From cd1879797e83fc0c46c934b2639d439cfedb57fd Mon Sep 17 00:00:00 2001
From: qbast <qbast@go2.pl>
Date: Wed, 2 May 2018 21:59:17 +0200
Subject: [PATCH] Add support for encrypted connection between zetcd and etcd
 (#4903)

* Add support for encrypted connection between zetcd and etcd. Fixes #4898

* Remove added empty lines

* Fix problems found by helm lint

* Fix whitespace

* Fixes after review

* Remove trailing namespaces, increment chart version
---
 stable/zetcd/Chart.yaml                |  2 +-
 stable/zetcd/README.md                 |  5 ++++-
 stable/zetcd/templates/deployment.yaml | 18 ++++++++++++++++++
 stable/zetcd/values.yaml               |  9 +++++++++
 4 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/stable/zetcd/Chart.yaml b/stable/zetcd/Chart.yaml
index 34ad902408..640ecf9017 100644
--- a/stable/zetcd/Chart.yaml
+++ b/stable/zetcd/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 description: CoreOS zetcd Helm chart for Kubernetes
 name: zetcd
-version: 0.1.8
+version: 0.1.9
 appVersion: 0.0.3
 home: https://github.com/coreos/zetcd
 sources:
diff --git a/stable/zetcd/README.md b/stable/zetcd/README.md
index 4831a33aaf..5b59eef7ac 100644
--- a/stable/zetcd/README.md
+++ b/stable/zetcd/README.md
@@ -58,7 +58,10 @@ The following table lists the configurable parameters of the zetcd chart and the
 | `nodeSelector`                                    | Node labels for pod assignment                               |`{}`                                     |
 | `etcd.operatorEnabled`                            | Whether to use etcd-operator to launch a cluster                    | `true`                                        |
 | `etcd.endpoints`                                  | Existing etcd endpoints to be used when etcd-operator is disabled                    | `localhost:2379`                                        |
-
+| `etcd.tls.existingSecret`                                 | Name of the secret containing certificate, key and CA certificate          |                           |
+| `etcd.tls.ca`                                     | Key in TLS secret that contains CA certificate                             |                           |
+| `etcd.tls.cert`                                   | Key in TLS secret that contains client certificate                         |                           |
+| `etcd.tls.key`                                    | Key in TLS secret that contains private key                                |                           |
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example:
 
diff --git a/stable/zetcd/templates/deployment.yaml b/stable/zetcd/templates/deployment.yaml
index 619390edf1..0695a06774 100644
--- a/stable/zetcd/templates/deployment.yaml
+++ b/stable/zetcd/templates/deployment.yaml
@@ -29,6 +29,18 @@ spec:
 {{- else }}
             - "-endpoints" 
             - "{{ .Values.etcd.endpoints }}"
+{{- end }}
+{{- if .Values.etcd.tls }}
+            - "-certfile"
+            - "/etc/zetcd/secrets/{{ .Values.etcd.tls.cert }}"
+            - "-cafile"
+            - "/etc/zetcd/secrets/{{ .Values.etcd.tls.ca }}"
+            - "-keyfile"
+            - "/etc/zetcd/secrets/{{ .Values.etcd.tls.key }}"
+          volumeMounts:
+            - name: tls
+              mountPath: /etc/zetcd/secrets
+              readOnly: true
 {{- end }}
           ports:
             - containerPort: {{ .Values.service.internalPort }}
@@ -44,3 +56,9 @@ spec:
       nodeSelector:
 {{ toYaml .Values.nodeSelector | indent 8 }}
     {{- end }}
+{{- if .Values.etcd.tls }}
+      volumes:
+      - name: tls
+        secret:
+          secretName: {{ .Values.etcd.tls.existingSecret }}
+{{- end }}
diff --git a/stable/zetcd/values.yaml b/stable/zetcd/values.yaml
index bc2d648829..8d2491067f 100644
--- a/stable/zetcd/values.yaml
+++ b/stable/zetcd/values.yaml
@@ -33,6 +33,15 @@ etcd:
   operatorEnabled: true
   endpoints: localhost:2379
 
+  # Communication with etcd can be encrypted and authenticated with a certificate.
+  # In order to enable it, add 'tls' section providing existing secret
+  # containing CA certificate, client certificate and client key.
+  # tls:
+  #   existingSecret: etcd-tls-secret
+  #   cert: client.crt
+  #   key: client.key
+  #   ca: ca.crt
+
 etcd-operator:
   cluster:
     enabled: true