Adjust default kubeconfig file permissions

[dereknola]

Signed-off-by: Derek Nola [email protected]

Proposed Changes

cis-1.24 and newer (the upcoming cis-1.7, yes the name is weird) have moved to a more restrictive kubeconfig default. As the folder var/lib/rancher/k3s/server/cred containing these files is restricted to root users only, further restricting the files to read only for root does not present a huge change in file access.

Types of Changes

Verification

• Start k3s

root $ stat -c "%a %n" /var/lib/rancher/k3s/server/cred/* 
600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig
600 /var/lib/rancher/k3s/server/cred/api-server.kubeconfig
600 /var/lib/rancher/k3s/server/cred/cloud-controller.kubeconfig
600 /var/lib/rancher/k3s/server/cred/controller.kubeconfig
600 /var/lib/rancher/k3s/server/cred/ipsec.psk
600 /var/lib/rancher/k3s/server/cred/passwd
600 /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig
600 /var/lib/rancher/k3s/server/cred/supervisor.kubeconfig

All .kubeconfig files should be 600 permissions

Testing

Linked Issues

#7975

User-Facing Change

Further Comments

[dereknola]

Merging, arm CI runners are currently full.