65 lines
1.6 KiB
Markdown
65 lines
1.6 KiB
Markdown
# CKS Local Lab
|
|
|
|
This lab runs entirely inside an Ubuntu 24.04 WSL2 virtual machine. It uses
|
|
Docker Engine and Kind to create a two-node Kubernetes cluster.
|
|
|
|
## Isolation contract
|
|
|
|
- Cluster name: `cks-lab`
|
|
- Kubernetes version: `v1.34.0`
|
|
- Lab kubeconfig: `/opt/cks-lab/kubeconfig`
|
|
- Lab context: `kind-cks-lab`
|
|
- The scripts never read, merge, or modify `$HOME/.kube/config`.
|
|
- All destructive commands are limited to the Kind cluster named `cks-lab`.
|
|
|
|
Kubernetes v1.34 is deliberate: kube-bench v0.16.0 contains a CIS mapping for
|
|
v1.34. The production cluster is not a suitable lesson environment.
|
|
|
|
## Installation
|
|
|
|
Run these commands from PowerShell in this directory:
|
|
|
|
```powershell
|
|
# Opens one UAC prompt and enables the required Windows features.
|
|
.\01-enable-wsl.ps1
|
|
```
|
|
|
|
Restart Windows when requested. Then run:
|
|
|
|
```powershell
|
|
.\02-install-and-build.ps1
|
|
```
|
|
|
|
The first Ubuntu launch can take a few minutes. The script installs Docker,
|
|
kubectl, Kind, kube-bench, creates the cluster, and installs Calico.
|
|
|
|
## Daily use
|
|
|
|
Open the lab shell:
|
|
|
|
```powershell
|
|
.\enter-lab.ps1
|
|
```
|
|
|
|
The shell sets `KUBECONFIG=/opt/cks-lab/kubeconfig` and refuses to continue if
|
|
the active context is not `kind-cks-lab`.
|
|
|
|
Verify or rebuild the lab:
|
|
|
|
```powershell
|
|
.\verify-lab.ps1
|
|
.\reset-lab.ps1
|
|
.\02-install-and-build.ps1
|
|
```
|
|
|
|
Run kube-bench against the Kind control-plane node:
|
|
|
|
```bash
|
|
docker exec -it cks-lab-control-plane \
|
|
/opt/kube-bench/kube-bench run --benchmark cis-1.12
|
|
```
|
|
|
|
Lesson answers and progress remain in this repository, so they can be carried
|
|
to another PC. Cluster state is disposable and should be rebuilt there.
|
|
|