Repository navigation
Proxmox e2e leaves the tenant super-admin kubeconfig on the runner #4806
Description
The Proxmox e2e suite leaves the tenant's super-admin kubeconfig on the self-hosted runner after every run. hack/e2e-chainsaw/_lib/run-proxmox.sh writes it to ${TMPDIR:-/tmp}/proxmox-e2e-tenant.kubeconfig in fetch_tenant_kubeconfig, and nothing removes it afterwards. The "Remove staged credentials" step in .github/workflows/e2e-proxmox.yaml deletes only the management kubeconfig and the SSH key.
The umask 077 in that workflow is set inside the Stage step only, so the suite step runs with the runner's default umask. On a usual 022 the file is readable by any local user on the runner. I inferred that from the default umask and did not check it on the runner itself.
Fix: write the file under $RUNNER_TEMP or the workspace with umask 077, and add its path to the cleanup step.
Activity
lexfrei commentedon Oct 7, 2026
The leftover file is also read by a later run.
dump_diagnosticsinrun-proxmox.shchecks[ -s "$TENANT_KUBECONFIG" ]and then runskubectl get nodesandget pods -Awith it. When a run fails beforefetch_tenant_kubeconfig, for example inapply_tenantor the control plane wait, the dump uses the previous run's file. The log then shows that run's tenant, or an unreachable endpoint, as if it were the current one. Removing the file at the start of each run, or keeping it in a per-run directory, fixes this together with the cleanup above. I found this by reading the script, not by a run on the runner.themoriarti commentedon Oct 19, 2026
Fix in #4971: the file moves to a per-run location (
COZY_PROXMOX_WORKDIR, set torunner.tempby the workflow), is written underumask 077, and is removed at the start ofapply-tenant, in the suite'sfinally, and in the workflow's credential cleanup step. That covers both the leftover file and the stale read indump_diagnosticsfrom your comment.fix(e2e): keep the Proxmox tenant kubeconfig per run and remove it
fix(e2e): keep the Proxmox tenant kubeconfig per run and remove it (c…
fix(e2e): keep the Proxmox tenant kubeconfig per run and remove it
fix(e2e): keep the Proxmox tenant kubeconfig per run and remove it (#…