From bf484e940f3b5abdb8e0d2203e46e4e6628ddec6 Mon Sep 17 00:00:00 2001
From: Paul Czarkowski <username.taken@gmail.com>
Date: Tue, 29 Jan 2019 07:38:24 -0600
Subject: [PATCH] [stable/spinnaker] ensure spinnaker works behind gce ingress
 (#10863)

GCE ingress requires a /* pattern for the path, this allows the user
to specify the type of ingress controller via annotations to ensure
correct behavior.

the Gate service also needs to have some X headers modified in its
tomcat settings to work properly behind an SSL terminating reverse proxy
such as a GCE ingress.

Signed-off-by: Paul Czarkowski <username.taken@gmail.com>
---
 stable/spinnaker/Chart.yaml                  |  2 +-
 stable/spinnaker/templates/ingress/deck.yaml |  8 ++++++++
 stable/spinnaker/templates/ingress/gate.yaml |  8 ++++++++
 stable/spinnaker/values.yaml                 | 14 +++++++++++++-
 4 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/stable/spinnaker/Chart.yaml b/stable/spinnaker/Chart.yaml
index 5c28bc97f7..5d68c9cf3c 100644
--- a/stable/spinnaker/Chart.yaml
+++ b/stable/spinnaker/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Open source, multi-cloud continuous delivery platform for releasing software changes with high velocity and confidence.
 name: spinnaker
-version: 1.4.0
+version: 1.5.0
 appVersion: 1.11.6
 home: http://spinnaker.io/
 sources:
diff --git a/stable/spinnaker/templates/ingress/deck.yaml b/stable/spinnaker/templates/ingress/deck.yaml
index 1f87a22fa2..cb5946e728 100644
--- a/stable/spinnaker/templates/ingress/deck.yaml
+++ b/stable/spinnaker/templates/ingress/deck.yaml
@@ -14,7 +14,15 @@ spec:
   - host: {{ .Values.ingress.host | quote }}
     http:
       paths:
+      {{- if index $.Values.ingress "annotations" }}
+      {{- if eq (index $.Values.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" }}
+      - path: /*
+      {{- else }}{{/* Has annotations but ingress class is not "gce" nor "alb" */}}
       - path: /
+      {{- end }}
+      {{- else}}{{/* Has no annotations */}}
+      - path: /
+      {{- end }}
         backend:
           serviceName: spin-deck
           servicePort: 9000
diff --git a/stable/spinnaker/templates/ingress/gate.yaml b/stable/spinnaker/templates/ingress/gate.yaml
index 6423e498dc..26e4ed169d 100644
--- a/stable/spinnaker/templates/ingress/gate.yaml
+++ b/stable/spinnaker/templates/ingress/gate.yaml
@@ -14,7 +14,15 @@ spec:
   - host: {{ .Values.ingressGate.host | quote }}
     http:
       paths:
+      {{- if index $.Values.ingress "annotations" }}
+      {{- if eq (index $.Values.ingress.annotations "kubernetes.io/ingress.class" | default "") "gce" "alb" }}
+      - path: /*
+      {{- else }}{{/* Has annotations but ingress class is not "gce" nor "alb" */}}
       - path: /
+      {{- end }}
+      {{- else}}{{/* Has no annotations */}}
+      - path: /
+      {{- end }}
         backend:
           serviceName: spin-gate
           servicePort: 8084
diff --git a/stable/spinnaker/values.yaml b/stable/spinnaker/values.yaml
index 0ddebf274b..fcf3d990a9 100644
--- a/stable/spinnaker/values.yaml
+++ b/stable/spinnaker/values.yaml
@@ -22,7 +22,19 @@ halyard:
     data: {}
   additionalProfileConfigMaps:
     create: false
-    data: {}
+    data:
+    ## if you're running spinnaker behind a reverse proxy such as a GCE ingress
+    ## you may need the following profile settings for the gate profile.
+    ## see https://github.com/spinnaker/spinnaker/issues/1630
+    ## otherwise its harmless and will likely become default behavior in the future
+    ## According to the linked github issue.
+      gate-local.yml: |-
+        server:
+          tomcat:
+            protocolHeader: X-Forwarded-Proto
+            remoteIpHeader: X-Forwarded-For
+            internalProxies: .*
+            httpsServerPort: X-Forwarded-Port
 
   ## Uncomment if you want to add extra commands to the init script
   ## run by the init container before halyard is started.