fix: enhance kubeconfig handling for NAS deployments to prevent permission issues

.gitea/workflows/nas-k3s-deploy.yml

@@ -112,7 +112,7 @@ name: Deploy NAS K3s
           - "true"
           - "false"
       image_tag:
-        description: "Docker image tag. Defaults to the pushed commit SHA first 8 chars."
+        description: "Docker image tag. Defaults to 'latest' (deploy whatever CI most recently published)."
         required: false
         default: ""
       keep_releases:
@@ -446,7 +446,7 @@ jobs:
 
           image_tag="${REQUESTED_IMAGE_TAG}"
           if [ -z "${image_tag}" ]; then
-            image_tag="$(git rev-parse --short=8 HEAD)"
+            image_tag="latest"
           fi
 
           case "${image_tag}" in
@@ -494,8 +494,8 @@ jobs:
           fi
 
           if ! bash deploy/scripts/gitea-registry-images.sh verify; then
-            echo "::error::Missing image(s) for commit ${IMAGE_TAG}. CI must publish images before CD."
-            echo "::error::Frontend images come from Frontend CI; backend/migrate images come from Backend CI."
+            echo "::error::Missing image(s) at tag '${IMAGE_TAG}' for: ${IMAGE_LIST}."
+            echo "::error::Run the matching CI workflow (Frontend CI / Backend CI) to publish images first."
             exit 1
           fi
 
@@ -640,11 +640,40 @@ jobs:
             fi
           }
 
+          # k3s writes kubeconfig at /etc/rancher/k3s/k3s.yaml mode 0600 root:root.
+          # Many NAS sudo setups elevate admin to a service user instead of root,
+          # so `sudo kubectl` may still hit "permission denied". Copy kubeconfig
+          # once into the SSH user's home and point KUBECONFIG at the copy.
+          ensure_kubeconfig() {
+            kubeconfig_target="${HOME:-/tmp}/.kube/config"
+            mkdir -p "$(dirname "${kubeconfig_target}")"
+
+            if [ -r /etc/rancher/k3s/k3s.yaml ]; then
+              cp /etc/rancher/k3s/k3s.yaml "${kubeconfig_target}"
+            else
+              kubeconfig_tmp="${kubeconfig_target}.tmp.$$"
+              if sudo_cmd cat /etc/rancher/k3s/k3s.yaml > "${kubeconfig_tmp}" 2>/dev/null && [ -s "${kubeconfig_tmp}" ]; then
+                mv "${kubeconfig_tmp}" "${kubeconfig_target}"
+              else
+                rm -f "${kubeconfig_tmp}"
+                echo "Cannot read /etc/rancher/k3s/k3s.yaml as $(whoami) or via sudo."
+                echo "On the NAS, fix once with one of:"
+                echo "  sudo chmod 0644 /etc/rancher/k3s/k3s.yaml"
+                echo "  sudo install -m 0640 -g admin /etc/rancher/k3s/k3s.yaml /etc/rancher/k3s/k3s.yaml"
+                echo "or restart k3s with --write-kubeconfig-mode 0644."
+                exit 1
+              fi
+            fi
+            chmod 600 "${kubeconfig_target}"
+            export KUBECONFIG="${kubeconfig_target}"
+          }
+          ensure_kubeconfig
+
           kubectl_cmd() {
             if command -v kubectl >/dev/null 2>&1; then
               kubectl "$@"
             elif command -v k3s >/dev/null 2>&1; then
-              sudo_cmd k3s kubectl "$@"
+              k3s kubectl "$@"
             else
               echo "Cannot find kubectl or k3s on NAS."
               exit 1