Remove kube-rbac-proxy

[sbueringer]

/kind cleanup

According to the v1alpha4 migration documentation kube-rbac-proxy should be removed: https://cluster-api.sigs.k8s.io/developer/providers/v1alpha3-to-v1alpha4

• cluster-api-provider-azure version: main

[CecileRobertMichon]

@mboersma @devigned how would this affect telemetry (if at all)? Are we currently using kube-rbac-proxy?

[CecileRobertMichon]

/assign

[mboersma]

I don't think this would affect our telemetry stack.

[sbueringer]

I don't know enough about CAPZ to assess the consequences but in CAPI it hat the following effect:

• before kube-rbac-proxy was removed the metrics could be scraped via the kube-rbac-proxy (but only authenticated)
• now metrics cannot be scraped at least when using the release manifests directly, because kube-rbac-proxy is gone and we're binding the metrics port on localhost (https://github.com/kubernetes-sigs/cluster-api/blob/main/config/manager/manager.yaml#L24)

That was the result of the decisions to drop kube-rbac-proxy and only bind the metrics to locahost for security reasons (kubernetes-sigs/cluster-api#4640 (review)). There is a PR in the main repo to document how to enable metrics scraping (kubernetes-sigs/cluster-api#4247) but it's stale.

In the core CAPI e2e tests we simply change the bind address to be able to scrape the metrics during the tests: https://github.com/kubernetes-sigs/cluster-api/blob/main/test/e2e/config/docker.yaml#L53-L54

[CecileRobertMichon]

I tested locally with tilt and I was still able to see traces in Jaeger, will open a PR shortly.

[sbueringer]

Makes sense, this only affects metrics :)