# CKS mock cluster — 1 control-plane + 2 workers, k8s v1.35
# Pinned digest from kind v0.32.0 (default 1.36) — we force 1.35.5 to match the exam.
# If `kind load`/image pull complains, use kind >= v0.32.0.
#
# CNI is Cilium (installed by bootstrap.sh), not kindnet — see networking: below.
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
name: cks
networking:
  disableDefaultCNI: true     # no kindnet — Cilium takes over, and it enforces NetworkPolicy deterministically
  kubeProxyMode: none         # Cilium eBPF kube-proxy replacement (no kube-proxy DaemonSet)
  podSubnet: "10.244.0.0/16"  # Cilium runs with ipam.mode=kubernetes, honoring this
  serviceSubnet: "10.96.0.0/16"
nodes:
  - role: control-plane
    image: kindest/node:v1.35.5@sha256:ce977ae6d65918d0b58a5f8b5e940429c2ce42fa3a5619ec2bbc60b949c0ac95
    extraMounts:
      # host dir for audit policy / encryption config / admission config you'll author on the VM
      - hostPath: ./exam-files
        containerPath: /etc/kubernetes/exam
    extraPortMappings:
      # ingress-nginx's kind provider manifest hostPorts — Task 2 (TLS Ingress) needs 80/443 reachable
      - containerPort: 80
        hostPort: 80
        protocol: TCP
      - containerPort: 443
        hostPort: 443
        protocol: TCP
      # so you can curl the Ingress task from the VM via NodePort too, if you set one up
      - containerPort: 30443
        hostPort: 30443
        protocol: TCP
  - role: worker
    image: kindest/node:v1.35.5@sha256:ce977ae6d65918d0b58a5f8b5e940429c2ce42fa3a5619ec2bbc60b949c0ac95
  - role: worker
    image: kindest/node:v1.35.5@sha256:ce977ae6d65918d0b58a5f8b5e940429c2ce42fa3a5619ec2bbc60b949c0ac95