Add support for custom ports when using ssh tunnel

[mikeblakeuk]

Add support for custom ports to bastion ssh.

The use case is that we want to connect to a Private AKS cluster.
We have bastion setup and VM we connect to.

It would be nice to force the custom ports, and let az do the ssh key management.

az network bastion ssh --name "bastion" --resource-group "$group" --target-resource-id "$vmId" --resource-port 22 --auth-type AAD -- -L $customPort:our-cluster-abcde.dev-eus.privatelink.eastus.azmk8s.io:443

https://github.com/Azure/azure-cli-extensions/blob/a2dc8d7661670d56c92115092725214710f4a9ab/src/bastion/azext_bastion/custom.py

Instead we have to create the tunnel, the create ssh keys, then run ssh with port forwarding.

kubectl config set "clusters.$name.server" "https://localhost:$clusterPort"

az network bastion tunnel --name bastion --resource-group $group--target-resource-id '$vmId' --resource-port 22 --port $bastionPort

az ssh config --ip localhost --port $bastionPort --file $sshConfigPath --overwrite --yes-without-prompt #--debug

ssh -NTf -v $sshParams localhost -p $bastionPort -F $sshConfigPath -o ExitOnForwardFailure=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null

[yonzhan]

Thank you for opening this issue, we will look into it.

[mikeblakeuk]

@yonzhan / @necusjz any more thoughts on this?

[aavalang]

@mikeblakeuk we dont have support for custom port yet but we do support connecting to you AKS cluster now. https://learn.microsoft.com/en-us/azure/bastion/bastion-connect-to-aks-private-cluster

[mikeblakeuk]

az aks get-credentials --name $name --resource-group $resourceGroup --overwrite-existing

PS C:\Projects\Tools> az aks bastion --name k8-dev-wus --resource-group k8.cluster.dev-wus --admin --bastion "/subscriptions/GUID/resourceGroups/mikeblake.management.dev/providers/Microsoft.Network/bastionHosts/bastion"
Preview version of extension is disabled by default for extension installation, enabled for modules without stable versions. 
Please run 'az config set extension.dynamic_install_allow_preview=true or false' to config it specifically. 
The command requires the extension aks-preview. Do you want to install it now? The command will continue to run after the extension is installed. (Y/n): 
Run 'az config set extension.use_dynamic_install=yes_without_prompt' to allow installing extensions without prompt.
No stable version of 'aks-preview' to install. Preview versions allowed.
The installed extension 'aks-preview' is in preview.
(BadRequest) Getting static credential is not allowed because this cluster is set to disable local accounts.
Code: BadRequest
Message: Getting static credential is not allowed because this cluster is set to disable local accounts.

Do we have to have admin?

The SSH way doesn't require it.

{
  "azure-cli": "2.83.0",
  "azure-cli-core": "2.83.0",
  "azure-cli-telemetry": "1.1.0",
  "extensions": {
    "aks-preview": "19.0.0b22",
    "bastion": "1.4.3",
    "ssh": "2.0.6"
  }
}