first commit

README.md

@@ -0,0 +1,38 @@
+# Kubernetes Security Baseline
+
+An auditable, GitOps-managed Kubernetes security baseline: local k3d for a
+fast reproducible demo, optional Terraform + Ansible for a cloud K3s host, CIS
+Benchmark checks in CI, Kyverno admission policies, and Falco runtime
+detection.
+
+## Phase 1: provision a local cluster
+
+The primary quick-start path requires Docker, k3d, and kubectl:
+
+```bash
+k3d cluster create --config local-quickstart/k3d-cluster-config.yaml
+kubectl get nodes -o wide
+```
+
+Expected result: one server and two agent nodes in `Ready` state. The bundled
+Traefik is disabled so later ArgoCD-managed components own add-ons explicitly.
+
+Delete the lab with `k3d cluster delete security-baseline`.
+
+## Production-style option
+
+`terraform/cloud-cluster/` and `ansible/bootstrap-k3s.yml` provide an optional,
+documented AWS path. It requires your own AWS credentials, an existing EC2 key
+pair, an Ubuntu AMI ID for the chosen region, and a tightly scoped admin CIDR.
+It is not needed for the portfolio demo and is not run in CI.
+
+## Build status
+
+- [x] Phase 1: local k3d definition and optional Terraform/Ansible path
+- [ ] Phase 2: ArgoCD app-of-apps deployment (scaffolded; runtime verification pending)
+- [ ] Phase 3: kube-bench CI scan
+- [ ] Phase 4: Kyverno policy set and CIS mapping
+- [ ] Phase 5: Falco rules and webhook alerting
+- [ ] Phase 6: test workloads and evidence capture
+- [ ] Phase 7: architecture/design documentation
+- [ ] Phase 8: final portfolio polish