Add Flatcar and Cilium kube-proxy-free architecture

local-quickstart/cilium.md

@@ -0,0 +1,40 @@
+# Cilium local profile
+
+The standard k3d profile is the default quick start. This profile is for
+demonstrating Cilium with kube-proxy replacement.
+
+Create it with:
+
+```bash
+k3d cluster create --config local-quickstart/k3d-cilium-cluster-config.yaml
+```
+
+Before installing Cilium, set the API server endpoint in a temporary values
+file. The endpoint must be reachable directly from every node. Do not use the
+Kubernetes service VIP because kube-proxy is disabled during bootstrap.
+
+```bash
+kubectl config current-context
+kubectl get nodes -o wide
+cp cilium/cilium-values.yaml /tmp/cilium-values.yaml
+# Replace REPLACE_WITH_API_SERVER_DNS_OR_PRIVATE_IP with the reachable API endpoint.
+helm repo add cilium https://helm.cilium.io/
+helm repo update
+helm upgrade --install cilium cilium/cilium \
+  --namespace kube-system \
+  --version 1.20.0 \
+  --values /tmp/cilium-values.yaml
+kubectl -n kube-system rollout status daemonset/cilium --timeout=300s
+kubectl -n kube-system get pods -l k8s-app=cilium
+```
+
+Install ArgoCD only after Cilium is Ready. Apply
+`argocd/optional-apps/cilium.yaml` manually after the endpoint is configured;
+it is intentionally outside the root app-of-apps watched directory until the
+cluster has been bootstrapped without kube-proxy.
+
+Delete the profile with:
+
+```bash
+k3d cluster delete security-baseline-cilium
+```

local-quickstart/k3d-cilium-cluster-config.yaml

@@ -0,0 +1,32 @@
+apiVersion: k3d.io/v1alpha5
+kind: Simple
+metadata:
+  name: security-baseline-cilium
+
+# This is an advanced local profile. The standard k3d profile remains the
+# lowest-friction quick start and keeps Flannel enabled.
+servers: 1
+agents: 2
+
+options:
+  k3s:
+    extraArgs:
+      - arg: --flannel-backend=none
+        nodeFilters:
+          - server:*
+      - arg: --disable-network-policy
+        nodeFilters:
+          - server:*
+      - arg: --disable-kube-proxy
+        nodeFilters:
+          - server:*
+      - arg: --disable=traefik
+        nodeFilters:
+          - server:*
+  k3d:
+    wait: true
+    timeout: 180s
+  kubeconfig:
+    updateDefaultKubeconfig: true
+    switchCurrentContext: true
+