Add hubble-ui as an option for cilium when installing hubble

[allen-mun]

/kind feature

1. Describe IN DETAIL the feature/behavior/change you would like to see.
With hubble-ui v0.8.0+, it seems like hubble-ui now supports TLS (from this PR, release link: here. It looks like the reason for not installing hubble-ui was for a fix in the v0.7.7 hubble-ui image (from this).

For us, hubble-ui would provide an easier and more visible solution than using hubble-cli to debug network issues.
2. Feel free to provide a design supporting your feature request.

[olemarkus]

The reason we don't support hubble-ui is because webapps are a bit tricky. They don't belong in kube-system, they tend to be exposed outside of the cluster and thus has a different security profile. They require external TLS, DNS, and they perhaps should use an Ingress. They perhaps need an authenticating/authorizing proxy.

Luckily it is now easy to install the hubble ui alone using the cilium helm chart.

[allen-mun]

Alright, without adding hubble-ui to kops, is it possible to change hubble-relay to toggle TLS since hubble-ui now supports it?

Line referenced here:

kops/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.9.yaml.template

Line 269 in 3245c6d

disable-server-tls: true

[olemarkus]

Yes. kOps 1.24 will probably switch this one to enable TLS.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[olemarkus]

I think it is quite safe to say we won't support this as an addon.
We have also added docs on how to install hubble on kops. See https://kops.sigs.k8s.io/networking/cilium/#hubble-ui

/close

[k8s-ci-robot]

@olemarkus: Closing this issue.

In response to this:

I think it is quite safe to say we won't support this as an addon.
We have also added docs on how to install hubble on kops. See https://kops.sigs.k8s.io/networking/cilium/#hubble-ui

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.