From a7241e01f9edffa97204665521278cd7c479aa06 Mon Sep 17 00:00:00 2001 From: Josh Siviour Date: Tue, 30 Jun 2026 09:21:07 +1000 Subject: [PATCH] feat: run EKS apiserver with anonymous-auth=false (CIS) (#447) Flip the k3s server apiserver to anonymous-auth=false. The only consumer of the anonymous path was mulga-eks-state-report's /healthz probe; switch it to an authenticated kubectl get --raw=/healthz through the node admin kubeconfig (an unauthenticated curl now returns 401). The NLB target group uses a TCP health check, and the host-side reconciler rides the authenticated NATS state-report, so neither depends on the anonymous apiserver path. --- scripts/images/eks-node/mulga-eks-state-report.sh | 4 +++- spinifex/handlers/eks/k3s_server_vm.go | 6 ++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/scripts/images/eks-node/mulga-eks-state-report.sh b/scripts/images/eks-node/mulga-eks-state-report.sh index f7464d3f9..19a2ccd88 100755 --- a/scripts/images/eks-node/mulga-eks-state-report.sh +++ b/scripts/images/eks-node/mulga-eks-state-report.sh @@ -36,7 +36,9 @@ KUBECONFIG=${KUBECONFIG:-/etc/rancher/k3s/k3s.yaml} export KUBECONFIG publish_report() { - if curl -sk --max-time 3 https://127.0.0.1:6443/healthz | grep -q '^ok$'; then + # Probe /healthz through the node's admin kubeconfig (apiserver runs + # anonymous-auth=false, CIS): an unauthenticated curl would return 401. + if kubectl get --raw='/healthz' 2>/dev/null | grep -q '^ok$'; then health=ok # Count Ready nodes only — k3s retains terminated workers as NotReady # until manually pruned, so a raw node count never drops on scale-down. diff --git a/spinifex/handlers/eks/k3s_server_vm.go b/spinifex/handlers/eks/k3s_server_vm.go index c89e45bb5..63871024c 100644 --- a/spinifex/handlers/eks/k3s_server_vm.go +++ b/spinifex/handlers/eks/k3s_server_vm.go @@ -430,7 +430,9 @@ func buildK3sUserData(in K3sServerInput) string { // First server uses cluster-init (embedded etcd); join servers set `server: ` + token. // etcd-expose-metrics: surfaces etcd fsync/commit latency on 127.0.0.1:2381/metrics. - // anonymous-auth=true: reconciler probes /healthz unauthenticated to gate ACTIVE; RBAC limits exposure. + // anonymous-auth=false (CIS): cluster health rides the authenticated NATS + // state-report (probes /healthz via the node's admin kubeconfig), not an + // unauthenticated apiserver probe; the NLB target group uses a TCP health check. // traefik+servicelb+local-storage are always disabled for AWS LB Controller parity. var configLines []string if in.ServerURL == "" { @@ -486,7 +488,7 @@ func buildK3sUserData(in K3sServerInput) string { " - service-account-signing-key-file="+k3sOIDCSigningKeyPath, " - service-account-issuer="+in.OIDCIssuer, " - api-audiences=sts.amazonaws.com", - " - anonymous-auth=true", + " - anonymous-auth=false", " - authentication-token-webhook-config-file="+k3sTokenWebhookKubeconfigPath, " - authentication-token-webhook-cache-ttl=5m", // v1: default v1beta1 rejects authentication.k8s.io/v1 TokenReview response (401).