Skip to content

Add SSH ProxyCommand for accessing VMs through a bastion/hypervisor#10

Merged
MiguelCarpio merged 1 commit intorhos-vaf:mainfrom
MiguelCarpio:proxy
Jan 15, 2026
Merged

Add SSH ProxyCommand for accessing VMs through a bastion/hypervisor#10
MiguelCarpio merged 1 commit intorhos-vaf:mainfrom
MiguelCarpio:proxy

Conversation

@MiguelCarpio
Copy link
Contributor

What does this PR do?
Support for accessing VMs through a bastion host or hypervisor using SSH ProxyCommand, which is essential for environments where VMs are not directly accessible from the pod network (like gpu-validation pod). e. g. VMs with private network floating IPs that can be accessed through the host (gpu-validation pod can reach the host network). This PR does:

  • Adds gpu_validation_ssh_proxy_command variable
  • Provides a helpful example showing the syntax: -o ProxyCommand="ssh -W %h:%p -o StrictHostKeyChecking=no -i /path/to/key user@bastion-host"
  • Defaults to empty (undefined), maintaining backward compatibility

The ProxyCommand uses the -W %h:%p flag, which tells SSH to forward the connection to the target host (%h) and port (%p) through the bastion, creating a transparent tunnel.

Why do we need this PR?
This is critical for environments where:

  • VMs are on private networks (e.g., 192.168.x.x)
  • Only the hypervisor/bastion has network access to the VMs
  • Ansible is running from a remote machine (not the hypervisor itself)

Copy link
Contributor

@bogdando bogdando left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, it makes sense to have it

Copy link
Contributor

@csibbitt csibbitt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm okay with this, but I'm curious - is this needed in our lab environment for some reason, or are you just using this for development purposes?

@MiguelCarpio
Copy link
Contributor Author

I'm okay with this, but I'm curious - is this needed in our lab environment for some reason, or are you just using this for development purposes?

@csibbitt We need this to allow the gpu-validation pod to reach the target VM, which is in a private network that is accessible from the host.

@MiguelCarpio MiguelCarpio merged commit 4206bba into rhos-vaf:main Jan 15, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants