code: func getClient() (*lock.EtcdLockClient, error) {
  	// copy of github.com/coreos/etcd/client.DefaultTransport so that
  	// TLSClientConfig can be overridden.
  	transport := &http.Transport{
  		Proxy: http.ProxyFromEnvironment,
  		Dial: (&net.Dialer{
  			Timeout:   30 * time.Second,
  			KeepAlive: 30 * time.Second,
  		}).Dial,
  		TLSHandshakeTimeout: 10 * time.Second,
  	}
  
  	if globalFlags.EtcdCAFile != "" || globalFlags.EtcdCertFile != "" || globalFlags.EtcdKeyFile != "" {
  		cert, err := tls.LoadX509KeyPair(globalFlags.EtcdCertFile, globalFlags.EtcdKeyFile)
  		if err != nil {
  			return nil, err
  		}
  
  		ca, err := ioutil.ReadFile(globalFlags.EtcdCAFile)
  		if err != nil {
  			return nil, err
  		}
  
  		capool := x509.NewCertPool()
  		capool.AppendCertsFromPEM(ca)
  
  		tlsconf := &tls.Config{
  			Certificates: []tls.Certificate{cert},
  			RootCAs:      capool,
  		}
  
  		tlsconf.BuildNameToCertificate()
  
  		transport.TLSClientConfig = tlsconf
  	}
  
  	cfg := client.Config{
  		Endpoints: globalFlags.Endpoints,
  		Transport: transport,
  		Username:  globalFlags.EtcdUsername,
  		Password:  globalFlags.EtcdPassword,
  	}
  
  	ec, err := client.New(cfg)
  	if err != nil {
  		return nil, err
  	}
  
  	kapi := client.NewKeysAPI(ec)
  
  	lc, err := lock.NewEtcdLockClient(kapi, globalFlags.Group)
  	if err != nil {
  		return nil, err
  	}
  	return lc, err
  }
docs: // getLockClient returns an initialized EtcdLockClient, using an etcd
  // client configured from the global etcd flags