Support https for kubernetes-dashboard

[karataliu]

What this PR does / why we need it:
For kubernetes v1.9, default dashboard was turn on with https: kubernetes/kubernetes#53046

Thus default dashboard location will turn to:
http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/

This will fail with tls: oversized record received with length 20527 if dashboard does not use https

Which issue this PR fixes
Related:

• https://github.com/kubernetes/dashboard/wiki/FAQ#im-accessing-dashboard-over-https
• https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.9.md

Updated Dashboard add-on to version 1.8.0: The Dashboard add-on now deploys with https enabled. The Dashboard can be accessed via kubectl proxy at http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/. The /ui redirect is deprecated and will be removed in 1.10. 

Special notes for your reviewer:
The old kubernetesmasteraddons-kubernetes-dashboard-deployment.yaml was copied to kubernetesmasteraddons-kubernetes-dashboard-http-deployment.yaml.

https related changes were applied to kubernetesmasteraddons-kubernetes-dashboard-http-deployment.yaml directly.

Release note:
Support https kubernetes dashboard

[karataliu]

note: this option only available in 1.8.0+ Dashboard image

[brendandburns]

Shouldn't this be based on the dashboard spec instead of the Kubernetes version? The kubernetes versions will support the new dashboard, right?

[karataliu]

(Changes here will be updated since #1946 introduces new approach for locating addons manifest.)

Yes, actually it should be decided by dashboard image version.
One thing to note is in kubernetes/kubernetes#53046, it changes default redirect of kubectl proxy '/ui' to use https. And this change now applies for v1.9.0+ .

That means if we're using v1.8 k8s with dashboard configured to HTTPS. Navigating to '/ui' would still redirect to the HTTP dashboard, which is not available. This break existing user experience who is using '/ui' for redirecting.

Thus I'd propose enabling it for v1.9 only. See also below versioning test comment.

[brendandburns]

One quick comment. I'd like to see us deploy the new dashboard even for older 1.7/1.8 clusters assuming that works...

[karataliu]

A detailed support versioning matrix could be found here: https://github.com/kubernetes/dashboard/wiki/Compatibility-matrix

It mentions that 1.8 dashboard will only fully support 1.8+ cluster.

I've tested with acs-engine generate cluster of following versions to use the 1.8 dashboard with HTTPS:

v1.6.13
v1.7.10

• http://localhost:8001/ui will redirect to http location:http://localhost:8001/api/v1/namespaces/kube-system/services/kubernetes-dashboard/proxy/
• Manually navigating to http://localhost:8001/api/v1/namespaces/kube-system/services/kubernetes-dashboard/proxy/ will load the ui, but the page reports an error:
  the server could not find the requested resource

v1.8.4

• http://localhost:8001/ui will redirect to http location:http://localhost:8001/api/v1/namespaces/kube-system/services/kubernetes-dashboard/proxy/
• Manually navigating to http://localhost:8001/api/v1/namespaces/kube-system/services/kubernetes-dashboard/proxy/ works

v1.9.0
v1.10.0-alpha.1

• Works well

[jackfrancis]

@karataliu could you kindly rebase from master? We just merged in v1.9.0 support, so getting that change in your branch should make it easier to test the effects of this change in 1.9

[karataliu]

@jackfrancis sure. done rebasing.

[jackfrancis]

lgtm

[jackfrancis]

I'm going to merge this as-is so we can get some bake time. @karataliu do you want submit a follow-up PR w/ this change for older k8s versions? @brendanburns FYI

[karataliu]

@jackfrancis

I would propose enabling https dashboard for 1.9+ only, see comment #1947 (comment)
elder versions either does not work, or has an incorrect '/ui' redirection.

What do you think?