Write pod-manifests as 0600 in cis mode

[dereknola]

Signed-off-by: Derek Nola derek.nola@suse.com

Proposed Changes

CIS 1.7 requires the pod-manifest yaml files to be 0600.

• If cis mode, we now write those files as 0600 instead of 0644.
• E2E function for debug help

Types of Changes

File Permisions in CIS

Verification

• Start rke2 with --profile=cis

root@server-0:/home/vagrant# stat -c "%a %n" /var/lib/rancher/rke2/agent/pod-manifests/*
600 /var/lib/rancher/rke2/agent/pod-manifests/cloud-controller-manager.yaml
600 /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml
600 /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
600 /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml
600 /var/lib/rancher/rke2/agent/pod-manifests/kube-proxy.yaml
600 /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml

Testing

Linked Issues

#4473

User-Facing Change

Further Comments