GCP SSH connection¶
Run commands on a Google Compute Engine VM over SSH from a task, via a managed
Leoflow Connection. The host, port, and credentials are encrypted at rest and
delivered to the task as AIRFLOW_CONN_<CONN_ID>.
URI shape¶
The control plane percent-escapes the password; ComputeEngineSSHHook (which
parses AIRFLOW_CONN_<ID>) un-escapes it back.
Fields the UI asks for¶
| Field | Required | Notes |
|---|---|---|
| Conn Id | yes | e.g. gcpssh_default. Exported as AIRFLOW_CONN_GCPSSH_DEFAULT. |
| Conn Type | yes | gcpssh. |
| Host | yes | The VM's IP or DNS name, e.g. 10.0.0.5. |
| Port | optional | Defaults to 22. |
| Login | yes | The OS login user on the VM. |
| Password | yes | Stored encrypted at rest (ADR 0019). Percent-escaped in the URI. |
| Extra | optional | JSON for hook-specific options (project, zone, IAP). |
Example DAG¶
The hook is imported inside the task body so DAG parsing stays import-light.
from airflow.decorators import dag, task
from pendulum import datetime
@dag(schedule=None, start_date=datetime(2026, 1, 1), catchup=False)
def gcpssh_run():
@task
def remote():
from airflow.providers.google.cloud.hooks.compute_ssh import (
ComputeEngineSSHHook,
)
hook = ComputeEngineSSHHook(gcp_conn_id="gcpssh_default")
client = hook.get_conn()
_, stdout, _ = client.exec_command("uname -a")
return stdout.read().decode()
remote()
gcpssh_run()
Security notes¶
- Prefer keys / IAP over passwords: production Compute Engine SSH normally uses OS Login or an SSH key plus Identity-Aware Proxy; pass those in Extra. The password field is for environments that still rely on it.
- Secrets in logs: never
print()the URI — it carries the password. Log the host + login only. - gRPC channel (agent ↔ control plane): secrets are served only over an authenticated channel (ADR 0021); Pro must run with TLS.