Merge pull request #2617 from DougAnsonAustinTX/Garnder_on_GCP_LP_Techreview

updates for the gardener techreview

Author: jasonrandrews

content/learning-paths/servers-and-cloud-computing/gardener-gcp/baseline.md

@@ -12,7 +12,7 @@ This section checks whether your Gardener Local setup is working correctly on an
 ### Set Kubeconfig
 This tells Kubernetes commands (**kubectl) which cluster to talk to**. Without this, kubectl won’t know where your Gardener cluster is.
 ``` console
-export KUBECONFIG=/home/gcpuser/gardener/kind/kubeconfig.yaml
+export KUBECONFIG=$PWD/example/gardener-local/kind/local/kubeconfig
 ```
 
 ### Check Cluster Health
@@ -140,6 +140,8 @@ test-nginx   0/1     ContainerCreating   0          1s
 test-nginx   1/1     Running             0          4s
 ```
 
+Now, press "ctrl-c" in the ssh shell to kill the currently running monitor. 
+
 ### Expose the Pod (ClusterIP Service)
 Pods cannot be accessed directly by other pods reliably.
 So we create a Kubernetes Service.
@@ -234,7 +236,7 @@ Ensures CoreDNS is functioning and services resolve properly. Run `nslookup` ins
 If DNS resolves correctly, service discovery is healthy.
 
 ``` console
-kubectl exec curl -- nslookup test-nginx-svc
+kubectl exec curl -- nslookup test-nginx-svc.default.svc.cluster.local
 ```
 
 You should see an output similar to:

content/learning-paths/servers-and-cloud-computing/gardener-gcp/benchmarking.md

@@ -23,7 +23,10 @@ If the cluster is not running or you don’t have admin access, security checks
 **Verify cluster:**
 
 ```console
-kubectl get shoots -n garden
+cd ~/gardener
+export KUBECONFIG=$PWD/example/gardener-local/kind/local/kubeconfig
+kubectl apply -f example/provider-local/shoot.yaml
+kubectl -n garden-local get shoots
 kubectl get nodes
 ```
 If the cluster is not ready, benchmarking does not make sense yet.
@@ -32,8 +35,8 @@ If the cluster is not ready, benchmarking does not make sense yet.
 Download the Arm64-compatible kube-bench binary from the official GitHub release. This tool will be used to check your Kubernetes cluster against CIS security benchmarks.
 
 ```console
-curl -L \
-https://github.com/aquasecurity/kube-bench/releases/download/v0.10.3/kube-bench_0.10.3_linux_arm64.tar.gz
+cd ~
+curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.10.3/kube-bench_0.10.3_linux_arm64.tar.gz --output ./kube-bench_0.10.3_linux_arm64.tar.gz
 ```
 
 ### Extract and Install kube-bench Configuration
@@ -123,36 +126,9 @@ resources and that all new resources are created in a specific namespace.
 49 checks WARN
 0 checks INFO
 ```
-### Benchmark summary on x86_64
-To compare the benchmark results, the following results were collected by running the same benchmark on a `x86 - c4-standard-4` (4 vCPUs, 15 GB Memory) x86_64 VM in GCP, running SUSE:
-
-| Category / Subsection                       | PASS | FAIL | WARN |
-| ------------------------------------------- | :--: | :--: | :--: |
-| **1. Control Plane Security Configuration** |      |      |      |
-| └─ 1.1 Control Plane Node Configuration Files  |  0   | 18   |  3   |
-| └─ 1.2 API Server                              |  9   |  7   |  5   |
-| └─ 1.3 Controller Manager                      |  5   |  0   |  1   |
-| └─ 1.4 Scheduler                               |  1   |  1   |  0   |
-| **2. Etcd Node Configuration**              |      |      |      |
-| └─ 2.1-2.7 Etcd Node Config                    |  7   |  0   |  0   |
-| **3. Control Plane Configuration**          |      |      |      |
-| └─ 3.1 Authentication and Authorization       |  0   |  0   |  3   |
-| └─ 3.2 Logging                                 |  0   |  0   |  2   |
-| **4. Worker Node Security Configuration**   |      |      |      |
-| └─ 4.1 Worker Node Configuration Files         |  2   |  5   |  4   |
-| └─ 4.2 Kubelet                                 |  5   |  3   |  3   |
-| └─ 4.3 kube-proxy                              |  1   |  0   |  0   |
-| **5. Kubernetes Policies**                  |      |      |      |
-| └─ 5.1 RBAC and Service Accounts               |  0   |  6   |  7   |
-| └─ 5.2 Pod Security Standards                  |  0   |  0   | 13   |
-| └─ 5.3 Network Policies and CNI                |  0   |  0   |  2   |
-| └─ 5.4 Secrets Management                      |  0   |  0   |  2   |
-| └─ 5.5 Extensible Admission Control            |  0   |  0   |  1   |
-| └─ 5.7 General Policies                        |  0   |  0   |  4   |
-| **Total**                                   | 34   | 42   | 54   |
-
-### Benchmark summary on Arm64
-Results from the earlier run on the `c4a-standard-4` (4 vCPU, 16 GB memory) Arm64 VM in GCP (SUSE):
+
+### Benchmark summary
+Results from the earlier run on the `c4a-standard-4` (4 vCPU, 16 GB memory) Arm64 VM in GCP (SUSE) will be similar to:
 
 | Category / Subsection                            | PASS | FAIL | WARN |
 |-------------------------------------------------|:----:|:----:|:----:|
@@ -179,8 +155,7 @@ Results from the earlier run on the `c4a-standard-4` (4 vCPU, 16 GB memory) Arm6
 | └─ 5.7 General Policies                          | 0    | 0    | 4    |
 | **Total**                                       | 43   | 38   | 49   |
 
-### Gardener benchmarking comparison on Arm64 and x86_64
-
+### Conclusions
 - **Strong Baseline Security:** The cluster passed **43 CIS checks**, indicating a solid foundational security posture out of the box on **Arm64 (C4A)** infrastructure.
 - **Control Plane Hardening Gaps:** A significant number of **FAIL results (38)** are concentrated in **control plane file permissions and API server settings**, which are commonly unmet in development and local/KinD-based setups.
 - **Healthy Etcd Configuration:** All **Etcd-related checks passed (7/7)**, demonstrating correct encryption, access controls, and secure peer/client configuration on **Arm64**.

content/learning-paths/servers-and-cloud-computing/gardener-gcp/images/gcp-shell.png

@@ -21,9 +21,11 @@ This enables SUSE’s official container support, so Docker and container tools
 
 ``` console
 sudo SUSEConnect -p sle-module-containers/15.5/arm64
-SUSEConnect --list-extensions | grep Containers
+sudo SUSEConnect --list-extensions | grep Containers
 ```
 
+You should see "Activated" as part of the output from the above commands. 
+
 ### Install Docker
 Docker is required to run KinD and Kubernetes components as containers. This step installs Docker, starts it, and allows your user to run Docker without sudo.
 ``` console
@@ -32,9 +34,20 @@ sudo zypper install -y docker
 sudo systemctl enable --now docker
 sudo usermod -aG docker $USER
 exit
+```
+
+Next, re-open a new shell into your VM and type the following:
+
+```console
 docker ps
 ```
 
+You should see the following output:
+
+```output
+CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
+```
+
 ### Install Go 1.24 (Manual)
 Gardener requires a newer Go version than what SUSE provides by default. Here, Go 1.24 is downloaded and installed manually.
 
@@ -81,7 +94,9 @@ Kustomize Version: v5.7.1
 Helm is used to install and manage Kubernetes applications. Gardener uses Helm internally to deploy its components.
 
 ``` console
-curl -sSfL https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | console
+curl -sSfL https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 > get_helm.sh
+chmod 755 ./get_helm.sh
+./get_helm.sh
 helm version
 ```
 
@@ -116,6 +131,12 @@ sudo mv kustomize /usr/local/bin/
 kustomize version
 ```
 
+You should see an output (Kustomize version) that is similar to:
+
+```output
+v5.3.0
+```
+
 ### Install Kind
 Kind (Kubernetes in Docker) creates a local Kubernetes cluster inside Docker. Gardener Local runs entirely on this KinD cluster.
 
@@ -160,19 +181,40 @@ Here you download the Gardener’s source code and switch to a known, stable rel
 ``` console
 cd ~
 git clone https://github.com/gardener/gardener.git
+cd gardener
 git fetch --all --tags
 git checkout v1.122.0
-cd gardener
 ```
 
 ### Clean Old KinD Network
 This removes any leftover KinD network from previous runs to avoid IP or port conflicts.
 
 ``` console
-docker network rm kind || true
+docker network rm kind
+```
+
+You should get the following output which is correct:
+
+```output
+Error response from daemon: network kind not found
+exit status 1
+```
+
+You can confirm this by typing:
+
+```console
 docker network ls
 ```
 
+Your output should look something like this (note the absence of the "kind" name...its not present in the network config):
+
+```output
+NETWORK ID     NAME      DRIVER    SCOPE
+bb9f7955c11b   bridge    bridge    local
+aec64365a860   host      host      local
+d60c34b45e0a   none      null      local
+```
+
 ### Create Gardener KinD Cluster
 This step creates the Kubernetes cluster using KinD and prepares it to run Gardener.
 
@@ -200,18 +242,20 @@ certificatesigningrequest.certificates.k8s.io/csr-rnvdk approved
 Kubelet Serving Certificate Signing Requests approved.
 ```
 
-### If IP/port binding fails (common on SUSE)
-If KinD fails due to networking issues (common on SUSE), re-adding loopback IPs fixes the problem.
+### If the above "make" command fails...
+
+If the above make command fails, please reset the loopback interfaces as follows and re-try the make command:
 
 ``` console
 sudo ip addr del 172.18.255.1/32 dev lo
 sudo ip addr del 172.18.255.22/32 dev lo
 sudo ip addr add 172.18.255.1/32 dev lo
 sudo ip addr add 172.18.255.22/32 dev lo
-docker network rm kind
+ip addr show lo
 make kind-up
 ```
 
+
 ### Export kubeconfig
 This config file allows `kubectl` to connect to the newly created Gardener local cluster.
 
@@ -325,13 +369,28 @@ EOF
 ```
 
 ### Get Shoot Admin Kubeconfig
+
+{{% notice Note %}}
+You may need to wait a 4-5 minutes before running the next commands... otherwise, they may fail. 
+If they fail, please wait a bit and retry again. 
+{{% /notice %}}
+
 This generates an admin kubeconfig so you can access and manage the Shoot Kubernetes cluster.
 
 ``` console
 ./hack/usage/generate-admin-kubeconf.sh > admin-kubeconf.yaml
 KUBECONFIG=admin-kubeconf.yaml kubectl get nodes
 ```
 
+{{% notice Note %}}
+If you get the following result from the "kubectl get nodes" command above:
+```output
+No resources found
+```
+Please wait a bit and retry again. Your nodes are still being generated! 
+{{% /notice %}}
+
+
 You should see an output similar to:
 
 ```output

content/learning-paths/servers-and-cloud-computing/gardener-gcp/images/gcp-ssh.png

@@ -26,6 +26,19 @@ To create a virtual machine based on the C4A instance type:
 
    ![Create a Google Axion C4A Arm virtual machine in the Google Cloud Console with c4a-standard-4 selected alt-text#center](images/gcp-vm.png "Creating a Google Axion C4A Arm virtual machine in Google Cloud Console")
 
-- Under **OS and Storage**, select **Change**, then choose an Arm64-based OS image. For this Learning Path, use **SUSE Linux Enterprise Server**. Pick the preferred version for your Operating System. Ensure you select the **Arm image** variant. Click **Select**.
-- Under **Networking**, enable **Allow HTTP traffic**.
+
+- Under **OS and Storage**, select **Change**, then choose an Arm64-based OS image. For this Learning Path, use **SUSE Linux Enterprise Server**. 
+- If using use **SUSE Linux Enterprise Server**. Select "Pay As You Go" for the license type.
+- Edit the Disk size ("Size(GB)" Textfield...) below and change it from "10" to "50" to increase the disk size of the VM to 50 GB...
+- Once appropriately selected and configured, please Click **Select**.
+- Under **Networking**, enable **Allow HTTP traffic** as well as **Allow HTTPS traffic**.
 - Click **Create** to launch the instance.
+- Once created, you should see a "SSH" option to the right in your list of VM instances.  Click on this to launch a SSH shell into your VM instance:
+
+![Invoke a SSH session via your browser alt-text#center](images/gcp-ssh.png "Invoke a SSH session into your running VM instance")
+
+- A window from your browser should come up and you should now see a shell into your VM instance:
+
+![Terminal Shell in your VM instance alt-text#center](images/gcp-shell.png "Terminal shell in your VM instance")
+
+Next, let's install Gardner!