Add support for encrypted connection between zetcd and etcd (#4903)

* Add support for encrypted connection between zetcd and etcd. Fixes #4898

* Remove added empty lines

* Fix problems found by helm lint

* Fix whitespace

* Fixes after review

* Remove trailing namespaces, increment chart version

stable/zetcd/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: CoreOS zetcd Helm chart for Kubernetes
 name: zetcd
-version: 0.1.8
+version: 0.1.9
 appVersion: 0.0.3
 home: https://github.com/coreos/zetcd
 sources:

stable/zetcd/README.md

@@ -58,7 +58,10 @@ The following table lists the configurable parameters of the zetcd chart and the
 | `nodeSelector`                                    | Node labels for pod assignment                               |`{}`                                     |
 | `etcd.operatorEnabled`                            | Whether to use etcd-operator to launch a cluster                    | `true`                                        |
 | `etcd.endpoints`                                  | Existing etcd endpoints to be used when etcd-operator is disabled                    | `localhost:2379`                                        |
-
+| `etcd.tls.existingSecret`                                 | Name of the secret containing certificate, key and CA certificate          |                           |
+| `etcd.tls.ca`                                     | Key in TLS secret that contains CA certificate                             |                           |
+| `etcd.tls.cert`                                   | Key in TLS secret that contains client certificate                         |                           |
+| `etcd.tls.key`                                    | Key in TLS secret that contains private key                                |                           |
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example:
 

stable/zetcd/templates/deployment.yaml

@@ -29,6 +29,18 @@ spec:
 {{- else }}
             - "-endpoints" 
             - "{{ .Values.etcd.endpoints }}"
+{{- end }}
+{{- if .Values.etcd.tls }}
+            - "-certfile"
+            - "/etc/zetcd/secrets/{{ .Values.etcd.tls.cert }}"
+            - "-cafile"
+            - "/etc/zetcd/secrets/{{ .Values.etcd.tls.ca }}"
+            - "-keyfile"
+            - "/etc/zetcd/secrets/{{ .Values.etcd.tls.key }}"
+          volumeMounts:
+            - name: tls
+              mountPath: /etc/zetcd/secrets
+              readOnly: true
 {{- end }}
           ports:
             - containerPort: {{ .Values.service.internalPort }}
@@ -44,3 +56,9 @@ spec:
       nodeSelector:
 {{ toYaml .Values.nodeSelector | indent 8 }}
     {{- end }}
+{{- if .Values.etcd.tls }}
+      volumes:
+      - name: tls
+        secret:
+          secretName: {{ .Values.etcd.tls.existingSecret }}
+{{- end }}

stable/zetcd/values.yaml

@@ -33,6 +33,15 @@ etcd:
   operatorEnabled: true
   endpoints: localhost:2379
 
+  # Communication with etcd can be encrypted and authenticated with a certificate.
+  # In order to enable it, add 'tls' section providing existing secret
+  # containing CA certificate, client certificate and client key.
+  # tls:
+  #   existingSecret: etcd-tls-secret
+  #   cert: client.crt
+  #   key: client.key
+  #   ca: ca.crt
+
 etcd-operator:
   cluster:
     enabled: true