Add Backends.SSLPassthrough attribute

[jcmoraisjr]

Add and configure Backends[].SSLPassthrough attribute based on server.SSLPassthrough attr and ingress.kubernetes.io/ssl-passthrough annotation.

[k8s-reviewable]

This change is 

[coveralls]

Coverage decreased (-0.2%) to 43.882% when pulling b59d49a on jcmoraisjr:jm-ssl-passthrough into 02cd3ce on kubernetes:master.

[aledbf]

@jcmoraisjr why are you adding this information in the backend? (this is already present)

[jcmoraisjr]

@aledbf this attribute is a single point of check if a backend is really a backend up to terminate SSL requests or not.

There are other two informations regarding SSL term:

1. Backend.Secure means Ingress will terminate SSL and reencrypt the connection to the backend.
2. Server.SSLPassthrough which willl also populate Configuration.PassthroughBackends is a server point of view that: a) doesn't validate a type mismatch - different servers with different SSLPassthrough configurations pointing to the same backend; and b) I cannot query the actual value from a backend iteration.

[aledbf]

Backend.Secure means Ingress will terminate SSL and reencrypt the connection to the backend.

Right. This only applies to ingress controllers that require the protocol to reach the upstream (like nginx). This is not required in haproxy. Just in case this does not means TLS termination in the POD, just that the pod must be contacted in port 443

a) doesn't validate a type mismatch - different servers with different SSLPassthrough configurations pointing to the same backend

This is correct. SSLPassthrough means terminate TLS in the pod. You could have the same backend in different ingress with different behavior. I don't think this should be a mutually exclusive option

[jcmoraisjr]

On HAProxy the backends (PODs) has two types of possible configurations: encrypt http data to https, or just proxy the request as is. I can use Backend.Secure to distinguish between them, however the proposal does a bit more:

• Check if the same backend (pod) is receiving SSLPassthrough and plain http. This is what I called a type mismatch.
• Avoid a HAProxy misconfiguration if the user configure both Backend.Secure and SSLPassthrough. If this wouldn't checked I'd connect a TCP frontend to a HTTP+TLS backend - the server would refuse to start.
• Warn about SSLPassthrough servers without a valid default backend and with path that wouldn't be used.

[aledbf]

/lgtm