KEP-4377: Secured Prometheus metrics endpoints

[kannon92]

What type of PR is this?

/kind documentation

What this PR does / why we need it:

KEP for securing metrics with TLS.

Which issue(s) this PR fixes:

KEP for #4377

Special notes for your reviewer:

Does this PR introduce a user-facing change?

NONE

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: kannon92
Once this PR has been reviewed and has the lgtm label, please assign mimowo for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for kubernetes-sigs-kueue canceled.

Name	Link
🔨 Latest commit	570e57b
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-sigs-kueue/deploys/67bfd260b89d4c0008307f68

[kannon92]

/cc @tenzen-y @mimowo

[mimowo]

/assign @gabesaba
for the first pass

[gabesaba]

/unassign

As I won't be able to take a look until next week

[mimowo]

/assign @PBundyra
Can you make the first pass here?

[PBundyra]

/assign @PBundyra Can you make the first pass here?

Sure, on it

[PBundyra]

/lgtm
Thanks @kannon92!

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 72f730f0bc8f1f6ebf62e4c0c154b538fc6770f0

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[tenzen-y]

/retitle KEP-4377: Secured Prometheus metrics endpoints

[kannon92]

cc @camilamacedo86

If you have time, i'd appreciate your insight best practices for metrics security.

[mimowo]

Can you put a sentance or a paragraph on when the external certificates are used (IIUC as discussed in the thread when internalCertManager is disabled), and on the defaults (IIUC: /etc/kueue/certs, and the cert names)?

[kannon92]

I have a section called Controller changes below.