Self-host
Trust a new SSH CA
After the control plane rotates its SSH certificate authority, tell each host.
Through a control plane, SSH access to a box is a certificate signed by the control plane's CA; each box trusts that CA. When the CA is rotated on the control plane (kvbox-cloud ca rotate there), every host has to be told, over its own socket, on the host:
kvbox server trust-ca --from-cloudIt asks the control plane the host joined for its current CA, shows the fingerprint and asks for confirmation (-y in scripts). To pass the key by hand:
kvbox server trust-ca "<the CA public key>"Every cloud box on the host gets the new CA line: in its record right away, and inside the guest through kvbox-agent if it is running. A box that is stopped or hibernated gets it the next time it runs; --json lists them under pendingReboot.