Fix race condition between secret upload and chmod

Add mode parameter to upload_file() that sets permissions atomically
via SFTP before writing content. All secret files (passwords, keys,
.mylogin.cnf) now use mode=0o600. Remove separate
change_permissions_to_root() calls that left a readable window.

Closes #90

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: szachovy

CHANGELOG.md

@@ -16,6 +16,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * CI workflow to build and push service images to GitHub Container Registry on master merge. (#97)
 * Pull-first with local build fallback for container images during deployment. (#97)
 
+### Fixed
+
+* Atomic file permissions via SFTP — secrets no longer readable between upload and chmod. (#90)
+
 ### Changed
 
 * Completed [ARCHITECTURE.md](./docs/ARCHITECTURE.md) (#93)

src/initialize.py

@@ -167,19 +167,22 @@ def start_mysql_servers(self) -> None:
             )
             node.upload_file(
                 content=self.mysql_root_password,
-                remote_file_path="/opt/superset-cluster/mysql-server/mysql_root_password"
+                remote_file_path="/opt/superset-cluster/mysql-server/mysql_root_password",
+                mode=0o600
             )
             node.upload_file(
                 content=self.cert_manager.deserialization(self.ca_key),
-                remote_file_path="/opt/superset-cluster/mysql-server/superset_cluster_ca_key.pem")
+                remote_file_path="/opt/superset-cluster/mysql-server/superset_cluster_ca_key.pem",
+                mode=0o600)
             node.upload_file(
                 content="".join(self.cert_manager.deserialization(node.certificate) for node in self.mysql_nodes)
                 + self.cert_manager.deserialization(self.ca_certificate),
                 remote_file_path="/opt/superset-cluster/mysql-server/superset_cluster_ca_certificate.pem"
             )
             node.upload_file(
                 content=self.cert_manager.deserialization(node.key),
-                remote_file_path="/opt/superset-cluster/mysql-server/mysql_server_key.pem"
+                remote_file_path="/opt/superset-cluster/mysql-server/mysql_server_key.pem",
+                mode=0o600
             )
             node.upload_file(
                 content=self.cert_manager.deserialization(node.certificate),
@@ -198,18 +201,18 @@ def start_mysql_mgmt(self, node: remote.RemoteConnection, state: str, priority:
         )
         node.upload_file(
             content=self.mysql_superset_password,
-            remote_file_path="/opt/superset-cluster/mysql-mgmt/mysql_superset_password"
+            remote_file_path="/opt/superset-cluster/mysql-mgmt/mysql_superset_password",
+            mode=0o600
         )
         node.upload_file(
             content=self.get_mylogin_cnf(self.mysql_nodes[0]),
-            remote_file_path="/opt/superset-cluster/mysql-mgmt/.mylogin.cnf"
-        )
-        node.change_permissions_to_root(
-            "/opt/superset-cluster/mysql-mgmt/.mylogin.cnf"
+            remote_file_path="/opt/superset-cluster/mysql-mgmt/.mylogin.cnf",
+            mode=0o600
         )
         node.upload_file(
             content=self.cert_manager.deserialization(self.ca_key),
-            remote_file_path="/opt/superset-cluster/mysql-mgmt/superset_cluster_ca_key.pem"
+            remote_file_path="/opt/superset-cluster/mysql-mgmt/superset_cluster_ca_key.pem",
+            mode=0o600
         )
         node.upload_file(
             content="".join(self.cert_manager.deserialization(node.certificate) for node in self.mysql_nodes)
@@ -218,7 +221,8 @@ def start_mysql_mgmt(self, node: remote.RemoteConnection, state: str, priority:
         )
         node.upload_file(
             content=self.cert_manager.deserialization(node.key),
-            remote_file_path="/opt/superset-cluster/mysql-mgmt/mysql_router_key.pem"
+            remote_file_path="/opt/superset-cluster/mysql-mgmt/mysql_router_key.pem",
+            mode=0o600
         )
         node.upload_file(
             content=self.cert_manager.deserialization(node.certificate),
@@ -254,15 +258,17 @@ def start_superset(self) -> None:
             )
             node.upload_file(
                 content=self.cert_manager.deserialization(self.ca_key),
-                remote_file_path="/opt/superset-cluster/superset/superset_cluster_ca_key.pem"
+                remote_file_path="/opt/superset-cluster/superset/superset_cluster_ca_key.pem",
+                mode=0o600
             )
             node.upload_file(
                 content=self.cert_manager.deserialization(self.ca_certificate),
                 remote_file_path="/opt/superset-cluster/superset/superset_cluster_ca_certificate.pem"
             )
             node.upload_file(
                 content=self.cert_manager.deserialization(node.superset_key),
-                remote_file_path="/opt/superset-cluster/superset/superset_cluster_key.pem"
+                remote_file_path="/opt/superset-cluster/superset/superset_cluster_key.pem",
+                mode=0o600
             )
             node.upload_file(
                 content=self.cert_manager.deserialization(node.superset_certificate),

src/remote.py

@@ -154,10 +154,12 @@ def upload_directory(self, local_directory_path: str, remote_directory_path: str
     def create_directory(self, remote_directory_path: str) -> None:
         self.sftp_client.mkdir(remote_directory_path)
 
-    def upload_file(self, content: str | bytes, remote_file_path: str) -> None:
+    def upload_file(self, content: str | bytes, remote_file_path: str, mode: int = 0o644) -> None:
         if isinstance(content, str):
             content = content.encode('utf-8')
-        self.sftp_client.putfo(io.BytesIO(content), remote_file_path)
+        with self.sftp_client.open(remote_file_path, 'wb') as remote_file:
+            remote_file.set_pmode(mode)
+            remote_file.write(content)
 
     def change_permissions_to_root(self, filepath: str) -> None:
         self.ssh_client.exec_command(f"chmod 600 {filepath}")