feat: run EKS apiserver with anonymous-auth=false (CIS) (#447)

Flip the k3s server apiserver to anonymous-auth=false. The only
consumer of the anonymous path was mulga-eks-state-report's /healthz
probe; switch it to an authenticated kubectl get --raw=/healthz through
the node admin kubeconfig (an unauthenticated curl now returns 401).
The NLB target group uses a TCP health check, and the host-side
reconciler rides the authenticated NATS state-report, so neither
depends on the anonymous apiserver path.

scripts/images/eks-node/mulga-eks-state-report.sh

@@ -36,7 +36,9 @@ KUBECONFIG=${KUBECONFIG:-/etc/rancher/k3s/k3s.yaml}
 export KUBECONFIG
 
 publish_report() {
-    if curl -sk --max-time 3 https://127.0.0.1:6443/healthz | grep -q '^ok$'; then
+    # Probe /healthz through the node's admin kubeconfig (apiserver runs
+    # anonymous-auth=false, CIS): an unauthenticated curl would return 401.
+    if kubectl get --raw='/healthz' 2>/dev/null | grep -q '^ok$'; then
         health=ok
         # Count Ready nodes only — k3s retains terminated workers as NotReady
         # until manually pruned, so a raw node count never drops on scale-down.

spinifex/handlers/eks/k3s_server_vm.go

@@ -430,7 +430,9 @@ func buildK3sUserData(in K3sServerInput) string {
 
 	// First server uses cluster-init (embedded etcd); join servers set `server: <first>` + token.
 	// etcd-expose-metrics: surfaces etcd fsync/commit latency on 127.0.0.1:2381/metrics.
-	// anonymous-auth=true: reconciler probes /healthz unauthenticated to gate ACTIVE; RBAC limits exposure.
+	// anonymous-auth=false (CIS): cluster health rides the authenticated NATS
+	// state-report (probes /healthz via the node's admin kubeconfig), not an
+	// unauthenticated apiserver probe; the NLB target group uses a TCP health check.
 	// traefik+servicelb+local-storage are always disabled for AWS LB Controller parity.
 	var configLines []string
 	if in.ServerURL == "" {
@@ -486,7 +488,7 @@ func buildK3sUserData(in K3sServerInput) string {
 		"  - service-account-signing-key-file="+k3sOIDCSigningKeyPath,
 		"  - service-account-issuer="+in.OIDCIssuer,
 		"  - api-audiences=sts.amazonaws.com",
-		"  - anonymous-auth=true",
+		"  - anonymous-auth=false",
 		"  - authentication-token-webhook-config-file="+k3sTokenWebhookKubeconfigPath,
 		"  - authentication-token-webhook-cache-ttl=5m",
 		// v1: default v1beta1 rejects authentication.k8s.io/v1 TokenReview response (401).