Skip to content

Commit 08dc049

Browse files
yokawasayokawasa
authored
Merge pull request #12 from yokawasa/0.6.0
release 0.6.0
2 parents 2964ab2 + cb050a8 commit 08dc049

File tree

5 files changed

+123
-74
lines changed

5 files changed

+123
-74
lines changed

‎CHANGELOG.md

+5-3
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,12 @@
22

33
All notable changes to the "kubectl-plugin-ssh-jump" extension will be documented in this file.
44

5+
## 0.6.0
6+
7+
- Support SSH local port forwarding to access a remote server. This allows to forward the traffic form local machine to SSH jump then SSH jump will forward the traffic to the remote server.
8+
59
## 0.5.0
10+
611
- Fix to address pod sshjump pod scheduling on hybrid clusters ([PR#9](https://github.com/yokawasa/kubectl-plugin-ssh-jump/pull/9), thanks to @swgriffith )
712

813
## 0.4.0
@@ -21,14 +26,11 @@ All notable changes to the "kubectl-plugin-ssh-jump" extension will be documente
2126
## 0.3.0
2227

2328
- Added Args param to exec in ssh session ( [PR#2](https://github.com/yokawasa/kubectl-plugin-ssh-jump/pull/2), thanks to @iuryfukuda )
24-
2529
## 0.2.0
2630

2731
- Added -P|--port options for specifing SSH port that target node is listening (default 22)
2832
- Added -o "StrictHostKeyChecking=no" for ssh login options
2933
- Changed the way to SSH login via SSH Jump Pod from using "-J" to using "ProxyCommand"
30-
31-
3234
## 0.1.0
3335

3436
- Initial release (alpha release)

‎README.md

+70-34
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,17 @@
22

33
[![kubectl plugin](https://img.shields.io/badge/kubectl-plugin-blue.svg)](https://github.com/topics/kubectl-plugin)
44

5-
A kubectl plugin to SSH into Kubernetes nodes using a SSH jump host Pod
5+
A kubectl plugin to access Kubernetes nodes or remote services using a SSH jump Pod
66

7-
A `jump host` Pod is an intermediary Pod or an SSH gateway to Kubernetes node machines, through which a connection can be made to the node machines.
7+
A `jump host` Pod is an intermediary Pod or an SSH gateway to Kubernetes node machines, through which a connection can be made to the node machines or remote services.
88

9-
Here is an scenario where you want to connect to Kubernetes node, but you have to go through a jump host Pod, because of firewalling, access privileges. etc. There is a number of valid reasons why the jump hosts are needed...
9+
Here is an scenario where you want to connect to Kubernetes nodes or remote services, but you have to go through a jump host Pod, because of firewalling, access privileges. etc. There is a number of valid reasons why the jump hosts are needed...
1010

11-
![](assets/arch-ssh-jumphost.png)
11+
**CASE 1: SSH into Kubernetes nodes via SSH jump Pod**
12+
![](assets/ssh-jump-node-ssh-login.png)
13+
14+
**CASE 2: Connect to remote serivces via SSH local port forwarding**. SSH local port forwarding allows to forward the traffic form local machine to SSH jump then SSH jump will forward the traffic to remote services (host:port)s.
15+
![](assets/ssh-jump-ssh-tunnel.png)
1216

1317
> [NOTE]
1418
> - Kubectl versions >= `1.12.0` (Preferred)
@@ -22,19 +26,22 @@ Here is an scenario where you want to connect to Kubernetes node, but you have t
2226
<!-- TOC -->
2327

2428
- [kubectl-plugin-ssh-jump](#kubectl-plugin-ssh-jump)
25-
- [Pre-requistes](#pre-requistes)
26-
- [Installation](#installation)
27-
- [Install through krew](#install-through-krew)
28-
- [Manual Installation](#manual-installation)
29-
- [How to use](#how-to-use)
30-
- [Usage](#usage)
31-
- [Option parameters Cache](#option-parameters-cache)
32-
- [SSH Agent (ssh-agent)](#ssh-agent-ssh-agent)
33-
- [Examples](#examples)
34-
- [Scenario1 - You have private & public SSH key on your side](#scenario1---you-have-private--public-ssh-key-on-your-side)
35-
- [Scenario2 - You have .pem file but you don't have public key on your side](#scenario2---you-have-pem-file-but-you-dont-have-public-key-on-your-side)
36-
- [Useful Links](#useful-links)
37-
- [Contributing](#contributing)
29+
- [Pre-requistes](#pre-requistes)
30+
- [Installation](#installation)
31+
- [Install through krew](#install-through-krew)
32+
- [Manual Installation](#manual-installation)
33+
- [How to use](#how-to-use)
34+
- [Usage](#usage)
35+
- [Option parameters Cache](#option-parameters-cache)
36+
- [SSH Agent (ssh-agent)](#ssh-agent-ssh-agent)
37+
- [Examples](#examples)
38+
- [CASE 1: SSH into Kubernetes nodes via SSH jump Pod](#case-1-ssh-into-kubernetes-nodes-via-ssh-jump-pod)
39+
- [1-1 - You have private & public SSH key on your side](#1-1---you-have-private--public-ssh-key-on-your-side)
40+
- [1-2 - You have .pem file but you don't have public key on your side](#1-2---you-have-pem-file-but-you-dont-have-public-key-on-your-side)
41+
- [CASE 2: Access remote serivces via SSH local port forwarding](#case-2-access-remote-serivces-via-ssh-local-port-forwarding)
42+
- [2-1 - Configuring SSH local port forwarding with --args or -a option](#2-1---configuring-ssh-local-port-forwarding-with---args-or--a-option)
43+
- [Useful Links](#useful-links)
44+
- [Contributing](#contributing)
3845

3946
<!-- /TOC -->
4047

@@ -75,8 +82,8 @@ $ kubectl plugin list
7582

7683
The following kubectl-compatible plugins are available:
7784

78-
/Users/yoichika/.krew/bin/kubectl-krew
79-
/Users/yoichika/.krew/bin/kubectl-ssh_jump
85+
/Users/yoichi.kawasaki/.krew/bin/kubectl-krew
86+
/Users/yoichi.kawasaki/.krew/bin/kubectl-ssh_jump
8087

8188
$ kubectl ssh-jump
8289
```
@@ -109,27 +116,30 @@ $ kubectl ssh-jump
109116
### Usage
110117

111118
```TXT
112-
Usage:
119+
Usage:
113120
kubectl ssh-jump <dest_node> [options]
114121
115122
Options:
116123
<dest_node> Destination node name or IP address
117124
dest_node must start from the following letters:
118125
ASCII letters 'a' through 'z' or 'A' through 'Z',
119-
the digits '0' through '9', or hyphen ('-'
126+
the digits '0' through '9', or hyphen ('-').
127+
NOTE: Setting dest_node as 'jumphost' allows to
128+
ssh into SSH jump Pod as 'root' user
120129
-u, --user <sshuser> SSH User name
121130
-i, --identity <identity_file> Identity key file, or PEM(Privacy Enhanced Mail)
122131
-p, --pubkey <pub_key_file> Public key file
123-
-P, --port <port> SSH port for target node SSH server (default:22)
132+
-P, --port <port> SSH port for target node SSH server
133+
Defaults to 22
124134
-a, --args <args> Args to exec in ssh session
125-
--skip-agent Skip automatically starting SSH agent and adding
135+
--skip-agent Skip automatically starting SSH agent and adding
126136
SSH Identity key into the agent before SSH login
127137
(=> You need to manage SSH agent by yourself)
128138
--cleanup-agent Clearning up SSH agent at the end
129139
The agent is NOT cleaned up in case that
130140
--skip-agent option is given
131141
--cleanup-jump Clearning up sshjump pod at the end
132-
Default: Skip cleaning up sshjump pod
142+
Defaults to skip cleaning up sshjump pod
133143
-h, --help Show this message
134144
135145
Example:
@@ -147,8 +157,8 @@ Example:
147157
```sh
148158
$ cat $HOME/.kube/kubectlssh/options
149159
sshuser=myuser
150-
identity=/Users/yokawasa/.ssh/id_rsa_k8s
151-
pubkey=/Users/yokawasa/.ssh/id_rsa_k8s.pub
160+
identity=/Users/yoichi.kawasaki/.ssh/id_rsa_k8s
161+
pubkey=/Users/yoichi.kawasaki/.ssh/id_rsa_k8s.pub
152162
port=22
153163
```
154164

@@ -166,27 +176,30 @@ Show all node list. Simply executing `kubectl ssh-jump` gives you the list of de
166176
```sh
167177
$ kubectl ssh-jump
168178

169-
Usage:
179+
Usage:
170180
kubectl ssh-jump <dest_node> [options]
171181

172182
Options:
173183
<dest_node> Destination node name or IP address
174184
dest_node must start from the following letters:
175185
ASCII letters 'a' through 'z' or 'A' through 'Z',
176-
the digits '0' through '9', or hyphen ('-')
186+
the digits '0' through '9', or hyphen ('-').
187+
NOTE: Setting dest_node as 'jumphost' allows to
188+
ssh into SSH jump Pod as 'root' user
177189
-u, --user <sshuser> SSH User name
178190
-i, --identity <identity_file> Identity key file, or PEM(Privacy Enhanced Mail)
179191
-p, --pubkey <pub_key_file> Public key file
180-
-P, --port <port> SSH port for target node SSH server (default:22)
192+
-P, --port <port> SSH port for target node SSH server
193+
Defaults to 22
181194
-a, --args <args> Args to exec in ssh session
182-
--skip-agent Skip automatically starting SSH agent and adding
195+
--skip-agent Skip automatically starting SSH agent and adding
183196
SSH Identity key into the agent before SSH login
184197
(=> You need to manage SSH agent by yourself)
185198
--cleanup-agent Clearning up SSH agent at the end
186199
The agent is NOT cleaned up in case that
187200
--skip-agent option is given
188201
--cleanup-jump Clearning up sshjump pod at the end
189-
Default: Skip cleaning up sshjump pod
202+
Defaults to skip cleaning up sshjump pod
190203
-h, --help Show this message
191204

192205
Example:
@@ -203,7 +216,10 @@ aks-nodepool1-18558189-0 10.240.0.4
203216
204217
```
205218
206-
#### Scenario1 - You have private & public SSH key on your side
219+
220+
#### CASE 1: SSH into Kubernetes nodes via SSH jump Pod
221+
222+
##### 1-1 - You have private & public SSH key on your side
207223
208224
Suppose you have private & public SSH key on your side and you want to SSH to a node named `aks-nodepool1-18558189-0`, execute the plugin with options like this:
209225
@@ -232,7 +248,7 @@ echo "uname -a" | kubectl ssh-jump aks-nodepool1-18558189-0
232248
Linux aks-nodepool1-18558189-0 4.15.0-1035-azure #36~16.04.1-Ubuntu SMP Fri Nov 30 15:25:49 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
233249
```
234250
235-
You can pass commands by `args`
251+
You can pass commands with `--args` or `-a` option
236252
``` sh
237253
kubectl ssh-jump aks-nodepool1-18558189-0 --args "uname -a"
238254
@@ -272,7 +288,7 @@ $ kubectl ssh-jump aks-nodepool1-18558189-0 \
272288
$ ssh-agent -k
273289
```
274290

275-
#### Scenario2 - You have .pem file but you don't have public key on your side
291+
##### 1-2 - You have .pem file but you don't have public key on your side
276292

277293
From v0.4.0, the plugin supports PEM (Privacy Enhanced Mail) scenario where you create key-pair but you only have .pem / private key (downloaded from AWS, for example) and you don't have the public key on your side.
278294
@@ -284,6 +300,26 @@ Suppose you've already downloaded a pem file and you want to ssh to your EKS wor
284300
```sh
285301
$ kubectl ssh-jump -u ec2-user -i ~/.ssh/mykey.pem ip-10-173-62-96.ap-northeast-1.compute.internal
286302
```
303+
#### CASE 2: Access remote serivces via SSH local port forwarding
304+
305+
SSH local port forwarding allows to forward the traffic form local machine to SSH jump then SSH jump will forward the traffic to remote services (host:port)s.
306+
##### 2-1 - Configuring SSH local port forwarding with --args or -a option
307+
308+
Suppose you have private & public SSH key on your side and you want to access a remote server (IP: `10.100.10.8`) using `3389`/TCP port which is not accessible directly but accessible via SSH jump, execute the plugin with options like this, at first:
309+
310+
- identity:`~/.ssh/id_rsa_k8s`
311+
- pubkey:`~/.ssh/id_rsa_k8s.pub`)
312+
313+
The command below allows to forward the traffic form local machine (`localhost:13200`) to SSH jump then SSH jump will forward the traffic to the remote server (`10.100.10.8:3389`).
314+
```sh
315+
$ kubectl ssh-jump sshjump \
316+
-i ~/.ssh/id_rsa_k8s -p ~/.ssh/id_rsa_k8s.pub \
317+
-a "-L 13200:10.100.10.8:3389"
318+
```
319+
> - `sshjump` is the hostname for SSH jump Pod
320+
> - The value for `--arg` or `-a` should be in this format: "-L local_port:remote_address:remote_port"
321+
322+
Now, you're ready to access to the remote server at port 13200 at local machine.
287323
288324
## Useful Links
289325

‎assets/ssh-jump-node-ssh-login.png

160 KB
Loading

‎assets/ssh-jump-ssh-tunnel.png

139 KB
Loading

‎kubectl-ssh-jump

+48-37
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,14 @@ Options:
2424
<dest_node> Destination node name or IP address
2525
dest_node must start from the following letters:
2626
ASCII letters 'a' through 'z' or 'A' through 'Z',
27-
the digits '0' through '9', or hyphen ('-')
27+
the digits '0' through '9', or hyphen ('-').
28+
NOTE: Setting dest_node as 'jumphost' allows to
29+
ssh into SSH jump Pod as 'root' user
2830
-u, --user <sshuser> SSH User name
2931
-i, --identity <identity_file> Identity key file, or PEM(Privacy Enhanced Mail)
3032
-p, --pubkey <pub_key_file> Public key file
31-
-P, --port <port> SSH port for target node SSH server (default:22)
33+
-P, --port <port> SSH port for target node SSH server
34+
Defaults to 22
3235
-a, --args <args> Args to exec in ssh session
3336
--skip-agent Skip automatically starting SSH agent and adding
3437
SSH Identity key into the agent before SSH login
@@ -37,7 +40,7 @@ Options:
3740
The agent is NOT cleaned up in case that
3841
--skip-agent option is given
3942
--cleanup-jump Clearning up sshjump pod at the end
40-
Default: Skip cleaning up sshjump pod
43+
Defaults to skip cleaning up sshjump pod
4144
-h, --help Show this message
4245
4346
Example:
@@ -181,11 +184,15 @@ EOF
181184
cat ${pubkey_sshjump} | \
182185
kubectl exec -i sshjump -- /bin/bash -c "cat > /root/.ssh/authorized_keys"
183186

184-
# Using the SSH Server as a jumphost (via port-forward proxy), ssh into the desired Node
185-
ssh -i ${identity} -p ${port} ${sshuser}@${destnode} \
186-
-o "ProxyCommand ssh root@127.0.0.1 -p 2222 -i ${identity_sshjump} -o \"StrictHostKeyChecking=no\" \"nc %h %p\"" \
187-
-o "StrictHostKeyChecking=no" $sshargs
188-
187+
if [ "${destnode}" = "sshjump" ]; then
188+
ssh ${sshuser}@127.0.0.1 -p 2222 -i ${identity_sshjump} \
189+
-o "StrictHostKeyChecking=no" $sshargs
190+
else
191+
# Using the SSH Server as a jumphost (via port-forward proxy), ssh into the desired Node
192+
ssh -i ${identity} -p ${port} ${sshuser}@${destnode} \
193+
-o "ProxyCommand ssh root@127.0.0.1 -p 2222 -i ${identity_sshjump} -o \"StrictHostKeyChecking=no\" \"nc %h %p\"" \
194+
-o "StrictHostKeyChecking=no" $sshargs
195+
fi
189196
# Stop port-forward
190197
kill -3 ${pid_port_forward} 2>/dev/null
191198
}
@@ -198,45 +205,45 @@ plugin_main() {
198205
nSkip=1
199206
case $1 in
200207
"-h" | "--help")
201-
help
202-
exit 0
203-
;;
208+
help
209+
exit 0
210+
;;
204211
"--cleanup-jump")
205-
cleanup_jump=yes
206-
;;
212+
cleanup_jump=yes
213+
;;
207214
"--cleanup-agent")
208-
cleanup_agent=yes
209-
;;
215+
cleanup_agent=yes
216+
;;
210217
"--skip-agent")
211-
skip_agent=yes
212-
;;
218+
skip_agent=yes
219+
;;
213220
"-u" | "--user" )
214-
c_sshuser=$2
215-
nSkip=2
216-
;;
221+
c_sshuser=$2
222+
nSkip=2
223+
;;
217224
"-i" | "--identity" )
218-
c_identity=$2
219-
nSkip=2
220-
;;
225+
c_identity=$2
226+
nSkip=2
227+
;;
221228
"-p" | "--pubkey" )
222-
c_pubkey=$2
223-
nSkip=2
224-
;;
229+
c_pubkey=$2
230+
nSkip=2
231+
;;
225232
"-P" | "--port")
226-
c_port=$2
227-
nSkip=2
228-
;;
233+
c_port=$2
234+
nSkip=2
235+
;;
229236
"-a" | "--args" )
230-
sshargs="$2"
231-
nSkip=2
232-
;;
237+
sshargs="$2"
238+
nSkip=2
239+
;;
233240
[0-9a-zA-Z-]*)
234-
destnode=$1
235-
;;
241+
destnode=$1
242+
;;
236243
*)
237-
help >&2
238-
exit 1
239-
;;
244+
help >&2
245+
exit 1
246+
;;
240247
esac
241248
shift $nSkip
242249
done
@@ -253,6 +260,10 @@ plugin_main() {
253260
get_node_list
254261
exit 1
255262
fi
263+
if [ "${destnode}" = "sshjump" ]; then
264+
echo "Setting destination name as 'jumphost' allows to ssh into SSH jump Pod as 'root' user"
265+
c_sshuser=root
266+
fi
256267

257268
if [ ! -d ${PLUGIN_DIR} ]; then
258269
mkdir -p ${PLUGIN_DIR}

0 commit comments

Comments
 (0)