[release-1.32] Fix local password validation when bind-address is set

[brandond]

Proposed Changes

• Backport Fix local password validation when bind-address is set #11607

Following a review from the security team, #11471 added a check to only allow node-password validation for the local node to be bypassed during startup if the request came from the loopback address. However, if bind-address is set, then the local agent will use the specified address instead of the loopback address when bootstrapping. This causes cert requests from the local agent to fail until the apiserver is up.

This is mostly fine here in k3s, it just makes the server start up a bit slower - but it breaks use of bind-address on RKE2 because the apiserver cannot come up until the agent (kubelet) is up.

Types of Changes

bugfix

Verification

• go test
• will add e2e in rke2 as well

Testing

Yes

Linked Issues

• [Release-1.32] - Improve test coverage of supervisor HTTP API #11539
• https://github.com/rancher/security-team/issues/1097

User-Facing Change

Further Comments

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 42.77%. Comparing base (0b41471) to head (abc1542).
Report is 1 commits behind head on release-1.32.

❗ There is a different number of reports uploaded between BASE (0b41471) and HEAD (abc1542). Click for more details.

HEAD has 2 uploads less than BASE

Flag	BASE (0b41471)	HEAD (abc1542)
unittests	1	0
e2etests	8	7

Additional details and impacted files

@@               Coverage Diff                @@
##           release-1.32   #11610      +/-   ##
================================================
- Coverage         50.11%   42.77%   -7.34%     
================================================
  Files               185      167      -18     
  Lines             19265    18652     -613     
================================================
- Hits               9654     7979    -1675     
- Misses             8227     9343    +1116     
+ Partials           1384     1330      -54     

Flag	Coverage Δ
e2etests	40.58% <100.00%> (-3.80%)	⬇️
inttests	35.17% <100.00%> (-0.04%)	⬇️
unittests	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.