From 37863205eca4a0b4ed3ad3319c0dff234fb46510 Mon Sep 17 00:00:00 2001
From: David Anderson <danderson@tailscale.com>
Date: Wed, 1 Nov 2023 12:24:44 -0700
Subject: [PATCH] cmd/k8s-operator: strip credentials from client config in
 noauth mode

Updates tailscale/corp#15526

Signed-off-by: David Anderson <danderson@tailscale.com>
---
 cmd/k8s-operator/proxy.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cmd/k8s-operator/proxy.go b/cmd/k8s-operator/proxy.go
index ec1027e09..74cda258f 100644
--- a/cmd/k8s-operator/proxy.go
+++ b/cmd/k8s-operator/proxy.go
@@ -91,6 +91,9 @@ func maybeLaunchAPIServerProxy(zlog *zap.SugaredLogger, restConfig *rest.Config,
 	}
 	hostinfo.SetApp("k8s-operator-proxy")
 	startlog := zlog.Named("launchAPIProxy")
+	if mode == apiserverProxyModeNoAuth {
+		restConfig = rest.AnonymousClientConfig(restConfig)
+	}
 	cfg, err := restConfig.TransportConfig()
 	if err != nil {
 		startlog.Fatalf("could not get rest.TransportConfig(): %v", err)