Merge pull request #591 from kubernetes-incubator/etcdtls

Add etcd tls support

roles/kubernetes-apps/ansible/templates/calico-policy-controller.yml.j2

@@ -26,7 +26,13 @@ spec:
           image: calico/kube-policy-controller:latest
           env:
             - name: ETCD_ENDPOINTS
-              value: "{{ etcd_endpoint }}"
+              value: "{{ etcd_access_endpoint }}"
+            - name: ETCD_CA_CERT_FILE
+              value: "{{ etcd_cert_dir }}/ca.pem"
+            - name: ETCD_CERT_FILE
+              value: "{{ etcd_cert_dir }}/node.pem"
+            - name: ETCD_KEY_FILE
+              value: "{{ etcd_cert_dir }}/node-key.pem"
             # Location of the Kubernetes API - this shouldn't need to be
             # changed so long as it is used in conjunction with
             # CONFIGURE_ETC_HOSTS="true".
@@ -38,3 +44,12 @@ spec:
             # This removes the need for KubeDNS to resolve the Service.
             - name: CONFIGURE_ETC_HOSTS
               value: "true"
+    volumeMounts:
+    - mountPath: {{ etcd_cert_dir }}
+      name: etcd-certs
+      readOnly: true
+  volumes:
+  - hostPath:
+      path: {{ etcd_cert_dir }}
+    name: etcd-certs
+