search

k3s-io / k3s-ansible

Apache License 2.0
2.09k stars 824 forks source link

Security exposure related to the token #356

Closed anon-software closed 2 months ago

anon-software commented 3 months ago

The installation playbook saves the token into the systemd unit configuration file /etc/systemd/system/k3s.service. The problem is that according to K3s' documentation "the server token should be guarded carefully" (https://docs.k3s.io/cli/token), yet the configuration file is readable by anybody. A better solution is to save the token into its corresponding environment file /etc/systemd/system/k3s.service.env which is readable by the super user only. This is what the standard K3s' installation script (https://get.k3s.io) does.

Changes

Linked Issues

anon-software commented 3 months ago

That is correct, the URL can remain where it is. It just looked nicer to me to move that as well. But I shall restore it where it was if you prefer the old location.

dereknola commented 3 months ago

Please restore it :)

anon-software commented 3 months ago

I have pushed another commit to move the URL back.