Jan Novak
6f28c97319
kindnet's NetworkPolicy enforcement isn't guaranteed, undermining the Task 1 lab; Cilium (with kube-proxy replacement) enforces it deterministically. Also fixes ingress-nginx, which was silently broken: missing ingress-ready node label left the controller Pending forever, and hostPorts 80/443 were never mapped in kind-config. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
37 lines
1.6 KiB
YAML
37 lines
1.6 KiB
YAML
# CKS mock cluster — 1 control-plane + 2 workers, k8s v1.35
|
|
# Pinned digest from kind v0.32.0 (default 1.36) — we force 1.35.5 to match the exam.
|
|
# If `kind load`/image pull complains, use kind >= v0.32.0.
|
|
#
|
|
# CNI is Cilium (installed by bootstrap.sh), not kindnet — see networking: below.
|
|
kind: Cluster
|
|
apiVersion: kind.x-k8s.io/v1alpha4
|
|
name: cks
|
|
networking:
|
|
disableDefaultCNI: true # no kindnet — Cilium takes over, and it enforces NetworkPolicy deterministically
|
|
kubeProxyMode: none # Cilium eBPF kube-proxy replacement (no kube-proxy DaemonSet)
|
|
podSubnet: "10.244.0.0/16" # Cilium runs with ipam.mode=kubernetes, honoring this
|
|
serviceSubnet: "10.96.0.0/16"
|
|
nodes:
|
|
- role: control-plane
|
|
image: kindest/node:v1.35.5@sha256:ce977ae6d65918d0b58a5f8b5e940429c2ce42fa3a5619ec2bbc60b949c0ac95
|
|
extraMounts:
|
|
# host dir for audit policy / encryption config / admission config you'll author on the VM
|
|
- hostPath: ./exam-files
|
|
containerPath: /etc/kubernetes/exam
|
|
extraPortMappings:
|
|
# ingress-nginx's kind provider manifest hostPorts — Task 2 (TLS Ingress) needs 80/443 reachable
|
|
- containerPort: 80
|
|
hostPort: 80
|
|
protocol: TCP
|
|
- containerPort: 443
|
|
hostPort: 443
|
|
protocol: TCP
|
|
# so you can curl the Ingress task from the VM via NodePort too, if you set one up
|
|
- containerPort: 30443
|
|
hostPort: 30443
|
|
protocol: TCP
|
|
- role: worker
|
|
image: kindest/node:v1.35.5@sha256:ce977ae6d65918d0b58a5f8b5e940429c2ce42fa3a5619ec2bbc60b949c0ac95
|
|
- role: worker
|
|
image: kindest/node:v1.35.5@sha256:ce977ae6d65918d0b58a5f8b5e940429c2ce42fa3a5619ec2bbc60b949c0ac95
|