Hello everyone, My company is using open-source Airbyte on installed on Kubernetes. Is it possible to connect to MySQL database of another company that restrict access to VPN only? How this connection should be set up?

You can by using a jump host. That host would need to have access to the VPN or the other company could set up a jump host on their network.

@Marcelo Pio de Castro - I haven't been able to find anything in the docs yet, but is there support (or a config hack) to allow for a password-protected RSA SSH key to be used? We have a bastion ("jump") host, but all the SSH keys authorized there are required to be password protected as well.

On the link that I post there is this information: If you are using Password Authentication, then SSH Login Username should be set to the password of the User from the previous step. If you are using SSH Key Authentication leave this blank. Again, this is not the MySQl password, but the password for the OS-user that Airbyte is using to perform commands on the bastion. If you are using SSH Key Authentication, then SSH Private Key should be set to the RSA Private Key that you are using to create the SSH connection. This should be the full contents of the key file starting with -----BEGIN RSA PRIVATE KEY----- and ending with -----END RSA PRIVATE KEY-----.

No. I'm not using Password authentication. I'm using SSH Key authentication. But the SSH Key ITSELF is password-protected - most SSH software will bubble up the password prompt. For example, when I use JB DataGrip to connect, it pops a prompt. Same for VS Code when I use the SSH tunnel to connect.

Oh, I see, you still can use it. The password is client only. It exists because when using a user is using an ssh client, it is protected, but for Airbyte it does not make much sense to have a password to protect it. You still can

cat

you private key and get its content

I don't think you understand. I've added the private key to airbyte, that's not a problem. This is not a local/client-only protect the key from reading password. Also, my apologies, sometimes vocabulary can obscure, I think the term that's mostly used are "SSH key passphrases" like here and here. A passphrase is used to prevent someone from using the private key if they can get it. The SSH key is "something you have" and the passphrase is "something you know" and you've got to have both to use it to connect. Its baked into SSH when the key has a passphrase, a connection cannot be made with that key without providing the passphrase.

Well, you could just remove the password. Of course, the best practice is for airbyte to have its own private key, but if you want to remove the password from yours for testing you can:

ssh-keygen -f ~/.ssh/id_rsa -p

, just press enter twice on the new password for it to have no password. Again, the password doesn't make a lot of sense for Airbyte and does not add security, since the password and private key would be stored in the same place

maybe? I'll need to verify but I don't think the Bastion sshd will allow a key without a password, but that could just be organization security policy and not actually constrained.

I don't think there is a way for sshd validate that the private key has a passphrase, but I may be wrong