coulomb/railiance-cluster
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SCOPE: record RCLUSTER-WP-0019 admin kubeconfig and registries.yaml mode hardening
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
This commit is contained in:
codex 2026-10-21 00:00:01 +02:00
parent 48de6d9ee0
commit a5948408a5
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
SCOPE.md
View file

@ -95,6 +95,13 @@ future `rail-kubernetes` repo and must not be treated as long-term S2 scope.
This is a package evidence reference, not a fresh live health observation.
- k3s API access is tunnel-only on Railiance01; see `railiance-infra`
`RAIL-HO-WP-0009` and ADR-005. It is not a public/source-allowlisted surface.
- Admin credential file modes (RCLUSTER-WP-0019, done 2026-10-20): the
installer writes the admin kubeconfig with mode 600 and no longer exports it.
`ansible/k3s-kubeconfig-mode.yml`, applied on railiance01, keeps
the admin kubeconfig and `registries.yaml` at root 0600.
`registries.yaml`, which holds a registry login, had been found at 0644.
Restricted agent accounts on the node therefore cannot read cluster-admin or
registry credentials.
---
@ -133,7 +140,7 @@ future `rail-kubernetes` repo and must not be treated as long-term S2 scope.
```capability
type: infrastructure
title: Kubernetes cluster provisioning (k3s)
description: Install and configure a production k3s cluster including Helm, Traefik ingress, networking, and kubeconfig management on Railiance servers.
description: Install and configure a production k3s cluster including Helm, Traefik ingress, networking, and kubeconfig management on Railiance servers. Admin kubeconfig and registries.yaml are kept root 0600 (ansible/k3s-kubeconfig-mode.yml); the installer does not export the admin kubeconfig.
keywords: [kubernetes, k3s, cluster, helm, ingress, cni, k8s, provisioning]
```