A quick note to remind myself (and other people) how to tunnel to a node (or pod) in Kubernetes via the bastion server
rm ~/.ssh/known_hosts #Needed if you keep scaling the bastion up/down
BASTION=bastion.{cluster-domain}
DEST=$1
ssh -o StrictHostKeyChecking=no -o ProxyCommand='ssh -o StrictHostKeyChecking=no -W %h:%p admin@bastion.{cluster-domain}' admin@$DEST
Run like this:
bash ./tunnelK8s.sh NODE_IP
Example:
bash ./tunnelK8s.sh 10.10.10.100 #Assuming 10.10.10.100 is the node you want to connect to.
You can extend this by using this to ssh into a pod, assuming the pod has an SSH server on it.
BASTION=bastion.${cluster domain name}
NODE=$1
NODEPORT=$2
PODUSER=$3
ssh -o ProxyCommand="ssh -W %h:%p admin@$BASTION" admin@$NODE ssh -tto StrictHostKeyChecking=no $PODUSER@localhost -p $NODEPORT
So if you have service listening on port 32000 on node 10.10.10.100 that expects a login user of "poduser", you would do this:
bash ./tunnelPod.sh 10.10.10.100 32000 poduser
If you have to pass a password you can install sshpass on the node, then use that (be aware of security risk though – this is not an ideal solution)
ssh -o ProxyCommand="ssh -W %h:%p admin@$BASTION" admin@$NODE sshpass -p ${password} ssh -tto StrictHostKeyChecking=no $PODUSER@localhost -p $NODEPORT
Caveat though — you will have to make sure that your node security group allows your bastion security group to talk to the nodes on the additional ports. By default, the only port that the bastions are able to talk to the node security groups on is SSH (22) only.
Like this:
Like Loading...
You must be logged in to post a comment.