From f0fd1a8d82efc3f274e888bc78fac12955308a93 Mon Sep 17 00:00:00 2001
From: Ravi Kumar <rustyclock@protonmail.com>
Date: Mon, 27 Aug 2018 07:49:39 +0530
Subject: [PATCH] [incubator/kafka] Add ability to mount secrets (#7233)

* [incubator/kafka] Add ability to mount secrets

* Provide the ability to mount secrets in the kafka brokers. This is useful when using custom authorizers.
* Add ability to pass environment variables

* [incubator/kafka] Update Readme, incorporate review suggestions
---
 incubator/kafka/Chart.yaml                 |  2 +-
 incubator/kafka/README.md                  |  1 +
 incubator/kafka/templates/statefulset.yaml | 24 ++++++++++++++++++++++
 incubator/kafka/values.yaml                | 15 ++++++++++++++
 4 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/incubator/kafka/Chart.yaml b/incubator/kafka/Chart.yaml
index 935ec96f9a..34d37d79fa 100755
--- a/incubator/kafka/Chart.yaml
+++ b/incubator/kafka/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 description: Apache Kafka is publish-subscribe messaging rethought as a distributed
   commit log.
 name: kafka
-version: 0.8.8
+version: 0.9.0
 appVersion: 4.1.2
 keywords:
 - kafka
diff --git a/incubator/kafka/README.md b/incubator/kafka/README.md
index 0c318077a3..78c9845d7e 100644
--- a/incubator/kafka/README.md
+++ b/incubator/kafka/README.md
@@ -80,6 +80,7 @@ following configurable parameters:
 | `external.annotations`                         | Additional annotations for the external service.                                                                                                                         | `{}`                                                               |
 | `rbac.enabled`                                 | Enable a service account and role for the init container to use in an RBAC enabled cluster                                                                               | `false`                                                            |
 | `configurationOverrides`                       | `Kafka ` [configuration setting][brokerconfigs] overrides in the dictionary format                                                                                       | `{ offsets.topic.replication.factor: 3 }`                          |
+| `secrets` | `{}` | Pass any secrets to the kafka pods. Each secret will be passed as an environment variable by default. The secret can also be mounted to a specific path (in addition to environment variable) if required. Environment variable names are generated as: `<secretName>_<secretKey>` (All upper case)|
 | `additionalPorts`                              | Additional ports to expose on brokers.  Useful when the image exposes metrics (like prometheus, etc.) through a javaagent instead of a sidecar                           | `{}`                                                               |
 | `readinessProbe.initialDelaySeconds`           | Number of seconds before probe is initiated.                                                                                                                             | `30`                                                               |
 | `readinessProbe.periodSeconds`                 | How often (in seconds) to perform the probe.                                                                                                                             | `10`                                                               |
diff --git a/incubator/kafka/templates/statefulset.yaml b/incubator/kafka/templates/statefulset.yaml
index e8c988d69c..e1a1db4f60 100644
--- a/incubator/kafka/templates/statefulset.yaml
+++ b/incubator/kafka/templates/statefulset.yaml
@@ -173,6 +173,15 @@ spec:
         - name: KAFKA_JMX_PORT
           value: "{{ .Values.jmx.port }}"
         {{- end }}
+        {{- range $secret := .Values.secrets }}
+          {{- range $key := $secret.keys }}
+        - name: {{ (print $secret.name "_" $key) | upper }}
+          valueFrom:
+            secretKeyRef:
+              name: {{ $secret.name }}
+              key: {{ $key }}
+          {{- end }}
+        {{- end }}
         # This is required because the Downward API does not yet support identification of
         # pod numbering in statefulsets. Thus, we are required to specify a command which
         # allows us to extract the pod ID for usage as the Kafka Broker ID.
@@ -188,6 +197,16 @@ spec:
         volumeMounts:
         - name: datadir
           mountPath: {{ .Values.persistence.mountPath | quote }}
+        {{- range $secret := .Values.secrets }}
+          {{- if $secret.mountPath }}
+            {{- range $key := $secret.keys }}
+        - name: {{ include "kafka.fullname" $ }}-{{ $secret.name }}
+          mountPath: {{ $secret.mountPath }}
+          subPath: {{ $key }}
+          readOnly: true
+            {{- end }}
+          {{- end }}
+        {{- end }}
       volumes:
       {{- if not .Values.persistence.enabled }}
       - name: datadir
@@ -202,6 +221,11 @@ spec:
           name: {{ include "kafka.fullname" . }}-metrics
           {{- end }}
       {{- end }}
+      {{- range .Values.secrets }}
+      - name: {{ include "kafka.fullname" $ }}-{{ .name }}
+        secret:
+          secretName: {{ .name }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
   {{- if .Values.persistence.enabled }}
   volumeClaimTemplates:
diff --git a/incubator/kafka/values.yaml b/incubator/kafka/values.yaml
index 369bbb5f1b..4b90d6b59a 100644
--- a/incubator/kafka/values.yaml
+++ b/incubator/kafka/values.yaml
@@ -40,6 +40,21 @@ podManagementPolicy: OrderedReady
 rbac:
   enabled: false
 
+## Useful if using any custom authorizer
+## Pass in some secrets to use (if required)
+# secrets:
+# - name: myKafkaSecret
+#   keys:
+#     - username
+#     - password
+#   # mountPath: /opt/kafka/secret
+# - name: myZkSecret
+#   keys:
+#     - user
+#     - pass
+#   mountPath: /opt/zookeeper/secret
+
+
 ## The name of the storage class which the cluster should use.
 # storageClass: default