rancher-monitoring node-exporter and pushprox-clients listen on hostNetwork

[dkeightley]

Rancher Server Setup

• Rancher version: Affects all rancher-monitoring (v2) chart versions

Describe the bug
Open ports can be observed for 9796 (node-exporter) and 10011, 10012, etc. (push-proxy-clients) when running scans on a cluster with the rancher-monitoring chart installed

# netstat -plant
tcp6       0      0 :::10011                :::*                    LISTEN      27772/pushprox-clie
tcp6       0      0 :::10012                :::*                    LISTEN      3503825/pushprox-cl
tcp6       0      0 :::10013                :::*                    LISTEN      3504218/pushprox-cl
tcp6       0      0 :::10014                :::*                    LISTEN      28088/pushprox-clie

Expected Result
These ports are not needed for external access and should be bound only on internal interfaces or disabled

Additional context

• node-exporter appears to be solved with the value prometheus-node-exporter.hostNetwork: false, testing shows the prometheus targets are UP and scraping successfully with this applied.
• push-proxy-clients can be solved with a chart adjustment, currently proposed in Disable pushprox client metrics by default charts#1689

Note

The addition of hostPort is generated automatically by Kubernetes when hostNetwork: true is set, as such when upgrading an existing monitoring v2 node-exporter (to set hostNetwork: false) it will in fact continue to be accessible on the host network namespace. The daemonset will either need to be re-created or modified directly to remove hostPort

SURE-3198

[aiyengar2]

PR is out for review, @MKlimuszka @SheilaghM I have left this in To Triage to identify / confirm that we can commit to the v2.6.4 milestone for merging / testing this issue. Feel free to move it to In Review if it has been triaged!

[ronhorton]

Pass Verified in 2.6-head Commit ID 93f3e13

1. Created a downstream cluster
2. got keys for node from UI
3. installed net-tools on node
4. ran netstat -plant

result:
the unused ports mentioned in https://github.com/rancher/rancher/issues/36140#issue-1102420026 are no longer exposed

Note: was able to reproduce this issue prior to installing rancher-monitoring:100.1.1+up19.0.3