Thought about it for a few seconds, and yeah, I'm sticking with meh on this one. I do have a managed K8s cluster running on one of the major hosting services.

Thought about it for a few seconds, and yeah, I'm sticking with meh on this one. I do have a managed K8s cluster running on one of the major hosting services. It seems I can indeed hit the /healthz endpoint without auth. But I don't see any reason to care. First off, the control plane URL is a UUID tacked onto the hosting service's DNS. Good luck figuring out what it is starting from the URLs of the sites hosted on it. Even if you're my ISP or somehow otherwise in a position to observe traffic to the CP, good luck correlating it to what's actually hosted there. Yeah you can see that the cluster is healthy, but not much of anything else without auth AFAIK. Second, there's a tension between "network restrictions don't help that much, if your control system is actually secure, it should be secure enough to expose to the clearnet" and "defense in depth always, another layer never hurts anything". I'm leaning towards the first. You can always come up with an excuse to add another layer, but how much does it actually protect you from any reasonably plausible attacker? Lots of stuff far more sensitive and valuable than anything I've got has control interfaces exposed to the net like that, relying solely on the security of OpenSSH, K8s TLS cert system, etc for their protection. If somebody figured out how to bypass that, and chose to use the capability against my stuff, who's to say that any extra layers of security I could dream up would actually slow them down? I think it's not likely, and those extra layers are much more likely to trip me up and let me accidentally lock myself out than to stop any plausible attacker.