Add BootstrapSSHKeyPair public key to agent ignition

Add the generated bootstrap SSH public key to the core user's
SSHAuthorizedKeys in the agent ignition, alongside the
user-provided key from the InfraEnv spec. This enables the
installer to SSH to the rendezvous host using the bootstrap key
without requiring the user to provide a key.

This key does not persist into the cluster, it is only active while the
agent ISO is booted.

Assisted-by: Claude Code

Author: zaneb

pkg/asset/agent/image/ignition.go

@@ -108,6 +108,7 @@ func (a *Ignition) Dependencies() []asset.Asset {
 		&tls.KubeAPIServerLocalhostSignerCertKey{},
 		&tls.KubeAPIServerServiceNetworkSignerCertKey{},
 		&tls.AdminKubeConfigSignerCertKey{},
+		&tls.BootstrapSSHKeyPair{},
 		&password.KubeadminPassword{},
 		&agentconfig.AgentConfig{},
 		&agentconfig.AgentHosts{},
@@ -136,7 +137,8 @@ func (a *Ignition) Generate(ctx context.Context, dependencies asset.Parents) err
 	}
 
 	pwd := &password.KubeadminPassword{}
-	dependencies.Get(pwd)
+	bootstrapSSHKeyPair := &tls.BootstrapSSHKeyPair{}
+	dependencies.Get(pwd, bootstrapSSHKeyPair)
 	pwdHash := string(pwd.PasswordHash)
 
 	infraEnv := agentManifests.InfraEnv
@@ -151,6 +153,7 @@ func (a *Ignition) Generate(ctx context.Context, dependencies asset.Parents) err
 					Name: "core",
 					SSHAuthorizedKeys: []igntypes.SSHAuthorizedKey{
 						igntypes.SSHAuthorizedKey(infraEnv.Spec.SSHAuthorizedKey),
+						igntypes.SSHAuthorizedKey(string(bootstrapSSHKeyPair.Public())),
 					},
 					PasswordHash: &pwdHash,
 				},

pkg/asset/agent/image/ignition_test.go

@@ -654,6 +654,11 @@ logdir /var/log/chrony`,
 				assertExpectedFiles(t, ignitionAsset.Config, tc.expectedFiles, tc.expectedFileContent)
 
 				assertServiceEnabled(t, ignitionAsset.Config, tc.serviceEnabledMap)
+
+				assert.Len(t, ignitionAsset.Config.Passwd.Users, 1)
+				assert.Equal(t, "core", ignitionAsset.Config.Passwd.Users[0].Name)
+				assert.Contains(t, ignitionAsset.Config.Passwd.Users[0].SSHAuthorizedKeys, igntypes.SSHAuthorizedKey("my-ssh-key"))
+				assert.Contains(t, ignitionAsset.Config.Passwd.Users[0].SSHAuthorizedKeys, igntypes.SSHAuthorizedKey("test-bootstrap-ssh-key\n"))
 			}
 		})
 	}
@@ -801,6 +806,7 @@ func buildIgnitionAssetDefaultDependencies(t *testing.T) []asset.Asset {
 		&tls.KubeAPIServerServiceNetworkSignerCertKey{},
 		&tls.AdminKubeConfigSignerCertKey{},
 		&tls.AdminKubeConfigClientCertKey{},
+		&tls.BootstrapSSHKeyPair{Pub: []byte("test-bootstrap-ssh-key\n")},
 		&gencrypto.AuthConfig{},
 		&common.InfraEnvID{},
 		&agentcommon.OptionalInstallConfig{},