kubectl-ssh-jump

#!/usr/bin/env bash

[[ -n $DEBUG ]] && set -x -e

PLUGIN_DIR="${HOME}/.kube/kubectlssh"
MAX_POD_CREATION_TIME=10   # unit: ~seconds
RANDOM_POD_NAME=ssh-jump-host-$(xxd -l 16 -c 16 -p < /dev/random)
LOCAL_PORT=2222
LOCAL_ADDRESS='127.0.0.1'

help(){
  echo "Usage: "
  echo "  kubectl ssh-jump <dest_node> [options]"
  echo ""
  options
}

options(){
  cat <<"EOF"
Options:
  <dest_node>                                 Destination node name or IP address with user name
  -i, --identity <identity_file>              Identity key file, or PEM(Privacy Enhanced Mail)
  -c, --context <context_name>                You can user other context
  --image <image>                             Your custom image
  -P, --port <port>                           SSH port for target node SSH server (default:22)
  --port-forward <local_port>:<remote_port>   If you just want to enable port forwarding
  --port-forward-bind-address <address>       Address to bind (optional, default:127.0.0.1)
  -a, --args <args>                           Args to exec in ssh session
  -h, --help                                  Show this message

Example:
  $ kubectl ssh-jump -i ~/.ssh/mykey.pem admin@rabbit.internal.prod
  $ kubectl ssh-jump -i ~/.ssh/mykey.pem --context prod admin@rabbit.internal.prod

Port forward example:
  $ kubectl ssh-jump -i ~/.ssh/mykey.pem --port-forward 37017:27017 admin@mongo.internal.prod

EOF
}

function cleanup() {
  # Stop port-forward
  kill -3 ${pid_port_forward} 2>/dev/null

  # remove "lock"
  rm -f ${PLUGIN_DIR}/${LOCAL_PORT}.lock

  echo "Clearning up SSH Jump host (Pod)..."
  kubectl --context ${context} delete pod ${RANDOM_POD_NAME} --grace-period 0 --force 2> /dev/null
}

run_ssh_node(){
  local destnode="$1"
  local identity="$2"
  local port="$3"
  local sshargs="$4"
  local image="$5"
  local port_forward="$6"
  # we use it in cleanup func
  context="$7"
  local port_forward_bind_address="$8"

  # Install an SSH Server
  echo "Creating SSH jump host (Pod)..."
  cat <<EOF | kubectl --context ${context} apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: ${RANDOM_POD_NAME}
  labels:
    jump_host: test
spec:
  containers:
    - name: sshjump
      image: ${image}
      ports:
        - containerPort: 22
  nodeSelector:
    "kubernetes.io/os": linux
EOF

  # Wait until sshjump gets ready
  c=1
  while [[ ${c} -le $(( MAX_POD_CREATION_TIME * 10 )) ]];
  do
    pod_status=$(kubectl --context ${context} get pod $RANDOM_POD_NAME 2>/dev/null | tail -1 | awk '{print $3}')
    if [ "${pod_status}" = "Running" ]; then
      break
    fi
    (( c++ ))
    sleep 0.1
  done

  # Generate temp private/public key to ssh to the sshjump
  identity_sshjump=${PLUGIN_DIR}/id_rsa_sshjump
  pubkey_sshjump=${PLUGIN_DIR}/id_rsa_sshjump.pub
  if [ ! -f "${pubkey_sshjump}" ]; then
    echo "Generating nopass SSH pri/pub key to ssh to the sshjump ..."
    ssh-keygen -t rsa -f ${identity_sshjump} -N '' > /dev/null
  fi

  # Setup portforward
  # "lock" mechanism
  while [ -f "${PLUGIN_DIR}/${LOCAL_PORT}.lock" ]; do
      (( LOCAL_PORT++ ))
  done
  touch ${PLUGIN_DIR}/${LOCAL_PORT}.lock

  kubectl --context ${context} port-forward ${RANDOM_POD_NAME} ${LOCAL_PORT}:22 2>/dev/null &
  pid_port_forward=$!

  # Inject public SSH key to sshjump
  cat ${pubkey_sshjump} | kubectl --context ${context} exec -i ${RANDOM_POD_NAME} -- /bin/bash -c "cat > /root/.ssh/authorized_keys"

  trap cleanup SIGHUP EXIT

  if [ -n "${port_forward}" ];
  then
    # port forward
    arr_port_forward=(${port_forward//:/ })
    arr_destnode=(${destnode//@/ })

    ssh -o StrictHostKeyChecking=no \
        -o HostkeyAlgorithms=+ssh-rsa \
        -o PubkeyAcceptedAlgorithms=+ssh-rsa \
        -L ${port_forward_bind_address:-$LOCAL_ADDRESS}:${arr_port_forward[0]}:${arr_destnode[1]}:${arr_port_forward[1]} root@127.0.0.1 \
        -p ${LOCAL_PORT} \
        -i ${identity_sshjump}
  else
    # Using the SSH Server as a jumphost (via port-forward proxy), ssh into the desired machine
    ssh -i ${identity} -p ${port} ${destnode} \
      -o "ProxyCommand ssh root@127.0.0.1 -p ${LOCAL_PORT} -i ${identity_sshjump} -o HostkeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa -o StrictHostKeyChecking=no \"nc %h %p\"" \
      -o StrictHostKeyChecking=no ${sshargs}
  fi
}

plugin_main() {
  while [ $# -gt 0 ] ; do
    nSkip=1
    case $1 in
      "-h" | "--help")
	help
	exit 0
	;;
      "-i" | "--identity" )
	c_identity=$2
	nSkip=2
  ;;
      "-c" | "--context" )
	c_context=$2
	nSkip=2
	;;
      "-P" | "--port")
	c_port=$2
	nSkip=2
  ;;
      "--port-forward")
	c_port_forward=$2
	nSkip=2
  ;;
      "--port-forward-bind-address")
  c_port_forward_bind_address=$2
  nSkip=2
  ;;
      "--image")
	c_image=$2
	nSkip=2
	;;
      "-a" | "--args" )
	sshargs="$2"
	nSkip=2
	;;
      [0-9a-zA-Z-@]*)
	destnode=$1
	;;
      *)
	help >&2
	exit 1
	;;
    esac
    shift $nSkip
  done

  if [[ "$(type kubectl &>/dev/null; echo $?)" -eq 1 ]]; then
    echo "Error: missing kubectl command" >&2
    echo "Please install kubectl (https://kubernetes.io/docs/tasks/tools/install-kubectl/)" >&2
    exit 1
  fi

  if [ ! -d ${PLUGIN_DIR} ]; then
    mkdir -p ${PLUGIN_DIR}
  fi

  if [ ! -f "${c_identity}" ]; then
    echo "Error: identity file is required" >&2
    help >&2
    exit 1
  fi

  if [ ! -n "${c_port}" ]; then
    c_port="22"    # default: 22
  fi
  echo "using: port=${c_port}"

  if [ "${sshargs}" != "" ]; then
    echo "using: args=${sshargs}"
  fi

  if [ ! -n "${c_image}" ]; then
    c_image="corbinu/ssh-server"
  fi
  echo "using: image=${c_image}"

  if [ -n "${c_port_forward}" ]; then
    echo "port forwarding enabled"
  fi

  if [ ! -n "${c_context}" ]; then
    c_context="$(kubectl config current-context)"
  fi
  echo "using: context=${c_context}"
  
  echo "using: port-forward-bind-address=${c_port_forward_bind_address}"

  # SSH Logging into desitnation node via Jump host
  run_ssh_node "${destnode}" "${c_identity}" "${c_port}" "${sshargs}" "${c_image}" "${c_port_forward}" "${c_context}" "${c_port_forward_bind_address}"

}

plugin_main "$@"