Files
kubernetes-security-baselin…/scripts/proxmox/k3d-test-host.md
T
swaphb 2bd22db276
Kube-bench CIS scan / Scan ephemeral K3s cluster (push) Successful in 1m37s
add Flatcar k3d security test host
2026-08-14 21:47:10 -04:00

1.3 KiB

Flatcar k3d test host

create-flatcar-k3d-test-host.sh creates a dedicated Flatcar VM for Linux k3d testing. It is separate from the Gitea runner and does not receive a runner registration token or a repository credential.

The default profile is 4 CPU cores, 16 GiB memory, and a 100 GiB disk. The Ignition configuration enables Docker, creates /opt/k3d-test/workspace, and installs pinned k3d and kubectl binaries on first boot.

Enable snippets on the Proxmox storage first:

pvesm set local --content iso,vztmpl,backup,snippets

Create the VM:

VM_ID=9101 \
SSH_PUBLIC_KEY="$(cat ~/.ssh/id_ed25519.pub)" \
DISK_STORAGE=pve1_nvme \
SNIPPET_STORAGE=local \
bash create-flatcar-k3d-test-host.sh

After the VM receives a DHCP address:

ssh core@<vm-ip> 'systemctl status docker k3d-test-tools --no-pager'
ssh core@<vm-ip> 'k3d version && kubectl version --client'

Clone the repository into the test workspace, then run the project tests from the Flatcar host. The Docker socket remains local to this VM, so the MacBook only acts as the SSH operator workstation.

The VM is intentionally dedicated to disposable security testing. Do not run untrusted workloads or unrelated services on it. k3d creates K3s nodes as Docker containers, so the host still has broad control over the test cluster.