apiVersion: k3d.io/v1alpha5
kind: Simple
metadata:
  name: security-baseline-ci

# CI only needs one control-plane node for the K3s CIS scan. Keeping agents
# out of this disposable job avoids unnecessary Docker resource pressure on
# shared GitHub or Gitea runners.
servers: 1
agents: 0

options:
  k3s:
    extraArgs:
      - arg: --disable=traefik
        nodeFilters:
          - server:*
  k3d:
    wait: true
    timeout: 180s
  kubeconfig:
    updateDefaultKubeconfig: true
    switchCurrentContext: true