Bootstrapping a controller across a firewall


I’m trying to create a K8s cluster with Juju on a corporate vSphere network to which I have limited access.
juju bootstrap --deubg true vs-cloud vs-controller --config datastore=vs_ds --config primary-network=vs_network

The vs_network produces IP addresses to which I do not have direct access. There isn’t a network I can access that does produce IPs I can readily access. I can access the IPs from a bastion into which I can SSH.

Is there a way to proxy juju’s SSH connection to the controller through an intermediary?