From 85afb0196466dbed215d15a7ff8813215fcbf98c Mon Sep 17 00:00:00 2001 From: Greg Schrock Date: Wed, 19 Aug 2026 09:15:35 -0400 Subject: [PATCH] Add SCO re-onboarding step to ensure no authorized keys escape cleanup There's a particular case where 1. SCO has completed and placed authorized keys 2. Salt onboarding has not been attempted In this case, the AP does not have any state for the asset. Cleanup does not attempt to remove the authorized keys when it hasn't seen that asset. The result is subsequent SCO attempts would repeatedly fail as already complete (authorized keys already exist). Explicit cleaning prevents this corner case possibility. --- docs/sec-conductor-onboard.md | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/docs/sec-conductor-onboard.md b/docs/sec-conductor-onboard.md index 86f20cd227..f2fd26a82b 100644 --- a/docs/sec-conductor-onboard.md +++ b/docs/sec-conductor-onboard.md @@ -149,7 +149,27 @@ Mon 2026-08-10 18:29:06 UTC ``` -3. Restore the original asset ID. +3. Ensure all authorized keys are removed for the original asset ID. + +`delete system connectivity authorized-keys entry comment node all` + +This operation may indicate keys were removed. + +``` +admin@node0.Conductor# delete system connectivity authorized-keys entry comment Spoke1Node0 node all +✔ Updating SSH Configuration... +Deleted 2 entries on node0.Conductor +``` + +Alternatively, the keys may have been missing or removed by the temporary asset rename. It is **not an issue** if no entries are removed. + +``` +admin@node0.Conductor# delete system connectivity authorized-keys entry comment Spoke1Node0 node all +✔ Updating SSH Configuration... +Deleted 0 entries on node0.Conductor +``` + +4. Restore the original asset ID. `config authority router node asset-id `