Correct way to inject ssh host keys with etc transient activated

Ask Fedora
1

I can’t find the right way to inject the ssh host keys into a system with etc transient = true.

As I understand it, depending on external mechanisms is fine for the installation phase day 0, but it generates some doubts:

  1. Wouldn’t those keys be lost after a restart?
  2. Is it possible to modify those keys on day 2 with a bootc update?
  3. Is it advisable to perform a systemd drop-in to the SSH service so that it moves or reads the keys in some persistent path such as /var/ssh?

Thanks

2

Can you post a reproductible example ?

3

When you used transient /etc, you either need to provision your system configuration on each boot or copy it from another persistent storage that you trust (which is mostly the same thing but put differently).

So if you use cloud-init for example, you need to provision those files for each boot.