add environment-specific cilium profiles
Kube-bench CIS scan / Scan ephemeral K3s cluster (push) Successful in 1m3s
Kube-bench CIS scan / Scan ephemeral K3s cluster (push) Successful in 1m3s
This commit is contained in:
@@ -19,6 +19,12 @@
|
||||
- cilium_k8s_service_port | int > 0
|
||||
fail_msg: Set cilium_k8s_service_host and cilium_k8s_service_port for kube-proxy replacement.
|
||||
|
||||
- name: Require a supported Cilium profile
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- cilium_profile in ['k3d', 'flatcar-k3s']
|
||||
fail_msg: cilium_profile must be k3d or flatcar-k3s.
|
||||
|
||||
- name: Verify kube-proxy is disabled
|
||||
ansible.builtin.raw: "{{ k3d_tool_dir }}/kubectl -n kube-system get daemonset kube-proxy"
|
||||
become_user: "{{ k3d_user }}"
|
||||
@@ -47,7 +53,8 @@
|
||||
{{ k3d_tool_dir }}/helm upgrade --install cilium cilium/cilium
|
||||
--namespace {{ cilium_namespace }}
|
||||
--version {{ cilium_chart_version }}
|
||||
--values {{ cilium_values_file }}
|
||||
--values {{ cilium_common_values_file }}
|
||||
--values {{ cilium_profile_values_file }}
|
||||
--set kubeProxyReplacement=true
|
||||
--set k8sServiceHost={{ cilium_k8s_service_host }}
|
||||
--set k8sServicePort={{ cilium_k8s_service_port }}
|
||||
|
||||
Reference in New Issue
Block a user