rsync stunnel manual setup with nginx ingress

rsync-stunnel-server-setup.yaml

apiVersion: v1
kind: Pod
metadata:
  labels:
    app: crane2
  name: rsync-server
  namespace: default
spec:
  containers:
  - command:
    - /usr/bin/rsync
    - --daemon
    - --no-detach
    - --port=2222
    - -vvv
    image: quay.io/konveyor/rsync-transfer:latest
    imagePullPolicy: Always
    name: rsync
    ports:
    - containerPort: 2222
      name: rsyncd
      protocol: TCP
    resources: {}
    securityContext:
      capabilities:
        drop:
        - MKNOD
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /etc/rsyncd.conf
      name: crane2-rsync-server-config
      subPath: rsyncd.conf
    - mountPath: /etc/rsync-secret
      name: crane2-rsync-server-secret
    - mountPath: /mnt/state-transfer/volsync
      name: volsync
  - command:
    - /bin/stunnel
    - /etc/stunnel/stunnel.conf
    image: quay.io/konveyor/rsync-transfer:latest
    imagePullPolicy: Always
    name: stunnel
    ports:
    - containerPort: 6443
      name: stunnel
      protocol: TCP
    resources: {}
    securityContext:
      capabilities:
        drop:
        - MKNOD
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /etc/stunnel/stunnel.conf
      name: crane2-stunnel-server-config
      subPath: stunnel.conf
    - mountPath: /etc/stunnel/certs
      name: crane2-stunnel-server-secret
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  preemptionPolicy: PreemptLowerPriority
  priority: 0
  restartPolicy: Always
  schedulerName: default-scheduler
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  volumes:
  - name: volsync
    emptyDir: {}
  - configMap:
      defaultMode: 420
      name: crane2-rsync-server-config
    name: crane2-rsync-server-config
  - name: crane2-rsync-server-secret
    secret:
      defaultMode: 384
      items:
      - key: credentials
        path: rsyncd.secrets
      secretName: crane2-rsync-server-secret
  - configMap:
      defaultMode: 420
      name: crane2-stunnel-server-config
    name: crane2-stunnel-server-config
  - name: crane2-stunnel-server-secret
    secret:
      defaultMode: 420
      items:
      - key: tls.crt
        path: tls.crt
      - key: tls.key
        path: tls.key
      secretName: crane2-stunnel-server-secret
---
apiVersion: v1
data:
  credentials: cm9vdDpyb290
kind: Secret
metadata:
  labels:
    app: crane2
  name: crane2-rsync-server-secret
  namespace: default
type: Opaque
---
apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZ4ekNDQTYrZ0F3SUJBZ0lDQitRd0RRWUpLb1pJaHZjTkFRRUxCUUF3ZFRFTE1Ba0dBMVVFQmhNQ1ZWTXgKQ3pBSkJnTlZCQWdUQWs1RE1Rd3dDZ1lEVlFRSEV3TlNSRlV4SGpBY0JnTlZCQW9URlUxcFozSmhkR2x2YmlCRgpibWRwYm1WbGNtbHVaekVVTUJJR0ExVUVDeE1MUlc1bmFXNWxaWEpwYm1jeEZUQVRCZ05WQkFNVERHOXdaVzV6CmFHbG1kQzVwYnpBZUZ3MHlNVEV4TWpNd016STVORFphRncwek1URXhNak13TXpJNU5EWmFNSFV4Q3pBSkJnTlYKQkFZVEFsVlRNUXN3Q1FZRFZRUUlFd0pPUXpFTU1Bb0dBMVVFQnhNRFVrUlZNUjR3SEFZRFZRUUtFeFZOYVdkeQpZWFJwYjI0Z1JXNW5hVzVsWlhKcGJtY3hGREFTQmdOVkJBc1RDMFZ1WjJsdVpXVnlhVzVuTVJVd0V3WURWUVFECkV3eHZjR1Z1YzJocFpuUXVhVzh3Z2dJaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQ0R3QXdnZ0lLQW9JQ0FRQzAKUXUrQjVmS1BxMzhVbG9YUEpISzFvL0E1dHRBeUZLbnVWaGVlZHpZZnZQMU8yRGFKeDdmVFFTNTk3aUJLM3ZQegpHSVBHK2ZlaEhhWnEwWEJPb2RLWVJpaXNma1Z0YkFFMXJmb2tvUFgxK3UyS3poVHR5RDZOeFJuYjhYMVpaUmtUCm00VERHNFUzN3hQTElWTHJZbHNXTmtkeXVFNDRQeDRhNUxuaUFhYkJjTGV5NGtxblpuU2YwNDRoVXhDa3l4dW8KYTB6U0x3cGJuTlA3YmJCZkdYWnpXclphWUxpV29rOEpaSW1IVDhWeER2L0NxeXFxdGkrRDFtWEFBS0w2UVlkNQpzMmova0dNeTdiOTBkYW93QW1vM0RVR2FmeXNnWm9mQVgwN1pCblM4aTJ2QWM5NEk0bC9FWnlXbkR0bnpRclc5ClljaUpSZTFjSUpEZkYxQ0VRZFl4U0VURDRhR1Znd1pWZlVraG9VVCtXS1V2YVIybTh6TGw5ZlVWWUdzUjAyZDAKemdRVC9tSkNqME5HMVYyamhsODFWcC9qTWx1MWk1YW56V21Dc2YrWlFzOEdYTmNFMWdhZlhHekhpUnZLT3NlbwpqanlocUxycFVvSUxYeVZlOU5nRUsvbm5sdVcrWUJDQmQrK3g0TG5hM1E1Q1VZN0dabWdoZHBRQlFibVdHNzhyCk96Zkl1OUU2d0FVN25EbVNEZUVEb2dtV202MGFrSDFjYkVyWnNUN3B6QW1CaFZqTmRadEhZbEZvb1A5UGlQMVcKWWJXcUJqc0s4V0sra2hiY21TVFNEYlB4V3M1SEE5eWxJWTBwcWNVejVzWjdhMHlRcFp1SlBvSGdaVklsckhDVQpab0dmZkpOUWtRdm9PU2NuR0ZlVlRIcDlxS0VBRVpPVytUT1lvS0Z5NlFJREFRQUJvMkV3WHpBT0JnTlZIUThCCkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3SUdDQ3NHQVFVRkJ3TUJNQThHQTFVZEV3RUIKL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRktBL2ZUTjZrYmdsS0NCckpBYTZNRFJkaDkrdk1BMEdDU3FHU0liMwpEUUVCQ3dVQUE0SUNBUUJnMERYZG5HNllEZzRjMXdIQUtwVjkyTjRSN0VoV291cmJ5Q2ZsdUJwU0Y4bzMvY25VCkJhYnREWWMvOGFMcG8vOUxsL2JPRHZDNWpLSUpqbUhDczRtMGovNmtvWW5WRFd6R1ZodmJBRTZJbUpxTUNGbDIKSVkwODVqOEN1M2RWa1FpSnIrdzM2NTAwbmxxaVBWdlE4ZFJCbEFLK1YvMHE1WUp2ZDVLN2Nha2hSalJlZ09QWAprTW5JRm1ycnJhbSsvY2txaStNaVdKQlp3SVM1REZ3RUlNK28zQkw4aU5RYi9rOTdMR1lKQktNdFJabE5iK0JWCjV6am5OallvK3BRanBsUWlDbHd5QlgxU2xmYUw1OGJrU2Z3UVZIdGU5M0tKN0UvRFZubkVsSHl2U2dSWjBpSDUKV21oWWNyVE82MzVRSWJXZUkxMTRWYUdyZEJycDNYYnBpN3FDcS81Zm85ODk2MUl2WVptR2M4d3hOM2MydXRYQgp3K3NCT3d0Z0UxVnpsbkNyY21jU2Zlb3ptQVhLcllDOEhvdG1lR05OaExTRS9mZDVkaDE2YWNlSFZrSy9qUDV3CjYxS0I0K1c1QWJaUkE4R0pobS9wVEVpeWdWUWw5TGtTekI5Y2dndVBUa3NHMHFDSW5wQjhzYTQ4b05LN2JaR3oKdFRHam8wcmNXaVdYY3BuS3pXeDRNOURwV0dQczJKdTBpV2U2SmNjdE4yVFZIZ2RXbVAwL21SQU44R25rajl6bgo5VkxmaTErT3lML2dHczNrandMeWF6Y0c3Wkh3Y1p5d2kweUFOd3NtNXRzZ29PTk5IV2REbEpydFJyRlVkSzI0CnphQ2hhbHlNaHo0bzJnQjI1QXU3SnpMbzhRUEZNOVVhbS9rWkhxOG1WSmU4a29DemNQQld4WUowdWc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBdEVMdmdlWHlqNnQvRkphRnp5Unl0YVB3T2JiUU1oU3A3bFlYbm5jMkg3ejlUdGcyCmljZTMwMEV1ZmU0Z1N0N3o4eGlEeHZuM29SMm1hdEZ3VHFIU21FWW9ySDVGYld3Qk5hMzZKS0QxOWZydGlzNFUKN2NnK2pjVVoyL0Y5V1dVWkU1dUV3eHVGTis4VHl5RlM2MkpiRmpaSGNyaE9PRDhlR3VTNTRnR213WEMzc3VKSwpwMlowbjlPT0lWTVFwTXNicUd0TTBpOEtXNXpUKzIyd1h4bDJjMXEyV21DNGxxSlBDV1NKaDAvRmNRNy93cXNxCnFyWXZnOVpsd0FDaStrR0hlYk5vLzVCak11Mi9kSFdxTUFKcU53MUJtbjhySUdhSHdGOU8yUVowdkl0cndIUGUKQ09KZnhHY2xwdzdaODBLMXZXSElpVVh0WENDUTN4ZFFoRUhXTVVoRXcrR2hsWU1HVlgxSklhRkUvbGlsTDJrZApwdk15NWZYMUZXQnJFZE5uZE00RUUvNWlRbzlEUnRWZG80WmZOVmFmNHpKYnRZdVdwODFwZ3JIL21VTFBCbHpYCkJOWUduMXhzeDRrYnlqckhxSTQ4b2FpNjZWS0NDMThsWHZUWUJDdjU1NWJsdm1BUWdYZnZzZUM1MnQwT1FsR08KeG1ab0lYYVVBVUc1bGh1L0t6czN5THZST3NBRk81dzVrZzNoQTZJSmxwdXRHcEI5WEd4SzJiRSs2Y3dKZ1lWWQp6WFdiUjJKUmFLRC9UNGo5Vm1HMXFnWTdDdkZpdnBJVzNKa2swZzJ6OFZyT1J3UGNwU0dOS2FuRk0rYkdlMnRNCmtLV2JpVDZCNEdWU0pheHdsR2FCbjN5VFVKRUw2RGtuSnhoWGxVeDZmYWloQUJHVGx2a3ptS0NoY3VrQ0F3RUEKQVFLQ0FnQVFTcGhnMGdwcEI2UFZsWUVFWnBQamJLeVNXcjVZT0Z2ZlNYS2JCTVVrZXkwZGloYnJ2dHdUUUtuVwpBY1p6WGRFSVlHZlFmTmp2ZThHRmwrWWhoU2lHVUpqdWRmOEtVNStNWFd2bEVaTUpKeU4renY4L09rREZDVkk3CitZaE5vd0J3TURjQWR5VkVGOXhmR0dUcEZ4dUtWMTkvczc2R0FOWlVzZVZHMHNWaWFEQ0IvMGVsOTNHRTNGYlYKRmkvRDVRTmI1azZzRkVwSVcxVWhQUm1hanErUTMxcnBzaUljb3hDbmxhbUVUQ1paQUhVRy8vYzhOSGo0M2xDVgoyTGppQ3pnV1BLdTVwVEFCODFEQlVyME4xN29IdmEvM0taVVpPWXI5VE4vUVoyLzNkbFpIcjNFYXRuTFhTa2N4CjRQcTdySVRHVitjSzJRSUp1SHUvWGRrT0N2RXpuakliUWdhb3NTK3JSSUV5SEtnZk9vamtueHc0Vk8xeUFQTDMKSlYxcGllaFJqMzEvWEUwQ2xoeDRDWmVXdzNWQzQ2SXlhRHhsWCt3REVsSmFZbytLR1U3Yy9WMGZReHB2d0R3TQpEeVhKc0U2NlJoQ3Qwdnh4Tk0xMzY3OXBSYVFibEcwWVU1OTQ1cHVhUnhyclh3SU83a3YxaDV1MWxHS3RYZExUClNOaWYyUk1OdnVoT0p2M1NJKzRoaVJlS3VjZ0hhd25iWDZFNTJnaDBUZ0R2RENsYWFXZ00rdXRiRitvZWxFSC8KK2h4NC96T3BSZVlJdHhlQWo3RFpMSWpLUmlDQUUycG44ekVtUWliRlV3QlZQaWZqV29tbjdrODIxUW95cW1jOApGMHJHd09LcFFrYWQ1NVljTXJuUHRxQUlLMkF0eG5YSWhpbFl1WmhMclRYT1JHSmZUUUtDQVFFQTJjN1RzeVM4CjJNdTEwWlJSR0ptT3h5c2JiazlJbGVmSi80bFY4aGZ3aWN2K2dNbktQTURNOUJMbktSd3M3MmlpbU1CSXVMbmoKY0poT3FMVFR1M3BYM1c2K2dCSzRuajlONk9QNlhPZ2k4TXZsS1lHYU5vU3RMNnBSWm5IMis2UzR0TTA2cGxFQQpicDk0Kzh4TTc2MzNyazhNekQ3dGVxME14dFVib2ppUVZrMjFLd21qWUNZUjFDUUpkMU1BMEJGZVVQNVl5ejR1CndHc1FXVEZzaXFOd21XTUdQVkxmUUJPUWh1NkVQczlsdy9FYzg3ZEhrS1hMUEtYeC9lU3VSTTZLSjJTUG8yS0QKRnB6NXI0djZ2OTZvTUQwcUhQbkF4cnVpZU9yRmV3V2Q3anY1OHRqS0JjNmhOdVpRZ2RXWHF1am1aT2tMT2pQZAptTHlLQjBwWnUxUEZjd0tDQVFFQTA5NnY1OTRiUnBhVVFMYWxmZVcvRVREUHBZbUtoNzhUTnY2eU8vS2U5aHdjCm9DcThJUFlCVmVjYmJIb25maHdlRjRMRElMRHIreldLeWsvR09FTnhya3JKYmgyRjBuc1UvN1c5TEI4M2c3V0wKOHc5OUJjMGN2ekEyWlhsOUd6NE1INGtpL1V2NlVlUEtib1BYLy91Q1dma1hCbkpxa3BqblNFOEpGQ21PUnZ0WQpWQjg3WTF6M2ZLalFxNTVFRTgrQjZsYU85bnhCZDE0NDgzTjBSempjVzZXNjU0bmlmQVBURzRCeUE5dlh6Y0FCCkxLeEgzMncwSFVXdjNRYUpKQnlkWlNUV0N1Q0hxY2RvU2dvcHFhc0NDTjlrN2hBenFGOEhOSUFpSEVTL21YNGQKMk82M0J2OU5hMjlhUEltcm9pVzRGVVd1UUlma3dTWUJGSmpWVjBzdk13S0NBUUJucWlEb0twd1hNeDJlV2xFZQp2RGRRWkJ2eUxKb0hmd0tOTlBoSytVbnF5OFNkMTIwQjdXR2U2VUJNT0xUS1hhckZ1UDdqck5XclNWSm15V25jCjJTWG9wa1RWQUJRT2ZXSy9iWUpEcGRpN2NzL25LV0FVZ3FGTEJtMG5yU1k0THZZYVYzT0twUkxuazg4cFNOdDEKVi8rQ1h1MWdhTEx1cUY1a1pCbDY1Q0VPY24yL3RoNmtMSHBmMWFjTHU5MnZLaFVSeDN6TGZ4VVJUK1BBRDkzeApQa2poT0ZoSDU2R0tCY1hMOHNuT2V6ZWNRcTNjOFdhR1dlS1pRd0lpTFMwa1lva3VwcFlXMVZRKzl3ZC9uY2dDCmVoN2lscm5zZ0pKWUJBWVlOdVUyNEQyQ25ka2cxRDJTOWYyVSs1bGxzaHMxcFJQREE0ZnNjN01NZHUvYStIQXMKMEhveEFvSUJBUURDNGFDNERLcldJUWU1QnNmdXAvYzUzc1lCSkNTU2ZJVTJIc3pmSzJwZ1FyZHA5Q1VieEd5eQpFV1ErUVpZMS83TUdPVGMyeU1ZblNiYWlKUUxWR2VSbFIxRkV3azhucmlOQW1uQ3BOd1dmVnN5bUJHY2hnT3VpClNMeWdWa0ZuWDRsVE1KZEltaXhrU3IwWExwcnVVUEF6eGxVUmp3ak1VMnphTENqVHJPMjhDTkhVZnUzbmxjbm4KbG5ocWc2ZG0rWVlzZ1BYN2I0dmdPb0QwSGd5a3ZuNmlwaXpuY1FNc3cyL1phaXAxdGpBb2h5WU5hMktvOWlSeAprSG9WT2ovSFFiTGRLQ2JoMW1tekYwS3NaL0N1cWlleTlaa25DU3diQVYzbFFyOGRkWGN2dnJ2Qm9NSWw0NHZZCitKSHVBVXdvVjcyZGczeW15dGoxZVBtaGNuczZVbVBWQW9JQkFRQzVsZGZLSmhXNmtTU2Rwc3BDbE1DL3E2VkcKY0YwRi9OWXBhYmpOSmltU3Fjb2IwS3hhQnVtVHB5ZnFoNkhhbjExQ1Vta2tqaXBXSURSV3RwTm5TTk1qMForNwptVmYrbk1ZNHpqUWZIa0h3d01YaDcySzJ5K2dGSjF1RWpWMG9Bd01NSTNLbUtMTHBoY1FYZGRmUXl2enV4Y01BCnByQlNxalFRejhrRC85TndnT2laazQyV2ZLM2VtYUptZ2lwTEhyTXAvWmc2K0VDeGJTSzRLSE5UTm02YmZXdHYKQ1djWXU0VG5hT3ZGVk1kOWYzc0NNUFdvb0tYemQvRDFsTzdkTUFmMnJSNzNqbHRuK0RzUFhqMnVVMFVmUDZlZgpma1BDTmY4RTFMQ2tvM0lVVk9oUVRIVkpDNHczRStXZ1VFcDZCMzM0Z0ZkcUFRUGN0Y1JxRktxUVJsMVQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
kind: Secret
metadata:
  labels:
    app: crane2
  name: crane2-stunnel-server-secret
  namespace: default
type: Opaque
---
apiVersion: v1
data:
  rsyncd.conf: |+
    syslog facility = local7
    read only = no
    list = yes
    log file = /dev/stdout
    max verbosity = 4
    auth users = root
    hosts allow = ::1, 127.0.0.1, localhost
    uid = root
    gid = root

    [volsync]
        comment = archive for state-transfer/pvc-0
        path = /mnt/state-transfer/volsync
        use chroot = no
        munge symlinks = no
        list = yes
        read only = false
        auth users = root
        secrets file = /etc/rsync-secret/rsyncd.secrets

kind: ConfigMap
metadata:
  labels:
    app: crane2
  name: crane2-rsync-server-config
  namespace: default
---
apiVersion: v1
data:
  stunnel.conf: |
    foreground = yes
    pid =
    socket = l:TCP_NODELAY=1
    socket = r:TCP_NODELAY=1
    debug = 7
    sslVersion = TLSv1.2
    [rsync]
    accept = 6443
    connect = 2222
    key = /etc/stunnel/certs/tls.key
    cert = /etc/stunnel/certs/tls.crt
    TIMEOUTclose = 0
kind: ConfigMap
metadata:
  labels:
    app: crane2
  name: crane2-stunnel-server-config
  namespace: default
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: crane2
  name: volsync
  namespace: default
spec:
  ports:
    - name: volsync
      port: 6443
      protocol: TCP
      targetPort: 6443
  selector:
    app: crane2
  sessionAffinity: None
  type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: volsync-ssl-passthrough
  namespace: default
  annotations:
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
spec:
  rules:
    - host: localhost
      http:
        paths:
          - pathType: Prefix
            path: "/"
            backend:
              service:
                name: volsync
                port:
                  number: 6443

steps.md

1. Install the nginx ingress controller on kind: https://kind.sigs.k8s.io/docs/user/ingress/#create-cluster and https://kind.sigs.k8s.io/docs/user/ingress/#ingress-nginx
2. create the server resources in default namespace: oc create -f https://gist.githubusercontent.com/alaypatel07/9f02dd9f8d9969c3d9994372a4555cd6/raw/822ff59a1c10b8e1a495bc920a56de6d1d62c533/rsync-stunnel-server-setup.yaml
3. mint self signed certificates for the stunnel client
4. update the certificate path in stunnel.conf
5. run $ stunnel /path/to/stunnel.conf in one windot
6. run RSYNC_PASSWORD=root rsync <filename> rsync://root@localhost:8081/volsync/<filename>

$ RSYNC_PASSWORD=root rsync 1 rsync://root@localhost:8081/volsync/1
server_recv(2) starting pid=10
recv_file_name(1)
received 1 names
recv_file_list done
get_local_name count=1 1
generator starting pid=10
delta-transmission enabled
recv_generator(1,0)
generating and sending sums for 0
count=1 rem=2 blength=700 s2length=2 flength=2
generate_files phase=1
recv_files(1) starting
recv_files(1)
recv mapped 1 of size 2
got file_sum
renaming .1.NvXGYq to 1
recv_files phase=1
generate_files phase=2
recv_files phase=2
recv_files finished
generate_files phase=3
generate_files finished

stunnel.conf

pid =
client = yes
syslog = no
output = /dev/stdout
foreground = yes
sslVersion = all
options = NO_SSLv2

[rsync]
debug = 7
accept = 8081
cert = /path-to/client.crt
key = /path-to/client.key
# the sni is inferred as localhost
# if you want the request to present a different SNI
# uncomment the following line and add the sni hostname
# sni = volsync.default.svc
# note: the above hostname should be present as the ingress.spec.rules.host
# for nginx ingress controller to do sni mapping correctly
connect = localhost:443