add support for ssl-redirect annotation

[M00nF1sh]

add a new annotation "ssl-redirect" to simply the configuration for HTTP-HTTPS redirect

What is the problem

1. The current solution (https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/tasks/ssl_redirect/) to configure HTTP→HTTPS redirect via AWSLoadBalancer is complicated and intrusive to customer’s Ingress rules.
2. The current solution (https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/tasks/ssl_redirect/) to configure HTTP→HTTPS redirect via AWSLoadBalancer is not AWS-config compatible.
   1. AWS Config is a AWS service that validates best practices on AWS resource configurations.
   2. with current solution, we’ll have a catch all rule(*path:/**) to do SSL-redirect instead of using the default rule per listener (which AWS config expects).
3. The current solution (https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/tasks/ssl_redirect/) to configure HTTP→HTTPS redirect is tricky, that relies on an implementation detail that the controller will ignore infinite redirect rules.
   1. when generate rules for port 80, the controller inserts the redirect-to-ssl rule as expected.
   2. when generate rules for port 443, the controller ignores the redirect-to-ssl rule as it will be a infinite redirect.

What will be changed

We’ll introduce a new annotation called “alb.ingress.kubernetes.io/ssl-redirect” to do SSL redirection.
The value of alb.ingress.kubernetes.io/ssl-redirect is simply the SSL port to redirect to. e.g. alb.ingress.kubernetes.io/ssl-redirect: 443

1. The port must be appears in the listen-port for Ingresses, and must be a HTTPS port.
2. All HTTP port for Ingresses will be redirect to this SSL port under HTTP_301 redirect.

Note:

1. currently ALB only supports HTTP_301 or HTTP_302 for ** redirect actions. And HTTP_301 is the preferred status_code for HTTP to HTTPS redirection.
2. There are also a HTTP_308 status code can be used be achieve HTTP to HTTPS redirection. However, ALB currently don’t support it. If ALB supports it in the future, we can add a separate annotation like alb.ingress.kubernetes.io/ssl-redirect-status-code: HTTP_308 to further customize the behavior for advanced users.

Alternative designs considered:

1. we can allow specify both port and status code for the SSL redirect, like alb.ingress.kubernetes.io/ssl-redirect: '{"port":443, "status_code": "HTTP_301"}'
   1. pros: more flexible since we can have more settings like status_code.
   2. cons: more complicated to configure.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: M00nF1sh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [M00nF1sh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kishorj]

I have some minor comments, changes look good otherwise.

[kishorj]

/lgtm