kubeadm: support specifying HTTP endpoints for external etcd, allowing users to separate gRPC and HTTP traffic for etcd

[SataQiu]

What type of PR is this?

/kind feature

What this PR does / why we need it:

kubeadm: support specifying HTTP endpoints for external etcd.

Which issue(s) this PR is related to:

Fixes kubernetes/kubeadm#3234

Special notes for your reviewer:

Does this PR introduce a user-facing change?

kubeadm: Add `HTTPEndpoints` field to `ClusterConfiguration.Etcd.ExternalEtcd` that can be used to configure the HTTP endpoints for etcd communication in v1beta4. This field is used to separate the HTTP traffic (such as /metrics and /health endpoints) from the gRPC traffic handled by Endpoints. This separation allows for better access control, as HTTP endpoints can be exposed without exposing the primary gRPC interface. Corresponds to etcd's `--listen-client-http-urls` configuration. If not provided, Endpoints will be used for both gRPC and HTTP traffic.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: SataQiu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/kubeadm/OWNERS [SataQiu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[neolit123]

the existing endpoints list is validated to have http protocol in the URLs.

i think this is missing some validation in:

https://github.com/SataQiu/kubernetes/blob/c080adc2364aee7a275a9cccaf96ca8eef785c2b/cmd/kubeadm/app/apis/kubeadm/validation/validation.go#L332C29-L332C41

• endpoints should be validated to be non-empty and to have https?
• if httpenpoints is not empty we should also validate it for https?

[neolit123]

new types should be documented in doc.go following the similar pattern from before explaining in what release it was added.

[SataQiu]

Updated. httpenpoints can be http instead of https.

[neolit123]

/hold
for review

[pacoxu]

/priority important-soon
/triage accepted

[SataQiu]

/retest

[neolit123]

i will review again later today or tomorrow morning.

[HirazawaUi]

I'd like to know if we have test jobs based on this PR, or if tests have been run locally. The code looks great, but we still need to verify that it functions correctly. Running tests would also help us validate whether HTTPEndpoints and Endpoints provide full compatibility. If they aren't fully compatible, it could potentially cause issues.

[HirazawaUi]

Suggested change

	out.Endpoints = *(*[]string)(unsafe.Pointer(&in.Endpoints))
	// set the HTTPEndpoints to the same as the Endpoints
	// this is to maintain backwards compatibility with the v1beta3 API
	out.HTTPEndpoints = *(*[]string)(unsafe.Pointer(&in.Endpoints))
	out.Endpoints = *(&in.Endpoints)
	// set the HTTPEndpoints to the same as the Endpoints
	// this is to maintain backwards compatibility with the v1beta3 API
	out.HTTPEndpoints = *(&in.Endpoints)

will be simper?

[HirazawaUi]

This appears to be behavior that is incompatible with previous versions (previously we did not validate whether the length of Endpoints was 0). However, given that Endpoints should not be empty, this should not pose an issue.