apiVersion: k3d.io/v1alpha5
kind: Simple
metadata:
  name: security-baseline-cilium

# This is an advanced local profile. The standard k3d profile remains the
# lowest-friction quick start and keeps Flannel enabled.
servers: 1
agents: 2

options:
  k3s:
    extraArgs:
      - arg: --flannel-backend=none
        nodeFilters:
          - server:*
      - arg: --disable-network-policy
        nodeFilters:
          - server:*
      - arg: --disable-kube-proxy
        nodeFilters:
          - server:*
      # Include both the external Flatcar address and the internal k3d server
      # address so workstation and in-cluster API clients pass TLS validation.
      - arg: --tls-san=K3D_EXTERNAL_API_SERVER_IP
        nodeFilters:
          - server:*
      - arg: --tls-san=K3D_INTERNAL_API_SERVER_IP
        nodeFilters:
          - server:*
      - arg: --disable=traefik
        nodeFilters:
          - server:*
  k3d:
    wait: true
    timeout: 180s
  kubeconfig:
    updateDefaultKubeconfig: true
    switchCurrentContext: true