SSH key options are not respected when user is root

[Tris Emmy Wilson]

In user data, if "user" is set to "root" and "ssh_authorized_keys" are set, any SSH key options are ignored. For example, with the following:

    user: root
    ssh_authorized_keys:
      - cert-authority,principals="globalroot" ssh-ed25519 SomeEd25519Key Global User Issuing CA

...the following ends up in ~root/.ssh/authorized_keys:

    ssh-ed25519 SomeEd25519Key Global User Issuing CA

However, the SSH key options are respected when "user" is not set to root.

I think, but am not sure, that this is due to an oversight in the `apply_credentials` method in `cc_ssh.py`. In this snippet:

    if disable_root:
        if not user:
            user = "NONE"
        key_prefix = disable_root_opts.replace('$USER', user)
        key_prefix = key_prefix.replace('$DISABLE_USER', 'root')
    else:
        key_prefix = ''

"key_prefix" being set to the empty string causes "ssh_util.setup_user_keys" to pass a non-None value to AuthKeyLineParser.parse, causing it to ignore the options set on the key in favor of the empty string. I think setting "key_prefix = None" here may fix the problem but don't know enough about the cloud-init development process + what the security implications of this might be.

I'm testing in a Proxmox 6 environment using the Debian 10 OpenStack cloud-init image.

[Paride Legovini (paride)]

Hello Tris and thanks for your bug report. I agree with your findings and could reproduce the issue. The fact that key_prefix is set to the empty string is likely to be the culprit, as you found out already.

[Tris Emmy Wilson (emptystring)]

I submitted a PR fixing this: https://github.com/canonical/cloud-init/pull/871

[shixuantong (sxt1001)]

I find that the preceding solution is not merged and has been automatically closed. Can you submit it again?

[James Falcon (falcojr)]

Tracked in Github Issues as https://github.com/canonical/cloud-init/issues/3868