mirror of
https://github.com/tailscale/tailscale.git
synced 2026-07-21 21:11:58 -04:00
b6713e9bc8
When running under the macOS sandbox, "tailscale configure kubeconfig" refused outright whenever $KUBECONFIG was set, assuming the path would not be writable. Yet when $KUBECONFIG was unset it happily relied on the home-relative-path entitlement to write to ~/.kube/config, so the two paths made inconsistent assumptions about what the sandbox can reach. Resolve the kubeconfig path first, then check whether the target file (or the nearest existing parent directory) is actually writable. Only report an error if it is not, and include macOS sandbox guidance in that error since a path outside the home directory is the likely cause. This lets a $KUBECONFIG that does point under the home directory work, rather than being rejected unconditionally. Fixes #20007 Change-Id: I9880363c38b981efaed7e97367851ddacf647be1 Signed-off-by: James Tucker <james@tailscale.com>