From fde5856486ebd939abed08430fb01d813fcbdf20 Mon Sep 17 00:00:00 2001
From: Daniel Whatmuff <danielwhatmuff@users.noreply.github.com>
Date: Thu, 24 May 2018 18:05:32 +0100
Subject: [PATCH] Adding HTTPS using AWS ACM with whitelisting option to the
 concourse chart (#5594)

* adding https option to use ACM in AWS and also whitelisting for service type LoadBalancer

* fixing check for range of IPs

* removing extraneous space

* adding description of value

* bumping version

* bumping to 1.6.0
---
 stable/concourse/Chart.yaml             |  2 +-
 stable/concourse/README.md              |  1 +
 stable/concourse/templates/web-svc.yaml |  6 ++++++
 stable/concourse/values.yaml            | 10 ++++++++++
 4 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/stable/concourse/Chart.yaml b/stable/concourse/Chart.yaml
index e4be70a05c..a2d02a7f77 100644
--- a/stable/concourse/Chart.yaml
+++ b/stable/concourse/Chart.yaml
@@ -1,5 +1,5 @@
 name: concourse
-version: 1.5.1
+version: 1.6.0
 appVersion: 3.10.0
 description: Concourse is a simple and scalable CI system.
 icon: https://avatars1.githubusercontent.com/u/7809479
diff --git a/stable/concourse/README.md b/stable/concourse/README.md
index 417a6acc1c..8e10478cee 100644
--- a/stable/concourse/README.md
+++ b/stable/concourse/README.md
@@ -110,6 +110,7 @@ The following table lists the configurable parameters of the Concourse chart and
 | `web.tolerations` | Tolerations for the web nodes | `[]` |
 | `web.service.type` | Concourse Web service type | `ClusterIP` |
 | `web.service.annotations` | Concourse Web Service annotations | `nil` |
+| `web.service.loadBalancerSourceRanges` | Concourse Web Service Load Balancer Source IP ranges | `nil` |
 | `web.service.atcNodePort` | Sets the nodePort for atc when using `NodePort` | `nil` |
 | `web.service.tsaNodePort` | Sets the nodePort for tsa when using `NodePort` | `nil` |
 | `web.ingress.enabled` | Enable Concourse Web Ingress | `false` |
diff --git a/stable/concourse/templates/web-svc.yaml b/stable/concourse/templates/web-svc.yaml
index 2d2227d9a0..8797714a50 100644
--- a/stable/concourse/templates/web-svc.yaml
+++ b/stable/concourse/templates/web-svc.yaml
@@ -17,6 +17,12 @@ metadata:
     {{- end }}
 spec:
   type: {{ .Values.web.service.type }}
+  {{ if .Values.web.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+    {{- range .Values.web.service.loadBalancerSourceRanges }}
+    - {{ . }}
+    {{- end }}
+  {{ end }}
   ports:
     - name: atc
       port: {{ .Values.concourse.atcPort }}
diff --git a/stable/concourse/values.yaml b/stable/concourse/values.yaml
index 4044d220c8..194c5a8e9d 100644
--- a/stable/concourse/values.yaml
+++ b/stable/concourse/values.yaml
@@ -237,6 +237,16 @@ web:
     # annotations:
     #   prometheus.io/probe: "true"
     #   prometheus.io/probe_path: "/"
+    #
+    #   ## When using web.service.type: LoadBalancer, enable HTTPS with an ACM cert
+    #   service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:eu-west-1:123456789:certificate/abc123-abc123-abc123-abc123"
+    #   service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
+    #   service.beta.kubernetes.io/aws-load-balancer-backend-port: "atc"
+    #   service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
+    #
+    # ## When using web.service.type: LoadBalancer, whitelist the load balancer to particular IPs
+    # loadBalancerSourceRanges:
+    #   - 192.168.1.10/32
 
   # When using web.service.type: NodePort, sets the nodePort for atc
   #  atcNodePort: 30150