--- name: framework-financial-services-satellite-architecture-connectivity-bastion title: Completing workload operator actions through a bastion host description: All interactive operator actions on the resources in Satellite location must be run through a bastion host in the management plane. A bastion host is a server that can be accessed through SSH, Windows Remote Desktop Protocol (RDP), `oc` (Red Hat OpenShift CLI), or `kubectl`, but only through a private secure connection. After set up, the bastion host allows a secure connection to Red Hat OpenShift on IBM Cloud clusters, Satellite APIs, or Satellite location hosts. Administrative tasks on the individual services or hosts are completed by using SSH, `oc`, or `kubectl` proxied through the bastion. In addition, session auditing must be enabled to record all privileged user actions. last-updated: 2025-03-02 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/framework-financial-services?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Completing workload operator actions through a bastion host {: #satellite-architecture-connectivity-bastion} All interactive operator actions on the resources in Satellite location must be run through a bastion host in the management plane. A bastion host is a server that can be accessed through SSH, Windows Remote Desktop Protocol (RDP), `oc` (Red Hat OpenShift CLI), or `kubectl`, but only through a private secure connection. After set up, the bastion host allows a secure connection to Red Hat OpenShift on IBM Cloud clusters, Satellite APIs, or Satellite location hosts. Administrative tasks on the individual services or hosts are completed by using SSH, `oc`, or `kubectl` proxied through the bastion. In addition, session auditing must be enabled to record all privileged user actions. {: shortdesc} After connecting to your management plane through your designated connection method specific to your environment, a complete bastion solution should meet the following requirements. {{site.data.content.bastion-host-requirements}} ## Access to Red Hat OpenShift on IBM Cloud management APIs {: #openshit-api} Red Hat OpenShift on IBM Cloud management tasks can be completed by using `oc` CLI tool and `kubectl`. If your bastion solution provides direct support for `kubectl` or `oc` sessions, it is recommended to configure such capabilities for the Red Hat OpenShift on IBM Cloud clusters that are deployed to your Satellite locations. Otherwise, you should consider setting up hosts in your management plane that can provide shell access with `oc` or `kubectl` CLI tools to complete Red Hat OpenShift on IBM Cloud management. Operators should access those hosts through SSH connecting through a bastion. ## Access to Red Hat OpenShift on IBM Cloud management UI {: #openshit-api} Red Hat OpenShift on IBM Cloud cluster that is deployed on a Satellite location provides a management UI (web console). You should consider UI access as an exception, preferring the operator actions should CLI or CI/CD automation for effective access control, reliability, and audit. If the operators or administrators need to access this UI, the access should be facilitated by the bastion solution as well. In this scenario, a bastion solution would act as an HTTPS reverse proxy that the operator would use to access the Red Hat OpenShift on IBM Cloud management UI. ## Access to Satellite hosts through SSH {: #openshit-api} In general, the Satellite architecture discourages shell to the host OS, including SSH. Host OS updates and other maintenance (for example, backups) should be automated or completed by creating and attaching a new host instance. Login with a `root` account is explicitly blocked after a host is attached to a Satellite location. If operator access to a Satellite host is required for troubleshooting purposes, SSH connection should be completed through a bastion that uses a nonroot account. ## Set up a bastion host {: #setup} You need to install and manage your own bastion solution within your management plane. A bastion solution can be implemented in a variety of ways. For one example that uses Teleport Enterprise Edition in the VPC reference architecture, see [Setting up a bastion host for secure connectivity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-bastion-tutorial-teleport&format=markdown). ## Related controls in IBM Cloud Framework for Financial Services {: #next-steps} {{site.data.content.related-controls-disclaimer}} | Family | Control | |---------------------|---------------------------------------------------| | Audit and Accountability (AU) | [AU-14 Session Audit](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-14&format=markdown) | | Access Control (AC) | [AC-6 (9) Least Privilege | Log Use of Privileged Functions](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-6.9&format=markdown) \n [AC-17 Remote Access](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-17&format=markdown) | | Identification and Authentication (IA) | [IA-2 (1) Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-2.1&format=markdown) | {: caption="Related controls in IBM Cloud Framework for Financial Services [FSv2.0]" caption-side="top"} {: #related-controls-fsv2.0} {: tab-title="FSv2.0"} {: tab-group="RelatedControls-1"} {: class="simple-tab-table"} | Family | Control | |---------------------|---------------------------------------------------| | Audit and Accountability (AU) | [AU-14 Session Audit](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-au-14&format=markdown) | | Access Control (AC) | [AC-6 (9) Least Privilege | Auditing Use of Privileged Functions](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-ac-6.9&format=markdown) \n [AC-17 Remote Access](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-ac-17&format=markdown) | | Identification and Authentication (IA) | [IA-2 (1) Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-ia-2.1&format=markdown) | {: caption="Related controls in IBM Cloud Framework for Financial Services [FSv1.1]" caption-side="top"} {: #related-controls-fsv1.1} {: tab-title="FSv1.1"} {: tab-group="RelatedControls-1"} {: class="simple-tab-table"} ## Next steps {: #next-steps} - [Using IBM Cloud services with Satellite Link](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-connectivity-to-services&format=markdown)