OpenShift: Adding Public Key to core user

Post-installation, the supported way to add another SSH public key for the core user on OpenShift/RHCOS nodes is by updating or creating a MachineConfig that contains all desired sshAuthorizedKeys. The Machine Config Operator (MCO) then rolls the change out to the targeted MachineConfigPool.

Note: OpenShift commonly uses 99-worker-ssh and 99-master-ssh to manage SSH keys for the core user.

1. Export the existing MachineConfig for worker

oc get machineconfig 99-worker-ssh -o yaml > 99-worker-ssh.yaml

2. Add the second public key

Edit the file and ensure both keys are present under sshAuthorizedKeys.

Example:

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: worker
  name: 99-worker-ssh
spec:
  config:
    ignition:
      version: 3.5.0
    passwd:
      users:
      - name: core
        sshAuthorizedKeys:
        - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAEXISTINGKEY user1@example
        - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAANEWKEY user2@example

Important: The sshAuthorizedKeys list is authoritative. Include the existing key(s) plus the new key. Do not provide only the new key unless you want to remove the old ones. The MCO only supports modifying sshAuthorizedKeys for the core user.

3. Apply the MachineConfig

oc apply -f 99-worker-ssh.yaml

The Machine Config Operator will render a new configuration and update the nodes in the associated MachineConfigPool.

4. Watch the rollout

Check the MachineConfigPool:

oc get mcp

Watch until the pool reports:

• UPDATED=True
• UPDATING=False
• DEGRADED=False

5. Verify one of the nodes

ssh core@<node-ip>

Using either the original key or the newly added key.

You can also verify on the node:

oc debug node/<node-name>

chroot /host
cat /home/core/.ssh/authorized_keys

The file should contain both public keys

This will add both public keys to the core user on all worker nodes.

You can repeat for the control plane.

References: Update SSH Keys