Rotate SSH Keys¶

Note

After applying the MachineConfig, the Machine Config Operator will roll out the change to each node, causing a rolling reboot. Ensure your cluster has sufficient capacity to handle node drains during this process.

Steps¶

Generate a new key:

ssh-keygen -t ed25519 -f ~/.ssh/ocp -C "ocp-key-rotation"

Export the existing MachineConfig:

oc get machineconfig 99-master-ssh -o yaml > 99-master-ssh.yaml

Edit to include both the old and new keys:

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 99-master-ssh
spec:
  config:
    ignition:
      version: 3.5.0
    passwd:
      users:
      - name: core
        sshAuthorizedKeys:
        - ssh-ed25519 AAAA...your_old_key_here...
        - ssh-ed25519 AAAA...your_new_key_here...

Apply:
```
oc apply -f 99-master-ssh.yaml
```
Repeat for Worker Nodes using 99-worker-ssh instead of 99-master-ssh
Once all nodes have rebooted and are Ready, verify SSH access with the new key:
```
ssh -i ~/.ssh/ocp core@{{ node_ip }}
```
After confirming the new key works, remove the old key from the MachineConfig and reapply