[Calvin S. (calvin197)]

What this PR does / why we need it:
Documents a risk-accepted, by-design security decision for the AgentBaker apiserver sidecar. Addresses Mythos security findings (tracked under ADO 37518878):

• No application-layer authentication (ADO 37518903) and plaintext HTTP / no TLS (ADO 37518917) — apiserver/routers.go registers handlers with only timeout and panic-recovery middleware (no JWT/mTLS/API-key check), and apiserver/apiserver.go serves via ListenAndServe (not ListenAndServeTLS). These are the same underlying root cause, reported twice by different scanner passes.

This is not fixed in code because it's intentional: the apiserver is an internal-only sidecar invoked solely by the AKS RP control plane over the cluster-internal network, never exposed publicly. The enforced security boundary is network isolation (pod/cluster network policy) configured in the RP deployment — outside this repo, not app-layer auth. The handlers are stateless template generators that don't read tenant secrets. Adding real auth (mTLS/token-based) would require a cert/token issuance-and-rotation mechanism plus a coordinated change on the RP caller side (a different repo/system) — out of scope for a security-hardening pass.

This PR adds in-place code comments at NewRouter and ListenAndServe documenting the risk-acceptance rationale and a clear instruction that authentication middleware must be added if this router is ever exposed beyond the trusted RP-only network boundary. No functional/behavioral change. Validated with go build, go vet, and go test ./apiserver/... (all pass).

Which issue(s) this PR fixes:

Fixes #

ADO work items (msazure/CloudNativeCompute): 37518903, 37518917 (parent: 37518878)

[github-actions]

PR Title Lint Failed ❌

Current Title: Security/document apiserver authn risk

Your PR title doesn't follow the expected format. Please update your PR title to follow one of these patterns:

Conventional Commits Format:

• feat: add new feature - for new features
• fix: resolve bug in component - for bug fixes
• docs: update README - for documentation changes
• refactor: improve code structure - for refactoring
• test: add unit tests - for test additions
• chore: remove dead code - for maintenance tasks
• chore(deps): update dependencies - for updating dependencies
• ci: update build pipeline - for CI/CD changes

Guidelines:

• Use lowercase for the type and description
• Keep the description concise but descriptive
• Use imperative mood (e.g., "add" not "adds" or "added")
• Don't end with a period

Examples:

• ✅ feat(windows): add secure TLS bootstrapping for Windows nodes
• ✅ fix: resolve kubelet certificate rotation issue
• ✅ docs: update installation guide
• ❌ Added new feature
• ❌ Fix bug.
• ❌ Update docs

Please update your PR title and the lint check will run again automatically.

[github-actions]

Windows Unit Test Results

  3 files   18 suites   52s ⏱️
563 tests 563 ✅ 0 💤 0 ❌
585 runs  585 ✅ 0 💤 0 ❌

Results for commit 085709f.

[github-actions]

Package	Line Rate	Health
test	0%	❌
windows	27%	❌
staging_cse_windows Package 1	65%	➖
debug	0%	❌
provisioningscripts	2%	❌
parts_windows Package 1	73%	➖
Summary	38% (1652 / 6834)	❌

[Copilot]

🔵 Needs a closer look

Deployment and security owners must confirm the external isolation, boundary TLS/authentication, and risk-acceptance claims.

No open issues 🎉

What changed in this PR

Documents the security risk-acceptance rationale for the AgentBaker apiserver sidecar’s lack of application-layer authentication and use of plaintext HTTP. Changes are comment-only; runtime behavior is unchanged.

Changes:

• Explains reliance on externally configured RP network isolation.
• Requires authentication middleware if the router is exposed beyond the trusted boundary.
• Adds the stated boundary TLS/authentication rationale beside ListenAndServe.

File	Description
apiserver/​routers.go	Documents authentication rationale and requirements for broader exposure.
apiserver/​apiserver.go	Documents intentional plaintext HTTP and stated external security controls.

_{Review effort: Balanced}

[github-actions]

Package	Line Rate	Health
shellspec spec	28%	❌
Summary	28% (4591 / 16082)	❌