<p>Running CoreOS, etcd is not secured by default. To secure it I can use TLS, which adds a level of complexity I'm willing to work on. </p>

<p>Now, is Kubernetes able to use a TLS secured etcd cluster? </p>

<p>In the config for the kubelet and various pods, Kubernetes passes the etcd endpoints as parameters, so they require etcd and will need the certificates to talk to it if it is secured. 
If Kubernetes supports TLS connection to etcd, how does it get configured? </p>

<p>Thanks</p>

<p>The API server is the only component that speaks directly to etcd. When starting the API server, you can pass a <code>--etcd-config=/path/to/client/config</code> parameter instead of just pointing to an unsecured etcd server with <code>--etcd-server</code></p>

<p>In that config file, you would specify the etcd servers, along with the client credentials (cert/key) to use to connect.</p>

<p>The format is that expected by the go-etcd client NewClientFromFile function, which expects a JSON serialization of the <a href="https://github.com/coreos/go-etcd/blob/de3514f25635bbfb024fdaf2a8d5f67378492675/etcd/client.go#L50" rel="nofollow">Client</a> struct, specifically the <code>config</code> and <code>cluster</code> keys</p>
