Jan Novak
6f28c97319
kindnet's NetworkPolicy enforcement isn't guaranteed, undermining the Task 1 lab; Cilium (with kube-proxy replacement) enforces it deterministically. Also fixes ingress-nginx, which was silently broken: missing ingress-ready node label left the controller Pending forever, and hostPorts 80/443 were never mapped in kind-config. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
62 lines
2.8 KiB
Bash
62 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
# CKS mock — cluster bootstrap. Run on your Ubuntu VM (needs docker, kind >= v0.32.0, kubectl v1.35, helm).
|
|
# CNI is Cilium (kube-proxy replacement, no kindnet, no kube-proxy) — see kind-config.yaml's networking: block.
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
cd "$HERE"
|
|
|
|
# ---- pinned versions ----
|
|
CILIUM_VERSION="1.20.0"
|
|
INGRESS_NGINX_REF="controller-v1.15.1"
|
|
|
|
mkdir -p exam-files
|
|
|
|
echo "[*] Creating kind cluster 'cks' (1 cp + 2 workers, k8s v1.35.5)..."
|
|
# No --wait here: with disableDefaultCNI, nodes are legitimately NotReady (and CoreDNS Pending)
|
|
# until Cilium is installed below — waiting now would just time out.
|
|
kind create cluster --config kind-config.yaml
|
|
kubectl config use-context kind-cks
|
|
|
|
echo "[*] Installing Cilium v${CILIUM_VERSION} (CNI + kube-proxy replacement)..."
|
|
CP_IP="$(docker inspect -f '{{.NetworkSettings.Networks.kind.IPAddress}}' cks-control-plane)"
|
|
helm repo add cilium https://helm.cilium.io/ >/dev/null
|
|
helm repo update cilium >/dev/null
|
|
helm upgrade --install cilium cilium/cilium \
|
|
--version "$CILIUM_VERSION" --namespace kube-system \
|
|
--set ipam.mode=kubernetes \
|
|
--set kubeProxyReplacement=true \
|
|
--set k8sServiceHost="$CP_IP" --set k8sServicePort=6443 \
|
|
--set operator.replicas=1 \
|
|
--set image.pullPolicy=IfNotPresent \
|
|
--wait --timeout=5m
|
|
|
|
echo "[*] Waiting for Cilium and nodes to be Ready..."
|
|
kubectl -n kube-system rollout status ds/cilium --timeout=300s
|
|
kubectl wait --for=condition=Ready nodes --all --timeout=300s
|
|
command -v cilium >/dev/null 2>&1 && cilium status --wait || true
|
|
|
|
echo "[*] Installing an ingress controller (needed for the TLS task)..."
|
|
kubectl label node cks-control-plane ingress-ready=true --overwrite
|
|
kubectl apply -f "https://raw.githubusercontent.com/kubernetes/ingress-nginx/${INGRESS_NGINX_REF}/deploy/static/provider/kind/deploy.yaml"
|
|
kubectl -n ingress-nginx rollout status deploy/ingress-nginx-controller --timeout=300s
|
|
|
|
cat <<'EOF'
|
|
|
|
[*] Cluster up. Sanity check:
|
|
kubectl get nodes -o wide
|
|
cilium status
|
|
kubectl -n kube-system get ds kube-proxy # expected: not found — Cilium replaces it
|
|
|
|
[*] Host-side tooling you want on the VM (install latest):
|
|
- kube-bench : https://github.com/aquasecurity/kube-bench/releases (or run as a Job in-cluster)
|
|
- trivy : https://github.com/aquasecurity/trivy (apt: aquasecurity repo)
|
|
- kubesec : https://github.com/controlplaneio/kubesec/releases
|
|
- falco : apt install falco (v0.44.1) — used in the runtime task on the VM
|
|
- helm : for Kyverno / Falco chart installs / Cilium (already used above)
|
|
- cilium-cli : optional, https://github.com/cilium/cilium-cli/releases — `cilium status`/`cilium connectivity test`
|
|
- cosign : optional, image signing task
|
|
|
|
[*] Now run ./seed.sh to plant the vulnerable/target objects for the kubectl-only tasks.
|
|
EOF
|