{"id":24678723,"url":"https://github.com/contrast-security-oss/demo-k8s-operator","last_synced_at":"2026-05-14T21:32:15.681Z","repository":{"id":72669522,"uuid":"539409722","full_name":"Contrast-Security-OSS/demo-k8s-operator","owner":"Contrast-Security-OSS","description":null,"archived":false,"fork":false,"pushed_at":"2023-10-25T17:38:16.000Z","size":21,"stargazers_count":2,"open_issues_count":1,"forks_count":0,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-09-30T18:59:59.387Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Contrast-Security-OSS.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-09-21T09:35:46.000Z","updated_at":"2023-12-14T04:04:04.000Z","dependencies_parsed_at":"2023-10-25T18:50:37.682Z","dependency_job_id":null,"html_url":"https://github.com/Contrast-Security-OSS/demo-k8s-operator","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Contrast-Security-OSS/demo-k8s-operator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Contrast-Security-OSS%2Fdemo-k8s-operator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Contrast-Security-OSS%2Fdemo-k8s-operator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Contrast-Security-OSS%2Fdemo-k8s-operator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Contrast-Security-OSS%2Fdemo-k8s-operator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Contrast-Security-OSS","download_url":"https://codeload.github.com/Contrast-Security-OSS/demo-k8s-operator/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Contrast-Security-OSS%2Fdemo-k8s-operator/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279018012,"owners_count":26086235,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-14T02:00:06.444Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-26T13:18:03.382Z","updated_at":"2025-10-14T05:38:19.341Z","avatar_url":"https://github.com/Contrast-Security-OSS.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Contrast Agent Operator Demo\n\nThis repo includes examples of how to create a Kubernetes cluster, deploy the Contrast Agent Operator and some known vulnerable applications. Typical deployment times:\n\n* AKS - 5 mins\n* EKS - 20 mins\n\n---\n\n## Deploying on Azure/AKS\n\nThis deployment will typically take ±5 minutes.\n\n### Pre-requisites for Azure/AKS\n\n1. Install Terraform from here: \u003chttps://www.terraform.io/downloads.html\u003e.\n1. Install the Azure cli tools using `brew update \u0026\u0026 brew install azure-cli`.\n1. Install kubectl using `brew update \u0026\u0026 brew install kubectl`.\n\n### Steps for Azure/AKS\n\n1. Change directory to the [AKS](/terraform-aks/) folder\n1. If your Azure CLI is not authenticated then log into the Azure (`az login`)  to cache your credentials.\n1. Create a terraform.tfvars file to add your initials and preferred Azure location, for example:\n\n        location=\"UK South\"\n        initials=\"da\"\n\n1. Run `terraform init` to download the required plugins.\n1. Run `terraform apply` to deploy a new cluster.\n1. Grab your AKS credentials for kubectl:\n\n        az aks get-credentials --resource-group $(terraform output resource_group_name | tr -d '\"') --name $(terraform output kubernetes_cluster_name | tr -d '\"')\n\n1. Deploy the operator and demo apps.\n1. View the Kubernetes dashboard (optional):\n\n        az aks browse --resource-group $(terraform output resource_group_name | tr -d '\"') --name $(terraform output  kubernetes_cluster_name | tr -d '\"')\n\n1. After your demo, run `terraform destroy --auto-approve` to remove all resources.\n\n---\n\n## Deploying on AWS/EKS\n\n### Pre-requisites for AWS/EKS\n\n1. Install kubectl using `brew update \u0026\u0026 brew install kubectl`.\n1. Install the AWS CLI using `brew update \u0026\u0026 brew install awscli`.\n1. If your AWS CLI is not authenticated then run (`aws configure`)  to cache your credentials.\n1. Install eksctl using `brew update \u0026\u0026 brew install eksctl`.\n\n### Steps for AWS/EKS\n\n1. Create a K8S cluster using `eksctl create cluster --name sales-engineering-da --region us-east-2`\n1. Grab your EKS credentials for kubectl: `aws eks update-kubeconfig --region us-east-2 --name sales-engineering-da`\n1. After your demo, run `eksctl delete cluster --name sales-engineering-da --region us-east-2` to remove all resources.\n\n---\n\n## Installing the Contrast Agent Operator\n\n1. Install the operator:\n\n        kubectl apply -f https://github.com/Contrast-Security-OSS/agent-operator/releases/latest/download/install-prod.yaml\n\n1. Configure the operator using one of the two options below:\n\n### Express Configuration\n\n1. Rename the [config-template.yaml](config-template.yaml) to config.yaml and add your agent credentials on lines 9-11. This file includes agent injectors for all languages.\n1. Run `kubectl apply -f config.yaml`\n\n### Step by Step Configuration\n\n1. Configure the operator credentials:\n\n        kubectl -n contrast-agent-operator create secret generic default-agent-connection-secret --from-literal=apiKey=TODO --from-literal=serviceKey=TODO --from-literal=userName=TODO\n\n1. Create a ClusterAgentConnection:\n\n    ```\n    kubectl apply -f - \u003c\u003cEOF\n    apiVersion: agents.contrastsecurity.com/v1beta1\n    kind: ClusterAgentConnection\n    metadata:\n      name: default-agent-connection\n      namespace: contrast-agent-operator\n    spec:\n      template:\n        spec:\n          url: https://eval.contrastsecurity.com/Contrast\n          apiKey:\n            secretName: default-agent-connection-secret\n            secretKey: apiKey\n          serviceKey:\n            secretName: default-agent-connection-secret\n            secretKey: serviceKey\n          userName:\n            secretName: default-agent-connection-secret\n            secretKey: userName\n    EOF\n    ```\n\n1. Create an AgentInjector (this should be done per target language - example is for Java):\n\n    ```\n    kubectl apply -f - \u003c\u003cEOF\n    apiVersion: agents.contrastsecurity.com/v1beta1\n    kind: AgentInjector\n    metadata:\n      name: contrast-agent-injector\n      namespace: default\n    spec:\n      type: java\n      selector:\n        labels:\n          - name: contrast\n            value: java\n    EOF\n    ```\n\n---\n\n## Deploying Applications\n\n1. Make sure you have the relevant agent injector created and deploy vulnerable applications from the apps folder, e.g.: `kubectl apply -f /apps/webgoat.yaml`\n\n1. Visit your application in the browser via the external IP. Remember to add `/WebGoat` (or equivalent): `kubectl get services`\n\n---\n\n## Troubleshooting\n\n### Troubleshoot the Application  \n\n1. Check the app has the correct Contrast annotations: `kubectl describe Deployment/webgoat`\n\n1. Check if Contrast is mentioned in the application logs: `kubectl -n default logs Deployment/webgoat`\n\n1. Show logging from the init container on the pod: `kubectl logs Deployment/webgoat -c contrast-init`\n\n### Troubleshoot the Agent Operator  \n\n1. Check the operator is running: `kubectl -n contrast-agent-operator get pods`\n\n1. Check the operator logs: `kubectl logs -f deployment/contrast-agent-operator  --namespace contrast-agent-operator`\n\n1. If you don't have operator logs, check everything is configured:\n\n        kubectl get all,secrets,clusteragentconfiguration,clusteragentconnection --namespace contrast-agent-operator\n\n1. Elevate the operator logging:\n\n        kubectl -n contrast-agent-operator set env deployment/contrast-agent-operator CONTRAST_LOG_LEVEL=Trace","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcontrast-security-oss%2Fdemo-k8s-operator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcontrast-security-oss%2Fdemo-k8s-operator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcontrast-security-oss%2Fdemo-k8s-operator/lists"}