Since this is a new chunk of work that might be a little fiddly getting the permissions right, this task is to move the Toolforge metrics-server and kube-state-metrics services into the new metrics namespace with potentially their own PSPs or with the default psp, if that seems appropriate.
General guidelines would be the usual principle of least privilege and running the containers in a security context that specifies a non-root UID. It probably won't be that hard, but including a security context that runs as a UID other than root may or may not work for metrics-server, etc. It seems likely that they'll work ok since they don't need filesystem access to work.