Repository: kubernetes/kubernetes (language: go)

Issue:
`"failed to initialize nfacct client" err="nfacct sub-system not available"` logged when `k8s.io/kubernetes/pkg/proxy/metrics` module is initialized as non-root user
### What happened?

The `k8s.io/kubernetes/pkg/proxy/metrics` module now logs two errors during module initialization. Simply loading the module will cause two errors to be printed to stderr if the code is not run as root, or is run on a node without nfacct support. 

This is due to `newNFAcctMetricCollector` being used when creating Prometheus metrics during module variable initialization, which calls `klog.Errors()` if the nfacct client cannot be initialized.

This regression was introduced by:
* https://github.com/kubernetes/kubernetes/pull/125866

K3s ships all the various Kubernetes components bundled in a single multicall binary, which means that our `kubectl` now logs these errors when it is run as a non-root user.

### What did you expect to happen?

No error logs on module init

### How can we reproduce it (as minimally and precisely as possible)?

https://github.com/brandond/kube-proxy-repro

```golang
import (
	"k8s.io/kubernetes/cmd/kube-proxy/app"
)

func main() {
	_ = app.NewProxyCommand()
}
```

### Anything else we need to know?

cc @aroradaman @danwinship

### Kubernetes version

<details>

```console
$ kubectl version
Client Version: v1.31.0+k3s1
Kustomize Version: v5.4.2
Server Version: v1.31.0+k3s1
```

</details>


### Cloud provider

n/a

### OS version

n/a


### Install tools

n/a

### Container runtime (CRI) and version (if applicable)

n/a


### Related plugins (CNI, CSI, ...) and versions (if applicable)

n/a

area/proxy
sig/network


Discussion / hints:

Fix patch:
diff --git a/pkg/proxy/metrics/metrics.go b/pkg/proxy/metrics/metrics.go
index 96b4f42487fff..d65e7c29d0f04 100644
--- a/pkg/proxy/metrics/metrics.go
+++ b/pkg/proxy/metrics/metrics.go
@@ -147,8 +147,7 @@ var (
 		"kubeproxy_iptables_ct_state_invalid_dropped_packets_total",
 		"packets dropped by iptables to work around conntrack problems",
 		nil, nil, metrics.ALPHA, "")
-	IPTablesCTStateInvalidDroppedNFAcctCounter   = "ct_state_invalid_dropped_pkts"
-	iptablesCTStateInvalidDroppedMetricCollector = newNFAcctMetricCollector(IPTablesCTStateInvalidDroppedNFAcctCounter, iptablesCTStateInvalidDroppedPacketsDescription)
+	IPTablesCTStateInvalidDroppedNFAcctCounter = "ct_state_invalid_dropped_pkts"
 
 	// IPTablesRestoreFailuresTotal is the number of iptables restore failures that the proxy has
 	// seen.
@@ -273,8 +272,7 @@ var (
 		"kubeproxy_iptables_localhost_nodeports_accepted_packets_total",
 		"Number of packets accepted on nodeports of loopback interface",
 		nil, nil, metrics.ALPHA, "")
-	LocalhostNodePortAcceptedNFAcctCounter     = "localhost_nps_accepted_pkts"
-	localhostNodePortsAcceptedMetricsCollector = newNFAcctMetricCollector(LocalhostNodePortAcceptedNFAcctCounter, localhostNodePortsAcceptedPacketsDescription)
+	LocalhostNodePortAcceptedNFAcctCounter = "localhost_nps_accepted_pkts"
 )
 
 var registerMetricsOnce sync.Once
@@ -299,9 +297,11 @@ func RegisterMetrics(mode kubeproxyconfig.ProxyMode) {
 
 		switch mode {
 		case kubeproxyconfig.ProxyModeIPTables:
+			iptablesCTStateInvalidDroppedMetricCollector := newNFAcctMetricCollector(IPTablesCTStateInvalidDroppedNFAcctCounter, iptablesCTStateInvalidDroppedPacketsDescription)
 			if iptablesCTStateInvalidDroppedMetricCollector != nil {
 				legacyregistry.CustomMustRegister(iptablesCTStateInvalidDroppedMetricCollector)
 			}
+			localhostNodePortsAcceptedMetricsCollector := newNFAcctMetricCollector(LocalhostNodePortAcceptedNFAcctCounter, localhostNodePortsAcceptedPacketsDescription)
 			if localhostNodePortsAcceptedMetricsCollector != nil {
 				legacyregistry.CustomMustRegister(localhostNodePortsAcceptedMetricsCollector)
 			}


Test patch: