From 36f733c12ce414104016e5480349758311c1965b Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 20 Oct 2026 22:40:41 +0200 Subject: [PATCH] RCLUSTER-WP-0019: keep registries.yaml root 0600 (found world-readable with registry login) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61 --- ansible/k3s-kubeconfig-mode.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/ansible/k3s-kubeconfig-mode.yml b/ansible/k3s-kubeconfig-mode.yml index 493d708..21bd994 100644 --- a/ansible/k3s-kubeconfig-mode.yml +++ b/ansible/k3s-kubeconfig-mode.yml @@ -305,3 +305,19 @@ success_msg: >- admin kubeconfig {{ kubeconfig_stat.stat.pw_name }}:{{ kubeconfig_stat.stat.gr_name }} {{ kubeconfig_stat.stat.mode }}; API ready + + # registries.yaml can hold registry logins; it was found 0644 on 2026-10-20 + # by the RAIL-HO-WP-0014 posture check. k3s reads it as root at startup. + - name: Stat registries.yaml (metadata only) + ansible.builtin.stat: + path: /etc/rancher/k3s/registries.yaml + get_checksum: false + register: registries_stat + + - name: Restrict registries.yaml to root (0600) when present + ansible.builtin.file: + path: /etc/rancher/k3s/registries.yaml + owner: root + group: root + mode: "0600" + when: k3s_kubeconfig_mode_action == 'apply' and registries_stat.stat.exists