If you don't want to allow anonymous requests to the apiserver, your options are:

• provide authentication credentials to the component performing the health check
• OR, switch the health check to a TCP ping (not recommended, since it means it would treat any TCP connection as healthy, even when /healthz was returning unhealthy)
• OR, expose an unsecured port and make your health check use that (not recommended, since it exposes an access method that gives full API access via an http port)