Enable optional TLS on nodecache metrics endpoint

[nuhakala]

Fixes #692. Chose to do the configuration with flags instead of extra config file because thought that it will be simpler and more in line with the project overall.

Adapted the implementation for CoreDNS metrics TLS support to nodecache. The original PR here coredns/coredns#7255

• TLS support optional (backward compatible)
• TLS can be configured through command line flags, including the key files and client certificate.
• Added tests

New command line flags

• tls-cert-file default value /etc/ssl/tls.crt
• tls-private-key-file default value /etc/ssl/tls.key
• client-auth-type default value NoClientCert
• client-ca-file default value empty
• tls-min-version default value TLS version 13
• tls-enabled default value false

In order to use the feature, one needs to give as flag -tls-enabled=1. The defaults are used and the existence of TLS key-files is checked and error is thrown if no files are found. The defaults can be changed by using the corresponding flags.

[k8s-ci-robot]

Welcome @nuhakala!

It looks like this is your first PR to kubernetes/dns 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/dns has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @nuhakala. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: nuhakala
Once this PR has been reviewed and has the lgtm label, please assign damiansawicki for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-triage-robot]

Unknown CLA label state. Rechecking for CLA labels.

Send feedback to sig-contributor-experience at kubernetes/community.

/check-cla
/easycla

[linux-foundation-easycla]

• ✅login: nuhakala / (93f5941)

The committers listed above are authorized under a signed CLA.

[nuhakala]

@bowei @MrHohn Do you have time to review?

[nuhakala]

@bowei @MrHohn Can I get a review on this so that the PR can move forward?

[kashifest]

it would be great to have some reviews on this one and move it forward. /cc @DamianSawicki

[lentzi90]

/ok-to-test

[DamianSawicki]

it would be great to have some reviews on this one and move it forward. /cc @DamianSawicki

Personally, I won't be able to have a look at it at the moment.

I see 3 open PRs touching the cmd/node-cache directory (this one, #690, and #689). It could be really beneficial if authors of these PRs, with apparent expertise in node-cache, could cross-review each other's PRs. CC: @Michcioperz @johnbelamaric @zooneon

[peppi-lotta]

This PR is self-contained and primarily focuses on updates to metrics.go and metrics_test.go. The changes to main.go and cache_app.go are minimal and only introduce optional flags to support TLS encryption for the /metrics endpoint.

The implementation is designed to be non-intrusive and does not alter existing functionality. As such, reviewing this PR does not require familiarity with other open pull requests.

[k8s-ci-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.