Merge pull request #62789 from serathius/prometheus-secure

Automatic merge from submit-queue (batch tested with PRs 62632, 62789, 62512, 62848). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[prometheus addon] Use secure kubelet port

This PR changes port used by prometheus server to kubelet secure port. To access endpoints for metrics it adds "nodes/metrics" resource to rbac.
Previously it was not possible to authorize to kubelet in GCP, because Token Auth was disabled.
PR that enabled Token Auth in GCP https://github.com/kubernetes/kubernetes/pull/58178
```release-note
NONE
```
/cc @brancz @kawych

cluster/addons/prometheus/prometheus-configmap.yaml

@@ -37,11 +37,11 @@ data:
       relabel_configs:
       - action: labelmap
         regex: __meta_kubernetes_node_label_(.+)
-      - source_labels: [__address__]
+      scheme: https
-        action: replace
+      tls_config:
-        target_label: __address__
+        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-        regex: ([^:;]+):(\d+)
+        insecure_skip_verify: true
-        replacement: ${1}:10255
+      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 
     - job_name: kubernetes-nodes-cadvisor
       kubernetes_sd_configs:
@@ -49,11 +49,13 @@ data:
       relabel_configs:
       - action: labelmap
         regex: __meta_kubernetes_node_label_(.+)
-      - source_labels: [__address__]
+      - target_label: __metrics_path__
-        action: replace
+        replacement: /metrics/cadvisor
-        target_label: __address__
+      scheme: https
-        regex: ([^:;]+):(\d+)
+      tls_config:
-        replacement: ${1}:4194
+        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        insecure_skip_verify: true
+      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 
     - job_name: kubernetes-service-endpoints
       kubernetes_sd_configs:

cluster/addons/prometheus/prometheus-rbac.yaml

@@ -19,6 +19,7 @@ rules:
       - ""
     resources:
       - nodes
+      - nodes/metrics
       - services
       - endpoints
       - pods