Add support for enabling ssl_ciphers per host

[aramase]

This PR adds annotation option to configure ssl_ciphers. Using the annotation will set the ssl_ciphers at the server level and will apply to all paths on the host.
(http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)

fixes #1956

[k8s-reviewable]

This change is 

[aramase]

Example ingress resource:

→ cat /tmp/test.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: test-ing
  annotations:
    nginx.ingress.kubernetes.io/proxy-buffering: "on"
#    nginx.ingress.kubernetes.io/ssl-ciphers: "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"
#    nginx.ingress.kubernetes.io/client-body-buffer-size: 1k
spec:
  tls:
  - hosts:
    - test.net
  rules:
  - host: test.net
    http:
      paths:
      - path: /tea
        backend:
          serviceName: tea-svc
          servicePort: 80
  - host: test2.net
    http:
      paths:
      - path: /tea
        backend:
           serviceName: tea-svc
           servicePort: 80
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: test-ing2
  annotations:
    nginx.ingress.kubernetes.io/ssl-ciphers: "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"
#    nginx.ingress.kubernetes.io/client-body-buffer-size: 1k
spec:
  tls:
  - hosts:
    - test.net
  rules:
  - host: test3.net
    http:
      paths:
      - path: /tea-test
        backend:
          serviceName: tea-svc
          servicePort: 80

Server sections from nginx config generated:

    ## start server test.net
    server {
        server_name test.net ;

        listen 80;

        listen [::]:80;

        set $proxy_upstream_name "-";

        listen 443  ssl http2;

        listen [::]:443  ssl http2;

        # PEM sha: 907d86930e081d4086fa8bea5f25191205c504b1
        ssl_certificate                         /ingress-controller/ssl/default-fake-certificate.pem;
        ssl_certificate_key                     /ingress-controller/ssl/default-fake-certificate.pem;

        more_set_headers                        "Strict-Transport-Security: max-age=15724800; includeSubDomains;";
...

    ## start server test2.net
    server {
        server_name test2.net ;

        listen 80;

        listen [::]:80;

        set $proxy_upstream_name "-";
...

    ## start server test3.net
    server {
        server_name test3.net ;

        listen 80;

        listen [::]:80;

        set $proxy_upstream_name "-";

        ssl_ciphers                             ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
...

[aramase]

Another sample ingress resource used for testing:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: test-ing
  annotations:
    nginx.ingress.kubernetes.io/ssl-ciphers: "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"
#    nginx.ingress.kubernetes.io/client-body-buffer-size: 1k
spec:
  tls:
  - hosts:
    - test.net
  rules:
  - host: test.net
    http:
      paths:
      - path: /tea
        backend:
          serviceName: tea-svc
          servicePort: 80
  - host: test2.net
    http:
      paths:
      - path: /tea
        backend:
           serviceName: tea-svc
           servicePort: 80

    server {
        server_name test.net ;

        listen 80;

        listen [::]:80;

        set $proxy_upstream_name "-";

        listen 443  ssl http2;

        listen [::]:443  ssl http2;

        # PEM sha: 907d86930e081d4086fa8bea5f25191205c504b1
        ssl_certificate                         /ingress-controller/ssl/default-fake-certificate.pem;
        ssl_certificate_key                     /ingress-controller/ssl/default-fake-certificate.pem;

        more_set_headers                        "Strict-Transport-Security: max-age=15724800; includeSubDomains;";

        ssl_ciphers                             ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
...

    ## start server test2.net
    server {
        server_name test2.net ;

        listen 80;

        listen [::]:80;

        set $proxy_upstream_name "-";

        ssl_ciphers                             ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
...

[coveralls]

Coverage increased (+0.04%) to 39.742% when pulling 38cad21 on aramase:ssl-cipher into 2f700a9 on kubernetes:master.

[aledbf]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aledbf, aramase

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

• OWNERS [aledbf]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[aledbf]

@aramase thanks!

[f0o]

This doesnt seem to work for the parameter nginx.ingress.kubernetes.io/ssl-protocols or am I mistaken somewhere?

I specified:

  annotations:
    nginx.ingress.kubernetes.io/ssl-ciphers: "ALL"
    nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1 TLSv1.1 TLSv1.2"

But the ingress is still only doing TLSv1.2 and none of the rest, any ideas?