diff --git a/.github/workflows/terraform-k8apps-apply.yaml b/.github/workflows/terraform-k8apps-apply.yaml
index 0374509..192b434 100644
--- a/.github/workflows/terraform-k8apps-apply.yaml
+++ b/.github/workflows/terraform-k8apps-apply.yaml
@@ -89,6 +89,14 @@ jobs:
       - name: Terraform Apply
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
         run: |
-          cd terraform/k8sapps
-          sectool exec terraform apply --auto-approve
+          for HOST in $TRUSTED_HOSTS; do
+            ssh -f -N -L 16443:localhost:16443 $ANSIBLE_USER@$HOST
+            # override hosts address in kube config
+            sed -i "s/server: https:\/\/$HOST:16443/server: https:\/\/localhost:16443/g" ~/.kube/config
+            cd terraform/k8sapps
+            sectool exec terraform apply --auto-approve
+            pkill -f "ssh -f -N -L 16443:localhost:16443 $ANSIBLE_USER@$HOST"
+          done