Creating Users with SSH Access to Harvester Nodes

The default rancher user account can access nodes via SSH, but you may need to create additional administrative users with SSH access. Because the Harvester operating system is immutable, user accounts created using the standard useradd command will be lost when the node restarts.

To create persistent users with SSH access, perform the following steps:

Create a cloud-init.yaml file for public key authentication.
```
apiVersion: node.harvesterhci.io/v1beta1
kind: CloudInit
metadata:
  name: add-test-user
spec:
  matchSelector: {} # Applies to all nodes
  filename: 99_add_test_user.yaml
  contents: |
    #cloud-config
    users:
      - name: test-user
        gecos: "admin_user"
        groups: [users, admin]
        sudo: ALL=(ALL) NOPASSWD:ALL
        shell: /bin/bash
        ssh_authorized_keys:
        - ssh-rsa AAAA.... # Full authorized public key
```
- name: Specify a unique username for the new account.
- matchSelector: Leave the block empty {} to apply this configuration to all nodes, or modify it to target specific nodes.
- #cloud-config: Write this header exactly as shown at the very beginning of the contents block.
- groups: Add the user to the admin group to ensure administrative privileges are retained.
- ssh_authorized_keys: Specify the complete, single-line public key string (typically copied from your local machine’s ~/.ssh/id_ed25519.pub or ~/.ssh/id_rsa.pub file).

Create a password hash.

openssl passwd -6 'test'
$6$zF26pcXOS2eaivX8$6ySoTzQC2cToz29mGFC0DuG5cVWTv3Mktc3k/g1KXTtrG2BhsFh8xs3N0zBmNx0D/H4f1W48a45vI1RK8Rzs.0

Replace test with your actual password.

Create a cloud-init.yaml file for password authentication.

apiVersion: node.harvesterhci.io/v1beta1
kind: CloudInit
metadata:
  name: add-test-user
spec:
  matchSelector: {} # applies to all nodes
  filename: 99_add_test_user.yaml
  contents: |
    #cloud-config
    users:
      - name: test-user
        gecos: "admin_user"
        groups: [users, admin]
        sudo: ALL=(ALL) NOPASSWD:ALL
        shell: /bin/bash
        lock_passwd: false
        passwd: $6$zF26pcXOS2eaivX8$6ySoTzQC2cToz29mGFC0DuG5cVWTv3Mktc3k/g1KXTtrG2BhsFh8xs3N0zBmNx0D/H4f1W48a45vI1RK8Rzs.0

name: Specify a unique username for the new account.
matchSelector: Leave the block empty {} to apply this configuration to all nodes, or modify it to target specific nodes.
#cloud-config: Write this header exactly as shown at the very beginning of the contents block.
groups: Add the user to the admin group to ensure administrative privileges are retained.
passwd: Specify the password hash you created.

Apply the YAML file.

kubectl apply -f cloud-init.yaml

The following trailing file will be created:

cat /oem/99_add_test_user.yaml
#cloud-config
users:
  - name: test-user
    gecos: "admin_user"
    groups: users, admin
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    ...

On the Harvester UI, go to Hosts.
Locate the target node, and then select ⋮ → Enable Maintenance Mode.

Repeat this step for each node covered by the value of the matchSelector field in the cloud-init.yaml files.
Wait until the state changes to Maintenance, and then reboot the nodes.
On the Hosts screen, select ⋮ → Disable Maintenance Mode for each affected node.