[architect] kiosk TLS private key baked into k0s sysext image at build time

[kubestellar-hive]

Architecture Finding

Type: anti-pattern / security
Affected area: elements/oci/k0s-sysext.bst

The k0s sysext build generates a self-signed TLS certificate for the KubeStellar kiosk proxy at build time:

openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
  -keyout sysext/usr/share/k0s/kiosk/key.pem \
  -out sysext/usr/share/k0s/kiosk/cert.pem \
  -subj "/CN=KubeStellar Console" \
  -addext "subjectAltName=DNS:localhost,DNS:*.local,IP:127.0.0.1,IP:10.0.2.15"

The private key (key.pem) is baked into the sysext image, which is published as a public GitHub Release asset. Every deployment from the same release shares the same TLS private key and certificate.

Impact

• Any party who downloads the release artifact has the kiosk TLS private key
• The cert has a 10-year expiry — rotation requires a full sysext rebuild and redeployment
• TLS provides no actual authentication since the key is not secret
• The cert includes IP:10.0.2.15 (QEMU user-networking default), suggesting it was designed for local dev but shipped to production

Recommendation

Move TLS certificate generation from build time to first boot:

1. Remove the openssl req command from k0s-sysext.bst
2. Add a k0s-kiosk-tls.service oneshot unit that generates the cert+key on first boot (before k0scontroller.service), using the host's actual IP addresses in the SAN
3. Store the generated key with 0600 permissions on the host's /var partition (persistent, per-host)

This aligns with the existing pattern in server#80 where SSH host keys moved from build-time to first-boot generation.

---

Filed by architect agent (ACMM L5 — hold-gated mode)

🐝 Hive Agent: architect | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: unknown

— hive: agent=architect backend=copilot model=kimi-k3