From a5948408a565d383a99f43d414145277a43ce233 Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 21 Oct 2026 00:00:01 +0200 Subject: [PATCH] SCOPE: record RCLUSTER-WP-0019 admin kubeconfig and registries.yaml mode hardening Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61 --- SCOPE.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/SCOPE.md b/SCOPE.md index f15b0d6..f672cb5 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -95,6 +95,13 @@ future `rail-kubernetes` repo and must not be treated as long-term S2 scope. This is a package evidence reference, not a fresh live health observation. - k3s API access is tunnel-only on Railiance01; see `railiance-infra` `RAIL-HO-WP-0009` and ADR-005. It is not a public/source-allowlisted surface. +- Admin credential file modes (RCLUSTER-WP-0019, done 2026-10-20): the + installer writes the admin kubeconfig with mode 600 and no longer exports it. + `ansible/k3s-kubeconfig-mode.yml`, applied on railiance01, keeps + the admin kubeconfig and `registries.yaml` at root 0600. + `registries.yaml`, which holds a registry login, had been found at 0644. + Restricted agent accounts on the node therefore cannot read cluster-admin or + registry credentials. --- @@ -133,7 +140,7 @@ future `rail-kubernetes` repo and must not be treated as long-term S2 scope. ```capability type: infrastructure title: Kubernetes cluster provisioning (k3s) -description: Install and configure a production k3s cluster including Helm, Traefik ingress, networking, and kubeconfig management on Railiance servers. +description: Install and configure a production k3s cluster including Helm, Traefik ingress, networking, and kubeconfig management on Railiance servers. Admin kubeconfig and registries.yaml are kept root 0600 (ansible/k3s-kubeconfig-mode.yml); the installer does not export the admin kubeconfig. keywords: [kubernetes, k3s, cluster, helm, ingress, cni, k8s, provisioning] ```