first commit

local-quickstart/README.md

@@ -0,0 +1,21 @@
+# Local quick start
+
+Prerequisites: Docker, `k3d`, and `kubectl`.
+
+Create the cluster and verify all nodes become Ready:
+
+```bash
+k3d cluster create --config local-quickstart/k3d-cluster-config.yaml
+kubectl config use-context k3d-security-baseline
+kubectl get nodes -o wide
+```
+
+The config creates one server and two agents and disables the bundled Traefik
+so later GitOps components own the cluster add-ons explicitly.
+
+To remove the local cluster:
+
+```bash
+k3d cluster delete security-baseline
+```
+

local-quickstart/k3d-cluster-config.yaml

@@ -0,0 +1,33 @@
+apiVersion: k3d.io/v1alpha5
+kind: Simple
+metadata:
+  name: security-baseline
+
+# The default path is intentionally small enough for a laptop, while still
+# exercising a server/agent topology rather than a single-node shortcut.
+servers: 1
+agents: 2
+
+options:
+  k3s:
+    # Keep the local cluster focused on the security stack. Ingress can be
+    # added later without changing the cluster definition.
+    extraArgs:
+      - arg: --disable=traefik
+        nodeFilters:
+          - server:*
+  k3d:
+    wait: true
+    timeout: 120s
+  kubeconfig:
+    updateDefaultKubeconfig: true
+    switchCurrentContext: true
+
+ports:
+  - port: 8080:80
+    nodeFilters:
+      - loadbalancer
+  - port: 8443:443
+    nodeFilters:
+      - loadbalancer
+