From 212f45e2caa1192902115df2a824fd5cdd29a1ab Mon Sep 17 00:00:00 2001 From: Ryan Yin Date: Wed, 26 Aug 2026 17:41:24 +0800 Subject: [PATCH] security: restrict k3s kubeconfig file mode to 600 --- lib/genK3sServerModule.nix | 2 +- .../tests/security-k3s-kubeconfig/expected.nix | 10 ++++++++++ .../tests/security-k3s-kubeconfig/expr.nix | 15 +++++++++++++++ .../tests/security-k3s-kubeconfig/expected.nix | 10 ++++++++++ .../tests/security-k3s-kubeconfig/expr.nix | 15 +++++++++++++++ 5 files changed, 51 insertions(+), 1 deletion(-) create mode 100644 outputs/aarch64-linux/tests/security-k3s-kubeconfig/expected.nix create mode 100644 outputs/aarch64-linux/tests/security-k3s-kubeconfig/expr.nix create mode 100644 outputs/x86_64-linux/tests/security-k3s-kubeconfig/expected.nix create mode 100644 outputs/x86_64-linux/tests/security-k3s-kubeconfig/expr.nix diff --git a/lib/genK3sServerModule.nix b/lib/genK3sServerModule.nix index c5059b8d..2020af79 100644 --- a/lib/genK3sServerModule.nix +++ b/lib/genK3sServerModule.nix @@ -60,7 +60,7 @@ in let flagList = [ "--write-kubeconfig=${kubeconfigFile}" - "--write-kubeconfig-mode=644" + "--write-kubeconfig-mode=600" "--service-node-port-range=80-32767" "--kube-apiserver-arg='--allow-privileged=true'" # required by kubevirt "--data-dir /var/lib/rancher/k3s" diff --git a/outputs/aarch64-linux/tests/security-k3s-kubeconfig/expected.nix b/outputs/aarch64-linux/tests/security-k3s-kubeconfig/expected.nix new file mode 100644 index 00000000..2cc5bf6e --- /dev/null +++ b/outputs/aarch64-linux/tests/security-k3s-kubeconfig/expected.nix @@ -0,0 +1,10 @@ +{ + lib, + outputs, +}: +lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (name: { + # Only the control-plane (master) nodes write the admin kubeconfig; agents + # (workers) connect to the master and have no --write-kubeconfig-* flags. + mode600 = lib.hasInfix "-master-" name; + mode644 = false; +}) diff --git a/outputs/aarch64-linux/tests/security-k3s-kubeconfig/expr.nix b/outputs/aarch64-linux/tests/security-k3s-kubeconfig/expr.nix new file mode 100644 index 00000000..7de55cf1 --- /dev/null +++ b/outputs/aarch64-linux/tests/security-k3s-kubeconfig/expr.nix @@ -0,0 +1,15 @@ +{ + lib, + outputs, +}: +lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) ( + name: + let + isK3s = lib.hasPrefix "k3s" name; + flags = if isK3s then outputs.nixosConfigurations.${name}.config.services.k3s.extraFlags else ""; + in + { + mode600 = lib.hasInfix "--write-kubeconfig-mode=600" flags; + mode644 = lib.hasInfix "--write-kubeconfig-mode=644" flags; + } +) diff --git a/outputs/x86_64-linux/tests/security-k3s-kubeconfig/expected.nix b/outputs/x86_64-linux/tests/security-k3s-kubeconfig/expected.nix new file mode 100644 index 00000000..2cc5bf6e --- /dev/null +++ b/outputs/x86_64-linux/tests/security-k3s-kubeconfig/expected.nix @@ -0,0 +1,10 @@ +{ + lib, + outputs, +}: +lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (name: { + # Only the control-plane (master) nodes write the admin kubeconfig; agents + # (workers) connect to the master and have no --write-kubeconfig-* flags. + mode600 = lib.hasInfix "-master-" name; + mode644 = false; +}) diff --git a/outputs/x86_64-linux/tests/security-k3s-kubeconfig/expr.nix b/outputs/x86_64-linux/tests/security-k3s-kubeconfig/expr.nix new file mode 100644 index 00000000..7de55cf1 --- /dev/null +++ b/outputs/x86_64-linux/tests/security-k3s-kubeconfig/expr.nix @@ -0,0 +1,15 @@ +{ + lib, + outputs, +}: +lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) ( + name: + let + isK3s = lib.hasPrefix "k3s" name; + flags = if isK3s then outputs.nixosConfigurations.${name}.config.services.k3s.extraFlags else ""; + in + { + mode600 = lib.hasInfix "--write-kubeconfig-mode=600" flags; + mode644 = lib.hasInfix "--write-kubeconfig-mode=644" flags; + } +)