openssh/client/root.yml

applications:
- openssh
parameters:
  openssh:
    client:
      enabled: true
      user:
        root:
          # never-ever enable root globally. it must be enabled per-case|node
          enabled: false
          user: ${linux:system:user:root}
          private_key:
            key: ${_param:root_private_key}
            type: rsa