fix: terraform & module

infra/terraform/modules/k3s/main.tf

@@ -1,6 +1,6 @@
 locals {
   sudo_prefix    = var.ssh_user == "root" ? "" : "sudo "
-  install_env    = var.k3s_version != "" ? "INSTALL_K3S_VERSION=${var.k3s_version} " : ""
+  install_env    = "INSTALL_K3S_VERSION=${var.k3s_version} "
   disable_flags  = join(" ", [for c in var.k3s_disable_components : "--disable=${c}"])
   kubeconfig_cmd = "${local.sudo_prefix}cat /etc/rancher/k3s/k3s.yaml"
 }
@@ -22,10 +22,20 @@ resource "null_resource" "k3s_install" {
 
   provisioner "remote-exec" {
     inline = [
-      "${local.sudo_prefix}sh -c 'curl -sfL https://get.k3s.io | ${local.install_env}sh -s - server --write-kubeconfig-mode 644 ${local.disable_flags}'",
+      "${local.sudo_prefix}sh -c 'curl -sfL https://get.k3s.io | ${local.install_env}sh -s - server ${local.disable_flags}'",
       "until ${local.sudo_prefix}test -f /etc/rancher/k3s/k3s.yaml; do sleep 2; done",
     ]
   }
+
+  # Le kubeconfig est lu via sudo (fetch_kubeconfig), pas besoin de --write-kubeconfig-mode :
+  # il reste 600/root par defaut, ce qui evite d'exposer les droits cluster-admin a tout utilisateur local.
+  provisioner "remote-exec" {
+    when       = destroy
+    on_failure = continue
+    inline = [
+      "${local.sudo_prefix}sh -c 'test -x /usr/local/bin/k3s-uninstall.sh && /usr/local/bin/k3s-uninstall.sh || true'",
+    ]
+  }
 }
 
 resource "null_resource" "fetch_kubeconfig" {

infra/terraform/modules/k3s/variables.tf

@@ -23,8 +23,12 @@ variable "ssh_private_key_path" {
 
 variable "k3s_version" {
   type        = string
-  description = "Version k3s a installer (ex: v1.31.2+k3s1). Chaine vide = derniere version stable."
-  default     = ""
+  description = "Version k3s a epingler pour un deploiement reproductible (ex: v1.31.5+k3s1). Voir https://github.com/k3s-io/k3s/releases."
+
+  validation {
+    condition     = length(trimspace(var.k3s_version)) > 0
+    error_message = "k3s_version doit etre epinglee explicitement, pas de valeur vide (sinon k3s.io installerait la derniere version a chaque run, non reproductible)."
+  }
 }
 
 variable "k3s_disable_components" {