Use lightweight cluster topology in CI

.github/workflows/kube-bench-scan.yml

@@ -23,7 +23,7 @@ jobs:
 
       - name: Create ephemeral K3s cluster
         run: |
-          k3d cluster create --config local-quickstart/k3d-cluster-config.yaml
+          k3d cluster create --config ci/k3d-ci-cluster-config.yaml
           kubectl wait --for=condition=Ready nodes --all --timeout=180s
           kubectl get nodes -o wide
 
@@ -74,4 +74,3 @@ jobs:
       - name: Delete ephemeral cluster
         if: always()
         run: k3d cluster delete security-baseline
-

ci/README.md

@@ -6,8 +6,12 @@ read-only host mounts because the CIS checks inspect processes, permissions,
 and node configuration. The job is intentionally separate from the ArgoCD
 application tree so the scanner cannot become part of the workload baseline.
 
-GitHub Actions creates the local cluster, runs the job, stores the JSON report,
-and prints pass, warn, and fail totals in the workflow summary. The workflow
+GitHub Actions creates a disposable one-server K3s cluster, runs the job,
+stores the JSON report, and prints pass, warn, and fail totals in the workflow
+summary. The CI topology is intentionally smaller than the developer
+quick-start topology so it remains reliable on shared runners.
+
+The workflow
 fails if the scanner job or report generation fails. It does not yet fail on
 CIS findings because a vanilla K3d cluster is expected to produce findings;
 later hardening phases can turn selected controls into merge gates.
@@ -55,4 +59,3 @@ docker run -d \
 Mounting the Docker socket gives workflow jobs substantial control over the
 runner host. Use a dedicated disposable runner, restrict its repository scope,
 and avoid placing unrelated credentials on that host.
-

ci/k3d-ci-cluster-config.yaml

@@ -0,0 +1,24 @@
+apiVersion: k3d.io/v1alpha5
+kind: Simple
+metadata:
+  name: security-baseline-ci
+
+# CI only needs one control-plane node for the K3s CIS scan. Keeping agents
+# out of this disposable job avoids unnecessary Docker resource pressure on
+# shared GitHub or Gitea runners.
+servers: 1
+agents: 0
+
+options:
+  k3s:
+    extraArgs:
+      - arg: --disable=traefik
+        nodeFilters:
+          - server:*
+  k3d:
+    wait: true
+    timeout: 180s
+  kubeconfig:
+    updateDefaultKubeconfig: true
+    switchCurrentContext: true
+