security: restrict k3s kubeconfig file mode to 600

2026-08-27 21:43:57 +02:00 · 2026-08-26 18:14:43 +08:00
parent be6e2b4110
commit 212f45e2ca
5 changed files with 51 additions and 1 deletions
@@ -60,7 +60,7 @@ in
      let
        flagList = [
          "--write-kubeconfig=${kubeconfigFile}"
-          "--write-kubeconfig-mode=644"
+          "--write-kubeconfig-mode=600"
          "--service-node-port-range=80-32767"
          "--kube-apiserver-arg='--allow-privileged=true'" # required by kubevirt
          "--data-dir /var/lib/rancher/k3s"