Implement TLS authentication for kafka mqt (#1300)

* use secrets to store keys and certificates

pkg/mqtrigger/mqtrigger.go

@@ -17,7 +17,11 @@ limitations under the License.
 package mqtrigger
 
 import (
+	"fmt"
+	"io/ioutil"
 	"os"
+	"path"
+	"strings"
 
 	"github.com/pkg/errors"
 	"go.uber.org/zap"
@@ -28,6 +32,7 @@ import (
 
 func Start(logger *zap.Logger, routerUrl string) error {
 	fissionClient, _, _, err := crd.MakeFissionClient()
+
 	if err != nil {
 		return errors.Wrap(err, "failed to get fission or kubernetes client")
 	}
@@ -40,10 +45,57 @@ func Start(logger *zap.Logger, routerUrl string) error {
 	// Message queue type: nats is the only supported one for now
 	mqType := os.Getenv("MESSAGE_QUEUE_TYPE")
 	mqUrl := os.Getenv("MESSAGE_QUEUE_URL")
+
+	secretsPath := strings.TrimSpace(os.Getenv("MESSAGE_QUEUE_SECRETS"))
+
+	var secrets map[string][]byte
+	if len(secretsPath) > 0 {
+		// For authentication with message queue
+		secrets, err = readSecrets(logger, secretsPath)
+		if err != nil {
+			return err
+		}
+	}
+
 	mqCfg := messageQueue.MessageQueueConfig{
-		MQType: mqType,
-		Url:    mqUrl,
+		MQType:  mqType,
+		Url:     mqUrl,
+		Secrets: secrets,
 	}
 	messageQueue.MakeMessageQueueTriggerManager(logger, fissionClient, routerUrl, mqCfg)
 	return nil
 }
+
+func readSecrets(logger *zap.Logger, secretsPath string) (map[string][]byte, error) {
+
+	// return if no secrets exist
+	if _, err := os.Stat(secretsPath); os.IsNotExist(err) {
+		return nil, err
+	}
+
+	secretFiles, err := ioutil.ReadDir(secretsPath)
+	if err != nil {
+		return nil, err
+	}
+
+	secrets := make(map[string][]byte)
+	for _, secretFile := range secretFiles {
+
+		fileName := secretFile.Name()
+		// /etc/secrets contain some hidden directories (like .data)
+		// ignore them
+		if !secretFile.IsDir() && !strings.HasPrefix(fileName, ".") {
+			logger.Info(fmt.Sprintf("Reading secret from %s", fileName))
+
+			filePath := path.Join(secretsPath, fileName)
+			secret, fileReadErr := ioutil.ReadFile(filePath)
+			if fileReadErr != nil {
+				return nil, fileReadErr
+			}
+
+			secrets[fileName] = secret
+		}
+	}
+
+	return secrets, nil
+}