[SEC] SSH into AWS EKS K8s pod without Public IP

[elgalu]

clearml-session/clearml_session/__main__.py

Lines 632 to 634 in ae09bf3

	remote_address = \
	task_parameters.get('properties/k8s-gateway-address') or \
	task_parameters.get('properties/external_address')

Hi, I'm trying to understand what's the trust point to be able for a user to SSH into a remote cloud K8s Pod (AWS EKS) without having to expose the public IP of K8s worker nodes.

Does it uses K8s ingress for SSH or what is k8s-gateway-address exactly and how is that secured?

Also, can 2 users be SSHing into 2 pods on the same AWS instance (shared big machine) at the same time without being able to impersonate each other?

[jkhenning]

Hi @elgalu,

To support it, you'll have to use the k8s-glue support in the ClearML Agent (see here) with the --ports-mode option, which automatically labels pods in such a way that you can set up an ingress based on pod labels and SSH to the correct pod using a port assigned by the ingress.