We need a better story for SSH key rotation

[Manishearth]

Salt only adds keys, and doesn't remove them. We should be able to remove a key from the list here and have it get removed on the server.

I had to rotate a key recently and I had to change salt and also run some sed commands on all machines.

cc @edunham

[aneeshusa]

The relevant PR is #692.

There is an ssh_auth.absent state which may be helpful: https://docs.saltstack.com/en/2016.3/ref/states/all/salt.states.ssh_auth.html#salt.states.ssh_auth.absent

I'd prefer to just control the entire contents of the authorized_keys file, but it looks like AWS injects some extra keypairs at the top of the file? Not sure if Macstadium does as well.

[edunham]

AWS's injection is the servo and servo-reserved-instances keys that we provide them at instance creation time. It would probably be good form to keep those when overwriting the file, but those pubkeys will rarely change so we could just stick them in the pillar.

I believe that Macstadium does not use SSH access to our machines, so we would be OK to overwrite the authorized_keys on every highstate.

So, we should be fine to have Salt manage authorized_keys as a file constructed from the keys in the pillar and rewrite it whenever it wants.