From 52d98a6d9599db807246e768cec83fac7e5071b6 Mon Sep 17 00:00:00 2001 From: Krstan Vjestica Date: Tue, 14 Jul 2026 10:10:00 +0200 Subject: [PATCH] dev-cluster: document accepted dev-only security tradeoffs Flag the hardcoded join token, world-readable synced kubeconfig and unpinned k3s install as deliberate local-dev conveniences (L19/L20), not to be reused or exposed outside the throwaway Vagrant cluster. --- Vagrantfile | 5 +++++ scripts/server-init.sh | 3 +++ 2 files changed, 8 insertions(+) diff --git a/Vagrantfile b/Vagrantfile index 6befefe..3bc0b5a 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -25,6 +25,11 @@ # vagrant destroy -f # Pre-shared token for all k3s nodes. Dev-only — do not reuse for prod. +# needtofix L19/L20 (accepted, dev-only): this is a local throwaway Vagrant +# cluster on a private host-only network. The hardcoded join token, the +# world-readable kubeconfig (0644, so the host can read the synced admin.conf), +# and the unpinned curl|sh k3s install are deliberate dev conveniences. NEVER +# expose this cluster or reuse these values outside local development. K3S_TOKEN = "forail-dev-cluster-shared-token-do-not-reuse" K3S_VERSION = "v1.30.4+k3s1" INIT_SERVER_IP = "192.168.56.30" diff --git a/scripts/server-init.sh b/scripts/server-init.sh index 6e7f8e7..59f2c9f 100755 --- a/scripts/server-init.sh +++ b/scripts/server-init.sh @@ -54,6 +54,9 @@ done # Publish kubeconfig with the right server URL (default is 127.0.0.1) # so the host can use it directly via $KUBECONFIG=shared/admin.conf. +# needtofix L19 (accepted, dev-only): 0644 is required so the host user can +# read the Vagrant-synced admin.conf. This grants cluster-admin to anyone with +# the file — fine for a local throwaway cluster only. sed "s|server: https://127.0.0.1:6443|server: https://${NODE_IP}:6443|" \ /etc/rancher/k3s/k3s.yaml > "$SHARED_DIR/admin.conf" chmod 644 "$SHARED_DIR/admin.conf"