<p>Is it possible to use Kubespray with Bastion but on custom port and with agent forwarding? If it is not supported, what changes does one need to do?</p>

<p>Always, since you can configure that at three separate levels: via the host user's <code>~/.ssh/config</code>, via the entire playbook with <code>group_vars</code>, or as inline config (that is, on the command line or in the inventory file).</p>

<p>The ssh config is hopefully straightforward:</p>

<pre><code>Host 1.2.* *.example.com # or whatever pattern matches the target instances
  ProxyJump someuser@some-bastion:1234
  # and then the Agent should happen automatically, unless you mean
  # ForwardAgent yes
</code></pre>

<p>I'll speak to the inline config next, since it's a little simpler:</p>

<pre><code>ansible-playbook -i whatever \
    -e '{"ansible_ssh_common_args": "-o ProxyJump=\"someuser@jump-host:1234\""}' \
    cluster.yaml
</code></pre>

<p>or via the inventory in the same way:</p>

<pre><code>master-host-0 ansible_host=1.2.3.4 ansible_ssh_common_args="-o ProxyJump='someuser@jump-host:1234'"
</code></pre>

<p>or via <code>group_vars</code>, which you can either add to an existing <code>group_vars/all.yml</code>, or if it doesn't exist then create that <code>group_vars</code> directory containing the <code>all.yml</code> file as a child of the directory containing your inventory file</p>

<p>If you have more complex ssh config than you wish to encode in the inventory/command-line/group_vars, you can also instruct the ansible-invoked ssh to use a dedicated config file via the <a href="https://docs.ansible.com/ansible/2.6/user_guide/intro_inventory.html?highlight=ansible_ssh_extra_args#list-of-behavioral-inventory-parameters" rel="nofollow noreferrer"><code>ansible_ssh_extra_args</code></a> variable:</p>

<pre><code>ansible-playbook -e '{"ansible_ssh_extra_args": "-F /path/to/special/ssh_config"}' ...
</code></pre>
