swaphb/kubernetes-security-baseline-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Flatcar and Cilium kube-proxy-free architecture
Kube-bench CIS scan / Scan ephemeral K3s cluster (push) Failing after 3m11s
Details

Browse Source
This commit is contained in:
swaphb
2026-08-10 17:19:18 -04:00
parent 8934ea95a4
commit fc786ec63c
10 changed files with 194 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/cloud-cluster/README.md
+4 -4
View File
@@ -1,10 +1,10 @@
# Optional production-style path
This directory provisions one encrypted Ubuntu EC2 host with a deliberately
This directory provisions one encrypted Flatcar EC2 host with a deliberately
small network surface. It is a scaffold for the documented cloud path; the
local k3d path remains the primary, cost-free portfolio demo.
The AWS account, region, AMI, SSH key pair, and administrator CIDR are inputs,
The AWS account, region, Flatcar AMI, SSH key pair, and administrator CIDR are inputs,
not repository values. Do not commit a real `terraform.tfvars` file or private
keys. The security group intentionally exposes SSH and the Kubernetes API only
to `admin_cidr`; add any public application ports explicitly when needed.
@@ -21,7 +21,7 @@ terraform apply
terraform output -raw public_ip
```
Then run `ansible/bootstrap-k3s.yml` against the output IP. `terraform destroy`
Then run `ansible/bootstrap-k3s.yml` against the output IP. Configure the
Cilium API endpoint before installing Cilium. `terraform destroy`
removes the lab resources when finished. This path is not required for the
portfolio demo and is not invoked by CI.