Bug 2160902

We would have to do this for all capsules as well, not only for satellite. The downside is that if we did this and someone renamed their capsule, then they would lose access to any host that was being managed through it. In general this feels like it has a great footgun potential, but I'll leave that to other to decide.

If we decide to do this, this will be an easy fix.

We'd very much like to see this RFE enacted as soon as possible, please.

I don't see a real problem with this for the (relative infrequent) case of someone renaming their capsules. 

There is already a procedure you have to go through, (see e.g.  
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.9/html/administering_red_hat_satellite/sect-red_hat_satellite-administering_red_hat_satellite-renaming_a_server), so it is just a step has to be added to that.

I would like to see this implemented soon, please.

I think this is a great idea. There are couples of things to be considered. As Adam mentioned, all Capsules with REX feature would have to be listed. Another thing is, DNS is not always configured correctly and Satellite may not even know, what the record resolves to on managed hosts. Due to this, the functionality should be opt-in. Due to the DNS aspect, I'd suggest we introduce a Parameter "remote_execution_ssh_keys_accepted_from" which users would fill in (either globally, per host group etc). If some value is specified in there, it would be used in the configuring template.

Two other things to mention. To increase the security, the private keys that Satellite use can also be protected with the passphrase. Such passphrase then needs to be used every time the REX job is triggered.

Second - the requested functionality can already be implemented today. User can unlock and edit the default "remote_execution_ssh_keys" provisioning template snippet. This snippet is used both from provisioning templates and during the registration process. The lines that needs to be adjusted is 

  cat << EOF >> <%= ssh_path %>/authorized_keys
<%= host_param('remote_execution_ssh_keys').is_a?(String) ? host_param('remote_execution_ssh_keys') : host_param('remote_execution_ssh_keys').join("\n") %>
EOF

it would be slightly more complicated, but the following should do the trick

  cat << EOF >> <%= ssh_path %>/authorized_keys
<% if host_param('remote_execution_ssh_keys').is_a?(String) -%>
from=satellite.example.com <%= host_param('remote_execution_ssh_keys') -%>
<% else -%>
<%=  host_param('remote_execution_ssh_keys').map { |key| "from=satellite.example.com #{key}"}.join("\n") %>
<% end -%>
EOF

the satellite.example.com can be easily replaced with the parameter I mentioned above. Just keep in mind that with every update, the snippet will get restored. If you'd like to keep it persistent, you'd have to clone it and update your kickstart templates to use this new clone.