Using admin endpoint for metrics is insecure

[erikschul]

IIUC, it is common practice to expose /ready and /stats/prometheus using the admin endpoint.
But this also exposes admin privileges, like stopping the server.
Any compromised Prometheus scraper could stop Envoy services and cause a severe outage (across all scraped Envoy services).

Proposal:
Implement configuration for enabling a minimal service that serves only /ready and /stats/* endpoints.

Current workaround:

• Configure localhost cluster.
• Configure listener with limited routes:

routes:
  - match: { prefix: "/stats/prometheus"}
    route: { cluster: admin_cluster }
  - match: { prefix: "/ready"}
    route: { cluster: admin_cluster }
  - match: { prefix: "/"}
    direct_response:
      status: 404

See also: https://github.com/envoyproxy/gateway/blob/7ad22df2817b126c95eb1d36a732da872519468e/internal/xds/bootstrap/bootstrap.yaml.tpl#L65

Kubernetes can poll /ready using localhost, so that's less of a problem, but if /ready needs to be consumed by a downstream service, it would be equally insecure.

[phlax]

cc @jmarantz