From f4cf35b5f30bbe1f1f4e6763566156d88e18f20f Mon Sep 17 00:00:00 2001
From: Ravi Kumar <rustyclock@protonmail.com>
Date: Tue, 2 Oct 2018 01:19:52 +0530
Subject: [PATCH] [incubator/zookeeper] Add secrets to zookeeper (#7232)

* Provide the ability to mount secrets to the zookeeper nodes. This is useful when using kafka with a custom authorizer.

Signed-off-by: rustycl0ck <the.absolute.dude@gmail.com>
---
 incubator/zookeeper/Chart.yaml                |  2 +-
 .../zookeeper/templates/statefulset.yaml      | 27 +++++++++++++++++--
 incubator/zookeeper/values.yaml               | 17 ++++++++++++
 3 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/incubator/zookeeper/Chart.yaml b/incubator/zookeeper/Chart.yaml
index e119a27cce..c58087e099 100644
--- a/incubator/zookeeper/Chart.yaml
+++ b/incubator/zookeeper/Chart.yaml
@@ -1,6 +1,6 @@
 name: zookeeper
 home: https://zookeeper.apache.org/
-version: 1.1.2
+version: 1.2.0
 appVersion: 3.4.10
 description: Centralized service for maintaining configuration information, naming,
   providing distributed synchronization, and providing group services.
diff --git a/incubator/zookeeper/templates/statefulset.yaml b/incubator/zookeeper/templates/statefulset.yaml
index 7a5a0a3698..5e6b4e4d8a 100644
--- a/incubator/zookeeper/templates/statefulset.yaml
+++ b/incubator/zookeeper/templates/statefulset.yaml
@@ -72,11 +72,31 @@ spec:
             - name: {{ $key | upper | replace "." "_" }}
               value: {{ $value | quote }}
           {{- end }}
+          {{- range $secret := .Values.secrets }}
+            {{- range $key := $secret.keys }}
+          - name: {{ (print $secret.name "_" $key) | upper }}
+            valueFrom:
+              secretKeyRef:
+                name: {{ $secret.name }}
+                key: {{ $key }}
+            {{- end }}
+          {{- end }}
           resources:
 {{ toYaml .Values.resources | indent 12 }}
           volumeMounts:
             - name: data
               mountPath: /var/lib/zookeeper
+            {{- range $secret := .Values.secrets }}
+              {{- if $secret.mountPath }}
+                {{- range $key := $secret.keys }}
+            - name: {{ $.Release.Name }}-{{ $secret.name }}
+              mountPath: {{ $secret.mountPath }}/{{ $key }}
+              subPath: {{ $key }}
+              readOnly: true
+                {{- end }}
+              {{- end }}
+            {{- end }}
+
 
 {{- if .Values.exporters.jmx.enabled }}
         - name: jmx-exporter
@@ -148,8 +168,12 @@ spec:
       tolerations:
 {{ toYaml . | indent 8 }}
     {{- end }}
-      {{- if (or .Values.exporters.jmx.enabled (not .Values.persistence.enabled)) }}
       volumes:
+        {{- range .Values.secrets }}
+        - name: {{ $.Release.Name }}-{{ .name }}
+          secret:
+            secretName: {{ .name }}
+        {{- end }}
         {{- if .Values.exporters.jmx.enabled }}
         - name: config-jmx-exporter
           configMap:
@@ -159,7 +183,6 @@ spec:
         - name: data
           emptyDir: {}
         {{- end }}
-      {{- end }}
   {{- if .Values.persistence.enabled }}
   volumeClaimTemplates:
     - metadata:
diff --git a/incubator/zookeeper/values.yaml b/incubator/zookeeper/values.yaml
index 547cd1077e..5ed16c0a40 100644
--- a/incubator/zookeeper/values.yaml
+++ b/incubator/zookeeper/values.yaml
@@ -113,6 +113,23 @@ securityContext:
   fsGroup: 1000
   runAsUser: 1000
 
+## Useful if using any custom authorizer.
+## Pass any secrets to the kafka pods. Each secret will be passed as an
+## environment variable by default. The secret can also be mounted to a
+## specific path (in addition to environment variable) if required. Environment
+## variable names are generated as: `<secretName>_<secretKey>` (All upper case)
+# secrets:
+# - name: myKafkaSecret
+#   keys:
+#     - username
+#     - password
+#   # mountPath: /opt/kafka/secret
+# - name: myZkSecret
+#   keys:
+#     - user
+#     - pass
+#   mountPath: /opt/zookeeper/secret
+
 persistence:
   enabled: true
   ## zookeeper data Persistent Volume Storage Class