1.8 KiB
Kubernetes Security Baseline
An auditable, GitOps-managed Kubernetes security baseline: local k3d for a fast reproducible demo, optional Flatcar plus Terraform and Ansible for a cloud K3s host, Cilium eBPF networking, CIS Benchmark checks in CI, Kyverno admission policies, and Falco runtime detection.
Phase 1: provision a local cluster
The primary quick-start path requires Docker, k3d, and kubectl:
k3d cluster create --config local-quickstart/k3d-cluster-config.yaml
kubectl get nodes -o wide
Expected result: one server and two agent nodes in Ready state. The bundled
Traefik is disabled so later ArgoCD-managed components own add-ons explicitly.
Delete the lab with k3d cluster delete security-baseline.
Production-style option
terraform/cloud-cluster/ and ansible/bootstrap-k3s.yml provide an optional,
documented AWS path. It uses Flatcar as the host OS, disables Flannel and
kube-proxy, and installs Cilium as the CNI and eBPF service datapath. It
requires your own AWS credentials, an existing EC2 key pair, a Flatcar AMI ID
for the chosen region, and a tightly scoped admin CIDR.
It is not needed for the portfolio demo and is not run in CI.
Build status
- Phase 1: local k3d definition and optional Terraform/Ansible path
- Phase 2: ArgoCD app-of-apps deployment (scaffolded; runtime verification pending)
- Phase 3: kube-bench CI scan
- Architecture revision: Flatcar hosts and Cilium kube-proxy replacement (configured; runtime verification pending)
- Phase 4: Kyverno policy set and CIS mapping (configured; runtime verification pending)
- Phase 5: Falco rules and webhook alerting
- Phase 6: test workloads and evidence capture
- Phase 7: architecture/design documentation
- Phase 8: final portfolio polish