T158568 brought up that replica.my.cnf and .kube/config files for tool accounts are owned by the tool account's user and group, i. e. (in general) accessible by the tool maintainers (= group members), but due to the permissions -r-------- only readable by the tool account itself. This means that to read this file, tool maintainers must use become or sudo to switch to the tool account whereas for all other files they can just use their normal ways.

IMHO they should be -r--r----- instead, i. e. readable by the tool account and the members of its group. (NB: I don't have problems accessing these files with -r--------; I'm thinking about tool maintainers for whom the extra step is not just a nuisance.)

The permissions are set in modules/role/files/labs/db/maintain-dbusers.py:

120     f = os.open(file_path, os.O_CREAT | os.O_WRONLY | os.O_NOFOLLOW)
121     try:
122         os.write(f, replica_buffer.getvalue().encode('utf-8'))
123         # uid == gid
124         os.fchown(f, uid, uid)
125         os.fchmod(f, 0o400)
126 
127         # Prevent removal or modification of the credentials file by users
128         subprocess.check_output(['/usr/bin/chattr', '+i', file_path])
129     except:
130         os.remove(file_path)
131         raise
132     finally:
133         os.close(f)

and modules/toollabs/files/maintain-kubeusers:

242     f = os.open(path, os.O_CREAT | os.O_WRONLY | os.O_NOFOLLOW)
243     try:
244         os.write(f, json.dumps(config, indent=4, sort_keys=True).encode('utf-8'))
245         # uid == gid
246         os.fchown(f, int(user.id), int(user.id))
247         os.fchmod(f, 0o400)
248         logging.info('Write config in %s', path)
249     except:
250         logging.exception()
251         raise
252     finally:
253         os.close(f)

Note that in the case of maintain-dbusers.py, after T158420 is fixed, the permissions and the assigned group depend on whether the user is a tool account (0o440) or not (0o400) as non-tool accounts are all members of the wikidev group and no per-user groups exist for those users.