Puppet Class: ssh::authorized_keys

Defined in:
manifests/authorized_keys.pp

Summary

Add `ssh_authorized_keys` via hiera in a loop

Overview

This class was designed so you can just paste the output of the ssh pubkey into hiera and it will work. See the example below for details.

> WARNING > > This creates a user for every key and every user in the Hash. If this is > large, please consider moving to a central source for these keys, such as > LDAP, so that you do not over-burden your Puppet server. > > WARNING

Examples:

Adding user keys via Hiera

---
ssh::authorized_keys::keys:
  kelly: ssh-rsa skjfhslkdjfs...
  nick:
  - ssh-rsa sajhgfsaihd...
  - ssh-rsa jrklsahsgfs...
  mike:
    key: dlfkjsahh...
    type: ssh-rsa
    user: mlast
    target: /home/gitlab-runner/.ssh/authorized_keys

Parameters:

  • keys (Hash) (defaults to: {}) —

    The hash to generate key resouces from

See Also:

Author:



33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
 
# File 'manifests/authorized_keys.pp', line 33

class ssh::authorized_keys (
  Hash $keys = {},
) {

  $expanded_keys = $keys.reduce({}) |Hash $result, Tuple $data| {
    $key_name = $data[0]
    $params   = $data[1]

    case $params {
      String: {
        $opts = ssh::parse_ssh_pubkey($params)
        $name = pick($opts['name'],$key_name)
        $title = "${name} - ${opts['key'][0,5]}..."
        $update = {
          $title => $opts + { 'user' => $key_name }
        }
      }
      Array: {
        $update = $params.reduce({}) |$memo, $key| {
          $opts = ssh::parse_ssh_pubkey($key)
          $name = pick($opts['name'],$key_name)
          $title = "${name} - ${opts['key'][0,5]}..."
          $memo + {
            $title => $opts + { 'user' => $key_name }
          }
        }
      }
      Hash: {
        $update = { $key_name => $params }
      }
      default: {
        $update = {}
      }
    }

    ($result + $update)
  }

  $expanded_keys.each |$key_name, $data| {
    ssh_authorized_key {
      $key_name: * => $data
    }
  }
}