Open challenges to limited testers about kctf HOT 6 OPEN

We probably could use a TCP Load Balancer and then put it behind IAP in GCP. https://cloud.google.com/iap/docs/using-tcp-forwarding

from kctf.

RBAC on the challenge I think could work too

from kctf.

Note: An internal TCP/UDP load balancer is not assigned a fully-qualified domain name (FQDN), and it is not possible to configure one using GKE. You can assign a static IP address to your internal TCP/UDP load balancer and assign that IP to a record in Cloud DNS, but Cloud DNS is not tightly integrated with GKE.

https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing

from kctf.

Perhaps the most elegant solution is to create an external load balancer with only IAP ports https://cloud.google.com/kubernetes-engine/docs/how-to/service-parameters#lb_source_ranges and then ask IAP to connect to the IP address

https://cloud.google.com/iap/docs/using-tcp-forwarding has the ranges needed

from kctf.

the downside of this, is that we need to do it to a specific node and port.. in gctf this was complicated =/

from kctf.

nvm, this has to be done with RBAC, and this means we need to let users put tasks inside a namespace, and propagate credentials somehow.

we don't put tasks inside namespaces by default (I think it's still possible, but it's not done by default anymore)

from kctf.