pool json file should take ssh pub-key not priv-key

[azure]

pool json file should take ssh pub-key not priv-key

[annatisch]

Thanks @kim0,
There's actually two different scenarios here. When creating a user account with which to remotely access the compute node, you're quite right and the server should be supplied with the public key. This is documented in the user create command:
docs.microsoft.com/cli/azure/batch/node/user#create

The Linux user config on the pool that requires the private key is for a different scenario where the Batch service impersonates / runs a work load as a specified user. This concept is discussed further in this article:
docs.microsoft.com/azure/batch/batch-user-accounts

Additionally, the specific scenario that requires the private ssh key is documented in the Batch API:
docs.microsoft.com/rest/api/batchservice/add-a-pool-to-an-account#linuxUserConfiguration

The SSH private key is used to automatically configure password-less SSH between nodes in a Linux pool when the pool's enableInterNodeCommunication property is true. If not specified, password-less SSH is not configured between nodes.

Hopefully this helps clarify :)

[kim0]

Thank you! It certainly helps. However can you please show me where to inject the public ssh key into the json file (that's used in --json-file)? The json schema did not mention any public ssh key :)

Thanks a lot

[annatisch]

The public ssh key is not actually part of pool create process. The userAccounts property on the pool is only for this "user impersonation" feature - so the public key can't be inserted into this particular json file. You can however supply it in a json file to the user create command. Where your json will look like this:

{
    "name":"myuseraccount1",
    "isAdmin":true,  
    "password":"mypassword",  
    "expiryTime": "2017-08-01T23:00:00.000Z",
    "sshPublicKey": "mysshkey"
} 

This can then be added with an additional command:

az batch pool create --json-file my_pool.json
az batch node user create --pool-id <pool_id> --node-id <node_id> --json-file my_user_settings.json

[kim0]

Alright, since this bug report does not seem related to what I'm trying to do, I'm not very passionate about it :) I'll continue my discussion in #30

However, thinking about it. It's a bit confusing to have user accounts in two different places. I mean, we could always be creating the user account using the same json file. And if the user should be remotely accessible, I'd supply public ssh key. If the user account would only be used to internally ssh'ing between nodes. I'd supply the private key. I can even supply both keys and the user-account ends up being used in both ways. That way seems more logical to me!

Feel free to close this ticket at any time folks. Thanks

[annatisch]

Thanks @kim0 - I agree it's confusing to differentiate between the two scenarios that are both documented as a "user account" - even though they achieve very different things.... I'll give this feedback to the team.