system:anonymous can access pods.metrics.k8s.io - how to prohibit this?

[cinimins]

Hello,

we have vCluster currently deployed using the Helm chart in version 0.25.2 (because we still need to use the k0s distro) and noticed that metrics can be accessed directly via the vcluster ingress without any authentication:

$ curl https://vcluster.local/apis/metrics.k8s.io/v1beta1/pods
{
  "kind": "PodMetricsList",
  "apiVersion": "metrics.k8s.io/v1beta1",
  "metadata": {},
  "items": [
    {
      "metadata": {
	    ...
      },
      "timestamp": "2025-10-15T09:37:46Z",
      "window": "1m6.055s",
      "containers": [
        {
          "name": "kafka",
          "usage": {
            "cpu": "25008698n",
            "memory": "1347532Ki"
          }
        },
        {
          "name": "jmx-exporter",
          "usage": {
            "cpu": "926196n",
            "memory": "57144Ki"
          }
        }
      ]
    },
	...
}

I was wondering how we could prohibit that.

Our first approach was setting controlPlane.distro.k0s.extraArgs: ["--anonymous-auth=false"], but apprently this argument is not recognized by the k0s binary.

What is the recommend way to deactivate this inside the vcluster? Maybe I could deactivate that in /run/k0s/k0s.yaml, but the Helm chart only seems to allow me to overwrite the entire file instead of adding/overwriting a single KV-pair.