kubernetes-security-baseline-lab/ansible/README.md

Optional Ansible bootstrap

The playbook applies a small host baseline (AppArmor, unattended security updates, swap removal, and SSH hardening) and installs a pinned K3s server. It is intentionally separate from the local k3d path so the portfolio can be run without cloud credentials.

cp inventory.example.yml inventory.yml
# Replace the Terraform public IP and local SSH key path.
ansible-playbook -i inventory.yml bootstrap-k3s.yml

Before production use, review the pinned K3s version and extend the playbook for your organization’s OS baseline, firewall model, HA topology, and secret management. RKE2 can replace K3s here if the target environment requires it.