nodelocaldns: allow binding metrics address to host IP

[cristicalin]

What type of PR is this?

/kind feature

What this PR does / why we need it:

This PR implements a boolean nodelocaldns_bind_metrics_host_ip that allows a deployer to ensure nodelocaldns prometheus listen interface is bound to the host IP instead of listening on all addresses. This is important to ensure that on multi-homed hosts we don't unnecessarily leak information on additional network interfaces.

For better control, deployers should also protect this using host based firewalls or endpoint policies with Calico.

Which issue(s) this PR fixes:

Fixes #7740

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Allow deployers to limit the interface on which nodelocaldns exposes its prometheus listening port.

[k8s-ci-robot]

Hi @cristicalin. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[oomichi]

/ok-to-test
/lgtm

[oomichi]

I had a question about the syntax {$FOO}, but that seems fine from https://coredns.io/manual/configuration/#environment-variables

[cristicalin]

Yes, that is the way Caddyfiles (the configuration file format used by CoreDNS) do interpolation.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cristicalin, floryut

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [floryut]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment