@spinnaker/google 2026.0.2 → 2026.1.0

package/src/loadBalancer/configure/http/listeners/listener.component.js

@@ -64,11 +64,93 @@ module(GOOGLE_LOADBALANCER_CONFIGURE_HTTP_LISTENERS_LISTENER_COMPONENT, [GCE_ADD
         };
 
         this.isHttps = (port) => port === 443 || port === '443';
+        // certificateMap writes are only supported on global external/classic HTTPS proxies (HTTP
+        // type). INTERNAL_MANAGED regional proxies do not support certificateMap per GCP docs.
+        this.supportsCertificateMap = () => this.command.loadBalancer.loadBalancerType === 'HTTP';
+        this.certificateMapPattern = /^[a-z]([-a-z0-9]*[a-z0-9])?$/;
+        // Extracts the short resource name from a certificateMap value. Users may paste a full
+        // Certificate Manager URL (e.g. //certificatemanager.googleapis.com/projects/p/locations/
+        // global/certificateMaps/my-map); only the last path segment (the map name) is stored.
+        // The server reconstructs the full URL using GCEUtil.buildCertificateMapUrl.
+        this.getCertificateMapName = (certificateMap) => {
+          if (!_.isString(certificateMap)) {
+            return certificateMap;
+          }
+          const normalized = certificateMap.trim();
+          return normalized ? _.last(normalized.split('/')) : normalized;
+        };
+
+        // Reconcile the XOR between certificate and certificateMap on a listener. Ensures only
+        // one is active at a time. Also infers certificateSource for existing listeners that were
+        // created before the certificateSource field existed (backward compat).
+        this.syncCertificateState = (listener) => {
+          if (!this.supportsCertificateMap()) {
+            listener.certificateSource = 'certificate';
+            listener.certificateMap = null;
+            return;
+          }
+
+          if (!listener.certificateSource) {
+            listener.certificateSource = listener.certificateMap ? 'certificateMap' : 'certificate';
+          }
+
+          if (listener.certificateSource === 'certificateMap') {
+            listener.certificate = null;
+            if (_.isString(listener.certificateMap)) {
+              listener.certificateMap = this.getCertificateMapName(listener.certificateMap);
+            }
+          } else {
+            listener.certificateMap = null;
+          }
+        };
+
+        this.onCertificateSourceChanged = (listener) => {
+          if (!this.supportsCertificateMap()) {
+            listener.certificateSource = 'certificate';
+            listener.certificateMap = null;
+            return;
+          }
+
+          if (listener.certificateSource === 'certificateMap') {
+            listener.certificate = null;
+          } else {
+            listener.certificateMap = null;
+          }
+        };
+
+        this.onCertificateSelected = (listener) => {
+          if (listener.certificate) {
+            listener.certificateSource = 'certificate';
+            listener.certificateMap = null;
+          }
+        };
+
+        this.onCertificateMapChanged = (listener) => {
+          if (_.isString(listener.certificateMap)) {
+            listener.certificateMap = this.getCertificateMapName(listener.certificateMap);
+          }
+          if (listener.certificateMap) {
+            listener.certificateSource = 'certificateMap';
+            listener.certificate = null;
+          }
+        };
+
+        this.onPortChanged = (listener) => {
+          if (!this.isHttps(listener.port)) {
+            listener.certificate = null;
+            listener.certificateMap = null;
+            listener.certificateSource = 'certificate';
+          } else {
+            this.syncCertificateState(listener);
+          }
+        };
 
         if (!this.listener.name) {
           this.updateName(this.listener, this.application.name);
         }
 
+        this.onPortChanged(this.listener);
+
         this.onAddressSelect = (address) => {
           if (address) {
             this.listener.ipAddress = address.address;

package/src/loadBalancer/configure/http/listeners/listener.component.spec.js

@@ -0,0 +1,125 @@
+import { mock } from 'angular';
+
+describe('Component: gceListener', () => {
+  let $componentController;
+
+  beforeEach(mock.module(require('./listener.component').name));
+
+  beforeEach(
+    mock.inject((_$componentController_) => {
+      $componentController = _$componentController_;
+    }),
+  );
+
+  function buildBindings(listenerOverrides = {}, loadBalancerOverrides = {}) {
+    return {
+      command: {
+        backingData: {
+          certificates: [],
+          loadBalancerMap: {},
+          subnetMap: { default: [] },
+          addresses: [],
+        },
+        loadBalancer: {
+          credentials: 'test-account',
+          loadBalancerType: 'HTTP',
+          network: 'default',
+          region: 'us-central1',
+          ...loadBalancerOverrides,
+        },
+      },
+      listener: {
+        name: 'app-main',
+        port: 443,
+        certificate: null,
+        certificateMap: null,
+        created: false,
+        ...listenerOverrides,
+      },
+      deleteListener: () => {},
+      index: 0,
+      application: { name: 'app' },
+    };
+  }
+
+  function buildController(listenerOverrides = {}, loadBalancerOverrides = {}) {
+    const ctrl = $componentController('gceListener', {}, buildBindings(listenerOverrides, loadBalancerOverrides));
+    ctrl.$onInit();
+    return ctrl;
+  }
+
+  it('clears certificate when switching to certificateMap source', () => {
+    const ctrl = buildController({ certificate: 'legacy-cert', certificateSource: 'certificate' });
+
+    ctrl.listener.certificateSource = 'certificateMap';
+    ctrl.onCertificateSourceChanged(ctrl.listener);
+
+    expect(ctrl.listener.certificate).toBeNull();
+  });
+
+  it('clears certificateMap when switching to certificate source', () => {
+    const ctrl = buildController({
+      certificate: null,
+      certificateMap: 'cm',
+      certificateSource: 'certificateMap',
+    });
+
+    ctrl.listener.certificateSource = 'certificate';
+    ctrl.onCertificateSourceChanged(ctrl.listener);
+
+    expect(ctrl.listener.certificateMap).toBeNull();
+  });
+
+  it('forces certificate source for internal managed load balancers', () => {
+    const ctrl = buildController(
+      {
+        certificateMap: 'cm',
+        certificateSource: 'certificateMap',
+      },
+      { loadBalancerType: 'INTERNAL_MANAGED' },
+    );
+
+    expect(ctrl.listener.certificateSource).toBe('certificate');
+    expect(ctrl.listener.certificateMap).toBeNull();
+  });
+
+  it('clears cert fields when listener port changes away from HTTPS', () => {
+    const ctrl = buildController({
+      certificate: 'legacy-cert',
+      certificateMap: 'cm',
+      certificateSource: 'certificateMap',
+    });
+
+    ctrl.listener.port = 80;
+    ctrl.onPortChanged(ctrl.listener);
+
+    expect(ctrl.listener.certificate).toBeNull();
+    expect(ctrl.listener.certificateMap).toBeNull();
+    expect(ctrl.listener.certificateSource).toBe('certificate');
+  });
+
+  it('normalizes certificateMap URLs to map names', () => {
+    const ctrl = buildController({
+      certificate: null,
+      certificateMap: '//certificatemanager.googleapis.com/projects/p/locations/global/certificateMaps/cm',
+      certificateSource: 'certificateMap',
+    });
+
+    expect(ctrl.listener.certificateMap).toBe('cm');
+  });
+
+  it('validates certificateMap names with expected regex edge cases', () => {
+    const ctrl = buildController();
+
+    const validNames = ['a', 'my-map', 'm1', 'map-123', 'a-b-c-1'];
+    const invalidNames = ['', '1map', '-map', 'map-', 'map_name', 'map.name', 'Map'];
+
+    validNames.forEach((name) => {
+      expect(ctrl.certificateMapPattern.test(name)).toBe(true);
+    });
+
+    invalidNames.forEach((name) => {
+      expect(ctrl.certificateMapPattern.test(name)).toBe(false);
+    });
+  });
+});

package/src/loadBalancer/configure/http/templates.ts

@@ -5,6 +5,7 @@ export class HttpLoadBalancerTemplate {
   public region = 'global';
   public loadBalancerType = 'HTTP';
   public certificate = '';
+  public certificateMap = '';
   public defaultService: BackendServiceTemplate;
   public hostRules: HostRuleTemplate[] = [];
   public listeners: ListenerTemplate[] = [];
@@ -45,4 +46,6 @@ export class ListenerTemplate {
   public name: string;
   public port: number;
   public certificate: string | null = null;
+  public certificateMap: string | null = null;
+  public certificateSource: 'certificate' | 'certificateMap' = 'certificate';
 }

package/src/loadBalancer/configure/http/transformer.service.js

@@ -81,9 +81,16 @@ module(GOOGLE_LOADBALANCER_CONFIGURE_HTTP_TRANSFORMER_SERVICE, []).factory(
       return loadBalancer.listeners.map((listener) => {
         let command = _.cloneDeep(loadBalancer);
         command = _.omit(command, keysToOmit);
+        // Determine the authoritative cert source. The certificateSource field is explicit when
+        // present, but listeners deserialized from LBs created before this field existed may only
+        // have certificate/certificateMap values without a source. The fallback condition handles
+        // that: no certificate + truthy certificateMap implies certificateMap mode.
+        const useCertificateMap =
+          listener.certificateSource === 'certificateMap' || (!listener.certificate && !!listener.certificateMap);
         command.name = listener.name;
         command.portRange = listener.port;
-        command.certificate = listener.certificate || null;
+        command.certificate = useCertificateMap ? null : listener.certificate || null;
+        command.certificateMap = useCertificateMap ? listener.certificateMap || null : null;
         command.ipAddress = listener.ipAddress;
         command.subnet = listener.subnet;
 
@@ -151,6 +158,14 @@ module(GOOGLE_LOADBALANCER_CONFIGURE_HTTP_TRANSFORMER_SERVICE, []).factory(
         listener.stack = stack;
         listener.detail = freeFormDetails;
         listener.created = true;
+        listener.certificate = listener.certificate || null;
+        // Normalize certificateMap from the full Certificate Manager URL returned by the server
+        // (e.g. //certificatemanager.googleapis.com/projects/p/locations/global/certificateMaps/cm)
+        // to its short resource name. This mirrors getCertificateMapName in listener.component.js.
+        listener.certificateMap = listener.certificateMap ? _.last(listener.certificateMap.split('/')) : null;
+        // Infer certificateSource for listeners deserialized from LBs created before this field
+        // existed. The presence of certificateMap implies certificateMap mode.
+        listener.certificateSource = listener.certificateMap ? 'certificateMap' : 'certificate';
       });
 
       return loadBalancer.listeners;

package/src/loadBalancer/configure/http/transformer.service.spec.js

@@ -0,0 +1,182 @@
+import { mock } from 'angular';
+
+describe('Service: gceHttpLoadBalancerTransformer', () => {
+  let gceHttpLoadBalancerTransformer;
+
+  beforeEach(mock.module(require('./transformer.service').name));
+
+  beforeEach(
+    mock.inject((_gceHttpLoadBalancerTransformer_) => {
+      gceHttpLoadBalancerTransformer = _gceHttpLoadBalancerTransformer_;
+    }),
+  );
+
+  function buildBaseCommand(listener) {
+    return {
+      loadBalancer: {
+        listeners: [listener],
+        hostRules: [],
+        backendServices: [],
+        healthChecks: [],
+        defaultService: 'default-service',
+      },
+      backingData: {
+        healthChecksKeyedByName: {
+          'hc-1': { name: 'hc-1' },
+        },
+        backendServicesKeyedByName: {
+          'default-service': {
+            name: 'default-service',
+            sessionAffinity: 'NONE',
+            healthCheck: 'hc-1',
+          },
+        },
+      },
+    };
+  }
+
+  it('serializes certificateMap listeners as certificateMap-only commands', () => {
+    const command = buildBaseCommand({
+      name: 'app-main',
+      port: 443,
+      certificate: null,
+      certificateMap: 'cm',
+      certificateSource: 'certificateMap',
+      ipAddress: '10.0.0.1',
+      subnet: null,
+    });
+
+    const commands = gceHttpLoadBalancerTransformer.serialize(command, null);
+
+    expect(commands.length).toBe(1);
+    expect(commands[0].certificate).toBeNull();
+    expect(commands[0].certificateMap).toBe('cm');
+  });
+
+  it('serializes legacy certificate listeners without certificateMap', () => {
+    const command = buildBaseCommand({
+      name: 'app-main',
+      port: 443,
+      certificate: 'legacy-cert',
+      certificateMap: 'cm',
+      certificateSource: 'certificate',
+      ipAddress: '10.0.0.1',
+      subnet: null,
+    });
+
+    const commands = gceHttpLoadBalancerTransformer.serialize(command, null);
+
+    expect(commands.length).toBe(1);
+    expect(commands[0].certificate).toBe('legacy-cert');
+    expect(commands[0].certificateMap).toBeNull();
+  });
+
+  it('deserializes certificateMap listeners with certificateMap mode', () => {
+    const loadBalancer = {
+      defaultService: {
+        name: 'default-service',
+        healthCheck: { name: 'hc-1' },
+        sessionAffinity: 'NONE',
+      },
+      hostRules: [],
+      listeners: [
+        {
+          name: 'app-main',
+          certificate: null,
+          certificateMap: '//certificatemanager.googleapis.com/projects/p/locations/global/certificateMaps/cm',
+        },
+      ],
+      network: 'default',
+      region: 'global',
+      urlMapName: 'app',
+      account: 'test-account',
+    };
+
+    const commandLoadBalancer = gceHttpLoadBalancerTransformer.deserialize(loadBalancer);
+
+    expect(commandLoadBalancer.listeners.length).toBe(1);
+    expect(commandLoadBalancer.listeners[0].certificateSource).toBe('certificateMap');
+    expect(commandLoadBalancer.listeners[0].certificate).toBeNull();
+    expect(commandLoadBalancer.listeners[0].certificateMap).toBe('cm');
+  });
+
+  // The serialize fallback path: when certificateSource is absent, the
+  // condition `!listener.certificate && !!listener.certificateMap` at line 89
+  // of transformer.service.js infers certificateMap mode. This covers LBs
+  // created before the certificateSource field existed.
+  it('serializes certificateMap listener without explicit certificateSource via fallback', () => {
+    const command = buildBaseCommand({
+      name: 'app-main',
+      port: 443,
+      certificate: null,
+      certificateMap: 'cm',
+      ipAddress: '10.0.0.1',
+      subnet: null,
+    });
+
+    const commands = gceHttpLoadBalancerTransformer.serialize(command, null);
+
+    expect(commands.length).toBe(1);
+    expect(commands[0].certificate).toBeNull();
+    expect(commands[0].certificateMap).toBe('cm');
+  });
+
+  it('deserializes cert-only listener and infers certificateSource as certificate', () => {
+    const loadBalancer = {
+      defaultService: {
+        name: 'default-service',
+        healthCheck: { name: 'hc-1' },
+        sessionAffinity: 'NONE',
+      },
+      hostRules: [],
+      listeners: [
+        {
+          name: 'app-main',
+          certificate: 'legacy-cert',
+          certificateMap: null,
+        },
+      ],
+      network: 'default',
+      region: 'global',
+      urlMapName: 'app',
+      account: 'test-account',
+    };
+
+    const commandLoadBalancer = gceHttpLoadBalancerTransformer.deserialize(loadBalancer);
+
+    expect(commandLoadBalancer.listeners.length).toBe(1);
+    expect(commandLoadBalancer.listeners[0].certificateSource).toBe('certificate');
+    expect(commandLoadBalancer.listeners[0].certificate).toBe('legacy-cert');
+    expect(commandLoadBalancer.listeners[0].certificateMap).toBeNull();
+  });
+
+  it('deserializes listener with neither cert nor map and defaults to certificate source', () => {
+    const loadBalancer = {
+      defaultService: {
+        name: 'default-service',
+        healthCheck: { name: 'hc-1' },
+        sessionAffinity: 'NONE',
+      },
+      hostRules: [],
+      listeners: [
+        {
+          name: 'app-main',
+          certificate: null,
+          certificateMap: null,
+        },
+      ],
+      network: 'default',
+      region: 'global',
+      urlMapName: 'app',
+      account: 'test-account',
+    };
+
+    const commandLoadBalancer = gceHttpLoadBalancerTransformer.deserialize(loadBalancer);
+
+    expect(commandLoadBalancer.listeners.length).toBe(1);
+    // With neither field set, certificateSource defaults to 'certificate' (HTTP mode).
+    expect(commandLoadBalancer.listeners[0].certificateSource).toBe('certificate');
+    expect(commandLoadBalancer.listeners[0].certificate).toBeNull();
+    expect(commandLoadBalancer.listeners[0].certificateMap).toBeNull();
+  });
+});

package/src/loadBalancer/configure/internal/gceCreateInternalLoadBalancer.controller.ts

@@ -91,6 +91,7 @@ class InternalLoadBalancerCtrl extends CommonGceLoadBalancerCtrl implements ICon
     'loadBalancer',
     'gceCommonLoadBalancerCommandBuilder',
     'isNew',
+    'forPipelineConfig',
     'wizardSubFormValidation',
     'gceXpnNamingService',
     '$state',
@@ -102,6 +103,7 @@ class InternalLoadBalancerCtrl extends CommonGceLoadBalancerCtrl implements ICon
     private loadBalancer: InternalLoadBalancer,
     private gceCommonLoadBalancerCommandBuilder: GceCommonLoadBalancerCommandBuilder,
     private isNew: boolean,
+    private forPipelineConfig: boolean,
     private wizardSubFormValidation: any,
     private gceXpnNamingService: any,
     $state: StateService,
@@ -244,6 +246,12 @@ class InternalLoadBalancerCtrl extends CommonGceLoadBalancerCtrl implements ICon
     toSubmitLoadBalancer.backendService.name = toSubmitLoadBalancer.loadBalancerName;
     delete toSubmitLoadBalancer.instances;
 
+    if (this.forPipelineConfig) {
+      Object.assign(toSubmitLoadBalancer, { healthCheck: {} });
+      this.$uibModalInstance.close(toSubmitLoadBalancer);
+      return;
+    }
+
     this.taskMonitor.submit(() =>
       LoadBalancerWriter.upsertLoadBalancer(toSubmitLoadBalancer, this.application, descriptor, {
         healthCheck: {},

package/src/loadBalancer/configure/internalhttp/createInternalHttpLoadBalancer.controller.spec.js

@@ -0,0 +1,89 @@
+import { ApplicationModelBuilder } from '@spinnaker/core';
+import { GOOGLE_LOADBALANCER_CONFIGURE_INTERNAL_HTTP_CREATEHTTPLOADBALANCER_CONTROLLER } from './createInternalHttpLoadBalancer.controller';
+
+describe('Controller: gceCreateInternalHttpLoadBalancerCtrl (pipeline mode)', function () {
+  beforeEach(function () {
+    this.serializedCommands = [
+      {
+        name: 'app-internal-http',
+        portRange: '443',
+        certificate: null,
+        certificateMap: null,
+        ipAddress: '10.0.0.1',
+        subnet: 'subnet-1',
+        urlMapName: 'app-internal-http',
+        credentials: 'test',
+        region: 'us-west-2',
+        loadBalancerType: 'INTERNAL_MANAGED',
+      },
+    ];
+    this.transformer = {
+      serialize: jasmine.createSpy('serialize').and.returnValue(this.serializedCommands),
+    };
+    this.writer = {
+      upsertLoadBalancers: jasmine.createSpy('upsertLoadBalancers'),
+    };
+  });
+
+  beforeEach(function () {
+    window.module(GOOGLE_LOADBALANCER_CONFIGURE_INTERNAL_HTTP_CREATEHTTPLOADBALANCER_CONTROLLER, ($provide) => {
+      $provide.value('gceHttpLoadBalancerCommandBuilder', {});
+      $provide.value('gceHttpLoadBalancerTransformer', this.transformer);
+      $provide.value('gceHttpLoadBalancerWriter', this.writer);
+    });
+  });
+
+  beforeEach(
+    window.inject(function ($controller, $rootScope) {
+      this.$scope = $rootScope.$new();
+      this.modalInstance = {
+        close: jasmine.createSpy('close'),
+        dismiss: jasmine.createSpy('dismiss'),
+        result: { then: () => {} },
+      };
+      this.wizardSubFormValidation = {
+        config: () => this.wizardSubFormValidation,
+        register: () => this.wizardSubFormValidation,
+      };
+      const app = ApplicationModelBuilder.createApplicationForTests('app', {
+        key: 'loadBalancers',
+        lazy: true,
+        defaultData: [],
+      });
+      this.ctrl = $controller('gceCreateInternalHttpLoadBalancerCtrl', {
+        $scope: this.$scope,
+        application: app,
+        $uibModalInstance: this.modalInstance,
+        loadBalancer: {},
+        gceHttpLoadBalancerCommandBuilder: {},
+        isNew: true,
+        forPipelineConfig: true,
+        wizardSubFormValidation: this.wizardSubFormValidation,
+        gceHttpLoadBalancerTransformer: this.transformer,
+        gceHttpLoadBalancerWriter: this.writer,
+        $state: {},
+      });
+      this.ctrl.command = {};
+    }),
+  );
+
+  it('returns pipeline commands without submitting', function () {
+    this.ctrl.submit();
+
+    expect(this.writer.upsertLoadBalancers).not.toHaveBeenCalled();
+    expect(this.modalInstance.close).toHaveBeenCalledWith([
+      jasmine.objectContaining({
+        name: 'app-internal-http',
+        loadBalancerName: 'app-internal-http',
+        cloudProvider: 'gce',
+        listeners: [
+          jasmine.objectContaining({
+            name: 'app-internal-http',
+            port: '443',
+            subnet: 'subnet-1',
+          }),
+        ],
+      }),
+    ]);
+  });
+});

package/src/loadBalancer/configure/internalhttp/createInternalHttpLoadBalancer.controller.ts

@@ -54,6 +54,7 @@ class CreateInternalHttpLoadBalancerController implements ng.IComponentControlle
     'loadBalancer',
     'gceHttpLoadBalancerCommandBuilder',
     'isNew',
+    'forPipelineConfig',
     'wizardSubFormValidation',
     'gceHttpLoadBalancerTransformer',
     'gceHttpLoadBalancerWriter',
@@ -67,6 +68,7 @@ class CreateInternalHttpLoadBalancerController implements ng.IComponentControlle
     private loadBalancer: IGceHttpLoadBalancer,
     private gceHttpLoadBalancerCommandBuilder: any,
     private isNew: boolean,
+    private forPipelineConfig: boolean,
     private wizardSubFormValidation: any,
     private gceHttpLoadBalancerTransformer: any,
     private gceHttpLoadBalancerWriter: any,
@@ -130,6 +132,27 @@ class CreateInternalHttpLoadBalancerController implements ng.IComponentControlle
   public submit(): void {
     const serializedCommands = this.gceHttpLoadBalancerTransformer.serialize(this.command, this.loadBalancer);
     const descriptor = this.isNew ? 'Create' : 'Update';
+
+    if (this.forPipelineConfig) {
+      const pipelineCommands = serializedCommands.map((command: any) => ({
+        ...command,
+        cloudProvider: 'gce',
+        loadBalancerName: command.name,
+        listeners: [
+          {
+            name: command.name,
+            port: command.portRange,
+            certificate: command.certificate || null,
+            certificateMap: command.certificateMap || null,
+            ipAddress: command.ipAddress,
+            subnet: command.subnet,
+          },
+        ],
+      }));
+      this.$uibModalInstance.close(pipelineCommands);
+      return;
+    }
+
     this.taskMonitor.submit(() =>
       this.gceHttpLoadBalancerWriter.upsertLoadBalancers(serializedCommands, this.application, descriptor),
     );