Add Flatcar and Cilium kube-proxy-free architecture

README.md

@@ -1,9 +1,9 @@
 # Kubernetes Security Baseline
 
 An auditable, GitOps-managed Kubernetes security baseline: local k3d for a
-fast reproducible demo, optional Terraform + Ansible for a cloud K3s host, CIS
-Benchmark checks in CI, Kyverno admission policies, and Falco runtime
-detection.
+fast reproducible demo, optional Flatcar plus Terraform and Ansible for a cloud
+K3s host, Cilium eBPF networking, CIS Benchmark checks in CI, Kyverno
+admission policies, and Falco runtime detection.
 
 ## Phase 1: provision a local cluster
 
@@ -22,8 +22,10 @@ Delete the lab with `k3d cluster delete security-baseline`.
 ## Production-style option
 
 `terraform/cloud-cluster/` and `ansible/bootstrap-k3s.yml` provide an optional,
-documented AWS path. It requires your own AWS credentials, an existing EC2 key
-pair, an Ubuntu AMI ID for the chosen region, and a tightly scoped admin CIDR.
+documented AWS path. It uses Flatcar as the host OS, disables Flannel and
+kube-proxy, and installs Cilium as the CNI and eBPF service datapath. It
+requires your own AWS credentials, an existing EC2 key pair, a Flatcar AMI ID
+for the chosen region, and a tightly scoped admin CIDR.
 It is not needed for the portfolio demo and is not run in CI.
 
 ## Build status
@@ -31,6 +33,7 @@ It is not needed for the portfolio demo and is not run in CI.
 - [x] Phase 1: local k3d definition and optional Terraform/Ansible path
 - [ ] Phase 2: ArgoCD app-of-apps deployment (scaffolded; runtime verification pending)
 - [x] Phase 3: kube-bench CI scan
+- [ ] Architecture revision: Flatcar hosts and Cilium kube-proxy replacement (configured; runtime verification pending)
 - [ ] Phase 4: Kyverno policy set and CIS mapping
 - [ ] Phase 5: Falco rules and webhook alerting
 - [ ] Phase 6: test workloads and evidence capture