add Flatcar k3d security test host

2026-08-14 21:47:10 -04:00
parent e79045712d
commit 2bd22db276
3 changed files with 259 additions and 0 deletions
@@ -0,0 +1,40 @@
+# Flatcar k3d test host
+
+`create-flatcar-k3d-test-host.sh` creates a dedicated Flatcar VM for Linux
+k3d testing. It is separate from the Gitea runner and does not receive a
+runner registration token or a repository credential.
+
+The default profile is 4 CPU cores, 16 GiB memory, and a 100 GiB disk. The
+Ignition configuration enables Docker, creates `/opt/k3d-test/workspace`, and
+installs pinned k3d and kubectl binaries on first boot.
+
+Enable snippets on the Proxmox storage first:
+
+```bash
+pvesm set local --content iso,vztmpl,backup,snippets
+```
+
+Create the VM:
+
+```bash
+VM_ID=9101 \
+SSH_PUBLIC_KEY="$(cat ~/.ssh/id_ed25519.pub)" \
+DISK_STORAGE=pve1_nvme \
+SNIPPET_STORAGE=local \
+bash create-flatcar-k3d-test-host.sh
+```
+
+After the VM receives a DHCP address:
+
+```bash
+ssh core@<vm-ip> 'systemctl status docker k3d-test-tools --no-pager'
+ssh core@<vm-ip> 'k3d version && kubectl version --client'
+```
+
+Clone the repository into the test workspace, then run the project tests from
+the Flatcar host. The Docker socket remains local to this VM, so the MacBook
+only acts as the SSH operator workstation.
+
+The VM is intentionally dedicated to disposable security testing. Do not run
+untrusted workloads or unrelated services on it. k3d creates K3s nodes as
+Docker containers, so the host still has broad control over the test cluster.