Add http2-host-blacklist config flag

[nicknovitski]

What this PR does / why we need it:

A server block is created in nginx.conf for each host in ingresses. Currently, the IC can enable or disable http2 for all server blocks. With this flag, it becomes possible to selectively disable it per host/server.

NGINX v1.13.6 and later send resize notifications for HPACK header compression tables, which breaks a lot of our android traffic. All of this traffic goes to one host, so this feature will let us enable http2 for the majority of our traffic.

Which issue this PR fixes: fixes #2189

Special notes for your reviewer:
I wasn't able to get the e2e tests running on minikube 0.26.1. I couldn't figure out how to get them to work with RBAC, or how to create a cluster without RBAC (kubernetes/minikube#2342). That was a real pain. I'll just use travis for now, but I think the tests should work with RBAC as a default.

[nicknovitski]

It turns out that gorequest doesn't use http/2 if you set TLSClientConfig or anything else which effects the transport (parnurzeal/gorequest#124, golang/go#17051). The solution is supposed to be calling http2.ConfigureTransport to mutate it after construction.

If I don't do that, the connection is http/1.1. But if I do, the response is a 404, I assume due to hitting the default back end, though I don't know why.

e: My mistake, I was just mixing up test results. So my real problem is the blacklist not actually removing http2 from the listen directive. I'll work on that tomorrow.

[nicknovitski]

Weird. Adding a host to the blacklist definitely removes http2 from the appropriate listen directive in my manual testing, and also apparently in my automated testing (if I'm using WaitForNginxServer correctly), but for some reason the requests after that still use http/2.

[codecov-io]

Codecov Report

Merging #2482 into master will increase coverage by 0.03%.
The diff coverage is 58.33%.

@@            Coverage Diff             @@
##           master    #2482      +/-   ##
==========================================
+ Coverage    41.6%   41.64%   +0.03%     
==========================================
  Files          74       74              
  Lines        5290     5302      +12     
==========================================
+ Hits         2201     2208       +7     
- Misses       2792     2797       +5     
  Partials      297      297

Impacted Files	Coverage Δ
internal/file/bindata.go	62.4% <ø> (ø)	⬆️
internal/ingress/controller/template/template.go	64.75% <0%> (-0.7%)	⬇️
internal/ingress/controller/config/config.go	98.24% <100%> (+0.03%)	⬆️
internal/ingress/controller/template/configmap.go	77.57% <100%> (+1.09%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e82cb31...3f27a38. Read the comment docs.

[nicknovitski]

--vm-driver none failed to install kubelet in travis:

Moving files into cluster...
Downloading kubeadm v1.10.0
Downloading kubelet v1.10.0
Finished Downloading kubelet v1.10.0
Finished Downloading kubeadm v1.10.0
E0602 22:28:58.610170    5553 start.go:234] Error updating cluster:  downloading binaries: transferring kubeadm file: &{BaseAsset:{data:[] reader:0xc420088620 Length:0 AssetName:/home/travis/.minikube/cache/v1.10.0/kubelet TargetDir:/usr/bin TargetName:kubelet Permissions:0641}}: error creating file at /usr/bin/kubelet: open /usr/bin/kubelet: permission denied

[aledbf]

@nicknovitski please rebase

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: nicknovitski
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: aledbf

If they are not already assigned, you can assign the PR to them by writing /assign @aledbf in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[blakebarnett]

We really need this, is there anything blocking it we can help with?

[aledbf]

We really need this, is there anything blocking it we can help with?

Just rebase and that passing CI

[aledbf]

NGINX v1.13.6 and later send resize notifications for HPACK header compression tables, which breaks a lot of our android traffic.

Just un case current master uses nginx 1.15.3 that solves some issues with this and old clients

[blakebarnett]

excellent, I'll see if we can test it out, we're currently running an nginx-ingress fork of 0.9 and I really don't want to try to maintain it!

[aledbf]

@blakebarnett I am preparing the PR for 0.19.0. In the PR you will find a test image you can test

[nicknovitski]

I'll try out 0.19 and see if it fixes our problem.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closed this PR.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[wzrdtales]

Was there any progress on that after it lost track?

[nicknovitski]

As I understand it the nginx bug was fixed.