metrics: add support for secure serving

[zhangzujian]

Pull Request

• Make sure you have followed Kube-OVN Code Style.

What type of this PR

Examples of user facing changes:

• Features
• Bug fixes
• Docs
• Tests

Which issue(s) this PR fixes

Without secure serving:

$ curl -i http://172.19.0.2:10661/metrics
HTTP/1.1 200 OK
Content-Type: text/plain; version=0.0.4; charset=utf-8; escaping=values
Date: Wed, 17 Jul 2024 09:56:16 GMT
Transfer-Encoding: chunked

# metrics...

With secure serving:

$ curl -ik https://172.19.0.2:10661/metrics
HTTP/2 403
cache-control: no-cache, private
content-type: application/json
x-content-type-options: nosniff
content-length: 224
date: Wed, 17 Jul 2024 09:57:42 GMT

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "forbidden: User \"system:anonymous\" cannot get path \"/metrics\"",
  "reason": "Forbidden",
  "details": {},
  "code": 403
}

$ token=`kubectl create token -n kube-system coredns`
$ curl -ik -H "Authorization: Bearer $token" https://172.19.0.2:10661/metrics
HTTP/2 403
cache-control: no-cache, private
content-type: application/json
x-content-type-options: nosniff
content-length: 249
date: Wed, 17 Jul 2024 09:59:06 GMT

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "forbidden: User \"system:serviceaccount:kube-system:coredns\" cannot get path \"/metrics\"",
  "reason": "Forbidden",
  "details": {},
  "code": 403
}

$ cat <<EOF | kubectl apply -f - 
apiVersion: v1
kind: ServiceAccount
metadata:
  name: metrics-client
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: metrics-client
roleRef:
  name: system:monitoring
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: metrics-client
    namespace: default
EOF
# OR
$ cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: metrics-client
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: metrics-client
rules:
  - nonResourceURLs:
      - "/metrics"
    verbs:
      - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: metrics-client
roleRef:
  name: metrics-client
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: metrics-client
    namespace: default
EOF

$ token=`kubectl create token metrics-client`
$ curl -ik -H "Authorization: Bearer $token" https://172.19.0.2:10661/metrics
HTTP/2 200
cache-control: no-cache, private
content-type: text/plain; version=0.0.4; charset=utf-8; escaping=values
date: Wed, 17 Jul 2024 10:04:41 GMT

# metrics...