Dumb question about kubeprism and the endpoints

[evanrich]

So reading the convo here: #8080, I'm a bit confused. I've enabled Kubeprism via the video and a patch (is there a way to verify kubeprism is actually running/working though?) but now I'm a little confused, as it says the control planes don't need to talk to it? so my questions are, using the following patch:

cluster:
  controlPlane:
    endpoint: https://127.0.0.1:7445

1.) do only the worker nodes need to point to the kubeprism address or do i also need to apply this patch to the control plane nodes too?
2.) do you patch the machine config so that it points to 127.0.0.1:7445?

and I guess a bonus question, does changing this update the following config sections for the api server?

 --api-audiences=https://k8s.server.tld:6443
 --service-account-issuer=https://k8s.server.tld:6443

Edit:
So i tried changing the worker nodes, that seemed ok, but when I tried editing the machine config on the Control Plane nodes, i got the following (I only did one to start):

W0317 06:21:08.006996       1 lease.go:265] Resetting endpoints for master service "kubernetes" to [192.168.xxx.10 192.168.xxx.11 192.168.xxx.12]
I0317 06:21:08.009741       1 controller.go:624] quota admission added evaluator for: endpoints
I0317 06:21:08.020918       1 controller.go:624] quota admission added evaluator for: endpointslices.discovery.k8s.io
E0317 06:21:21.287137       1 authentication.go:73] "Unable to authenticate the request" err="invalid bearer token"
E0317 06:21:21.295088       1 authentication.go:73] "Unable to authenticate the request" err="invalid bearer token"
E0317 06:21:31.349751       1 authentication.go:73] "Unable to authenticate the request" err="invalid bearer token"
E0317 06:22:01.350063       1 authentication.go:73] "Unable to authenticate the request" err="invalid bearer token"
E0317 06:22:20.139225       1 authentication.go:73] "Unable to authenticate the request" err="invalid bearer token"
E0317 06:22:20.147689       1 authentication.go:73] "Unable to authenticate the request" err="invalid bearer token"
E0317 06:22:21.309742       1 authentication.go:73] "Unable to authenticate the request" err="invalid bearer token"

is this expected? fwiw, the api audience and service-account-issuer changed to localhost:7445, so i answered my bonus question, but wanted to make sure the "invalid bearer token" was expected on just changing one node. If i change the others, does that go away? I changed it back to the old endpoint and the invalid bearer token message went away.

[smira]

You don't need to change anything except for enabling KubePrism on all nodes.