apiserver :6443/readyz returns 401 status instead of expected 200 fails load balancer health check

[jeffmccune]

Hello. I'm replacing a 3 controller / 3 worker kubeadm cluster with a similar Talos cluster. The controller nodes are behind haproxy which is configured to health check each controller ip at https://${CONTROLLER_IP}:6443/readyz. This worked great in kubeadm and still seems to be the standard recommendation from upstream in kube 1.29.

In Talos 1.6 /readyz returns 401 Unauthorized. How can I get this endpoint to return 200 with haproxy?

❯ kubectl get --raw='/readyz'
ok

❯ curl -k https://controller1:6443/readyz
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "Unauthorized",
  "reason": "Unauthorized",
  "code": 401
}

[smira]

This is expected with the kube-apiserver being more secure by default, and not serving anonymous access on the public port.

You can tweak that with apiserver configuration if you need to, you're looking towards anonymous-auth flag to be true: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/

[smira]

cluster:
  apiServer:
   extraArgs:
     anonymous-auth: "true"

[jeffmccune]

Thanks for the quick response smira, works like a charm!

❯ curl -k https://controller1:6443/readyz
ok