<p>We have a kubernetes cluster (v1.10.2) that behaves very strange when we set to <strong>false</strong> the <strong>"anonymous-auth"</strong> flag.
We use the flannel network plugin and the logs in the flannel docker related to this issue are the following:</p>

<pre><code>E0515 09:59:13.396856       1 streamwatcher.go:109] Unable to decode an event from the watch stream: http2: server sent GOAWAY and closed the connection; LastStreamID=5, ErrCode=NO_ERROR, debug=""
E0515 09:59:13.397503       1 reflector.go:304] github.com/coreos/flannel/subnet/kube/kube.go:295: Failed to watch *v1.Node: Get https://10.96.0.1:443/api/v1/nodes?resourceVersion=167760&amp;timeoutSeconds=469&amp;watch=true: dial tcp 10.96.0.1:443: getsockopt: connection refused
E0515 09:59:14.398383       1 reflector.go:201] github.com/coreos/flannel/subnet/kube/kube.go:295: Failed to list *v1.Node: Get https://10.96.0.1:443/api/v1/nodes?resourceVersion=0: dial tcp 10.96.0.1:443: getsockopt: connection refused
E0515 09:59:15.419773       1 reflector.go:201] github.com/coreos/flannel/subnet/kube/kube.go:295: Failed to list *v1.Node: Get https://10.96.0.1:443/api/v1/nodes?resourceVersion=0: dial tcp 10.96.0.1:443: getsockopt: connection refused
E0515 09:59:16.420411       1 reflector.go:201] github.com/coreos/flannel/subnet/kube/kube.go:295: Failed to list *v1.Node: Get https://10.96.0.1:443/api/v1/nodes?resourceVersion=0: dial tcp 10.96.0.1:443: getsockopt: connection refused
</code></pre>

<p>Also, the events (<code>kubectl get events</code>) related to this issue seems to be:</p>

<pre><code>kube-system ........ kube-apiserver-{hash} Pod spec.containers{kube-apiserver} Warning Unhealthy kubelet, {...} Liveness probe failed: HTTP probe failed with statuscode: 401
</code></pre>

<p>This problem seems to happen randomly, every few minutes, the kubernetes cluster is not responsive during this time (<code>The connection to the server xx.xx.xx.xx was refused - did you specify the right host or port?</code>) for a few minutes (random again) and recovers by itself.</p>

Adi Fatol
<p>are you running the apiserver as a static pod? does it have a liveness check defined to call the /healthz endpoint? if so, that is likely run as an anonymous user and is failing when anonymous requests are disabled, causing the apiserver pod to be restarted</p>
