LOG-9375: Enhance the prometheus exporter with SAR auth strategy

[jcantrill]

This PR:

• Adds auth.strategy 'sar' (SubjectAccessReview) to the prometheus export sink
• Allows the sink to be protected by a well-known kubernetes pattern

Tested by granting the collector service account the permissions identified in the API notes and configuring like:

    [sinks.prometheus_output.auth]
    strategy = "sar"
    path = "/metrics"
    verb = "get"

Ref: https://redhat.atlassian.net/browse/LOG-9375

cc @vparfonov

[openshift-ci-robot]

@jcantrill: This pull request references LOG-9375 which is a valid jira issue.

Details

In response to this:

This PR:

• Adds auth.strategy 'sar' (SubjectAccessReview) to the prometheus export sink
• Allows the sink to be protected by a well-known kubernetes pattern

Tested by granting the collector service account the permissions identified in the API notes and configuring like:

   [sinks.prometheus_output.auth]
   strategy = "sar"
   path = "/metrics"
   verb = "get"

Ref: https://redhat.atlassian.net/browse/LOG-9375

cc @vparfonov

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jcantrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jcantrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jcantrill]

/label tide/merge-method-squash

[openshift-ci]

@jcantrill: The label(s) tide/merge-method-squash cannot be applied, because the repository doesn't have them.

Details

In response to this:

/label tide/merge-method-squash

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[jcantrill]

/test cargo-clippy-check

[openshift-ci]

@jcantrill: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/unit	c7a3408	link	true	/test unit

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.