Drop merging of authorized_keys.d into authorized_keys

[bgilbert]

Feature Request

Environment

All

Desired Feature

Ignition's model for writing SSH keys to disk assumes that update-ssh-keys is distributed as part of the OS. That is, it assumes that SSH keys should be written into ~/.ssh/authorized_keys.d/<file>, and then all files in authorized_keys.d should be merged into authorized_keys. Because Ignition carries utility code to handle the merging, doesn't invoke update-ssh-keys directly, and only runs on the first boot, the consequences of this assumption are limited: there's an extra ~/.ssh/authorized_keys.d/coreos-ignition file that mirrors what's written into .ssh/authorized_keys.

However, update-ssh-keys is a hack for supporting authorized_keys.d directories without any cooperation from sshd. It changes the workflow of updating SSH keys and isn't used on other distros; Fedora CoreOS and Red Hat CoreOS currently do not intend to ship it. Instead, in the short term, Fedora CoreOS will have special-case support for authorized_keys.d files written by individual tools, and in the medium term it will add generic support for the key directory (coreos/fedora-coreos-tracker#139 (comment)).

Change the Ignition master branch as follows:

• Fix Consider renaming authorized_keys.d fragment for spec 3.0 #710.
• Drop support for merging the authorized_keys.d fragment into authorized_keys. Instead, only write the fragment file.
• Document that distros using Ignition should support reading keys directly from the fragment file.
• Optionally, allow changing the keyfile path to .ssh/authorized_keys via the distro package for distros that don't want to support authorized_keys.d.

[ajeddeloh]

This isn't actually a spec change, but would be a breaking behavior change. What do you feel the priority on this is @bgilbert

[bgilbert]

I'd rather take the breaking change in 3.0. FCOS preview will probably want it. The actual code changes should be small.

[rfairley]

Had a read over this - since we will be going with Option #4 (for the medium term) in coreos/fedora-coreos-tracker#139, it seems good to start on this. Am interested to look into the Ignition changes listed here.