RKE2-Server changes rke2.yaml to 0416 rather than 0640

[HoustonDad]

Environmental Info:
RKE2 Version:
1.21 -> 1.27 has been tested, and is affected

Node(s) CPU architecture, OS, and Version:
VSphere, RHEL8 systems

Cluster Configuration:
Single node cluster

Describe the bug:
RKE2 is not honoring write-kubeconfig-mode, and is setting rke2.yaml to 0416 when attempting to get 0640.

New Installs:

• When setting write-kubeconfig-mode to 0640 in config.yaml prior to install, RKE2 will then set permissions on rke2.yaml to 0416.
• When setting write-kubeconfig-mode to 0600 in config.yaml prior to install, RKE2 will then set permissions on rke2.yaml to 0600.

Existing installs:

• When setting write-kubeconfig-mode to 0640 in config.yaml, after restarting rke2-server, RKE2 will then set permissions on rke2.yaml to 0416.
• When setting write-kubeconfig-mode to 0600 in config.yaml, after restarting rke2-server, RKE2 will then not set permissions on rke2.yaml.

NOTE: I get further weird behaviors when RKE2 doesn't mess with permissions, such as starting with least permissive and going to more permissive.

Steps To Reproduce:

curl -sfL https://get.rke2.io | INSTALL_RKE2_CHANNEL=v1.26 sh -

mkdir -p /etc/rancher/rke2
cat > /etc/rancher/rke2/config.yaml <<EOF
token: usercreatedtokenstring
write-kubeconfig-mode: 0600
EOF

systemctl enable rke2-server && systemctl start rke2-server

stat /etc/rancher/rke2/rke2.yaml
grep write /etc/rancher/rke2/config.yaml
sed -i 's#0600#0640#g' /etc/rancher/rke2/config.yaml
grep write /etc/rancher/rke2/config.yaml
systemctl restart rke2-server
stat /etc/rancher/rke2/rke2.yaml

Expected behavior:
rke2.yaml would be 0640

Actual behavior:
rke2.yaml becomes 0416

[brandond]

You want to quote that so it's a string. If you don't quote it, the YAML loader treats it as an octal number, which is then converted back to a string by the CLI parser.

token: usercreatedtokenstring
write-kubeconfig-mode: "0640"

If you do it your way, you can see from the node args that its getting converted incorrectly:

root@rke2-server-1:/# kubectl get node -o yaml | grep args
      rke2.io/node-args: '["server","--write-kubeconfig-mode","416"]'