mirrors/k3s-ansible
1
0 Fork 1
mirror of https://github.com/k3s-io/k3s-ansible.git synced 2026-10-23 03:22:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: make the server config file mode configurable (#561)

Browse Source 
* feat: make the server config file mode configurable

/etc/rancher/k3s/config.yaml holds the cluster token. The server and
upgrade roles write it at 0644, so every local account on a server node
can read the credential that joins a node to the cluster.

k3s_server_config_mode sets the mode of that file in both roles. It
defaults to 0644, so behaviour is unchanged unless it is set.

Signed-off-by: Kristofer <kristofer@atlascloud.is>

* docs: describe the server config file contents accurately

/etc/rancher/k3s/config.yaml does not always carry the cluster token. A
first server that lets K3s generate one writes the file without it, so the
file can contain the token rather than always holding it. Correct that
claim in the README, the inventory sample and the role default, and use
the US spelling of "honors".

Signed-off-by: Kristofer <kristofer@atlascloud.is>

* Name the floor the config file mode can be narrowed to

Saying any mode root can read works leaves the reader to work out what
that means in practice. The file is read only by k3s, running as root, so
0600 is the tightest mode that still works.

Signed-off-by: Kristofer <kristofer@atlascloud.is>

* Run the basic integration job with a non-default config file mode

The templated mode was only ever rendered with its default in CI, which
is the one value that cannot tell a working template from a broken one.
The basic inventory sets 0640 and the job reads the mode back off the
installed file.

Signed-off-by: Kristofer <kristofer@atlascloud.is>

---------

Signed-off-by: Kristofer <kristofer@atlascloud.is>
This commit is contained in:
Kris authored and GitHub committed 2026-09-16 11:55:02 -07:00
1 parent 281554e252
commit 1a600b60d3
8 files changed
+24 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+10
View File
@@ -144,6 +144,16 @@ The `use_external_database` flag is required when more than one server is define
The format of the datastore-endpoint parameter is dependent upon the datastore backend, please visit the [K3s datastore endpoint format](https://docs.k3s.io/datastore#datastore-endpoint-format-and-functionality) for details on the format and supported datastores.
### Server config file permissions
The server role writes `/etc/rancher/k3s/config.yaml` at mode `0644`. That file can contain the cluster token, so any local account on a server node can read the credential that joins a node to the cluster. Set `k3s_server_config_mode` to narrow it:
```yaml
k3s_server_config_mode: "0640"
```
K3s reads the file as root, so `0600` is the safe floor: no other account needs the file. The default stays `0644`, which is the mode the file already has on a running cluster, so a re-run changes nothing until the variable is set. The upgrade role rewrites the same file and honors the same variable.
## Upgrading
A playbook is provided to upgrade K3s on all nodes in the cluster. To use it, update `k3s_version` with the desired version in `inventory.yml` and run one of the following commands. Again, the syntax is slightly different depending on whether you installed `k3s-ansible` with `ansible-galaxy` or if you run the playbook from within the cloned git repository: