The LMA services (grafana, prometheus, kubedash, etc) should all be protected with basic auth. This will require a few things:

• Remove www prefix from kube-system-ingress.yaml.j2
• Add one hosts entry per host to kube-system-ingress.yaml.j2
• Generate basic auth during API server startup (and update with each API server password change)