[release-v1.17] Keep queue-proxy admin server on HTTP for PreStop hooks (#16163)

[Fedosin]

What this PR does / why we need it:

The queue-proxy admin server now always serves HTTP on port 8022, even when system-internal-tls is enabled. This simplifies the PreStop hook configuration and fixes graceful shutdown issues.

Changes:

• Queue-proxy admin server always uses HTTP, only main server uses TLS
• PreStop hooks always use HTTP scheme (removed dynamic configuration)
• Updated tests to reflect that admin server is always HTTP

Why this approach:

• PreStop hooks are called by kubelet locally within the pod (localhost)
• No network traffic leaves the pod, so TLS isn't needed for security
• Simpler implementation with no dynamic scheme configuration
• Prevents TLS handshake errors during pod shutdown

This fixes the issue where pods would receive HTTP 502 errors during scale-down operations when system-internal-tls was enabled. The error occurred because the PreStop hook was trying to connect with HTTP to a TLS-enabled admin server, causing immediate SIGTERM and dropped requests.

Cherry-picked from knative#16163

Which issue(s) this PR fixes:

JIRA: https://issues.redhat.com/browse/SRVKS-1332

Does this PR needs for other branches:

Does this PR (patch) needs to update/drop in the future?:

JIRA:

[dsimansk]

/approve
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dsimansk, Fedosin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [Fedosin,dsimansk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-cherrypick-robot]

@Fedosin: cannot checkout release-vX.Y: error checking out "release-vX.Y": exit status 1 error: pathspec 'release-vX.Y' did not match any file(s) known to git

Details

In response to this:

What this PR does / why we need it:

The queue-proxy admin server now always serves HTTP on port 8022, even when system-internal-tls is enabled. This simplifies the PreStop hook configuration and fixes graceful shutdown issues.

Changes:

• Queue-proxy admin server always uses HTTP, only main server uses TLS
• PreStop hooks always use HTTP scheme (removed dynamic configuration)
• Updated tests to reflect that admin server is always HTTP

Why this approach:

• PreStop hooks are called by kubelet locally within the pod (localhost)
• No network traffic leaves the pod, so TLS isn't needed for security
• Simpler implementation with no dynamic scheme configuration
• Prevents TLS handshake errors during pod shutdown

This fixes the issue where pods would receive HTTP 502 errors during scale-down operations when system-internal-tls was enabled. The error occurred because the PreStop hook was trying to connect with HTTP to a TLS-enabled admin server, causing immediate SIGTERM and dropped requests.

Cherry-picked from knative#16163

Which issue(s) this PR fixes:

JIRA: https://issues.redhat.com/browse/SRVKS-1332

Does this PR needs for other branches:

Does this PR (patch) needs to update/drop in the future?:

JIRA:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.