security: restrict k3s kubeconfig file mode to 600

lib/genK3sServerModule.nix

@@ -60,7 +60,7 @@ in
       let
         flagList = [
           "--write-kubeconfig=${kubeconfigFile}"
-          "--write-kubeconfig-mode=644"
+          "--write-kubeconfig-mode=600"
           "--service-node-port-range=80-32767"
           "--kube-apiserver-arg='--allow-privileged=true'" # required by kubevirt
           "--data-dir /var/lib/rancher/k3s"

outputs/aarch64-linux/tests/security-k3s-kubeconfig/expected.nix

@@ -0,0 +1,10 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (name: {
+  # Only the control-plane (master) nodes write the admin kubeconfig; agents
+  # (workers) connect to the master and have no --write-kubeconfig-* flags.
+  mode600 = lib.hasInfix "-master-" name;
+  mode644 = false;
+})

outputs/aarch64-linux/tests/security-k3s-kubeconfig/expr.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name:
+  let
+    isK3s = lib.hasPrefix "k3s" name;
+    flags = if isK3s then outputs.nixosConfigurations.${name}.config.services.k3s.extraFlags else "";
+  in
+  {
+    mode600 = lib.hasInfix "--write-kubeconfig-mode=600" flags;
+    mode644 = lib.hasInfix "--write-kubeconfig-mode=644" flags;
+  }
+)

outputs/x86_64-linux/tests/security-k3s-kubeconfig/expected.nix

@@ -0,0 +1,10 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (name: {
+  # Only the control-plane (master) nodes write the admin kubeconfig; agents
+  # (workers) connect to the master and have no --write-kubeconfig-* flags.
+  mode600 = lib.hasInfix "-master-" name;
+  mode644 = false;
+})

outputs/x86_64-linux/tests/security-k3s-kubeconfig/expr.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name:
+  let
+    isK3s = lib.hasPrefix "k3s" name;
+    flags = if isK3s then outputs.nixosConfigurations.${name}.config.services.k3s.extraFlags else "";
+  in
+  {
+    mode600 = lib.hasInfix "--write-kubeconfig-mode=600" flags;
+    mode644 = lib.hasInfix "--write-kubeconfig-mode=644" flags;
+  }
+)