How to Remote to a VM over an IAP tunnel with PyCharm - google-cloud-platform

Question

I have a google VM instance that has no external IP address assigned. I intend to establish SSH connection through PyCharm installed on my local machine (running macOS).
This can be done in terminal through gcloud IAP tunnel:
gcloud compute ssh <instance_name> --tunnel-through-iap
The entry added to ~./ssh/config for the instance is as following:
Host compute.<instance_id>
HostName compute.<instance_id>
IdentityFile /Users/<user_name>/.ssh/google_compute_engine
CheckHostIP no
HostKeyAlias compute.<instance_id>
IdentitiesOnly yes
StrictHostKeyChecking yes
UserKnownHostsFile /Users/<user_name>/.ssh/google_compute_known_hosts
ProxyCommand /Users/<user_name>/miniconda3/bin/python3 -S /Users/<user_name>/google-cloud-sdk/lib/gcloud.py beta compute start-iap-tunnel <instance_name> %p --listen-on-stdin --project=<project_name> --zone=us-central1-a --verbosity=warning
ProxyUseFdpass no
User <user_name>
With VS Code's Remote-SSH plugin, this setting can be used directly to establish SSH connection with no problem (example).
However, I have difficulty setting up the connection via PyCharm. The SSH Configurations tab takes:
- Host: compute.<instance_id>
- User name: compute.<instance_id>
- Port: 22
- Authentication type: key pair
- Private key file: path to ~/.ssh/google_compute_engine
and throws an exception for Host not being in the correct format.
If I try the internal IP address of the VM instance as host, the connection times out.
Is there a plugin similar to Remote-SSH in VS Code for PyCharm that can work properly with an IAP-tunnel? Or any other way this can be set up without exposing or assigning an External IP to the VM instance?

Answer 1

I know it's been a while, but I was just working on the same thing. I used the same config entry in ~./ssh/config, but PyCharm is doing some checks to make sure that top level Host value is valid (even though it isn't being used). I replaced that with something that would pass their validation checks, but I know I'd never actually use (to avoid potential conflicts).
For example, you can update to this:
Host mahmoud.local
HostName compute.<instance_id>
IdentityFile /Users/<user_name>/.ssh/google_compute_engine
CheckHostIP no
HostKeyAlias compute.<instance_id>
IdentitiesOnly yes
StrictHostKeyChecking yes
UserKnownHostsFile /Users/<user_name>/.ssh/google_compute_known_hosts
ProxyCommand /Users/<user_name>/miniconda3/bin/python3 -S /Users/<user_name>/google-cloud-sdk/lib/gcloud.py beta compute start-iap-tunnel <instance_name> %p --listen-on-stdin --project=<project_name> --zone=us-central1-a --verbosity=warning
ProxyUseFdpass no
User <user_name>
Then when you configure the SSH connection in PyCharm, you will want to use Host = mahmoud.local

Answer 2

Yes, also got it to work with the ~/.ssh/config host. At first I got a fingerprint error, but I turned off StrictHostkeyChecking and that solved it:
Host lukas-notebook-gpu
HostName compute.1234
IdentityFile /Users/lbatteau/.ssh/google_compute_engine
CheckHostIP no
HostKeyAlias compute.1234
IdentitiesOnly yes
StrictHostKeyChecking no
HashKnownHosts no
UserKnownHostsFile /Users/lbatteau/.ssh/google_compute_known_hosts
ProxyCommand /Users/lbatteau/.config/gcloud/virtenv/bin/python3 /Users/lbatteau/google-cloud-sdk/lib/gcloud.py compute start-iap-tunnel lukas-notebook-gpu %p --listen-on-stdin --project=myproject --zone=europe-west4-a --verbosity=warning
ProxyUseFdpass no