openshift router config to support client certificate authentication

sample_router_dc.yaml

apiVersion: v1
kind: DeploymentConfig
metadata:
  creationTimestamp: 2017-11-21T14:35:23Z
  generation: 7
  labels:
    router: router
  name: router
  namespace: default
  resourceVersion: "65033"
  selfLink: /oapi/v1/namespaces/default/deploymentconfigs/router
  uid: 350ebd39-cec9-11e7-b1e6-42d370282345
spec:
  replicas: 1
  selector:
    router: router
  strategy:
    activeDeadlineSeconds: 21600
    resources: {}
    rollingParams:
      intervalSeconds: 1
      maxSurge: 0
      maxUnavailable: 25%
      timeoutSeconds: 600
      updatePeriodSeconds: 1
    type: Rolling
  template:
    metadata:
      creationTimestamp: null
      labels:
        router: router
    spec:
      containers:
      - env:
        - name: DEFAULT_CERTIFICATE_DIR
          value: /etc/pki/tls/private
        - name: DEFAULT_CERTIFICATE_PATH
          value: /etc/pki/tls/private/tls.crt
        - name: ROUTER_CIPHERS
        - name: ROUTER_EXTERNAL_HOST_HOSTNAME
        - name: ROUTER_EXTERNAL_HOST_HTTPS_VSERVER
        - name: ROUTER_EXTERNAL_HOST_HTTP_VSERVER
        - name: ROUTER_EXTERNAL_HOST_INSECURE
          value: "false"
        - name: ROUTER_EXTERNAL_HOST_INTERNAL_ADDRESS
        - name: ROUTER_EXTERNAL_HOST_PARTITION_PATH
        - name: ROUTER_EXTERNAL_HOST_PASSWORD
        - name: ROUTER_EXTERNAL_HOST_PRIVKEY
          value: /etc/secret-volume/router.pem
        - name: ROUTER_EXTERNAL_HOST_USERNAME
        - name: ROUTER_EXTERNAL_HOST_VXLAN_GW_CIDR
        - name: ROUTER_LISTEN_ADDR
          value: 0.0.0.0:1936
        - name: ROUTER_METRICS_TYPE
          value: haproxy
        - name: ROUTER_SERVICE_HTTPS_PORT
          value: "443"
        - name: ROUTER_SERVICE_HTTP_PORT
          value: "80"
        - name: ROUTER_SERVICE_NAME
          value: router
        - name: ROUTER_SERVICE_NAMESPACE
          value: default
        - name: ROUTER_SUBDOMAIN
        - name: STATS_PASSWORD
          value: PlgVaGcTV1
        - name: STATS_PORT
          value: "1936"
        - name: STATS_USERNAME
          value: admin
        - name: TEMPLATE_FILE
          value: /var/lib/haproxy/conf/custom/config/haproxy-config.template
        image: openshift/origin-haproxy-router:v3.7.0-rc.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: 1936
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: router
        ports:
        - containerPort: 80
          hostPort: 80
          protocol: TCP
        - containerPort: 443
          hostPort: 443
          protocol: TCP
        - containerPort: 1936
          hostPort: 1936
          name: stats
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: 1936
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          requests:
            cpu: 100m
            memory: 256Mi
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /etc/pki/tls/private
          name: server-certificate
          readOnly: true
        - mountPath: /var/lib/haproxy/conf/custom/config
          name: config-volume
        - mountPath: /var/lib/haproxy/conf/custom/map
          name: map-volume
        - mountPath: /var/lib/haproxy/conf/custom/ca
          name: ca-volume
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: router
      serviceAccountName: router
      terminationGracePeriodSeconds: 30
      volumes:
      - name: server-certificate
        secret:
          defaultMode: 420
          secretName: router-certs
      - configMap:
          defaultMode: 420
          name: ccaconfig
        name: config-volume
      - configMap:
          defaultMode: 420
          name: caaverifymap
        name: map-volume
      - configMap:
          defaultMode: 420
          name: trustpem
        name: ca-volume
  test: false
  triggers:
  - type: ConfigChange
status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: 2017-11-23T10:33:15Z
    lastUpdateTime: 2017-11-23T10:33:17Z
    message: replication controller "router-7" successfully rolled out
    reason: NewReplicationControllerAvailable
    status: "True"
    type: Progressing
  - lastTransitionTime: 2017-11-23T10:33:49Z
    lastUpdateTime: 2017-11-23T10:33:49Z
    message: Deployment config has minimum availability.
    status: "True"
    type: Available
  details:
    causes:
    - type: Manual
    message: manual change
  latestVersion: 7
  observedGeneration: 7
  readyReplicas: 1
  replicas: 1
  unavailableReplicas: 0
  updatedReplicas: 1