[core] Add configuration file

[Minosity-VR]

What does this PR do?

Enhancement

Add a config file to customise the attack techniques, specifically the Kubernetes ones by passing config overrides to the deployed terraform resources.

The config file is entirely optional. If not set by the user, no config file is created, no terraform variables are passed to the state manager, no variable files are persisted to disk...

Motivation

When running Stratus Red Team in a Kubernetes cluster, it uses the user's identity. The user may not have the permission to create a namespace, blocking all k8s attacks that need a place to deploy a pod at warmup step.

The objective of this PR is to allow the user to target an existing namespace to deploy the pods.
We stay close to the Stratus Red Team philosophy of "The attack technique makes no assumption about the state of the environment prior to warming it up" because the only expectation is an existing namespace which is not 'volatile' (it's not much more than expecting the cluster to actually be there). We do not allow to directly target a pod though, as assuming anything on a k8s object that is ephemeral by design would go against this principle.

This also adds the possibility to customise pods images/labels/tolerations/node_placement - some clusters have given Node Groups, Cilium Network Policies, Container registry policies... that require those values to be set for the pod to be correctly scheduled and started.

Changes

• Add the support for a config.yaml file. This file can be set in <stratus_root>/config.yaml (stratus_root is ~/.stratus-red-team/ by default), or pointed by the env var STRATUS_CONFIG_PATH.
• Modify the Kubernetes attack technique terraform files to accept variables from the config file, in particular the namespace variable. If set, SRT will not try to create a new namespace for the attacks, but use the provided one.
• Add variables to control the created pods spec - possibility to define default variables or attack-specific variables

The config code is meant to be platform agnostic - the only parts that needs to be set platform by platform are the override system and the conversion to a go object to be used in the code directly.

For instance for k8s:

• there is a default key and a techniques key. If a key exists in both subsets, the technique one overrides the default one
• some elements of the config are extracted to a K8sPodConfig structure to be applied in the code directly, as some attack do not create the resource with terraform but directly with an API call and require this information.

There is no constraint on what is set in the config file, as long as it's valid yaml. The source of truth and reference for the variable used in an attack is the TerraformOverrideConfig array.

If a terraform file defines a config variable and expect it to be filled by the config, it must declare it in its TerraformOverrideConfig.

Example

If I try to run Stratus Red Team in a cluster where I don't have the permission to create namespaces, I will have the following error:

./bin/stratus detonate k8s.privilege-escalation.privileged-pod
2026/02/26 17:16:41 Checking your authentication against kubernetes
2026/02/26 17:16:45 Warming up k8s.privilege-escalation.privileged-pod
2026/02/26 17:16:45 Initializing Terraform to spin up technique prerequisites
2026/02/26 17:16:51 Applying Terraform to spin up technique prerequisites
2026/02/26 17:16:54 Error during warm up. Cleaning up technique prerequisites with terraform destroy
2026/02/26 17:16:55 unable to run terraform apply on prerequisite: unable to apply Terraform: exit status 1

Error: namespaces is forbidden: User "simon.marechal@datadoghq.com" cannot create resource "namespaces" in API group "" at the cluster scope

But if I create a config file specifying a namespace I control where I am allowed to deploy pods:

STRATUS_CONFIG_PATH=/Users/simon.marechal/stratus/config.yaml ./bin/stratus detonate k8s.privilege-escalation.
privileged-pod
2026/02/26 17:17:08 Checking your authentication against kubernetes
2026/02/26 17:17:11 Warming up k8s.privilege-escalation.privileged-pod
2026/02/26 17:17:11 Applying Terraform to spin up technique prerequisites
2026/02/26 17:17:12 Namespace stratus-training ready
2026/02/26 17:17:13 Creating privileged pod k8s.privilege-escalation.privileged-pod
2026/02/26 17:17:13 Privileged pod k8s.privilege-escalation.privileged-pod created in namespace stratus-training

QA Instructions

• make test
• docker build .
• terraform fmt -recursive -check in v2/internal/attacktechniques - skipped, not relevant
• stratus detonate works with or without config file