Skip to content

Arch (Architecture)

Represents an architecture. Here are all values supported where also a distribution of Bifröst is available for. See distributions for available values.

Data types

A collection of simple data-types used within Bifröst. More complex ones are defined on their dedicated pages.

Authorized Keys

These are usually files in the home directory of each user, located at ~/.ssh/authorized_keys. These files are in the format: 

1
2
[<options> ]<key-type> <encoded-public-key>[ <comment>]
...

They contain SSH Public Keys.

Bifröst supports the following OpenSSH authorized_keys options:

Option Effect
command="..." Replaces shell, command, and subsystem requests with the configured command. The original command is available as SSH_ORIGINAL_COMMAND.
environment="NAME=value" Adds or replaces an environment variable for the session. May be specified more than once for different names.
expiry-time="..." Rejects the key after the configured OpenSSH-compatible timestamp.
from="..." Restricts the key to numeric IP addresses, CIDR networks, numeric wildcards, and negated numeric patterns. Hostname patterns are not supported.
restrict Disables PTY, port forwarding, and agent forwarding unless individually enabled again.
pty, no-pty Enables or disables PTY allocation.
port-forwarding, no-port-forwarding Enables or disables local, dynamic, and reverse port forwarding.
permitopen="host:port" Restricts local and dynamic port-forwarding destinations. May be specified more than once.
permitlisten="[host:]port" Restricts reverse port-forwarding listeners. May be specified more than once.
agent-forwarding, no-agent-forwarding Enables or disables access to a forwarded SSH agent.
cert-authority Treats the entry as a user certificate authority instead of a directly authorized key. Supported by the simple and local authorizations.
principals="name,..." Further restricts a cert-authority entry to certificates containing at least one listed principal. The requested SSH username must still be a certificate principal.

Options not listed above are not supported. A key entry using an unsupported option, such as tunnel, user-rc, x11-forwarding, no-touch-required, or verify-required, is rejected instead of being treated as unrestricted. principals without cert-authority is also rejected.

Warning

Environment variables can change how commands and shells behave. Only configure environment= values that you trust, especially variables such as PATH, shell startup variables, or dynamic-loader settings.

Examples

1
2
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC80lm5FQbbyRUut6RwZJRbxTLO3W4f08ITDi9fA3+jx me@foo.tld
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDIGYzqJpPf3shQVGo98xMdl5S4LJmWme3i+sPcYseRrKziAWWGc8xzLUGnRwVe5X5v7J+IaHZ0dpnelylbnDwEvQTX+8gZybcL8RpS6u5dKqmKTv12SqcucpGStQ3O0Ec3MnRKEeMoJXIdqIVxuXxC8863H42KzkBvDjZn4qasF8IOVpGSC4+i93bNKScN6epQYzKcPCmZSSAnZJPgih0y1Z6+yNOJd+6PAFXmhBOh7yU0Ypne9szj/6o3YrPuNUj762CZyjg7ivQI/DvxwnUA2X8dnb2pyD4CGrr6YduWMl2xqUEDerNVaPc+I63QR8gIUYYmAs5uQwrDI4U0aWpC7erLMsNRa8C+YUdX+rV2+lJWSH8/k2NGrT1FoG5PWHmZTIe4juKIlAArzDAE6shauM3j4b4YLhly6mySXxT9m+EPtcrZjdEg76/0FylFUH70dx0Wf7lt50cLQIoXCJVovp/w95J6FVMYACl1y/sbDzmirg2PQkqkrr3MZnNY88jI/OuyZYAHNIjMkbriaFIkFBK4epGhsIIpsArPS8ZGZTQNBrrYWF+pf8JvJ1NaoLP+JKUP/A7l1KsqCKK3sWIRY7u8n8McK0VQMig4duHHtZ+aUGhZd/+m19UG1gg7QPUffZQM0RIPWWcsklrmlvzBqVcxgHXkZOoFqzc9WyewWQ== me-legacy@foo.tld

Docker Pull Credentials

To pull from an OCI/Docker image registry there can be credentials required. In these cases usually they have to be provided in this format.

Bifröst accept them in the following formats:

  1. Base64 URL encoded JSON of format {"username":"<username>","password":"<password>"} or {"auth":"<base64 encoded auth token>"}
  2. JSON of format {"username":"<username>","password":"<password>"} or {"auth":"<base64 encoded auth token>"} ... which will be:
    1. base64 URL encoded by Bifröst. -> result will be as 1.
  3. A bare auth token ... which will be:
    1. base64 URL encoded,
    2. put into {"auth":"<encoded bare auth token>"} JSON and
    3. finally base64 URL encoded by Bifröst. -> result will be as 1.

DSA Restriction

Can be one of:

  • none
  • all
  • at-least-1024-bits
  • at-least-2048-bits
  • at-least-3072-bits

Duration

A duration of time of Go flavor. Examples: 300ms, 6s, 5m, 12h or combined 12h5m6s300ms.

ED25519 Restriction

Can be one of:

  • none
  • all
  • at-least-256-bits

ECDSA Restriction

Can be one of:

  • none
  • all
  • at-least-256-bits
  • at-least-384-bits
  • at-least-521-bits

Environment Variable Name

The name of an environment variable. It has to fulfill the portable ASCII pattern [A-Za-z_][A-Za-z0-9_]*.

Environment Variables

A map from Environment Variable Name keys to string values. Values can use the template context documented by the property accepting this data type and cannot contain NUL characters.

Flow Name

Identifies flows. It has to fulfill the regular expression [a-z][a-z0-9]+.

File Mode

The permissions to access a file in octal notation. See Oracles documentation for more details.

File Path

A location of a file on the local file system. Like /foo/bar

GID

The identifier of a local group: a uint32 on Linux, or a textual local SAM group SID on Windows (not an Active Directory object GUID).

Host

Represents a host(-name), which can be either an IPv4, IPv6 or DNS name.

Kubeconfig

Configuration file in YAML format that defines how to access a Kubernetes cluster. See official Kubernetes documentation for more details.

Log Color Mode

Can be one of:

  • auto
  • always
  • never

Log Format

Can be one of:

  • text
  • json

Log Level

Can be one of:

  • TRACE
  • DEBUG
  • INFO
  • WARN
  • ERROR
  • FATAL

Net Address

Socket address in format [<Host>]:<port>.

Os (Operating System)

Represents an operating system. Here are all values supported where also a distribution of Bifröst is available for. See distributions for available values.

Password

Represents an encoded or plain password that can be evaluated if it does match a requested one.

Password Type

Can be one of:

  • plain
  • bcrypt

Public Keys

A string containing one or more OpenSSH public-key lines. Empty lines and lines beginning with # are ignored. Unlike Authorized Keys, these lines cannot contain options. Certificate-authority configuration also rejects certificate lines because each trust anchor must be a plain public key.

1
2
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... organization-user-ca
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQ... legacy-user-ca

Pull Policy

Can be one of:

  • ifAbsend: The resource (e.g. an image) is pulled only if it is not already present locally.
  • always: Everytime a context is crated (for example a new environment) the latest version of the resource will be pulled from the remote registry (for example an image). It does not matter if the resource does already exist or not. No matter if the resource (like images) is based on digest or of the digest is the same, the digest is the same, the corresponding sub-resources will not be pulled.
  • never: The resource (like an image) has to be present. Otherwise, the process will fail.

Regex

Regular expression of Go flavor. You can play around with it at regex.com.

RSA Restriction

Can be one of:

  • none
  • all
  • at-least-1024-bits
  • at-least-2048-bits
  • at-least-3072-bits
  • at-least-4096-bits

SSH Ciphers

Can be one of:

  • aes128-cbc
  • 3des-cbc
  • arcfour
  • arcfour128
  • arcfour256
  • chacha20-poly1305@openssh.com
  • aes128-ctr
  • aes192-ctr
  • aes256-ctr
  • aes128-gcm@openssh.com
  • aes256-gcm@openssh.com

SSH Key Exchange

Can be one of:

  • diffie-hellman-group1-sha1
  • diffie-hellman-group14-sha1
  • diffie-hellman-group14-sha256
  • diffie-hellman-group16-sha512
  • ecdh-sha2-nistp256
  • ecdh-sha2-nistp384
  • ecdh-sha2-nistp521
  • curve25519-sha256@libssh.org
  • curve25519-sha256
  • diffie-hellman-group-exchange-sha1
  • diffie-hellman-group-exchange-sha256
  • mlkem768x25519-sha256

SSH Message Authentication

Can be one of:

  • hmac-sha1
  • hmac-sha1-96
  • hmac-sha2-256
  • hmac-sha2-512
  • hmac-sha2-256-etm@openssh.com
  • hmac-sha2-512-etm@openssh.com

SSH Public Key

The public variant of an SSH keypair of a user.

Please refer to the good documentation at GitHub how to create SSH (public) keys.

UID

The identifier of a local user: a uint32 on Linux, or a textual local SAM user [SID](https://en.wikipedia.org/wiki/Security_Identifier on Windows (not an Active Directory object GUID).

URL

Represents a classical URL to reference resources (for example) in the internet, like https://bifroest.engity.org.