apiVersion: k3d.io/v1alpha5
kind: Simple
metadata:
  name: security-baseline

# The default path is intentionally small enough for a laptop, while still
# exercising a server/agent topology rather than a single-node shortcut.
servers: 1
agents: 2

options:
  k3s:
    # Keep the local cluster focused on the security stack. Ingress can be
    # added later without changing the cluster definition.
    extraArgs:
      - arg: --disable=traefik
        nodeFilters:
          - server:*
  k3d:
    wait: true
    timeout: 120s
  kubeconfig:
    updateDefaultKubeconfig: true
    switchCurrentContext: true

ports:
  - port: 8080:80
    nodeFilters:
      - loadbalancer
  - port: 8443:443
    nodeFilters:
      - loadbalancer