Bastion in kOps

    To enable a bastion instance group, a user will need to set the flag on cluster create

    To add a bastion instance group to a pre-existing cluster, create a new instance group with the --role Bastion flag and one or more subnets (e.g. utility-us-east-2a,utility-us-east-2b).

    1. kops create instancegroup bastions --role Bastion --subnet $SUBNET

    Configure the bastion instance group

    You can edit the bastion instance group to make changes. By default the name of the bastion instance group will be bastions and you can specify the name of the cluster with --name as in:

    1. kops edit ig bastions --name $KOPS_NAME

    You should now be able to edit and configure your bastion instance group.

    1. apiVersion: kops.k8s.io/v1alpha2
    2. kind: InstanceGroup
    3. metadata:
    4.   name: bastions
    5.   associatePublicIp: true
    6.   image: kope.io/k8s-1.4-debian-jessie-amd64-hvm-ebs-2016-10-21
    7.   machineType: t2.micro
    8.   maxSize: 1
    9.   minSize: 1
    10.   role: Bastion
    11.   subnets:
    12.   - utility-us-east-2a

    Note: If you want to turn off the bastion server, you must set the instance group maxSize and fields to 0.

    If you do not want the bastion instance group created at all, simply drop the --bastion flag off of your create command. The instance group will never be created.

    Using a public CNAME to access your bastion

    By default the bastion instance group will create a public CNAME alias that will point to the bastion ELB.

    Unless a user is using --dns-zone which will inherently use the bastion-$ZONE syntax.

    You can define a custom bastion CNAME by editing the main cluster config kops edit cluster $NAME and modifying the following block

    1. spec:
    2.   topology:
    3.     bastion:
    4.       bastionPublicName: bastion.mycluster.example.com

    When configuring a LoadBalancer, you can also choose to have a public load balancer or an internal (VPC only) load balancer. The type field should be Public or Internal (defaults to Public if omitted).

    1. spec:
    2.   topology:
    3.     bastion:
    4.       loadBalancer:
    5.         type: "Internal"

    Additional security groups to ELB

    Introduced
    Kops 1.18

    If you want to add security groups to the bastion ELB

    1. spec:
    2.     bastion:
    3.       bastionPublicName: bastion.mycluster.example.com
    4.       loadBalancer:
    5.         additionalSecurityGroups:
    6.         - "sg-***"

    Access when using gossip

    When using gossip mode, there is no DNS zone where we can configure a CNAME for the bastion. Because bastions are fronted with a load balancer, you can instead use the endpoint of the load balancer to reach your bastion.

    On AWS, an easy way to find this DNS name is with kops toolbox:

    Verify your local agent is configured correctly

    1. $ ssh-add -L
    2. ssh-rsa <PUBLIC_RSA_HASH> /Users/kris/.ssh/id_rsa
    1. ssh-add ~/.ssh/id_rsa

    Check if the key is now added using ssh-add -L

    SSH into the bastion, then into a master

    1. ssh -A admin@<bastion_elb_a_record>
    2. ssh admin@<master_ip>

    Changing your ELB idle timeout

    The bastion is accessed via an AWS ELB. The ELB is required to gain secure access into the private network and connect the user to the ASG that the bastion lives in. kOps will by default set the bastion ELB idle timeout to 5 minutes. This is important for SSH connections to the bastion that you plan to keep open.

    You can increase the ELB idle timeout by editing the main cluster config kops edit cluster $NAME and modifying the following block

    Where the maximum value is 3600 seconds (60 minutes) allowed by AWS. For more information see configuring idle timeouts.

    Using the bastion

    Once your cluster is setup and you need to SSH into the bastion you can access a cluster resource using the following steps

    1. # Verify you have an SSH agent running. This should match whatever you built your cluster with.
    2. ssh-add -l
    3. # If you need to add the key to your agent:
    4. ssh-add path/to/private/key
    6. # Now you can SSH into the bastion
    7. ssh -A admin@<bastion-ELB-address>

    Now that you can successfully SSH into the bastion with a forwarded SSH agent. You can SSH into any of your cluster resources using their local IP address. You can get their local IP address from the cloud console.