From 8934ea95a47e9423a9464d22099dd5b2f8dab5ab Mon Sep 17 00:00:00 2001
From: swaphb <s@swaphb.com>
Date: Sun, 9 Aug 2026 22:01:11 -0400
Subject: [PATCH] Use lightweight cluster topology in CI

---
 .github/workflows/kube-bench-scan.yml |  3 +--
 ci/README.md                          |  9 ++++++---
 ci/k3d-ci-cluster-config.yaml         | 24 ++++++++++++++++++++++++
 3 files changed, 31 insertions(+), 5 deletions(-)
 create mode 100644 ci/k3d-ci-cluster-config.yaml

diff --git a/.github/workflows/kube-bench-scan.yml b/.github/workflows/kube-bench-scan.yml
index 600d6fe..af56988 100644
--- a/.github/workflows/kube-bench-scan.yml
+++ b/.github/workflows/kube-bench-scan.yml
@@ -23,7 +23,7 @@ jobs:
 
       - name: Create ephemeral K3s cluster
         run: |
-          k3d cluster create --config local-quickstart/k3d-cluster-config.yaml
+          k3d cluster create --config ci/k3d-ci-cluster-config.yaml
           kubectl wait --for=condition=Ready nodes --all --timeout=180s
           kubectl get nodes -o wide
 
@@ -74,4 +74,3 @@ jobs:
       - name: Delete ephemeral cluster
         if: always()
         run: k3d cluster delete security-baseline
-
diff --git a/ci/README.md b/ci/README.md
index 89dfd7e..f2f8b8f 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -6,8 +6,12 @@ read-only host mounts because the CIS checks inspect processes, permissions,
 and node configuration. The job is intentionally separate from the ArgoCD
 application tree so the scanner cannot become part of the workload baseline.
 
-GitHub Actions creates the local cluster, runs the job, stores the JSON report,
-and prints pass, warn, and fail totals in the workflow summary. The workflow
+GitHub Actions creates a disposable one-server K3s cluster, runs the job,
+stores the JSON report, and prints pass, warn, and fail totals in the workflow
+summary. The CI topology is intentionally smaller than the developer
+quick-start topology so it remains reliable on shared runners.
+
+The workflow
 fails if the scanner job or report generation fails. It does not yet fail on
 CIS findings because a vanilla K3d cluster is expected to produce findings;
 later hardening phases can turn selected controls into merge gates.
@@ -55,4 +59,3 @@ docker run -d \
 Mounting the Docker socket gives workflow jobs substantial control over the
 runner host. Use a dedicated disposable runner, restrict its repository scope,
 and avoid placing unrelated credentials on that host.
-
diff --git a/ci/k3d-ci-cluster-config.yaml b/ci/k3d-ci-cluster-config.yaml
new file mode 100644
index 0000000..367f461
--- /dev/null
+++ b/ci/k3d-ci-cluster-config.yaml
@@ -0,0 +1,24 @@
+apiVersion: k3d.io/v1alpha5
+kind: Simple
+metadata:
+  name: security-baseline-ci
+
+# CI only needs one control-plane node for the K3s CIS scan. Keeping agents
+# out of this disposable job avoids unnecessary Docker resource pressure on
+# shared GitHub or Gitea runners.
+servers: 1
+agents: 0
+
+options:
+  k3s:
+    extraArgs:
+      - arg: --disable=traefik
+        nodeFilters:
+          - server:*
+  k3d:
+    wait: true
+    timeout: 180s
+  kubeconfig:
+    updateDefaultKubeconfig: true
+    switchCurrentContext: true
+