Source:
<code>public ServicePort expose( KubernetesEnvironment k8sEnv, String backendServiceName, ServicePort backendServicePort, String protocol, Map<String, ServerConfig> secureServers) throws InfrastructureException { Preconditions.checkArgument( secureServers != null && !secureServers.isEmpty(), "Secure servers are missing"); ensureJwtProxyInjected(k8sEnv); int listenPort = availablePort++; Set<String> excludes = new HashSet<>(); Boolean cookiesAuthEnabled = null; for (ServerConfig config : secureServers.values()) { if (config.getAttributes().containsKey(UNSECURED_PATHS_ATTRIBUTE)) { Collections.addAll( excludes, config.getAttributes().get(UNSECURED_PATHS_ATTRIBUTE).split(",")); } Boolean serverCookiesAuthEnabled = parseBoolean(config.getAttributes().get(SECURE_SERVER_COOKIES_AUTH_ENABLED_ATTRIBUTE)); if (cookiesAuthEnabled == null) { cookiesAuthEnabled = serverCookiesAuthEnabled; } else { if (!cookiesAuthEnabled.equals(serverCookiesAuthEnabled)) { throw new InfrastructureException( "Secure servers which expose the same port should have the same `cookiesAuthEnabled` value."); } } } ServicePort exposedPort = new ServicePortBuilder() .withName("server-" + listenPort) .withPort(listenPort) .withProtocol(protocol) .withNewTargetPort(listenPort) .build(); k8sEnv.getServices().get(serviceName).getSpec().getPorts().add(exposedPort); proxyConfigBuilder.addVerifierProxy( listenPort, "http://" + backendServiceName + ":" + backendServicePort.getTargetPort().getIntVal(), excludes, cookiesAuthEnabled, <START> identity.getWorkspaceId(), <END> ingressServiceExposureStrategy.getIngressPath(pathBase, exposedPort)); k8sEnv .getConfigMaps() .get(getConfigMapName()) .getData() .put(JWT_PROXY_CONFIG_FILE, proxyConfigBuilder.build()); return exposedPort; }</code><technical_language>useful mention in PR description cookies mechanism is a patched: path rules changed {che-host}://theia-blahblah-432.192.168.99.100.nip.io {che-host}://workspace123acsd/theia-blahblah-432.192.168.99.100.nip.io cookie is for workspace servers</technical_language>

Target:
public ServicePort expose( KubernetesEnvironment k8sEnv, String backendServiceName, ServicePort backendServicePort, String protocol, Map<String, ServerConfig> secureServers) throws InfrastructureException { Preconditions.checkArgument( secureServers != null && !secureServers.isEmpty(), "Secure servers are missing"); ensureJwtProxyInjected(k8sEnv); int listenPort = availablePort++; Set<String> excludes = new HashSet<>(); Boolean cookiesAuthEnabled = null; for (ServerConfig config : secureServers.values()) { if (config.getAttributes().containsKey(UNSECURED_PATHS_ATTRIBUTE)) { Collections.addAll( excludes, config.getAttributes().get(UNSECURED_PATHS_ATTRIBUTE).split(",")); } Boolean serverCookiesAuthEnabled = parseBoolean(config.getAttributes().get(SECURE_SERVER_COOKIES_AUTH_ENABLED_ATTRIBUTE)); if (cookiesAuthEnabled == null) { cookiesAuthEnabled = serverCookiesAuthEnabled; } else { if (!cookiesAuthEnabled.equals(serverCookiesAuthEnabled)) { throw new InfrastructureException( "Secure servers which expose the same port should have the same `cookiesAuthEnabled` value."); } } } ServicePort exposedPort = new ServicePortBuilder() .withName("server-" + listenPort) .withPort(listenPort) .withProtocol(protocol) .withNewTargetPort(listenPort) .build(); k8sEnv.getServices().get(serviceName).getSpec().getPorts().add(exposedPort); proxyConfigBuilder.addVerifierProxy( listenPort, "http://" + backendServiceName + ":" + backendServicePort.getTargetPort().getIntVal(), excludes, cookiesAuthEnabled, cookiePathStrategy.get(serviceName, exposedPort), externalServiceExposureStrategy.getExternalPath(serviceName, exposedPort)); k8sEnv .getConfigMaps() .get(getConfigMapName()) .getData() .put(JWT_PROXY_CONFIG_FILE, proxyConfigBuilder.build()); return exposedPort; }