Do not use the admin kubeconfig for the supervisor and core controllers

[brandond]

Proposed Changes

• Create a new kubeconfig with a dedicated user, and use that for the core controllers (supervisor, deploy, helm).
• Create separate Kubernetes clients for each controller so that their access and managed resources can be tracked.

Types of Changes

enhancement

Verification

Check audit logs - note that actions taken by the K3s supervisor, deploy controller, and helm controller no longer appear to come from the system:admin user, and instead use the system:k3s-supervisor username, and an appropriate user-agent.

Testing

Linked Issues

• Ensure that no embedded controllers are using the admin RBAC #7212

User-Facing Change

The K3s core controllers (supervisor, deploy, and helm) no longer use the admin kubeconfig. This makes it easier to determine from access and audit logs which actions are performed by the system, and which are performed by an administrative user.

Further Comments

[brandond]

Added an ADR @cwayne18

[codecov]

Codecov Report

Patch coverage: 70.12% and project coverage change: -0.05 ⚠️

Comparison is base (fe554fe) 47.57% compared to head (5fe07ea) 47.52%.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #7616      +/-   ##
==========================================
- Coverage   47.57%   47.52%   -0.05%     
==========================================
  Files         140      140              
  Lines       14284    14323      +39     
==========================================
+ Hits         6795     6807      +12     
- Misses       6411     6432      +21     
- Partials     1078     1084       +6     

Flag	Coverage Δ
inttests	44.88% <70.12%> (-0.04%)	⬇️
unittests	19.85% <26.31%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/cli/cmds/server.go	100.00% <ø> (ø)
pkg/daemons/config/types.go	84.44% <ø> (ø)
pkg/daemons/control/deps/deps.go	58.10% <45.45%> (-0.23%)	⬇️
pkg/util/client.go	48.14% <50.00%> (+0.77%)	⬆️
pkg/server/server.go	56.89% <74.50%> (-0.09%)	⬇️
pkg/cli/etcdsnapshot/etcd_snapshot.go	50.26% <100.00%> (ø)
pkg/daemons/control/server.go	71.91% <100.00%> (ø)
pkg/server/context.go	64.70% <100.00%> (+3.73%)	⬆️

... and 8 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.