Repository navigation
Explore the ssh-only deployment with mesh #548
Description
@matbun @antoinetran please let us know here any relevant news!
Metadata
Metadata
Assignees
Labels
No labels
{{ message }}
@matbun @antoinetran please let us know here any relevant news!
Activity
antoinetran commentedon Jul 29, 2026
Hi @dciangot , is the goal of this issue to test in the BSC cluster the mesh solution with a ssh reverse tunnel from k8s cluster to login node , and login to compute? That would require BSC access and I don't have for now. Probably @matbun would be a better assignee?
feat: add an SSH port-forward shadow for air-gapped HPC
feat: add an SSH port-forward shadow for air-gapped HPC
feat: add an SSH port-forward shadow for air-gapped HPC
feat: add an SSH port-forward shadow for air-gapped HPC
feat: add an SSH port-forward shadow for air-gapped HPC
feat: add an SSH port-forward shadow for air-gapped HPC
feat: add an SSH port-forward shadow for air-gapped HPC
matbun commentedon Oct 8, 2026
A first working version is currently being tested
feat: let offloaded pods reach cluster endpoints over the ssh shadow
feat: let offloaded pods reach cluster endpoints over the ssh shadow
docs: the reverse tunnel of the ssh shadow
21 remaining items
feat: let offloaded pods reach cluster endpoints over the ssh shadow
feat: send the virtual kubelet's Events to the API server
feat: run the reverse tunnel on the node's sshd with a job-owned relay
docs: the reverse tunnel of the ssh shadow
docs: performance of the reverse tunnel carriers
docs: reverse tunnel on the node's sshd, with a job-owned relay
docs: wrapper line for the reverse tunnel's hold command
virtual kubelet: values for the ssh shadow's reverse tunnel
feat: reverse.sshd and reverse.allowSocks for the ssh reverse tunnel
antoinetran commentedon Oct 28, 2026
Hi @matbun ! very impressed with the work! I hope to find sometime next week to review all that :) Also happy to know this design has been validated by BSC support team, so this is a sustainable work!
fix: reverse tunnel gaps found in review
docs: reverse tunnel review fixes
matbun commentedon Nov 2, 2026
I discussed with BSC team. This is allowed on a case-by-case basis and only when this is not used to circumvent their restrictions and security policies (e.g., internet access). In our case we use this to access our on-prem MLFlow and S3 endpoints. I would encourage you to explain them your use case and keep them in the loop
fix: reverse tunnel points from the second review
docs: bare Service names and GatewayPorts for the reverse tunnel