Support external cert secret

charts/pulsar/templates/_autorecovery.tpl

@@ -66,15 +66,15 @@ Define autorecovery tls certs volumes
 {{- if and .Values.tls.enabled .Values.tls.zookeeper.enabled }}
 - name: autorecovery-certs
   secret:
-    secretName: "{{ .Release.Name }}-{{ .Values.tls.autorecovery.cert_name }}"
+    secretName: "{{ template "pulsar.autorecovery.tls.secret.name" . }}"
     items:
     - key: tls.crt
       path: tls.crt
     - key: tls.key
       path: tls.key
 - name: ca
   secret:
-    secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
+    secretName: "{{ template "pulsar.tls.ca.secret.name" . }}"
     items:
     - key: ca.crt
       path: ca.crt
@@ -98,3 +98,14 @@ until timeout 15 bin/bookkeeper shell whatisinstanceid; do
   sleep 3;
 done;
 {{- end }}
+
+{{/*
+Define Autorecovery TLS certificate secret name
+*/}}
+{{- define "pulsar.autorecovery.tls.secret.name" -}}
+{{- if .Values.tls.autorecovery.certSecretName -}}
+{{- .Values.tls.autorecovery.certSecretName -}}
+{{- else -}}
+{{ .Release.Name }}-{{ .Values.tls.autorecovery.cert_name }}
+{{- end -}}
+{{- end -}}

charts/pulsar/templates/_bookkeeper.tpl

@@ -67,15 +67,15 @@ Define bookie tls certs volumes
 {{- if and .Values.tls.enabled (or .Values.tls.bookie.enabled .Values.tls.zookeeper.enabled) }}
 - name: bookie-certs
   secret:
-    secretName: "{{ .Release.Name }}-{{ .Values.tls.bookie.cert_name }}"
+    secretName: "{{ template "pulsar.bookie.tls.secret.name" . }}"
     items:
     - key: tls.crt
       path: tls.crt
     - key: tls.key
       path: tls.key
 - name: ca
   secret:
-    secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
+    secretName: "{{ template "pulsar.tls.ca.secret.name" . }}"
     items:
     - key: ca.crt
       path: ca.crt
@@ -144,3 +144,14 @@ until timeout 15 bin/bookkeeper shell whatisinstanceid; do
 done;
 {{- end }}
 {{- end }}
+
+{{/*
+Define Bookie TLS certificate secret name
+*/}}
+{{- define "pulsar.bookie.tls.secret.name" -}}
+{{- if .Values.tls.bookie.certSecretName -}}
+{{- .Values.tls.bookie.certSecretName -}}
+{{- else -}}
+{{ .Release.Name }}-{{ .Values.tls.bookie.cert_name }}
+{{- end -}}
+{{- end -}}

charts/pulsar/templates/_broker.tpl

@@ -73,15 +73,15 @@ Define broker tls certs volumes
 {{- if and .Values.tls.enabled (or .Values.tls.broker.enabled (or .Values.tls.bookie.enabled .Values.tls.zookeeper.enabled)) }}
 - name: broker-certs
   secret:
-    secretName: "{{ .Release.Name }}-{{ .Values.tls.broker.cert_name }}"
+    secretName: "{{ template "pulsar.broker.tls.secret.name" . }}"
     items:
     - key: tls.crt
       path: tls.crt
     - key: tls.key
       path: tls.key
 - name: ca
   secret:
-    secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
+    secretName: "{{ template "pulsar.tls.ca.secret.name" . }}"
     items:
     - key: ca.crt
       path: ca.crt
@@ -93,3 +93,14 @@ Define broker tls certs volumes
 {{- end }}
 {{- end }}
 {{- end }}
+
+{{/*
+Define Broker TLS certificate secret name
+*/}}
+{{- define "pulsar.broker.tls.secret.name" -}}
+{{- if .Values.tls.broker.certSecretName -}}
+{{- .Values.tls.broker.certSecretName -}}
+{{- else -}}
+{{ .Release.Name }}-{{ .Values.tls.broker.cert_name }}
+{{- end -}}
+{{- end -}}

charts/pulsar/templates/_helpers.tpl

@@ -136,3 +136,13 @@ Lookup pull policy, default to defaultPullPolicy
 {{- printf "%s" (.image.pullPolicy | default .root.Values.defaultPullPolicy) -}}
 {{- end -}}
 
+{{/*
+Define TLS CA secret name
+*/}}
+{{- define "pulsar.tls.ca.secret.name" -}}
+{{- if .Values.tls.common.caSecretName -}}
+{{- .Values.tls.common.caSecretName -}}
+{{- else -}}
+{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}
+{{- end -}}
+{{- end -}}

charts/pulsar/templates/_proxy.tpl

@@ -0,0 +1,84 @@
+{{/*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+*/}}
+
+{{/*
+Define Proxy TLS certificate secret name
+*/}}
+{{- define "pulsar.proxy.tls.secret.name" -}}
+{{- if .Values.tls.proxy.certSecretName -}}
+{{- .Values.tls.proxy.certSecretName -}}
+{{- else -}}
+{{ .Release.Name }}-{{ .Values.tls.proxy.cert_name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Define proxy certs mounts
+*/}}
+{{- define "pulsar.proxy.certs.volumeMounts" -}}
+{{- if and .Values.tls.enabled (or .Values.tls.proxy.enabled .Values.tls.broker.enabled) }}
+{{- if .Values.tls.proxy.enabled }}
+- mountPath: "/pulsar/certs/proxy"
+  name: proxy-certs
+  readOnly: true
+{{- if .Values.tls.proxy.untrustedCa }}
+- mountPath: "/pulsar/certs/ca"
+  name: proxy-ca
+  readOnly: true
+{{- end }}
+{{- end }}
+{{- if .Values.tls.broker.enabled }}
+- mountPath: "/pulsar/certs/broker"
+  name: broker-ca
+  readOnly: true
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Define proxy certs volumes
+*/}}
+{{- define "pulsar.proxy.certs.volumes" -}}
+{{- if and .Values.tls.enabled .Values.tls.proxy.enabled }}
+{{- if .Values.tls.proxy.untrustedCa }}
+- name: proxy-ca
+  secret:
+    secretName: "{{ template "pulsar.tls.ca.secret.name" . }}"
+    items:
+      - key: ca.crt
+        path: ca.crt
+  {{- end }}
+- name: proxy-certs
+  secret:
+    secretName: "{{ template "pulsar.proxy.tls.secret.name" . }}"
+    items:
+      - key: tls.crt
+        path: tls.crt
+      - key: tls.key
+        path: tls.key
+{{- end }}
+{{- if and .Values.tls.enabled .Values.tls.broker.enabled }}
+- name: broker-ca
+  secret:
+    secretName: "{{ template "pulsar.tls.ca.secret.name" . }}"
+    items:
+      - key: ca.crt
+        path: ca.crt
+{{- end }}
+{{- end }}

charts/pulsar/templates/_toolset.tpl

@@ -66,15 +66,15 @@ Define toolset tls certs volumes
 {{- if and .Values.tls.enabled .Values.tls.zookeeper.enabled }}
 - name: toolset-certs
   secret:
-    secretName: "{{ .Release.Name }}-{{ .Values.tls.toolset.cert_name }}"
+    secretName: "{{ template "pulsar.toolset.tls.secret.name" . }}"
     items:
     - key: tls.crt
       path: tls.crt
     - key: tls.key
       path: tls.key
 - name: ca
   secret:
-    secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
+    secretName: "{{ template "pulsar.tls.ca.secret.name" . }}"
     items:
     - key: ca.crt
       path: ca.crt
@@ -86,3 +86,14 @@ Define toolset tls certs volumes
 {{- end }}
 {{- end }}
 {{- end }}
+
+{{/*
+Define toolset TLS certificate secret name
+*/}}
+{{- define "pulsar.toolset.tls.secret.name" -}}
+{{- if .Values.tls.toolset.certSecretName -}}
+{{- .Values.tls.toolset.certSecretName -}}
+{{- else -}}
+{{ .Release.Name }}-{{ .Values.tls.toolset.cert_name }}
+{{- end -}}
+{{- end -}}

charts/pulsar/templates/_zookeeper.tpl

@@ -57,3 +57,56 @@ Define zookeeper tls settings
 {{- end }}
 {{- end }}
 
+{{/*
+Define zookeeper certs mounts
+*/}}
+{{- define "pulsar.zookeeper.certs.volumeMounts" -}}
+{{- if and .Values.tls.enabled .Values.tls.zookeeper.enabled }}
+- mountPath: "/pulsar/certs/zookeeper"
+  name: zookeeper-certs
+  readOnly: true
+- mountPath: "/pulsar/certs/ca"
+  name: ca
+  readOnly: true
+- name: keytool
+  mountPath: "/pulsar/keytool/keytool.sh"
+  subPath: keytool.sh
+{{- end }}
+{{- end }}
+
+{{/*
+Define zookeeper certs volumes
+*/}}
+{{- define "pulsar.zookeeper.certs.volumes" -}}
+{{- if and .Values.tls.enabled .Values.tls.zookeeper.enabled }}
+- name: zookeeper-certs
+  secret:
+    secretName: "{{ template "pulsar.zookeeper.tls.secret.name" . }}"
+    items:
+      - key: tls.crt
+        path: tls.crt
+      - key: tls.key
+        path: tls.key
+- name: ca
+  secret:
+    secretName: "{{ template "pulsar.tls.ca.secret.name" . }}"
+    items:
+      - key: ca.crt
+        path: ca.crt
+- name: keytool
+  configMap:
+    name: "{{ template "pulsar.fullname" . }}-keytool-configmap"
+    defaultMode: 0755
+{{- end}}
+{{- end }}
+
+{{/*
+Define ZooKeeper TLS certificate secret name
+*/}}
+{{- define "pulsar.zookeeper.tls.secret.name" -}}
+{{- if .Values.tls.zookeeper.certSecretName -}}
+{{- .Values.tls.zookeeper.certSecretName -}}
+{{- else -}}
+{{ .Release.Name }}-{{ .Values.tls.zookeeper.cert_name }}
+{{- end -}}
+{{- end -}}

charts/pulsar/templates/proxy-statefulset.yaml

@@ -247,16 +247,7 @@ spec:
             readOnly: true
           {{- end }}
           {{- end }}
-          {{- if .Values.tls.proxy.enabled }}
-          - mountPath: "/pulsar/certs/proxy"
-            name: proxy-certs
-            readOnly: true
-          {{- end}}
-          {{- if .Values.tls.enabled }}
-          - mountPath: "/pulsar/certs/ca"
-            name: ca
-            readOnly: true
-          {{- end}}
+          {{- include "pulsar.proxy.certs.volumeMounts" . | nindent 8 }}
           {{- if .Values.proxy.extraVolumeMounts }}
 {{ toYaml .Values.proxy.extraVolumeMounts | indent 10 }}
           {{- end }}
@@ -293,21 +284,6 @@ spec:
                 path: proxy/token
         {{- end}}
         {{- end}}
-        {{- if .Values.tls.proxy.enabled }}
-        - name: ca
-          secret:
-            secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
-            items:
-              - key: ca.crt
-                path: ca.crt
-        - name: proxy-certs
-          secret:
-            secretName: "{{ .Release.Name }}-{{ .Values.tls.proxy.cert_name }}"
-            items:
-              - key: tls.crt
-                path: tls.crt
-              - key: tls.key
-                path: tls.key
-        {{- end}}
+        {{- include "pulsar.proxy.certs.volumes" . | nindent 6 }}
       {{- end}}
 {{- end }}

charts/pulsar/templates/zookeeper-statefulset.yaml

@@ -219,17 +219,7 @@ spec:
         - name: "{{ template "pulsar.fullname" . }}-{{ .Values.zookeeper.component }}-{{ .Values.zookeeper.volumes.datalog.name }}"
           mountPath: /pulsar/data-log
         {{- end }}
-        {{- if and .Values.tls.enabled .Values.tls.zookeeper.enabled }}
-        - mountPath: "/pulsar/certs/zookeeper"
-          name: zookeeper-certs
-          readOnly: true
-        - mountPath: "/pulsar/certs/ca"
-          name: ca
-          readOnly: true
-        - name: keytool
-          mountPath: "/pulsar/keytool/keytool.sh"
-          subPath: keytool.sh
-        {{- end }}
+        {{- include "pulsar.zookeeper.certs.volumeMounts" . | nindent 8 }}
         {{- if .Values.zookeeper.extraVolumeMounts }}
 {{ toYaml .Values.zookeeper.extraVolumeMounts | indent 8 }}
         {{- end }}
@@ -241,26 +231,7 @@ spec:
       {{- if .Values.zookeeper.extraVolumes }}
 {{ toYaml .Values.zookeeper.extraVolumes | indent 6 }}
       {{- end }}
-      {{- if and .Values.tls.enabled .Values.tls.zookeeper.enabled }}
-      - name: zookeeper-certs
-        secret:
-          secretName: "{{ .Release.Name }}-{{ .Values.tls.zookeeper.cert_name }}"
-          items:
-            - key: tls.crt
-              path: tls.crt
-            - key: tls.key
-              path: tls.key
-      - name: ca
-        secret:
-          secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
-          items:
-            - key: ca.crt
-              path: ca.crt
-      - name: keytool
-        configMap:
-          name: "{{ template "pulsar.fullname" . }}-keytool-configmap"
-          defaultMode: 0755
-      {{- end}}
+      {{- include "pulsar.zookeeper.certs.volumes" . | nindent 6 }}
       {{- include "pulsar.imagePullSecrets" . | nindent 6}}
 {{- if and (and .Values.persistence .Values.volumes.persistence) .Values.zookeeper.volumes.persistence }}
   volumeClaimTemplates: