🌱 /pkg/proxy/server: handle /readyz and /livez outside of the auth chain

[s-urbaniak]

Summary

To simplify deployment we want the /readyz and /livez not be handled by the regular auth chain. This allows us to use simple httpGet kube probes.

Related issue(s)

Related helm chart update: kcp-dev/helm-charts#24

[s-urbaniak]

cc @sttts @hardys

[hardys]

/retest

failed to clone a repo so presumably temporary network disruption

[hardys]

/lgtm

Thanks for picking this up @s-urbaniak - for historical context, I didn't do this in #2178 because I was thinking we don't want any unauthenticated access to the proxy at all.

However I didn't consider liveness probes at that point (or more specifically that httpGet doesn't support client cert authentication), and after discussion it seems reasonable to expose these given there is a very low cost for hitting them (probably less than rejecting an unauthenticated request to any other path)

[sttts]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sttts

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/proxy/OWNERS [sttts]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ncdc]

kcp-dev/contrib-tmc#53
/retest

[ncdc]

PV flake, which has been fixed
/retest