Create firewall rule, update certs when secrets are updated

[bprashanth]

Fixes #1 on https://github.com/kubernetes/contrib/blob/master/ingress/controllers/gce/BETA_LIMITATIONS.md.

Also allows certificate update when the Kubernetes secret changes, and contains changes in preperation for running the controller on the master.

Assigning to Minhan, @kubernetes/goog-cluster fyi

[bprashanth]

@freehan tests passed

[freehan]

nit: add link to doc here https://cloud.google.com/compute/docs/load-balancing/health-checks#health_check_source_ips_and_firewall_rules

I have no idea where is it come from in my first glance.

[freehan]

LGTM. Sorry for keep you waiting.

[bprashanth]

Thanks!

[aknuds1]

Eagerly waiting on this to make its way into GKE. AFAICT TLS secret changes aren't currently applied.

[zhaytee]

Did this ever make it into GKE? It's a critical requirement for any production service using Ingress objects on GKE and LetsEncrypt TLS certs (which need to be rotated out every 90 days).

[gkop]

I just tried a simple apply on an edited secret, and yes it worked. The web console and gcloud compute ssl-certificates list reported the change right away, and the load balancer started serving it up in about 10 minutes. It would be nice to have this officially documented! Especially because there are other corners of k8s where changes to secrets aren't automatically picked up, like deployments, so we don't take it for granted.

[evanj]

I can verify the same thing, although in my case gcloud compute ssl-certificates list did not reflect the change immediately. It appeared that nothing happened, but after about ~10 minutes or so the change was applied in all the UIs and on the load balancer itself. Seamless!