[GLBC] Support backside re-encryption (#519)

Support backside re-encryption

controllers/gce/examples/backside_https/app.yaml

@@ -0,0 +1,50 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: my-echo-deploy
+spec:
+  replicas: 2
+  template:
+    metadata:
+      labels:
+        app: echo
+    spec:
+      containers:
+      - name: echoserver
+        image: nicksardo/echoserver:latest
+        imagePullPolicy: Always
+        ports:
+        - name: echo-443
+          containerPort: 443
+        # readinessProbe:   # Health check settings can be retrieved from an HTTPS readinessProbe as well
+        #   httpGet:
+        #     path: /healthcheck   # Custom health check path for testing
+        #     scheme: HTTPS
+        #     port: echo-443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: my-echo-svc
+  annotations:
+      service.alpha.kubernetes.io/app-protocols: '{"my-https-port":"HTTPS"}'   # Must map port-name to HTTPS for the GCP ingress controller
+  labels:
+    app: echo
+spec:
+  type: NodePort
+  ports:
+  - port: 12345  # Port doesn't matter as nodeport is used for Ingress
+    targetPort: echo-443
+    protocol: TCP
+    name: my-https-port
+  selector:
+    app: echo
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: my-echo-ingress
+spec:
+  backend:
+    serviceName: my-echo-svc
+    servicePort: my-https-port

controllers/gce/examples/health_checks/README.md

@@ -1,6 +1,6 @@
 # Simple HTTP health check example
 
-The GCE Ingress controller adopts the readiness probe from the matching endpoints, provided the readiness probe doesn't require HTTPS or special headers.
+The GCE Ingress controller adopts the readiness probe from the matching endpoints, provided the readiness probe doesn't require special headers.
 
 Create the following app:
 ```console
@@ -67,8 +67,6 @@ You can confirm the health check endpoint point it's using one of 2 ways:
 
 A few points to note:
 * The readiness probe must be exposed on the port matching the `servicePort` specified in the Ingress
-* The readiness probe cannot have special requirements, like headers or HTTPS
+* The readiness probe cannot have special requirements like headers
 * The probe timeouts are translated to GCE health check timeouts
 * You must create the pods backing the endpoints with the given readiness probe. This *will not* work if you update the replication controller with a different readiness probe.
-
-