Skip to content

Commit 2f60d00

Browse files
andytaelandytael
authored
Initial check in of Security Workshop (WMS8461) (#462)
* Adding +x to script, typos and remove verrazzano file * Repo updates for OL Changed repo for Oracle Linux to Oracle hosted repo * Typo in Dockerfile * Upgrading OKE and nodepool version to latest Current version 1.21.5 doesn't deploy properly. Upgrading to latest version * Updated README.md Changed the bit.ly URL * Initial check-in of sec workshop (#456) Initial check-in of sec workshop (#456) * Initial check in of Security Workshop (WMS8461) Initial check in of Security Workshop (WMS8461) * Initial check in of Security Workshop (WMS8461)
1 parent 21e2469 commit 2f60d00

29 files changed

+1723
-0
lines changed

‎workshops/dcms-ords-sec/.gitignore

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
##############################################################################
2+
# Project Specific
3+
##############################################################################
4+
/.oci*
5+
/.venv
6+
/.vscode
7+
/backup
8+
/uploads/*.zip
9+
/.DS_Store
10+
11+
##############################################################################
12+
# Terraform Generic
13+
##############################################################################
14+
# Local .terraform directories
15+
**/.terraform/*
16+
17+
# .tfstate files
18+
*.tfstate
19+
*.tfstate.*
20+
21+
# .terraform.lock.hcl (Controversial?)
22+
.terraform.lock.hcl
23+
24+
# Crash log files
25+
crash.log
26+
27+
# Exclude all .tfvars files, which are likely to contain sentitive data, such as
28+
# password, private keys, and other secrets. These should not be part of version control as they are data points which are potentially sensitive and subject
29+
# to change depending on the environment.
30+
#
31+
*.tfvars
32+
33+
# Ignore override files as they are usually used to override resources locally and so
34+
# are not checked in
35+
override.tf
36+
override.tf.json
37+
*_override.tf
38+
*_override.tf.json
39+
40+
# Include override files you do wish to add to version control using negated pattern
41+
#
42+
# !example_override.tf
43+
44+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
45+
# Plan file
46+
*.out
47+
tfplan
48+
49+
# Ignore CLI configuration files
50+
.terraformrc
51+
terraform.rc
52+
53+
# Generated bastion key file
54+
bastion_key
55+
terraform-env.sh
56+
.DS_store
57+
.DS_Store
58+
59+
# Temp file for project
60+
slask
61+
temp-file

‎workshops/dcms-ords-sec/apigw/APIORDS.postman_collection.json

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
{
2+
"info": {
3+
"_postman_id": "fa10a948-7ee7-4439-bdc7-f09565d577da",
4+
"name": "APIORDS",
5+
"schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
6+
},
7+
"item": [
8+
{
9+
"name": "ORDS_OAuth20",
10+
"request": {
11+
"auth": {
12+
"type": "oauth2",
13+
"oauth2": [
14+
{
15+
"key": "redirect_uri",
16+
"value": "http://{{api_hostname}}/auth/code/example/",
17+
"type": "string"
18+
},
19+
{
20+
"key": "state",
21+
"value": "7843928792043222",
22+
"type": "string"
23+
},
24+
{
25+
"key": "useBrowser",
26+
"value": false,
27+
"type": "boolean"
28+
},
29+
{
30+
"key": "authUrl",
31+
"value": "https://{{api_hostname}}/ords/ordstest/oauth/auth",
32+
"type": "string"
33+
},
34+
{
35+
"key": "accessTokenUrl",
36+
"value": "https://{{api_hostname}}/ords/ordstest/oauth/token",
37+
"type": "string"
38+
},
39+
{
40+
"key": "clientSecret",
41+
"value": "{{client_secret}}",
42+
"type": "string"
43+
},
44+
{
45+
"key": "clientId",
46+
"value": "{{client_id}}",
47+
"type": "string"
48+
},
49+
{
50+
"key": "tokenName",
51+
"value": "access_token",
52+
"type": "string"
53+
},
54+
{
55+
"key": "addTokenTo",
56+
"value": "header",
57+
"type": "string"
58+
}
59+
]
60+
},
61+
"method": "GET",
62+
"header": [],
63+
"url": {
64+
"raw": "https://{{api_hostname}}/ords/ordstest/examples/employees/",
65+
"protocol": "https",
66+
"host": [
67+
"{{api_hostname}}"
68+
],
69+
"path": [
70+
"ords",
71+
"ordstest",
72+
"examples",
73+
"employees",
74+
""
75+
]
76+
}
77+
},
78+
"response": []
79+
}
80+
],
81+
"auth": {
82+
"type": "oauth2",
83+
"oauth2": [
84+
{
85+
"key": "tokenName",
86+
"value": "access_token",
87+
"type": "string"
88+
},
89+
{
90+
"key": "challengeAlgorithm",
91+
"value": "S256",
92+
"type": "string"
93+
},
94+
{
95+
"key": "state",
96+
"value": "3668D7A713E93372E0406A38A8C02171",
97+
"type": "string"
98+
},
99+
{
100+
"key": "redirect_uri",
101+
"value": "https://{{api_hostname}}/v3/auth/code/example/",
102+
"type": "string"
103+
},
104+
{
105+
"key": "grant_type",
106+
"value": "authorization_code",
107+
"type": "string"
108+
},
109+
{
110+
"key": "clientSecret",
111+
"value": "{{client_secret}}",
112+
"type": "string"
113+
},
114+
{
115+
"key": "clientId",
116+
"value": "{{client_id}}",
117+
"type": "string"
118+
},
119+
{
120+
"key": "authUrl",
121+
"value": "https://{{api_hostname}}/app/ords/ordstest/oauth/auth",
122+
"type": "string"
123+
},
124+
{
125+
"key": "addTokenTo",
126+
"value": "header",
127+
"type": "string"
128+
},
129+
{
130+
"key": "client_authentication",
131+
"value": "header",
132+
"type": "string"
133+
},
134+
{
135+
"key": "accessTokenUrl",
136+
"value": "https://{{api_hostname}}/ords/ordstest/oauth/token",
137+
"type": "string"
138+
}
139+
]
140+
},
141+
"event": [
142+
{
143+
"listen": "prerequest",
144+
"script": {
145+
"type": "text/javascript",
146+
"exec": [
147+
""
148+
]
149+
}
150+
},
151+
{
152+
"listen": "test",
153+
"script": {
154+
"type": "text/javascript",
155+
"exec": [
156+
""
157+
]
158+
}
159+
}
160+
]
161+
}

‎workshops/dcms-ords-sec/apigw/ENV_Empty.postman_environment.json

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"id": "9db04bf4-fdb5-41f0-aca4-eec79b8c37a5",
3+
"name": "ORDSENV",
4+
"values": [
5+
{
6+
"key": "client_id",
7+
"value": "",
8+
"enabled": true
9+
},
10+
{
11+
"key": "api_hostname",
12+
"value": "",
13+
"enabled": true
14+
},
15+
{
16+
"key": "client_secret",
17+
"value": "",
18+
"enabled": true
19+
}
20+
],
21+
"_postman_variable_scope": "environment",
22+
"_postman_exported_at": "2022-07-27T08:51:18.037Z",
23+
"_postman_exported_using": "Postman/9.25.0"
24+
}

‎workshops/dcms-ords-sec/apigw/apigw-stress-script.js

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
import { check } from 'k6';
2+
import http from 'k6/http';
3+
const params = {
4+
headers: {
5+
'Authorization': 'Bearer '+`${__ENV.TOKEN}`,
6+
},
7+
};
8+
export const options = {
9+
userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36',
10+
scenarios: {
11+
constant_request_rate: {
12+
executor: 'constant-arrival-rate',
13+
rate: 400,
14+
timeUnit: '1s', // 1000 iterations per second, i.e. 1000 RPS
15+
duration: '1s',
16+
preAllocatedVUs: 100, // how large the initial pool of VUs would be
17+
maxVUs: 200, // if the preAllocatedVUs are not enough, we can initialize more
18+
},
19+
},
20+
}
21+
export default function () {
22+
const res = http.get(`${__ENV.MY_HOSTNAME}`,params);
23+
check(res, {
24+
'is status 200': (r) => r.status === 200,
25+
'is status 300': (r) => (r.status >= 300 && r.status < 400 ),
26+
'is status 400': (r) => (r.status >= 400 && r.status < 500 ) ,
27+
});
28+
}
29+

‎workshops/dcms-ords-sec/apigw/artillery.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#TRIMMEDURL=${api_gw_base_url:8}
2+
TRIMMEDURL=${api_gw_base_url}
3+
echo $TRIMMEDURL
4+
sed "s/TOKEN/$ACCESS_TOKEN/" ./stress.yaml.temp &>./stress1.yaml
5+
sed "s/API_GW_BASE_URL/$TRIMMEDURL/" ./stress1.yaml &>./stress.yaml
6+
rm ./stress1.yaml
7+
docker run --rm -it -v ${PWD}:/scripts artilleryio/artillery:latest run /scripts/stress.yaml
8+
rm ./stress.yaml

‎workshops/dcms-ords-sec/apigw/k6.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Copyright © 2022, Oracle and/or its affiliates.
2+
# All rights reserved. The Universal Permissive License (UPL), Version 1.0 as shown at http://oss.oracle.com/licenses/upl
3+
4+
k6 run -e MY_HOSTNAME=${api_gw_base_url}/ords/ordstest/examples/employees/ -e TOKEN=$1 ./apigw-stress-script.js --insecure-skip-tls-verify

‎workshops/dcms-ords-sec/apigw/sec_rules_apigw.json

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"securityRules": [
3+
{
4+
"description": null,
5+
"destination": null,
6+
"destinationType": null,
7+
"direction": "INGRESS",
8+
"icmpOptions": null,
9+
"isStateless": false,
10+
"protocol": "6",
11+
"source": "0.0.0.0/0",
12+
"sourceType": "CIDR_BLOCK",
13+
"tcpOptions": {
14+
"destinationPortRange": {
15+
"max": 443,
16+
"min": 443
17+
}
18+
},
19+
"udpOptions":null
20+
},
21+
{
22+
"description": null,
23+
"destination": null,
24+
"destinationType": null,
25+
"direction": "INGRESS",
26+
"icmpOptions": null,
27+
"isStateless": false,
28+
"protocol": "6",
29+
"source": "0.0.0.0/0",
30+
"sourceType": "CIDR_BLOCK",
31+
"tcpOptions": {
32+
"destinationPortRange": {
33+
"max": 80,
34+
"min": 80
35+
}
36+
},
37+
"udpOptions":null
38+
},
39+
{
40+
"description": null,
41+
"destination": "0.0.0.0/0",
42+
"destinationType": "CIDR_BLOCK",
43+
"direction": "EGRESS",
44+
"icmpOptions": null,
45+
"isStateless": false,
46+
"protocol": "6",
47+
"source": null,
48+
"sourceType":null,
49+
"tcpOptions": null,
50+
"udpOptions":null
51+
}
52+
]
53+
}

0 commit comments

Comments
 (0)