Add authz webhook matchcondition metrics

[ritazh]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #123276

Special notes for your reviewer:

Does this PR introduce a user-facing change?

kube-apiserver now reports the following metrics for authorization webhook match conditions:
- `apiserver_authorization_match_condition_evaluation_errors_total` counter metric labeled by authorizer type and name
- `apiserver_authorization_match_condition_exclusions_total` counter metric labeled by authorizer type and name
- `apiserver_authorization_match_condition_evaluation_seconds` histogram metric labeled by authorizer type and name

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

- [KEP]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/3221-structured-authorization-configuration

/sig auth
/assign @liggitt @palnabarun @enj

[palnabarun]

/retest-required

[liggitt]

There are no nodes that your pod can schedule to - check your requests, tolerations, and node selectors ((combined from similar events): 0/204 nodes are available: 17 Insufficient memory, 189 Insufficient cpu, 2 node(s) had untolerated taint

must be code freeze

/retest

[liggitt]

/lgtm
/approve
/hold for ack from @enj or @palnabarun

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 847d12f91e782742d7e2eff6f0e5a8e2242612ba

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, ritazh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/kubeapiserver/authorizer/OWNERS [liggitt]
• staging/src/k8s.io/apiserver/pkg/authorization/OWNERS [liggitt]
• staging/src/k8s.io/apiserver/plugin/pkg/authorizer/OWNERS [liggitt]
• test/OWNERS [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[liggitt]

/lgtm

/hold cancel
will take a post-merge review from @enj when he has time, but am unholding to unblock follow-up metric work

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: b200031cbbcf4be5622260c8f96a8f3ca5f8e3b3

[k8s-ci-robot]

@ritazh: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
check-dependency-stats	da82c53	link	false	/test check-dependency-stats

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[ritazh]

/retest

[liggitt]

unit test failure is #123632 (comment)