Disable HTTP/2 by Default for Metrics endpoint to Mitigate CVE Risks

[anshuman-agarwala]

What would you like to be added (User Story)?

There is a security vulnerability in golang/net which can allow malicious authorized clients to DOS the kube-apiserver.
More information can be found in kubernetes/kubernetes#121197

Detailed Description

The workaround for this issue that other projects have adopted is to make http/2 optional using a flag.
More information about the cve:
GHSA-qppj-fm5r-hxr3
GHSA-4374-p667-p6c8

Anything else you would like to add?

No response

Label(s) to be applied

/kind feature
One or more /area label. See https://github.com/kubernetes-sigs/cluster-api/labels?q=area for the list of labels.

[k8s-ci-robot]

This issue is currently awaiting triage.

If CAPI contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[sbueringer]

Wondering if this should be discussed on the controller-runtime level

[anshuman-agarwala]

Hi @sbueringer,
Shall I open the same issue in controller-runtime?

[sbueringer]

I think that would be good

[chrischdi]

xref:

• Disable HTTP/2 by Default to Mitigate CVE Risks controller-runtime#3096

[sbueringer]

Same answer as on: kubernetes-sigs/controller-runtime#3096 (comment)

/close

@anshuman-agarwala Let us know if we're missing something

[k8s-ci-robot]

@sbueringer: Closing this issue.

In response to this:

Same answer as on: kubernetes-sigs/controller-runtime#3096 (comment)

/close

@anshuman-agarwala Let us know if we're missing something

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.