fix(k3s): scp kubeconfig as ubuntu user on kyber

[shunkakinoki]

Summary

Galactica's local user is shunkakinoki, kyber's is ubuntu. After #1738 / #1739 landed galactica's pubkey in kyber's ~ubuntu/.ssh/authorized_keys (correct - that's the home-manager target user on kyber), but activate-client.sh still scp'd as galactica's local username and got Permission denied (publickey).

Verified end-to-end on galactica with this branch: bash config/k3s/activate-client.sh now logs kubeconfig synced from ubuntu@kyber.tail950b36.ts.net and writes the file.

There's a separate unrelated issue with the kubeconfig still containing https://127.0.0.1:6443 (server-side sed rewrite in activate.sh doesn't seem to have run) and a stale TLS cert that needs regen on kyber - both deferred from this PR per request.

Test plan

• shellspec spec/activate_k3s_client_spec.sh -> 10 examples, 0 failures
• shellcheck config/k3s/activate-client.sh clean
• Live run on galactica: sync succeeds with the new username

---

Summary by cubic

Fix k3s client kubeconfig sync by scp'ing as ubuntu@kyber.tail950b36.ts.net. This matches the authorized_keys user and resolves Permission denied (publickey).

• Bug Fixes
  • Set REMOTE_HOST to ubuntu@kyber.tail950b36.ts.net in activate-client.sh.
  • Added a spec to assert the script connects as the ubuntu user.

^{Written for commit fa61ef6. Summary will update on new commits.}

[indent-zero]

PR Summary

Fixes a kubeconfig sync failure between galactica and kyber: galactica's home-manager k3s-client activation runs as shunkakinoki, so scp defaulted to that username and was rejected by publickey because kyber's activate.sh places the authorized key (and the kubeconfig) under /home/ubuntu. Hardcoding the SCP target to ubuntu@kyber... aligns the connection with the user that actually owns authorized_keys on kyber, and a shellspec assertion locks in the convention.

• config/k3s/activate-client.sh: change REMOTE_HOST from kyber.tail950b36.ts.net to ubuntu@kyber.tail950b36.ts.net so scp/log lines target the correct remote user.
• spec/activate_k3s_client_spec.sh: add a kubeconfig fetch assertion that REMOTE_HOST= includes ubuntu@kyber.tail950b36.ts.net.

Issues

No issues found.

CI Checks

Waiting for CI checks...

[mesa-dot-dev]

You do not have enough credits to review this pull request. Please purchase more credits to continue.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 25f50ac0-0a37-4857-9be5-399d7e4a8589

📥 Commits

Reviewing files that changed from the base of the PR and between 595be68 and fa61ef6.

📒 Files selected for processing (2)

• config/k3s/activate-client.sh
• spec/activate_k3s_client_spec.sh

---

📝 Walkthrough

Summary by CodeRabbit

• Chores

  • Refined k3s client activation configuration to enhance remote host connection handling and improve deployment system reliability.

• Tests

  • Added test coverage to verify proper authentication mechanisms when connecting to remote deployment targets.

Walkthrough

The pull request updates the k3s client activation script to include an SSH username in the remote host address, changing REMOTE_HOST from a hostname-only string to a user-prefixed address (ubuntu@kyber.tail950b36.ts.net). A corresponding test assertion verifies this configuration change.

Changes

K3s Client SSH Configuration

Layer / File(s)	Summary
Remote Host SSH Configuration config/k3s/activate-client.sh	REMOTE_HOST now includes SSH username prefix, changing from kyber.tail950b36.ts.net to ubuntu@kyber.tail950b36.ts.net for scp-based kubeconfig retrieval.
Test Verification spec/activate_k3s_client_spec.sh	New test assertion verifies that REMOTE_HOST uses the ubuntu@kyber.tail950b36.ts.net format.

Possibly related PRs

• shunkakinoki/dotfiles#1517: Both PRs update the Kyber host user to "ubuntu" — the main PR prefixes the SSH host in the k3s activation script with "ubuntu@", while the retrieved PR changes default username to "ubuntu" in Nix configs.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A username now travels with the host address,
SSH connection gains explicit finesse,
Ubuntu awaits the kubeconfig call,
Tailscale DNS routes it through the wall,
Tests confirm the path both clear and small.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: fixing the k3s client to use the ubuntu user when copying the kubeconfig file from kyber.
Description check	✅ Passed	The description is directly related to the changeset, providing detailed context about the permission denied issue, the fix applied, testing performed, and known deferred issues.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/k3s-client-username-and-cert-regen

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mesa-dot-dev]

Mesa Description

TL;DR

Fixed K3s client configuration issue where kubeconfig SCP failed due to incorrect username, now using ubuntu user on kyber.

What changed?

• Modified activate-client.sh to use the ubuntu username when SCPing the kubeconfig from kyber.

^{Description generated by Mesa. Update settings}

[cubic-dev-ai]

No issues found across 2 files

[gemini-code-assist]

Code Review

This pull request updates the REMOTE_HOST variable in the activate-client.sh script to include the ubuntu user and adds a corresponding test case in the specification file to verify this change. I have no feedback to provide.