[stable/spinnaker] ensure spinnaker works behind gce ingress (#10863)

GCE ingress requires a /* pattern for the path, this allows the user
to specify the type of ingress controller via annotations to ensure
correct behavior.

the Gate service also needs to have some X headers modified in its
tomcat settings to work properly behind an SSL terminating reverse proxy
such as a GCE ingress.

Signed-off-by: Paul Czarkowski <username.taken@gmail.com>

stable/spinnaker/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Open source, multi-cloud continuous delivery platform for releasing software changes with high velocity and confidence.
 name: spinnaker
-version: 1.4.0
+version: 1.5.0
 appVersion: 1.11.6
 home: http://spinnaker.io/
 sources:

stable/spinnaker/templates/ingress/deck.yaml

@@ -14,7 +14,15 @@ spec:
   - host: {{ .Values.ingress.host | quote }}
     http:
       paths:
+      {{- if index $.Values.ingress "annotations" }}
+      {{- if eq (index $.Values.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" }}
+      - path: /*
+      {{- else }}{{/* Has annotations but ingress class is not "gce" nor "alb" */}}
       - path: /
+      {{- end }}
+      {{- else}}{{/* Has no annotations */}}
+      - path: /
+      {{- end }}
         backend:
           serviceName: spin-deck
           servicePort: 9000

stable/spinnaker/templates/ingress/gate.yaml

@@ -14,7 +14,15 @@ spec:
   - host: {{ .Values.ingressGate.host | quote }}
     http:
       paths:
+      {{- if index $.Values.ingress "annotations" }}
+      {{- if eq (index $.Values.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" }}
+      - path: /*
+      {{- else }}{{/* Has annotations but ingress class is not "gce" nor "alb" */}}
       - path: /
+      {{- end }}
+      {{- else}}{{/* Has no annotations */}}
+      - path: /
+      {{- end }}
         backend:
           serviceName: spin-gate
           servicePort: 8084

stable/spinnaker/values.yaml

@@ -22,7 +22,19 @@ halyard:
     data: {}
   additionalProfileConfigMaps:
     create: false
-    data: {}
+    data:
+    ## if you're running spinnaker behind a reverse proxy such as a GCE ingress
+    ## you may need the following profile settings for the gate profile.
+    ## see https://github.com/spinnaker/spinnaker/issues/1630
+    ## otherwise its harmless and will likely become default behavior in the future
+    ## According to the linked github issue.
+      gate-local.yml: |-
+        server:
+          tomcat:
+            protocolHeader: X-Forwarded-Proto
+            remoteIpHeader: X-Forwarded-For
+            internalProxies: .*
+            httpsServerPort: X-Forwarded-Port
 
   ## Uncomment if you want to add extra commands to the init script
   ## run by the init container before halyard is started.