaml
    │   └── templates/
    │       ├── _helpers.tpl     # MySQL template functions
    │       ├── deployment.yaml
    │       ├── service.yaml
    │       └── ...
    └── redis-library/           # Redis library chart
        ├── Chart.yaml           # type: library
        ├── values.yaml
        └── templates/
            ├── _helpers.tpl     # Redis template functions
            ├── deployment.yaml
            ├── service.yaml
            └── ...

Benefits

• Modularity: MySQL and Redis components are self-contained and reusable
• Maintainability: Each library chart can be developed and tested independently
• Flexibility: Easy to switch between internal library charts and external subcharts
• Reusability: Library charts can be used in other Helm applications
• Version Control: Each component can have its own versioning strategy

Library Chart Usage

Library charts are referenced in the main Chart.yaml as local dependencies:

dependencies:
  - name: mysql-library
    version: "0.1.0"
    repository: "file://./charts/mysql-library"
    condition: internalMySQL.enabled
  - name: redis-library
    version: "0.1.0"
    repository: "file://./charts/redis-library"
    condition: internalRedis.enabled

The main chart's helpers reference library chart templates:

{{- define "ctfd.mysql.connectionString" -}}
{{- if .Values.internalMySQL.enabled }}
{{- include "mysql-library.connectionString" . }}
{{- end }}
{{- end }}

License

This chart is licensed under the MIT License.