[SEC] SSH into AWS EKS K8s pod without Public IP

[elgalu]

https://github.com/allegroai/clearml-session/blob/ae09bf3bedbbcd26383820e44624c65c5397705b/clearml_session/__main__.py#L632-L634

Hi, I'm trying to understand what's the trust point to be able for a user to SSH into a remote cloud K8s Pod (AWS EKS) without having to expose the public IP of K8s worker nodes.

Does it uses K8s ingress for SSH or what is k8s-gateway-address exactly and how is that secured?

Also, can 2 users be SSHing into 2 pods on the same AWS instance (shared big machine) at the same time without being able to impersonate each other?

[jkhenning]

Hi @elgalu,

To support it, you'll have to use the k8s-glue support in the ClearML Agent (see here) with the --ports-mode option, which automatically labels pods in such a way that you can set up an ingress based on pod labels and SSH to the correct pod using a port assigned by the ingress.