# GCP Tunnel through IAP

**URL:** <https://forum.ansible.com/t/gcp-tunnel-through-iap/31722>\
**Category:** Ansible Project\
**Tags:** gcp\
**Created:** [November 25, 2019, 6:16pm UTC](https://forum.ansible.com/t/gcp-tunnel-through-iap/31722 "2019-11-25T18:16:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Micahel\_Scott](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@Micahel\_Scott](https://forum.ansible.com/u/Micahel_Scott)\
**Post date:** [November 25, 2019, 6:16pm UTC](https://forum.ansible.com/t/gcp-tunnel-through-iap/31722/1 "2019-11-25T18:16:11Z")

</div>

I am required to tunnel through IAP with service account credentials.

I have overridden my ssh binary, ‘ssh\_executable=script.sh’, creating a ‘gcloud compute ssh xxxx —tunnel-through-iap’ wrapper, where I regex ssh arguments into the gcloud command.

For tunneling to work I must  
1. Run my playbook with my instance IP in the hosts variable of my playbook  
2. Hardcode my compute instance hostname for my ssh wrapper connection.  
3. This always makes an initial connection but always fails to run the command. No matter my regex there is always extra “, ‘ or something.  
4. Comment out my ‘ssh\_execution’ wrapper overriding in ansible.cfg  
5. Run my playbook again which runs successfully.

Running the playbook with the gcp plugin will only list available instances but will never ssh successfully without a previously opened gcloud session.

---

<div class="post-metadata">

**Author:** ![C.J\_Brown](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@C.J\_Brown](https://forum.ansible.com/u/C.J_Brown)\
**Post date:** [February 9, 2021, 4:00pm UTC](https://forum.ansible.com/t/gcp-tunnel-through-iap/31722/2 "2021-02-09T16:00:01Z")

</div>

Say, did you ever find a better solution here? Because I’ve run into the same problem recently, and…well, it’s ugly.

I saw that this ticket had been filed against Ansible:

[https://github.com/ansible/ansible/issues/66310](https://github.com/ansible/ansible/issues/66310)

…but was auto-closed by ansibot when all this stuff got moved to the GCP collection. So I’ve filed my own feature request against that repo:

[https://github.com/ansible-collections/google.cloud/issues/373](https://github.com/ansible-collections/google.cloud/issues/373)

We’ll see if anybody picks it up over there. My sense is that a number of folks have had the Ansible-over-IAP problem; one of these days, GCP really ought to support a proper solution…

---

<div class="post-metadata">

**Author:** ![jean-yves](https://avatars.discourse-cdn.com/v4/letter/j/a587f6/32.png) [@jean-yves](https://forum.ansible.com/u/jean-yves)\
**Post date:** [February 9, 2021, 9:56pm UTC](https://forum.ansible.com/t/gcp-tunnel-through-iap/31722/3 "2021-02-09T21:56:07Z")

</div>

Hi,

Just gave some directions in the issue on github to make it work

Regards,

JYL