CAPD requires --anonymous-auth=true for the loadbalancer checks

[neoaggelos]

Summary

Some CIS hardening defaults in k8s-snap break the loadbalancer health checks for CAPD (probably also relevant for other infrastructure providers that provision L7 load balancers, e.g. AWS)

Update the CAPD cluster template to use --anonymous-auth=true on kube-apiserver

Notes

The health check endpoint that capd adds is https://github.com/kubernetes-sigs/cluster-api/blob/6ac336af578367a279018aba03eaedcac83f0e30/test/infrastructure/docker/internal/loadbalancer/config.go#L67

When paired with anonymous-auth, this results in the following error (from docker logs $cluster-lb container):

[WARNING] 170/171536 (78) : Server kube-apiservers/c1-control-plane-m88dx is DOWN, reason: Layer7 wrong status, code: 401, info: "Unauthorized", check duration: 107ms. 0 active and 0 backup servers left. 1 sessions active, 0 requeued, 0 remaining in queue.

Notes part 2

An alternative would be to use a custom haproxy config, but that seems far more complex to maintain (and it is not important for CAPD clusters)

[bschimke95]

LGTM