SECURITY: The /health endpoint should be on a different port than the webhook

[NickLarsenNZ]

Problem

Currently, the /health endpoint runs on the same port as the webhook.

The webhook doesn't implement any authentication mechanism, which means you must expose the webhook to the rest of the cluster (and possibly outside the cluster, depending on the CNI) just to enable readiness/liveness probes.

It would be ideal to limit it to local connections from external-dns to external-dns-ionos-webhook when running as a side-car (ie: listen on 127.0.0.1). But this currently breaks the readiness/liveness probes.

Proposal:

Run a separate server (in a go routine) specifically for /health which can safely be exposed.

Similar to what is done (opt-in) for metrics: #70