1

Ansible provides a ansible.builtin.authorized_key module which provides a lot of functionality:

  • You can set exclusive: true to delete all other keys.
  • You can set key_options: ....
  • You can list multiple keys in key by separating them with new lines.

Is there a way to combine all of the above?

The naive approach results in the key_options to be applied to all keys rather than having key options per key.

Is this a case of generating authorized_keys using ansible.builtin.file given the exclusiveness?

Helmut Grohne
  • 165
  • 1
  • 7

2 Answers2

1

One approach would be to use multiple authorized keys files, authorized_keys2 is deprecated but there's no reason you can't use it and you can specify multiple authorized keys files in sshd config

AuthorizedKeysFile

 Specifies the file that contains the public keys used for
 user authentication.  The format is described in the
 AUTHORIZED_KEYS FILE FORMAT section of sshd(8).  Arguments
 to AuthorizedKeysFile accept the tokens described in the
 TOKENS section.  After expansion, AuthorizedKeysFile is
 taken to be an absolute path or one relative to the user's
 home directory.  Multiple files may be listed, separated by
 whitespace.  Alternately this option may be set to none to
 skip checking for user keys in files.  The default is
 ".ssh/authorized_keys .ssh/authorized_keys2".

this might not be the optimal solution to your problem, but I think you're going to have to hack on ansible yourself to get it to do what you want.

Peter Turner
  • 1,482
  • 4
  • 18
  • 39
1

The #ansible IRC channel noted that key options can be included in the multiline key field. When doing so, key_options can be left unset and things work.

Having to construct this multiline key field including options is pretty close to generating content for ansible.builtin.file. A minor benefit of doing this is that ansible.builtin.authorized_key actually parses the content and errors out when it does not parse before deploying it.

Helmut Grohne
  • 165
  • 1
  • 7