1

Is it possible to opening a Azure Bastion tunnel in a DevOps Pipeline? I have successfully done so locally using native client but the tunneling command az network bastion tunnel but this results in a locked window until Ctrl-C is sent.

Is it possible to somehow integrate this into a DevOps Pipeline in order to ssh / scp to VM on a private network?

Thanks.

JGoodgive
  • 1,068
  • 10
  • 20

2 Answers2

2

az network bastion rdp and az network bastion rdp commands(2) open tunnel, connect with native SSH or RDP client, and finally when the client is disconnected tunnel is being tear-down and az process exits. For SCP you might want to consult https://serverfault.com/questions/522258/file-copying-over-an-already-established-ssh-connection and check if existing SSH connection can be re-used for SCP.

Alternative solution: open tunnel with background process. E.g.

nohup az network bastion tunnel > /dev/null 2>&1 & echo $! > run.pid
scp something
scp something
scp something else
kill -p $(cat run.pid)

disclaimer: did not test but this kind of process management should work. If tunnel command requires pty then it is more complicated and requires running tmux or other terminal multiplexer.

If you just need to run command(s) on VM az vm run-command(1) might also be a good alternative.

(1) https://learn.microsoft.com/en-us/cli/azure/vm/run-command?view=azure-cli-latest

(2) https://learn.microsoft.com/en-us/cli/azure/network/bastion?view=azure-cli-latest#az-network-bastion-ssh

jikuja
  • 459
  • 2
  • 16
  • Thanks! `az vm run-command` was a great entry point to the `az vm invoke-command` solution which lets me execute commands on the VM. But, then I would need a way (without Bastion) to scp files there without needing a public IP. Any bright ideas? – JGoodgive Sep 07 '22 at 08:08
  • Correction: Should be `az vm run-command invoke` and not invoke-command. – JGoodgive Sep 07 '22 at 11:26
  • True. Did not remember if invoke is asynchronous or not: command group made more sense than the command itself. As far as I know there is not management API for file movement. E.g. Azure Devops Copy file task is using WinRM protocol when interacting with VMs – jikuja Sep 07 '22 at 15:50
0

In my use case, we simply appended & to the end of the command to make it run in the background.

az network bastion tunnel &

https://www.maketecheasier.com/run-bash-commands-background-linux/

Tyler Chong
  • 650
  • 2
  • 12
  • 24