security: restrict k3s kubeconfig file mode to 600

2026-08-29 14:27:12 +02:00 · 2026-08-26 18:14:43 +08:00
parent be6e2b4110
commit 212f45e2ca
5 changed files with 51 additions and 1 deletions
@@ -0,0 +1,10 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (name: {
+  # Only the control-plane (master) nodes write the admin kubeconfig; agents
+  # (workers) connect to the master and have no --write-kubeconfig-* flags.
+  mode600 = lib.hasInfix "-master-" name;
+  mode644 = false;
+})