Pass-through options to ssh on az ssh vm & friends

[roy-work]

• If the issue is to do with Azure CLI 2.0 in-particular, create an issue here at Azure/azure-cli

Extension name (the extension in question)

ssh

Description of issue (in as much detail as possible)

az ssh vm (et al.) allows one to SSH; sometimes, we need to set up, e.g., SSH port-forwardings. It would be great if az ssh vm understood -- and passed the remaining options through to SSH, directly. E.g.,

az ssh vm -g my_group -n my_vm -- -o SomeSshOption=3 -L 8080:localhost:8080
          ^^^^^^^^^^^^^^^^^^^^    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
               az ssh opts                 options forwarded to ssh

-- is a fairly standard pattern for this sort of thing.

[yonzhan]

route to service team

[N6UDP]

Sadly -- didn't appear to be easy to support given the existing azure cli arguments parser -- for now I've added an additional args parameter as part of Azure/azure-cli-extensions#3698

[jiasli]

Transferring this issue to Azure CLI main repo as it is actually a general question.

-- is provided by argparse. As long as the parameter is declared as optional, -- will work.

For an example of declaring a positional argument:

azure-cli/src/azure-cli/azure/cli/command_modules/config/_params.py

Line 14 in 2c52cbc

c.positional('key_value', nargs='+', help="Space-separated configurations in the form of <section>.<key>=<value>.")

There was a discussion #18869 about how to pass arguments to another command, because the leading dashes in arguments like -o corrupts argparse's parsing.

Several workarounds are proposed in #18869, but we haven't decided which way to go.

[roy-work]

One other thing that is really difficult with the current setup is scp. This one is rather thorny, as in the worst case, it can involve up to two separate VMs at the same time, potentially in different tenants.

Yes, it is possible to go down to the lower level commands, such as az ssh cert, but the problem with that is that it forces every person who might use AAD login to have an understanding of how AAD login is actually built, under the hood. It'd be nice to only require those of us who maintain systems (e.g., I work on a cloud infra team, so we mandate AAD login presently, to avoid, e.g., scenarios where we have old keys sitting in authorized_keys files). It really just scales better. This might just mean there needs to be a az ssh scp, or something. (In addition to being able to forward arguments.)

[AchilleAsh]

Hi,

Using azure cli with ssh extension v1.0.0 or higher, this seems to be implemented:

az ssh vm -n myvm -g mygroup -- "-L 8888:localhost:8888" -v
[...]
debug1: Local connections to LOCALHOST:8888 forwarded to remote address localhost:8888
[...]

This is also briefly documented in the help, with example:

Positional
    <SSH_ARGS>            : Additional arguments passed to OpenSSH.
    
[...]
    Using additional ssh arguments
        az ssh vm --ip 1.2.3.4 -- -A -o ForwardX11=yes

Thus I believe this issue could safely be closed now :)