Kubernetes Instance Manager Operator for CTF challenges

---

KIMO runs CTF challenges as on-demand containers on Kubernetes. Each instance gets a TTL, health monitoring, and its own network isolation. A REST API (with optional proof-of-work gating) lets players spin up instances, and a pluggable backend layer notifies your scoring platform — CTFd supported out of the box, anything else via a generic HMAC webhook.

Full documentation: https://kimo-ctf.github.io/kimo/

Install

Requires a Kubernetes cluster, kubectl, and Helm 3.

git clone https://github.com/kimo-ctf/kimo.git
cd kimo
helm install kimo helm/kimo/

This installs the CRDs and the operator with the default generic backend. For CTFd:

helm install kimo helm/kimo/ -f config/samples/values-ctfd-backend.yaml

Quick start

# A working demo challenge (secret + template) and one instance of it
kubectl apply -f config/samples/kimo_v1alpha1_challengetemplate.yaml
kubectl apply -f config/samples/kimo_v1alpha1_challengeinstance.yaml

kubectl get challengeinstances -w

The instance moves Pending → Creating → Running once its pod passes the readiness check, and is torn down automatically when its TTL expires.

How it works

• ChallengeTemplate — defines a challenge: image, ports, flag secret, TTL, resource limits, PoW settings.
• ChallengeInstance — one running copy for a team/player. KIMO creates the Deployment, Service, and a NetworkFence for it.
• ChallengeSet — groups challenges and activates them on a schedule.
• NetworkFence — per-instance NetworkPolicy: deny by default, only exposed ports reachable.

Development

No local toolchain needed — everything runs in a container:

hack/dev.sh go test ./...   # build/test via the dev container
hack/kind.sh                # local kind cluster

License

Apache 2.0