I have some ideas:

1. Modify the preHandleRequest method or needApiKeyCheck method in DashboardServer.java to ensure that the health check endpoint completely bypasses authentication
2. Modify amoro-deployment.yaml and add a request header with name: X-Request-Source, value: Web to bypass authentication (but it is unreasonable from a design logic point of view)
3. Modify amoro-deployment.yaml and add query parameters to provide API key and signature, but signature will change over time, so it is more difficult to handle.
   So the first solution is simple and practical, do you think there is any problem?

Yes, I prefer the first solution, AMS should keep a global white list for all kinds of requests and keep an addition one for specific kinds of requests if needed.

I will work on it