maciekleks/stunnel repository overview

FROM 	alpine:edge

RUN 	set -x \
	&& addgroup -S stunnel -g 1000 \
	&& adduser -S -G stunnel stunnel -u 1001 \
	&& apk add stunnel

RUN 	set -x \
	&& mkdir -p /var/run/stunnel \
	&& chown -vR stunnel:stunnel /var/run/stunnel \
	&& chmod 700 /var/run/stunnel

USER 	stunnel

ENTRYPOINT 	["/bin/sh", "-c"] #overwrite it with command instruction in k8s yaml
CMD 	["stunnel"] #overwrite this by arg instruction in k8s yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: stunnel
  namespace: test-stunnel-egress
spec:
  replicas: 1
  selector:
    matchLabels:
      app: stunnel
  template:
    metadata:
      labels:
        app: stunnel
    spec:
      terminationGracePeriodSeconds: 0
      containers:
      - name: stunnel
        image: maciekleks/stunnel:0.1.0
        imagePullPolicy: IfNotPresent
        args: 
        - |          
          cat <<EOF > /etc/stunnel/stunnel.conf
          foreground=yes
          [squid-gcp]
          options=NO_TICKET
          sslVersionMax=TLSv1.2
          sslVersionMin=TLSv1.1
          cert = /var/run/stunnel/tls.crt
          key = /var/run/stunnel/tls.key
          #CAFile = /usr/local/share/ca-certificates/root.crt
          client = yes
          accept = 0.0.0.0:3128
          connect = <Squid-IP>:3128
          EOF
          stunnel 
        ports:
        - containerPort: 3128
        livenessProbe:
          exec:
            command:
            - pgrep 
            - stunnel
          initialDelaySeconds: 5
          periodSeconds: 5
        securityContext:      
          allowPrivilegeEscalation: false        
        volumeMounts:
        - name: mtls
          mountPath: "/var/run/stunnel"
          readOnly: true
      #- name: ca-crt
      #  mountPath: "/var/run/stunnel"
      #  readOnly: true
      volumes:
      - name: mtls
        secret:
          secretName: <your TLS secret>
    # - name: ca-crt
    #   configMap:
    #   name: ca-crt