[WIP] proposal for multi-bastion support using ssh_config parsing #25967
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This proposal relates to #14523.
It attempts to achieve the multi-bastion support by adding the possibility to specify a ssh_config file. It uses two environment variables
TF_USE_SSH_CONFIG
andTF_SSH_CONFIG
in order to enable the feature and to (optionally) override the ssh_config location. Pls. see the updates in website/docs/provisioners/connection.html.markdown for the limitations.Pros:
Cons:
Having that said, it is clear, that the very first question should be if this is really an option that is worth considering.
Regarding the parsing of the ssh_config file, at the moment an external parser is used, adding another dependency. This adds to the question above. Of course if the overall direction looks okay, thinking about implementing a dedicated ssh_config parser would be obvious, but clearly makes the change much larger (even if a partial-only support would be sufficient).
Example
templates.tf (sorry for the interpolation-only syntax, working on it):
Example ssh config (~/.ssh/config.tf.bastiondemo):
Output: