# How can i get ssh from AWX to Github private repo working trough proxy **URL:** \ **Category:** Get Help\ **Tags:** kubernetes, awx\ **Created:** [December 31, 2024, 4:14pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403 "2024-12-31T16:14:09Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [December 31, 2024, 4:14pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/1 "2024-12-31T16:14:09Z")
I have installed newest AWX on K8s. I have created Git ssh credentials and a test project where i connect to my private Github ansible repo. All that works, i can sync the repo. I want to make the same AWX in Production, but here AWX and K8s will be behind a outbound proxy. How do i set up the ssh to go trough the proxy ? - I have to use ssh credential because it is a private repo. Hope someone can help. Thanks. ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [January 1, 2025, 9:41pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/2 "2025-01-01T21:41:59Z")
I think you could create an ssh config and credential secret in k8s, and mount that as an extra volume for AWX. You’ll want to create a unique name for your ssh private key and specify its use for the proxy in your ssh config, that way it doesn’t get used accidentally for anything other than the proxy and only when the proxy is needed. ---
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [January 2, 2025, 6:52am UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/3 "2025-01-02T06:52:58Z")
> [@Denney-tech](#): > > ssh config and credential secret in k8s Many thanks Denney-tech for suggestions, but I don’t have the knowledge to set this up. And I also don’t know how to get AWX to use this sshconfig. When AWX makes the ssh connection to GitHub, it is not via the VM’s normal ssh, but from within AWX itself. A tcpdump in the VM on port 22 shows nothing. Thank you. ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [January 2, 2025, 3:59pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/4 "2025-01-02T15:59:43Z")
The exact steps depend a little bit on how you deployed AWX. Did you use Helm or the AWX-Operator? If you used Helm, I don’t know exactly what to tell you there. However, there is some documentation for the operator on adding extra volume mounts in k8s. * * * [Custom Volume and Volume Mount Options - Ansible AWX Operator Documentation](https://ansible.readthedocs.io/projects/awx-operator/en/latest/user-guide/advanced-configuration/custom-volume-and-volume-mount-options.html) * * * In your case, you’ll want to have an ssh config as a configmap, and the private key as a secret. I’ll provide some examples below, but make sure that your ssh config and proxy key work like this on a local machine first. ```yaml --- apiVersion: v1 kind: ConfigMap metadata: name: awx-proxy-ssh-config namespace: awx data: config: | Host my_proxy HostName proxy.example.com User your_username IdentityFile ~/.ssh/id_rsa_proxy Host github.com ProxyJump my_proxy Host *.github.com ProxyJump my_proxy --- apiVersion: v1 kind: Secret metadata: name: awx-proxy-ssh-key namespace: awx stringData: id_rsa_proxy: type: Opaque ``` Now you need to add the extra\_volumes and task\_extra\_volume\_mounts to the AWX spec. ```auto --- spec: ... extra_volumes: | - name: awx-proxy-config projected: sources: - configMap: name: awx-proxy-ssh-config items: - key: config path: config - secret: name: awx-proxy-ssh-key items: - key: id_rsa_proxy path: id_rsa_proxy mode: 400 task_extra_volume_mounts: | - name: awx-proxy-config mountPath: "/var/lib/awx/.ssh" ``` * * * This will mount the ssh config and key under the .ssh folder of awx’s home directory, but only on the task container where it will be used. And the ssh config only uses the key whenever the container needs to connect to [github.com](http://github.com) or its subdomains. ---
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [January 3, 2025, 3:43pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/5 "2025-01-03T15:43:46Z")
Thanks a lot 🙂 I’ll try it out and come back. ---
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [January 3, 2025, 4:34pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/6 "2025-01-03T16:34:06Z")
> [@Denney-tech](#): > > ```auto > stringData: > id_rsa_proxy: > > ``` Should this contain the key ? ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [January 3, 2025, 8:02pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/7 "2025-01-03T20:02:00Z")
Yes, in this example, you would paste the plaintext content of the private key file. I’m on my mobile right now, so I can’t give specific instruction at the moment, but alternatively, you can use kubectl to create the secret with `--from-file`. Or you can properly format the yaml with the base64 encoded file. In any case, do not commit the yaml secret to your code repository with the private key embedded plainly like this. If you want to automate the changes with Ansible, you could use kubernetes.core.k8s (iirc) to create the secret from a file or template and/or a lookup plugin/vaulted variable to provide the private key data. ---
**Author:** ![matteoclc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matteoclc/32/7020_2.png) [@matteoclc](https://forum.ansible.com/u/matteoclc)\ **Post date:** [January 3, 2025, 8:14pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/8 "2025-01-03T20:14:22Z")
Peter, “proxy” as in “http proxy”? ---
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [January 3, 2025, 8:18pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/10 "2025-01-03T20:18:53Z")
yes it is an http (squid) proxy but i will ProxyJump with ssh trough it ---
**Author:** ![matteoclc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matteoclc/32/7020_2.png) [@matteoclc](https://forum.ansible.com/u/matteoclc)\ **Post date:** [January 3, 2025, 8:22pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/11 "2025-01-03T20:22:32Z")
so you aren’t actually using the Squid proxy service but just using the same server as SSH jump host, got it ---
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [January 3, 2025, 8:28pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/13 "2025-01-03T20:28:32Z")
Hi again i already deployed before i saw your last message. I deployed the Configmap and Secret with succes but i get error on the last one with the extra volumes kubectl apply -f awx-extra-volumes-config.yaml error: error validating “awx-extra-volumes-config.yaml”: error validating data: [apiVersion not set, kind not set]; if you choose to ignore these errors, turn validation off with --validate=false ```auto --- spec: extra_volumes: | - name: awx-proxy-config projected: sources: - configMap: name: awx-proxy-ssh-config items: - key: config path: config - secret: name: awx-proxy-ssh-key items: - key: id_rsa_proxy path: id_rsa_proxy mode: 400 task_extra_volume_mounts: | - name: awx-proxy-config mountPath: "/var/lib/awx/.ssh" ``` ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [January 3, 2025, 8:31pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/14 "2025-01-03T20:31:07Z")
The extra volumes needs to be spliced into the main AWX CRD so the operator knows what to do. ---
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [January 3, 2025, 8:31pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/15 "2025-01-03T20:31:53Z")
I did not understand that ? ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [January 3, 2025, 8:41pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/16 "2025-01-03T20:41:36Z")
The snippet of code for the extra volumes needs to be added to the `kind: awx` custom resource definition that the awx-operator uses to deploy AWX in the first place. You need to merge the `spec:` sections yourself. ---
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [January 3, 2025, 8:47pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/17 "2025-01-03T20:47:33Z")
> [@Denney-tech](#): > > The extra volumes needs to be spliced into the main AWX CRD so the operator knows what to do. I think i got it, i insertedunder specs section here kubectl edit awx awx -n awx ---
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [January 3, 2025, 9:01pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/18 "2025-01-03T21:01:47Z")
[root@ansible-awx awx-on-k3s]# kubectl get pods -n awx NAME READY STATUS RESTARTS AGE awx-migration-24.6.1-7p5pz 0/1 Completed 0 5d awx-operator-controller-manager-687b856498-tggkz 2/2 Running 6 (2d9h ago) 5d1h awx-postgres-15-0 1/1 Running 3 (2d9h ago) 5d awx-task-7566c66bf4-7k8xl 4/4 Running 0 13m awx-web-969877586-2ckv4 3/3 Running 0 13m ```auto [root@ansible-awx awx-on-k3s]# kubectl exec -it -n awx awx-task-7566c66bf4-7k8xl -- ls -l /var/lib/awx/.ssh total 0 lrwxrwxrwx. 1 root 1000 13 Jan 3 20:47 config -> ..data/config lrwxrwxrwx. 1 root 1000 19 Jan 3 20:47 id_rsa_proxy -> ..data/id_rsa_proxy kubectl exec -it -n awx awx-task-7566c66bf4-7k8xl -- ssh -T git@github.com The authenticity of host 'squid-lxc-1.home (192.168.0.66)' can't be established. ED25519 key fingerprint is SHA256:Zsyp0i4GfMKBTx99O8F90+KO3DO/Qd/LZJtu1pFQbDI. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Failed to add the host to the list of known hosts (/var/lib/awx/.ssh/known_hosts). The authenticity of host 'github.com ()' can't be established. ED25519 key fingerprint is SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? Host key verification failed. command terminated with exit code 255 ``` ---
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [January 3, 2025, 9:09pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/19 "2025-01-03T21:09:28Z")
```auto [root@ansible-awx awx-on-k3s]# kubectl exec -it -n awx awx-task-7566c66bf4-7k8xl -- cat /var/lib/awx/.ssh/id_rsa_proxy -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn NhAAAAAwEAAQAAAYEAqQr878CTPY5IIl4+5pyYzD/UiOLyoSnJkiNSKPKKuC8VABQLQ2OX v9iUMHBHau+QyuD/ppOJ4uId1zVZxnkrefJFE8SChyHa2eclra3OFtgmG4/3XLeDqZTGod kubectl exec -it -n awx awx-task-7566c66bf4-7k8xl -- ssh -i /var/lib/awx/.ssh/id_rsa_proxy -T git@github.com The authenticity of host 'squid-lxc-1.home (192.168.0.66)' can't be established. ED25519 key fingerprint is SHA256:Zsyp0i4GfMKBTx99O8F90+KO3DO/Qd/LZJtu1pFQbDI. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Failed to add the host to the list of known hosts (/var/lib/awx/.ssh/known_hosts). The authenticity of host 'github.com ()' can't be established. ED25519 key fingerprint is SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Failed to add the host to the list of known hosts (/var/lib/awx/.ssh/known_hosts). Hi pemca! You've successfully authenticated, but GitHub does not provide shell access. command terminated with exit code 1 ``` ---
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [January 3, 2025, 9:12pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/20 "2025-01-03T21:12:37Z")
It is nearly working except for write permission here Failed to add the host to the list of known hosts (/var/lib/awx/.ssh/known\_hosts) Hi pemca! You’ve successfully authenticated ---
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [January 3, 2025, 9:36pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/21 "2025-01-03T21:36:21Z")
> [@pemca](#): > > ```auto > The authenticity of host 'squid-lxc-1.home (192.168.0.66)' can't be established. > ED25519 key fingerprint is SHA256:Zsyp0i4GfMKBTx99O8F90+KO3DO/Qd/LZJtu1pFQbDI. > This key is not known by any other names > Are you sure you want to continue connecting (yes/no/[fingerprint])? yes > Failed to add the host to the list of known hosts (/var/lib/awx/.ssh/known_hosts). > The authenticity of host 'github.com ()' can't be established. > ED25519 key fingerprint is SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU. > This key is not known by any other names > Are you sure you want to continue connecting (yes/no/[fingerprint])? yes > Failed to add the host to the list of known hosts (/var/lib/awx/.ssh/known_hosts). > Hi pemca! You've successfully authenticated, but GitHub does not provide shell access. > command terminated with exit code 1 > > ``` ```auto I changed here --- apiVersion: v1 kind: ConfigMap metadata: name: awx-proxy-ssh-config namespace: awx data: config: | Host git_proxy HostName squid-lxc-1.home User gituser IdentityFile ~/.ssh/id_rsa_proxy StrictHostKeyChecking no UserKnownHostsFile /dev/null Host github.com ProxyJump git_proxy StrictHostKeyChecking no UserKnownHostsFile /dev/null Host *.github.com ProxyJump git_proxy StrictHostKeyChecking no UserKnownHostsFile /dev/null ``` ```auto kubectl exec -it -n awx awx-task-75b47c6679-l5bgd -- ssh -i /var/lib/awx/.ssh/id_rsa_proxy -T git@github.com Warning: Permanently added 'squid-lxc-1.home' (ED25519) to the list of known hosts. Warning: Permanently added 'github.com' (ED25519) to the list of known hosts. Hi pemca! You've successfully authenticated, but GitHub does not provide shell access. command terminated with exit code 1 ``` ---
**Author:** ![pemca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pemca/32/7104_2.png) [@pemca](https://forum.ansible.com/u/pemca)\ **Post date:** [January 3, 2025, 9:39pm UTC](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403/22 "2025-01-03T21:39:57Z")
It works from the awx ssh root cli (awx-task), but not from the awx web. maybe it should have been done for awx-web container ?? ```auto NAME READY STATUS RESTARTS AGE awx-migration-24.6.1-7p5pz 0/1 Completed 0 5d1h awx-operator-controller-manager-755577f7c-pf8ln 2/2 Running 0 16m awx-postgres-15-0 1/1 Running 3 (2d10h ago) 5d1h awx-task-75b47c6679-l5bgd 4/4 Running 0 16m awx-web-77c4d969dc-ccg7p 3/3 Running 0 16m ``` [Next page](https://forum.ansible.com/t/how-can-i-get-ssh-from-awx-to-github-private-repo-working-trough-proxy/39403.md?page=2)