58 lines
2.4 KiB
Markdown
58 lines
2.4 KiB
Markdown
# Kubernetes Security Baseline
|
|
|
|
An auditable, GitOps-managed Kubernetes security baseline: local k3d for a
|
|
fast reproducible demo, optional Flatcar plus Terraform and Ansible for a cloud
|
|
K3s host, Cilium eBPF networking, CIS Benchmark checks in CI, Kyverno
|
|
admission policies, and Falco runtime detection.
|
|
|
|
## Repository layout
|
|
|
|
Deployment and GitOps configuration is grouped under `deployments/`:
|
|
|
|
```text
|
|
deployments/
|
|
├── argocd/ # app-of-apps and child Application definitions
|
|
├── cilium/ # Cilium Helm values for the optional kube-proxy-free path
|
|
└── falco/ # Falco Operator values and custom resource definitions
|
|
```
|
|
|
|
The platform payloads remain separate from their deployment definitions. Kyverno
|
|
policies live under `policies/`, runtime demonstration workloads live under
|
|
`test-workloads/`, and cluster provisioning code remains under `terraform/`,
|
|
`ansible/`, and `local-quickstart/`.
|
|
|
|
## Phase 1: provision a local cluster
|
|
|
|
The primary quick-start path requires Docker, k3d, and kubectl:
|
|
|
|
```bash
|
|
k3d cluster create --config local-quickstart/k3d-cluster-config.yaml
|
|
kubectl get nodes -o wide
|
|
```
|
|
|
|
Expected result: one server and two agent nodes in `Ready` state. The bundled
|
|
Traefik is disabled so later ArgoCD-managed components own add-ons explicitly.
|
|
|
|
Delete the lab with `k3d cluster delete security-baseline`.
|
|
|
|
## Production-style option
|
|
|
|
`terraform/cloud-cluster/` and `ansible/bootstrap-k3s.yml` provide an optional,
|
|
documented AWS path. It uses Flatcar as the host OS, disables Flannel and
|
|
kube-proxy, and installs Cilium as the CNI and eBPF service datapath. It
|
|
requires your own AWS credentials, an existing EC2 key pair, a Flatcar AMI ID
|
|
for the chosen region, and a tightly scoped admin CIDR.
|
|
It is not needed for the portfolio demo and is not run in CI.
|
|
|
|
## Build status
|
|
|
|
- [x] Phase 1: local k3d definition and optional Terraform/Ansible path
|
|
- [ ] Phase 2: ArgoCD app-of-apps deployment (scaffolded; runtime verification pending)
|
|
- [x] Phase 3: kube-bench CI scan
|
|
- [ ] Architecture revision: Flatcar hosts and Cilium kube-proxy replacement (configured; runtime verification pending)
|
|
- [ ] Phase 4: Kyverno policy set and CIS mapping (configured; runtime verification pending)
|
|
- [ ] Phase 5: Falco rules and webhook alerting
|
|
- [ ] Phase 6: test workloads and evidence capture
|
|
- [ ] Phase 7: architecture/design documentation
|
|
- [ ] Phase 8: final portfolio polish
|