Description

When updating to the new Ignition version the ebuild file set distro.writeAuthorizedKeysFragment=false to write the SSH pub keys to .ssh/authorized_keys directly instead of .ssh/authorized_keys.d/flatcar-ignition as before.

Impact

The keys will get lost when update-ssh-keys rewrites the .ssh/authorized_keys file

Environment and steps to reproduce

Didn't try to reproduce it, was just reading the code

Expected behavior

Ignition used to have similar code to what update-ssh-keys does in internal/authorized_keys_d/authorized_keys_d.go but now that code is gone because Fedora CoreOS uses the internal mechanism of SSH to read from this directory but that mechanism is not used in Flatcar. Therefore, just enabling writeAuthorizedKeysFragment is not enough either, because in addition we have to call update-ssh-keys after Ignition wrote the files to authorized_keys.d/ignition.

Additional information

discovered when reading https://github.com/flatcar-linux/coreos-overlay/pull/1784/files