CODEWITHSUNDEEP
kubernetesgoogle-cloud-platformgoogle-kubernetes-enginekubectlbastion-host
Rakib
Rakib

Reputation: 13085

Run 'kubectl' commands from my localhost to GKE - but via tunnelling through a bastion host

Currently...

I have a GKE/kubernetes/k8s cluster in GCP. I have a bastion host (Compute Engine VM Instance) in GCP. I have allowlisted my bastion host's IP in the GKE cluster's Master authorized networks section. Hence, in order to run kubectl commands to my GKE, I first need to SSH into my bastion host by running the gcloud beta compute ssh command; then I run the gcloud container clusters get-credentials command to authenticate with GKE, then from there I can run kubectl commands like usual.

Later...

I want to be able to run kubectl commands to my GKE cluster directly from my local development CLI. In order to do that, I can add my local development machine IP as an allowlisted entry into my GKE's Master authorized networks, and that should be it. Then i can run the gcloud container clusters get-credentials first and then run kubectl commands like usual.

However...

I am looking for a way to avoid having to allowlist my local development machine IP. Every time i take my laptop somewhere new, i have to update the allowlist my new IP from there before i can run the gcloud container clusters get-credentials command before running kubectl commands.

I wonder...

Is there a way to assign a port number in the bastion-host that can be used to invoke kubectl commands to the remote GKE cluster securely? And then, i can just use the gcloud compute start-iap-tunnel command (which BTW takes care of all permission issues using Cloud IAM) from my local dev CLI to establish a ssh-tunnel to that specific port number in the bastion host. That way, for the GKE cluster, it is receiving kubectl commands from the bastion host (which is already allowlisted in its Master authorized networks). But behind the scene, i am authenticating with the bastion host from my local dev CLI (using my glcoud auth credentails) and invoking kubectl commands from there securely.

Is this possible? Any ideas from anyone?

Upvotes: 1

Views: 1438

Answers (1)

Karthik Murugan
Karthik Murugan

Reputation: 1

This would help accessing to your secured GKE cluster from localhost

https://github.com/GoogleCloudPlatform/gke-private-cluster-demo

Once the bastion host is setup with tinyproxy as in the above doc, we can use the below shell functions to quickly enable/disable the bastion host access

enable_secure_kubectl() {
  # Aliasing kubectl/helm commands to use local proxy
  alias kubectl="HTTPS_PROXY=localhost:8888 kubectl"
  alias helm="HTTPS_PROXY=localhost:8888 helm"
  # Open SSH tunnel for 1 hour
  gcloud compute ssh my-bastion-host -- -o ExitOnForwardFailure=yes -M -S /tmp/sslsock -L8888:127.0.0.1:8888 -f sleep 3600
  # Get kubernetes credentials with internal ip for kube-apiserver in kubeconfig
  gcloud container clusters get-credentials my-gke-cluster --region us-east1 --project myproject --internal-ip
}

disable_secure_kubectl() {
  unalias kubectl
  unalias helm
  ssh -S /tmp/sslsock -O exit my-bastion-host
}

Upvotes: 0

Related Questions