Support HTTPS routing

[kyessenov]

We need to investigate how to route HTTPS traffic for pod ingress/egress traffic. TCP-level sufficient but maybe SNI works better.

[rshriram]

Why can't we go one level further and use the http connection manager (envoy) itself ? All we need are the cert files. We can use the kube secrets to pass them around. WDYT ? Am I missing something?

[kyessenov]

If we want to terminate HTTPS then that's great, but I was referring to the case when the application container doesn't trust us with the certs.

[kyessenov]

We need to add server-side SNI to Envoy to support opaque HTTPS services on the same ports.
See envoyproxy/envoy#95.

[kyessenov]

We went with TCP based routing instead of SNI for opaque HTTPS.
#312

[kyessenov]

Implemented (modulo port-sharing issue #237)