Repository navigation
virtual kubelet: values for the ssh shadow's reverse tunnel - #58
Merged
Merged
Conversation
matbun
force-pushed
the
feat/ssh-reverse-tunnel
branch
from
October 16, 2026 18:34
8b3af5e to
6181b29
Compare
virtualNode.network.ssh.reverse (enabled, nodeExec, sshdPath, pythonPath) renders Network.SSH.Reverse in the virtual kubelet config when enabled is true, and nothing otherwise. For interLink's reverse tunnel over the ssh shadow (interlink-hq/interLink#548). Co-Authored-By: Claude Fable 5.1 <[email protected]> Signed-off-by: Matteo Bunino <[email protected]>
The reverse tunnel changed in interLink: by default the compute node's own sshd now binds each forward as a unix socket in the pod's socket directory, and a relay the job starts serves it to the job's user only. The user-space sshd is kept as a fallback for sites whose node sshd refuses forwarding, and the SOCKS proxy, open to every user of the node, is refused unless the virtual kubelet allows it. Surface both as reverse.sshd (Network.SSH.Reverse.Sshd, omitted when unset) and reverse.allowSocks (AllowSocks, rendered only when it is true). allowSocks and reverse.enabled are both compared as strings, so a quoted "false" can turn on neither the proxy nor the reverse tunnel. The reverse comments are rewritten for the new shape: srun is a last resort that delegates the Kerberos ticket to the login node and runs execConnectCommand on the compute node (with the node's own sshd) in either forwardMode, sshdPath is for the user-space sshd only, pythonPath runs the relay, and the reverse tunnel needs SocketDirRoot in the plugin, which the ssh example now says too. The CI step that renders the ssh example now also sets the reverse values and checks that they reach the config, that the default allowSocks and a quoted "false" render no AllowSocks, and that a quoted "false" for reverse.enabled renders no Reverse block. Rendering the default values and the ssh example, with or without reverse.enabled, is byte-identical to before. Part of interlink-hq/interLink#548. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Matteo Bunino <[email protected]>
matbun
force-pushed
the
feat/ssh-reverse-tunnel
branch
from
October 28, 2026 13:53
6181b29 to
5df20a7
Compare
matbun
marked this pull request as ready for review
October 28, 2026 13:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part of interlink-hq/interLink#548. Values for interlink-hq/interLink#577.
virtualNode.network.ssh.reverse.*rendersNetwork.SSH.Reverse:enabled,sshd(nodeoruserspace),allowSocks(false by default),nodeExec,sshdPathandpythonPath.enabledandallowSocksare compared as strings, so a quoted"false"stays off, and the lint workflow checks that renders.Related issue : interlink-hq/interLink#548