Konata

1
secrets:
2
  token:
3
    env: RCTF_TOKEN
4
  minions-queue-secret:
5
    env: MINIONS_QUEUE_SECRET
6
  minions-rctf-secret:
7
    env: MINIONS_RCTF_SECRET
8
  ppfarming-api-ip:
9
    env: PPFARMING_API_IP
10

11
clusters:
12
  prod:
13
    gcloud:
14
      clusterName: sekaictf-infra
15
      project: sekaictf-500215
16
      zone: europe-west1-b
17
  instancer:
18
    gcloud:
19
      clusterName: instancer-cluster
20
      project: sekaictf-500215
21
      zone: europe-west1
22
  main:
23
    aliasTo: prod
24

25
registries:
26
  challenges: europe-west1-docker.pkg.dev/sekaictf-500215/sekaictf
27
  instancer-challenges: europe-west1-docker.pkg.dev/sekaictf-500215/challenge-registry
28

29
domains:
30
  static: chals.sekai.team
31
  instancer: instancer.sekai.team
32

33
rctf:
34
  baseUrl: 'https://ctf.sekai.team'
35
  teamToken:
36
    secret: token
37

38
templates:
39
  challengeDescription: |
40
    {{ challenge.description }}
41

42
    {{ endpoints_rendered.strip() }}

1
challenges:
2
  - category: misc
3
    name: Survey
4
    author: SekaiCTF
5
    releaseTime: '2026-06-28T20:00:00Z'
6
    description: |
7
      This year we tried many new things compared to previous iterations, and we would love your feedback
8

9
      [https://forms.gle/KdEuEWyUxeX5CEe26](https://forms.gle/KdEuEWyUxeX5CEe26)
10
    tags:
11
      - SEKAI
12
    flags:
13
      rctf: 'SEKAI{thx_4_play1ng_sekaictf_2026!}'
14
    scoring:
15
      initialValue: 39
16
      minimumValue: 39
17
      rctf:
18
        eligibleForTiebreaks: false

1
secrets:
2
  minions-rctf-secret:
3
    env: MINIONS_RCTF_SECRET

1
challenges:
2
  - overrideId: game_minions-in-16k
3
    category: game
4
    name: Minions in 16k
5
    author: mixy1
6
    scoring:
7
      rctf:
8
        kind: dynamic
9
        dynamic:
10
          secret:
11
            secret: minions-rctf-secret

1
challenges:
2
  - category: misc
3
    name: pwnable document fabricator
4
    author: SekaiCTF
5
    description: |
6
      yep it's another web challenge.
7
    attachments:
8
      files:
9
        - "challenge/"
10
      exclude:
11
        - "challenge/readflag.c"
12
      additional:
13
        - path: readflag.c
14
          strContent: |
15
            #include <stdio.h>
16
            int main() { printf("SEKAI{dummy_flag}"); }
17
      stripComponents: 1
18
    flags:
19
      rctf: SEKAI{example}
20
    instancerConfig:
21
      instancer: k8s
22
      challengeIntegrationId: pwnable-doc
23
      timeoutMilliseconds: 1800000
24
      expose:
25
        - kind: https
26
          hostPrefix: pwnable-doc
27
          containerName: app
28
          containerPort: 8080
29
      config:
30
        pods:
31
          - name: app
32
            egress: false
33
            ports:
34
              - protocol: TCP
35
                port: 8080
36
            spec:
37
              restartPolicy: Always
38
              terminationGracePeriodSeconds: 0
39
              automountServiceAccountToken: false
40
              enableServiceLinks: false
41
              containers:
42
                - name: app
43
                  image: "{{ images['pwnable-doc'] }}"
44
                  ports:
45
                    - containerPort: 8080
46
                  volumeMounts:
47
                    - name: tmp
48
                      mountPath: /tmp
49
                  resources:
50
                    requests: { cpu: 100m, memory: 128Mi }
51
                    limits: { cpu: 500m, memory: 512Mi }
52
                  readinessProbe:
53
                    tcpSocket: { port: 8080 }
54
                    initialDelaySeconds: 5
55
                    periodSeconds: 3
56
                  securityContext:
57
                    allowPrivilegeEscalation: false
58
                    readOnlyRootFilesystem: true
59
                    capabilities:
60
                      drop: ["ALL"]
61
              volumes:
62
                - name: tmp
63
                  emptyDir:
64
                    medium: Memory
65
                    sizeLimit: 512Mi
66

67
deployment:
68
  images:
69
    - path: challenge
70
      name: pwnable-doc
71
      tag: latest
72
      registryName: instancer-challenges
73
      platform: linux/amd64

1
challenges:
2
  - category: web
3
    name: '<\w+'
4
    author: claustra01
5
    adminBot:
6
      code: |
7
        import { Challenge } from '../src/types'
8

9
        const APP_HOST = '{{"ltw." + config.domains['static']}}'
10
        const APP_URL = `https://${APP_HOST}`
11

12
        export const challenge = new Challenge({
13
          timeoutMilliseconds: 30_000,
14
          inputs: {
15
            id: {
16
              pattern: '^[0-9a-fA-F-]{36}$',
17
            },
18
          },
19
          browser: 'chrome',
20
          restrictDomains: {
21
            host: {
22
              allowRegex: [{ pattern: '^{{("ltw." + config.domains['static']) | re_escape}}$' }],
23
              disallowRegex: [{ pattern: '.*' }],
24
            },
25
          },
26
        })

1
name: Deploy challenges
2

3
on:
4
  push:
5
    branches: [main]
6

7
permissions:
8
  contents: read
9
  id-token: write
10

11
jobs:
12
  detect:
13
    runs-on: ubuntu-latest
14
    outputs:
15
      matrix: ${{ steps.detect.outputs.matrix }}
16
      should_sync: ${{ steps.detect.outputs.should-sync }}
17
    steps:
18
      - uses: actions/checkout@v6
19
      - uses: project-sekai-ctf/konata-deploy-action/detect@main
20
        id: detect
21

22
  sync:
23
    needs: detect
24
    if: needs.detect.outputs.should_sync == 'true'
25
    runs-on: ubuntu-latest
26
    env:
27
      USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
28
    strategy:
29
      matrix:
30
        challenge: ${{ fromJson(needs.detect.outputs.matrix) }}
31
      fail-fast: false
32
    steps:
33
      - uses: actions/checkout@v6
34

35
      - name: Authenticate to Google Cloud
36
        uses: google-github-actions/auth@v3
37
        with:
38
          project_id: sekaictf-500215
39
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
40
          service_account: ${{ secrets.SERVICE_ACCOUNT }}
41

42
      - name: Activate Google Cloud SDK credentials
43
        run: |
44
          gcloud auth login --brief --cred-file="${GOOGLE_GHA_CREDS_PATH}"
45
          gcloud config set project sekaictf-500215
46

47
      - name: Install gke-gcloud-auth-plugin
48
        run: |
49
          curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --batch --dearmor -o /usr/share/keyrings/cloud.google.gpg
50
          echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | sudo tee /etc/apt/sources.list.d/google-cloud-sdk.list > /dev/null
51
          sudo apt-get update -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/google-cloud-sdk.list -o Dir::Etc::sourceparts="-"
52
          sudo apt-get install -yq --no-install-recommends google-cloud-cli-gke-gcloud-auth-plugin
53

54
      - name: Configure Docker for Artifact Registry
55
        run: gcloud auth configure-docker europe-west1-docker.pkg.dev,us-central1-docker.pkg.dev --quiet
56

57
      - uses: docker/setup-qemu-action@v3
58
        with:
59
          platforms: arm64
60

61
      - uses: project-sekai-ctf/konata-deploy-action/sync@main
62
        with:
63
          challenge-path: ${{ matrix.challenge }}
64
        env:
65
          RCTF_TOKEN: ${{ secrets.RCTF_TOKEN }}
66
          MINIONS_QUEUE_SECRET: ${{ secrets.MINIONS_QUEUE_SECRET }}
67
          MINIONS_RCTF_SECRET: ${{ secrets.MINIONS_RCTF_SECRET }}
68
          MINIONS_RCTF_API_GSA: ${{ secrets.MINIONS_RCTF_API_GSA }}
69
          MINIONS_RCTF_API_IP: ${{ secrets.MINIONS_RCTF_API_IP }}
70
          MINIONS_K8S_INSTANCER_API_URL: ${{ secrets.MINIONS_K8S_INSTANCER_API_URL }}
71
          MINIONS_K8S_INSTANCER_AUTH_TOKEN: ${{ secrets.MINIONS_K8S_INSTANCER_AUTH_TOKEN }}
72
          MINIONS_K8S_INSTANCER_CA_CERTIFICATE: ${{ secrets.MINIONS_K8S_INSTANCER_CA_CERTIFICATE }}
73
          MINIONS_GCS_BUCKET: ${{ secrets.MINIONS_GCS_BUCKET }}
74
          PPFARMING_API_IP: ${{ secrets.PPFARMING_API_IP }}
75
          PPFARMING_API_TOKEN: ${{ secrets.PPFARMING_API_TOKEN }}
76
          PPFARMING2_API_IP: ${{ secrets.PPFARMING2_API_IP }}
77
          PPFARMING2_API_TOKEN: ${{ secrets.PPFARMING2_API_TOKEN }}