🛡️ Bastion jump host

Hardened SSH jump box for private subnet access — keys only, audit, no direct prod. · ~30 min

Reviewed: ·Tested on: Kubernetes 1.29, Terraform 1.8, Ubuntu 22.04

If you're on Kubernetes 1.27 or older

  • Ingress: networking.k8s.io/v1 is required — v1beta1 removed in 1.22+
  • Pod Security: PodSecurityPolicy removed in 1.25 — use Pod Security Admission (PSA) labels
  • HPA v2 autoscaling/v2 is stable — check API version in manifests

If you're on Kubernetes 1.28

  • Sidecar containers (1.29+) change init-container ordering — review sidecar docs before upgrade
  • Verify metrics-server and HPA after control plane bump

If you're on Terraform 1.7 or older

  • S3 native locking (use_lockfile) differs from DynamoDB — don't mix backends mid-migration
  • Provider version constraints: run terraform init -upgrade after bump
  • terraform test (1.6+) replaces some external test harness patterns

1. Launch bastion in public subnet

Small instance, security group: SSH (22) from your office/VPN IP only. No application ports.

Guide →

2. Harden SSH

# /etc/ssh/sshd_config
PasswordAuthentication no
PermitRootLogin no
AllowUsers bastion
sudo systemctl reload sshd
Guide →

3. Jump to private instance

ssh -J bastion@bastion.example.com app@10.0.2.50
# or ~/.ssh/config:
# Host private-app
#   ProxyJump bastion@bastion.example.com
#   User app
#   HostName 10.0.2.50
Guide →

4. Optional WireGuard instead of public SSH

VPN-first access — bastion only reachable over WireGuard tunnel.

Guide →