security: restrict k3s kubeconfig file mode to 600

outputs/aarch64-linux/tests/security-k3s-kubeconfig/expected.nix

@@ -0,0 +1,10 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (name: {
+  # Only the control-plane (master) nodes write the admin kubeconfig; agents
+  # (workers) connect to the master and have no --write-kubeconfig-* flags.
+  mode600 = lib.hasInfix "-master-" name;
+  mode644 = false;
+})

outputs/aarch64-linux/tests/security-k3s-kubeconfig/expr.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name:
+  let
+    isK3s = lib.hasPrefix "k3s" name;
+    flags = if isK3s then outputs.nixosConfigurations.${name}.config.services.k3s.extraFlags else "";
+  in
+  {
+    mode600 = lib.hasInfix "--write-kubeconfig-mode=600" flags;
+    mode644 = lib.hasInfix "--write-kubeconfig-mode=644" flags;
+  }
+)