swaphb/kubernetes-security-baseline-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

consolidate Flatcar provisioning priorities
Kube-bench CIS scan / Scan ephemeral K3s cluster (push) Successful in 1m1s
Details

Browse Source
This commit is contained in:
swaphb
2026-08-16 14:40:43 -04:00
parent 20ff222531
commit 88e735109f
1 changed files with 13 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO.md
+13 -13
View File
@@ -125,18 +125,7 @@ still needs a clean kube-proxy-free cluster validation.
Ansible Vault data, and any locally stored cluster credentials. Ansible Vault data, and any locally stored cluster credentials.
- [ ] Add a lifecycle checklist suitable for interviews and portfolio review. - [ ] Add a lifecycle checklist suitable for interviews and portfolio review.
## Priority 5: Terraform and cloud path ## Priority 4b: Proxmox Terraform infrastructure path
- [ ] Pass Terraform outputs into Ansible inventory generation.
- [ ] Keep cloud credentials, AMI IDs, SSH keys, and network ranges outside
committed files.
- [ ] Add a documented command sequence for Terraform apply followed by the
Ansible bootstrap playbook.
- [ ] Add a documented destroy path and state storage guidance.
- [ ] Add validation that the cloud host exposes the CPU features required by
Falco and modern eBPF.
## Priority 5a: Proxmox Terraform infrastructure path
- [ ] Add `terraform/proxmox/` using the `bpg/proxmox` provider. - [ ] Add `terraform/proxmox/` using the `bpg/proxmox` provider.
- [ ] Pin a reviewed provider version and document the Proxmox VE version - [ ] Pin a reviewed provider version and document the Proxmox VE version
@@ -162,7 +151,7 @@ still needs a clean kube-proxy-free cluster validation.
- [ ] Document the required Proxmox storage content types, API permissions, - [ ] Document the required Proxmox storage content types, API permissions,
SSH access, and node prerequisites. SSH access, and node prerequisites.
## Priority 5b: Terraform to Ansible handoff ## Priority 4c: Terraform to Ansible handoff
The Proxmox Terraform path should hand off to the existing Ansible bootstrap The Proxmox Terraform path should hand off to the existing Ansible bootstrap
automatically after the VM is reachable. Terraform owns infrastructure automatically after the VM is reachable. Terraform owns infrastructure
@@ -208,6 +197,17 @@ will be documented as an optional convenience for the Proxmox path, because it
also means Terraform runs can be longer and Ansible execution metadata may be also means Terraform runs can be longer and Ansible execution metadata may be
stored in state depending on provider configuration. stored in state depending on provider configuration.
## Priority 5: Terraform and cloud path
- [ ] Pass Terraform outputs into Ansible inventory generation.
- [ ] Keep cloud credentials, AMI IDs, SSH keys, and network ranges outside
committed files.
- [ ] Add a documented command sequence for Terraform apply followed by the
Ansible bootstrap playbook.
- [ ] Add a documented destroy path and state storage guidance.
- [ ] Add validation that the cloud host exposes the CPU features required by
Falco and modern eBPF.
## Priority 6: Documentation and portfolio evidence ## Priority 6: Documentation and portfolio evidence
- [ ] Update the root README after each automation milestone. - [ ] Update the root README after each automation milestone.