Add support for encrypted connection between zetcd and etcd (helm#4903)

* Add support for encrypted connection between zetcd and etcd. Fixes helm#4898 * Remove added empty lines * Fix problems found by helm lint * Fix whitespace * Fixes after review * Remove trailing namespaces, increment chart version
agolo · May 2, 2018 · cd18797 · cd18797
1 parent 03ab26f
commit cd18797
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 2 deletions.
diff --git a/stable/zetcd/Chart.yaml b/stable/zetcd/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 description: CoreOS zetcd Helm chart for Kubernetes
 name: zetcd
-version: 0.1.8
+version: 0.1.9
 appVersion: 0.0.3
 home: https://github.com/coreos/zetcd
 sources:

diff --git a/stable/zetcd/README.md b/stable/zetcd/README.md
@@ -58,7 +58,10 @@ The following table lists the configurable parameters of the zetcd chart and the
 | `nodeSelector`                                    | Node labels for pod assignment                               |`{}`                                     |
 | `etcd.operatorEnabled`                            | Whether to use etcd-operator to launch a cluster                    | `true`                                        |
 | `etcd.endpoints`                                  | Existing etcd endpoints to be used when etcd-operator is disabled                    | `localhost:2379`                                        |
-
+| `etcd.tls.existingSecret`                                 | Name of the secret containing certificate, key and CA certificate          |                           |
+| `etcd.tls.ca`                                     | Key in TLS secret that contains CA certificate                             |                           |
+| `etcd.tls.cert`                                   | Key in TLS secret that contains client certificate                         |                           |
+| `etcd.tls.key`                                    | Key in TLS secret that contains private key                                |                           |
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example:
 

diff --git a/stable/zetcd/templates/deployment.yaml b/stable/zetcd/templates/deployment.yaml
@@ -29,6 +29,18 @@ spec:
 {{- else }}
             - "-endpoints" 
             - "{{ .Values.etcd.endpoints }}"
+{{- end }}
+{{- if .Values.etcd.tls }}
+            - "-certfile"
+            - "/etc/zetcd/secrets/{{ .Values.etcd.tls.cert }}"
+            - "-cafile"
+            - "/etc/zetcd/secrets/{{ .Values.etcd.tls.ca }}"
+            - "-keyfile"
+            - "/etc/zetcd/secrets/{{ .Values.etcd.tls.key }}"
+          volumeMounts:
+            - name: tls
+              mountPath: /etc/zetcd/secrets
+              readOnly: true
 {{- end }}
           ports:
             - containerPort: {{ .Values.service.internalPort }}
@@ -44,3 +56,9 @@ spec:
       nodeSelector:
 {{ toYaml .Values.nodeSelector | indent 8 }}
     {{- end }}
+{{- if .Values.etcd.tls }}
+      volumes:
+      - name: tls
+        secret:
+          secretName: {{ .Values.etcd.tls.existingSecret }}
+{{- end }}
diff --git a/stable/zetcd/values.yaml b/stable/zetcd/values.yaml
@@ -33,6 +33,15 @@ etcd:
   operatorEnabled: true
   endpoints: localhost:2379
 
+  # Communication with etcd can be encrypted and authenticated with a certificate.
+  # In order to enable it, add 'tls' section providing existing secret
+  # containing CA certificate, client certificate and client key.
+  # tls:
+  #   existingSecret: etcd-tls-secret
+  #   cert: client.crt
+  #   key: client.key
+  #   ca: ca.crt
+
 etcd-operator:
   cluster:
     enabled: true