- bootstrap.yml: install with --write-kubeconfig-mode=600, stop fetching the
admin kubeconfig to the controller, enforce root:root 0600.
- ansible/k3s-kubeconfig-mode.yml: narrow existing-host playbook with pinned
unit hashes, drift refusal, backup, config.yaml + flag rewrite, restart,
readiness/mode verification and rollback. Never prints unit/kubeconfig content.
- workplans/RCLUSTER-WP-0019: owner workplan; attended apply is T03 (human gate).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
1d8d11ddb3