Add support for custom ports when using ssh tunnel

Add support for custom ports to bastion ssh.

The use case is that we want to connect to a Private AKS cluster.
We have bastion setup and VM we connect to.

It would be nice to force the custom ports, and let az do the ssh key management.

az network bastion ssh --name "bastion" --resource-group "$group" --target-resource-id "$vmId" --resource-port 22 --auth-type AAD -- -L $customPort:our-cluster-abcde.dev-eus.privatelink.eastus.azmk8s.io:443

https://github.com/Azure/azure-cli-extensions/blob/a2dc8d7661670d56c92115092725214710f4a9ab/src/bastion/azext_bastion/custom.py

Instead we have to create the tunnel, the create ssh keys, then run ssh with port forwarding.

kubectl config set "clusters.$name.server" "https://localhost:$clusterPort"

az network bastion tunnel --name bastion --resource-group $group--target-resource-id '$vmId' --resource-port 22 --port $bastionPort

az ssh config --ip localhost --port $bastionPort --file $sshConfigPath --overwrite --yes-without-prompt #--debug

ssh -NTf -v $sshParams localhost -p $bastionPort -F $sshConfigPath -o ExitOnForwardFailure=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null

Thank you for opening this issue, we will look into it.

Yong Zhang (@yonzhan)

Yong Zhang (@yonzhan) / Ethan Yang (@necusjz) any more thoughts on this?

Mike Blake (@mikeblakeuk)

Mike Blake (@mikeblakeuk) we dont have support for custom port yet but we do support connecting to you AKS cluster now. https://learn.microsoft.com/en-us/azure/bastion/bastion-connect-to-aks-private-cluster

az aks get-credentials --name $name --resource-group $resourceGroup --overwrite-existing

PS C:\Projects\Tools> az aks bastion --name k8-dev-wus --resource-group k8.cluster.dev-wus --admin --bastion "/subscriptions/GUID/resourceGroups/mikeblake.management.dev/providers/Microsoft.Network/bastionHosts/bastion"
Preview version of extension is disabled by default for extension installation, enabled for modules without stable versions. 
Please run 'az config set extension.dynamic_install_allow_preview=true or false' to config it specifically. 
The command requires the extension aks-preview. Do you want to install it now? The command will continue to run after the extension is installed. (Y/n): 
Run 'az config set extension.use_dynamic_install=yes_without_prompt' to allow installing extensions without prompt.
No stable version of 'aks-preview' to install. Preview versions allowed.
The installed extension 'aks-preview' is in preview.
(BadRequest) Getting static credential is not allowed because this cluster is set to disable local accounts.
Code: BadRequest
Message: Getting static credential is not allowed because this cluster is set to disable local accounts.

Do we have to have admin?

The SSH way doesn't require it.

{
  "azure-cli": "2.83.0",
  "azure-cli-core": "2.83.0",
  "azure-cli-telemetry": "1.1.0",
  "extensions": {
    "aks-preview": "19.0.0b22",
    "bastion": "1.4.3",
    "ssh": "2.0.6"
  }
}

Navigation Menu

Repository navigation

Add support for custom ports when using ssh tunnel #9173

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Add support for custom ports when using ssh tunnel #9173

Description

Activity

yonzhan commented on Sep 17, 2025

mikeblakeuk commented on Sep 26, 2025

aavalang commented on Feb 28, 2026

mikeblakeuk commented on Mar 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions