Is there a way to exclusively manage multiple ssh keys with differing per-key options using ansible?

Question

Ansible provides a ansible.builtin.authorized_key module which provides a lot of functionality:

• You can set exclusive: true to delete all other keys.
• You can set key_options: ....
• You can list multiple keys in key by separating them with new lines.

Is there a way to combine all of the above?

The naive approach results in the key_options to be applied to all keys rather than having key options per key.

Is this a case of generating authorized_keys using ansible.builtin.file given the exclusiveness?

Answer 1

One approach would be to use multiple authorized keys files, authorized_keys2 is deprecated but there's no reason you can't use it and you can specify multiple authorized keys files in sshd config

AuthorizedKeysFile

     Specifies the file that contains the public keys used for
     user authentication.  The format is described in the
     AUTHORIZED_KEYS FILE FORMAT section of sshd(8).  Arguments
     to AuthorizedKeysFile accept the tokens described in the
     TOKENS section.  After expansion, AuthorizedKeysFile is
     taken to be an absolute path or one relative to the user's
     home directory.  Multiple files may be listed, separated by
     whitespace.  Alternately this option may be set to none to
     skip checking for user keys in files.  The default is
     ".ssh/authorized_keys .ssh/authorized_keys2".

this might not be the optimal solution to your problem, but I think you're going to have to hack on ansible yourself to get it to do what you want.

Answer 2

The #ansible IRC channel noted that key options can be included in the multiline key field. When doing so, key_options can be left unset and things work.

Having to construct this multiline key field including options is pretty close to generating content for ansible.builtin.file. A minor benefit of doing this is that ansible.builtin.authorized_key actually parses the content and errors out when it does not parse before deploying it.