Using Aspera Proxy with HSTS

If your environment provides public IP addresses for worker nodes, you do not need to install Aspera Proxy. In all other cases, Aspera Proxy must be used to allow transfers from clients to the HSTS instance. External traffic must be routed to the reverse proxy instance, which then routes it to the appropriate HSTS services within the Kubernetes cluster (which is exposed by using NodePort).

Overview of workflow

  1. Install an Aspera Proxy Server.
  2. Configure cloud-based servers for Aspera Proxy.
  3. Configure Aspera Proxy for use as a reverse proxy.
  4. Configure HSTS for use with Aspera Proxy.

These steps are explained as follows.

Install and configure Aspera Proxy

Note: You must install Aspera Proxy outside of the cluster in which your HSTS instance is created. However, Aspera Proxy must be on the same network as that cluster.

These instructions provide a streamlined workflow for installation. For more detailed instructions, see IBM Aspera Proxy Admin Guide.

  1. Download Aspera Proxy to the host from IBM Aspera downloads.
  2. As root, install Aspera Proxy.
    For example,
    rpm -ivh ibm-aspera-proxy- 
  3. Copy the contents of your Aspera Proxy license file into /opt/aspera/proxy/etc/aspera-license.
  4. Create a transfer user named xfer. You must use the string "xfer" for the username.
    adduser xfer 
  5. As the user xfer, run the following command:
    cat /opt/aspera/proxy/var/ >> /home/xfer/.ssh/authorized_keys
  6. Go to the file /home/xfer/.ssh/authorized_keys and confirm that the file belongs to the user xfer.
  7. Add Port 33001 to /etc/ssh/sshd_config.
  8. Restart SSHD.
    systemctl restart sshd
  9. Change the xfer users shell to the secure aspshell.
    chsh -s /bin/aspshell xfer
  10. Create the file /etc/sudoers.d/aspera_rproxy with the following content:
    Defaults:xfer !requiretty
    Defaults:xfer secure_path = /sbin:/bin:/usr/sbin:/usr/bin
    xfer ALL = NOPASSWD: /sbin/iptables-restore
  11. Create the directory /opt/aspera/proxy/etc/ssh_keys.

Configure cloud-based servers for Aspera Proxy

  1. Create an instance in your OpenShift VPC’s Public network subnet.
  2. Create a security group that allows inbound TCP 33001 and UDP 33001 - 33100.
  3. Locate OpenShift and Aspera Proxy on the same network subnet.
  4. Create a public IP address and attach it to your instance.

Configure Aspera Proxy for use as a reverse proxy

  1. Get the private IP and port for the Aspera reverse proxy to connect with HSTS.
    Use this syntax for an OpenShift deployment of the proxy, where identifies the name of your OpenShift project for the proxy:
    oc get svc -l,name=tcp-proxy
    For example,
    $ oc get svc -l,name=tcp-proxy
    NAME                   TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)           AGE
    my-test-tcp-proxy   LoadBalancer    33001:30027/TCP   4d2h
    In the output, CLUSTER-IP identifies the IP address (, and the first element of PORT(S) identifies the port (3001).
  2. Update the <server> section of the /opt/aspera/proxy/etc/aspera.conf file to identify the node user, public key, IP address, and port.
    Specifies the node user. Must be set to xfer.
    Specifies the location of the SSH private key file.
    Specifies the IP address and port.
    Specifies the private IP address of the Aspera Proxy server instance. It is needed when there are both private and public interfaces, which is the case for AWS. You can use the ip addr command to get this address, or the Instances screen of the AWS console.

    (For a description of all the <server> elements, see IBM Aspera Proxy Admin Guide.)

    For example,

    <?xml version="1.0" encoding="UTF-8"?>
    <CONF version="2">
  3. If you want to use a public SSH key that is created as part of the Aspera reverse proxy installation to validate communication with the HSTS instance, make a copy of the key for later use. For more information, see IBM Aspera Proxy Admin Guide.
  4. Restart the Aspera Proxy server.
    systemctl restart asperaproxy 

Configure HSTS for use with Aspera Proxy

  1. Access your HSTS YAML configuration file.
  2. Add the following template content. The configurations key must be indented two spaces.
      serverName: "<hostname_or_public_ip_of_aspera_rproxy>"
        type: ClusterIP
        type: LoadBalancer
            # Delete the annotations not needed for your provider
  3. Replace the <hostname_or_ip_of_aspera_rproxy> value with the IP address of your Aspera Proxy Server.
  4. Replace the <zone> value with the zone name.
  5. Replace the <vlan_id> value with the Vlan ID.
  6. Optionally, you can use the public SSH key that is created as part of the Aspera reverse proxy installation. To do so, at same level as the services key (that is, with two spaces of indentation), create an authorizedKeys key and set the value to public key of the proxy server.
  7. Delete the annotations values that are not relevant to your deployment.