Rotate SSH Keys¶

Machine Config Operator Documentation | KCS: Updating SSH keys

Note

SSH authorized-key updates are applied by the Machine Config Operator without draining or rebooting nodes. Monitor with oc get mcp until UPDATED=True.

Steps¶

Generate a new key:

ssh-keygen -t ed25519 -f ~/.ssh/ocp -C "ocp-key-rotation"

Export the existing MachineConfig:

oc get machineconfig 99-master-ssh -o yaml > 99-master-ssh.yaml

Edit to include both the old and new keys:

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 99-master-ssh
spec:
  config:
    ignition:
      version: 3.5.0
    passwd:
      users:
      - name: core
        sshAuthorizedKeys:
        - ssh-ed25519 AAAA...your_old_key_here...
        - ssh-ed25519 AAAA...your_new_key_here...

Apply:
```
oc apply -f 99-master-ssh.yaml
```
Repeat for Worker Nodes using 99-worker-ssh instead of 99-master-ssh
Once all nodes show UPDATED=True in oc get mcp, verify SSH access with the new key:
```
ssh -i ~/.ssh/ocp core@{{ node_ip }}
```
After confirming the new key works, remove the old key from the MachineConfig and reapply