custom-error-pages: Add an ability to disable "/metrics", "/healthz" and "/debug/vars" endpoints
The custom-error-pages backend does it job pretty well, however during a security scan it was detected that it exposes three endpoints:
/metrics
/healthz
/debug/vars
/metrics and /healthz are implemented by https://github.com/kubernetes/ingress-nginx/blob/499dbf57af5d0d7eb2fdb298cc89b5f4bf179854/images/custom-error-pages/rootfs/main.go#L78
/debug/vars at a first sight seems to be coming with github.com/prometheus/client_golang which includes expvar: https://pkg.go.dev/expvar
Especially the first and last ones expose information that might be considered as 'sensitive' by some organizations. Hence why I would like to ask for a feature toggle that would allow to disable those endpoints. It is to be considered if those should be exposed by default or not.
Source: kubernetes/ingress-nginx