make kubeconfig only readable by root

roles/rke2/templates/config.yaml.j2

@@ -38,7 +38,7 @@ cloud-provider-name: "{{ cloud_provider_name }}"
 {% if node_type == 'server' %}
 resolv-conf: "{{ resolv_conf_server }}"
 {# disable-cloud-controller: true #}
-write-kubeconfig-mode: "0644"
+write-kubeconfig-mode: "0600"
 {% if kube_apiserver_args is defined and kube_apiserver_args | length > 0%}
 kube-apiserver-arg:
 {% for kube_apiserver_arg in kube_apiserver_args %}