update https/proxy configs

[jhamman]

This PR updates our proxy/service configs to match the current layout in zero-to-jupyterhub: https://zero-to-jupyterhub.readthedocs.io/en/latest/administrator/security.html#set-up-automatic-https

[tjcrone]

These all look good to me. We are in a good spot for testing all of this on OOI. Happy to assist as needed. Thanks @jhamman!

[consideRatio]

I think the service to be configured to get an external IP and act as the entrypoint of traffic, need to be the proxy-public service, but this PR makes the hub service become the external entrypoint.

The hub service will go to the hub pod, and the hub pod wont proxy traffic onwards. The hub pod does not understand how to respond to someone requesting /user/erik. The hub pod do know how to accept a user on /hub/home and later on demand configure the proxy pod (which gets traffic from proxy public) to route /user/erik properly to the individual user pod. But, for the proxy pod to route to /user/erik, it needs to get the incoming traffic redirect to it, but that requires it to be the entrypoint of the domain, but this PR makes the Hub get the traffic to itself without passing through the proxy.

I didn't see a reference to this configuration in the documentation.

Hmmm... But with autohttps, there is one more proxy that shows up in front of the proxy-public service i think, a pod that will decrypt/encrypt incoming/outgoing traffic. So, the key here to ensure incoming traffic goes there i guess, but i think that should not force the user of the chart make a change like this.

[scottyhq]

yeah @jhamman and @consideRatio i was just wondering why this change would be needed given how things have been working in the past?...

I find it confusing that loadBalancerIP can be under either proxy or hub, but the documentation doesn't really clarify how they are different:
https://zero-to-jupyterhub.readthedocs.io/en/stable/reference.html#proxy-service-loadbalancerip
https://zero-to-jupyterhub.readthedocs.io/en/stable/reference.html#hub-service-loadbalancerip

[consideRatio]

@scottyhq yes I think that has been added for completeness at some point as the proxy service had that option, but it doesn't make sense to me in a z2jh deployment that one would ever configure the hub service to be a external entrypoint for network traffic.

[jhamman]

@consideRatio - to be honest, I'm not following all of what you and @scottyhq are going over. Are you suggesting I move/remove the loadBalancerIP section from our config?

[jhamman]

see also: berkeley-dsep-infra/hubploy#56