Kubelet Readonly Port

[gambol99]

The current implementation does not permit the user to specify the kubelet read-only port (which unset defaults to 10255). For security reasons we need this port switched off i.e. 0. This PR retains the default behavior but adds the readOnlyPort as an option for those whom need to override.

   podInfraContainerImage: gcr.io/google_containers/pause-amd64:3.0
   podManifestPath: /etc/kubernetes/manifests
+  readOnlyPort: 0
   registerSchedulable: false
   requireKubeconfig: true

And tested on the box

core@ip-10-250-34-23 ~ $ egrep -o 'read-only-port=[0-9]+' /etc/sysconfig/kubelet 
read-only-port=0

[gambol99]

/assign @chrislovecnm
/assign @justinsb

[gambol99]

a little bit of discussion here kubernetes/kubernetes#12968 on it ... but essentially we don't want pods to be able to iterate our nodes and discover information on whats running, settings, environment variables etc etc

[chrislovecnm]

Is heapster using this port at all?

[gambol99]

hi @chrislovecnm ... yes, heapster use's this endpoint to grab metrics ..

[KashifSaadat]

LGTM

[justinsb]

/lgtm

[k8s-github-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gambol99, justinsb

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

• OWNERS [justinsb]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[k8s-github-robot]

/test all [submit-queue is verifying that this PR is safe to merge]

[k8s-github-robot]

Automatic merge from submit-queue