Description of problem:

During the undercloud install we check if the stack user already has a rsa ssh key, otherwise we create one:

https://github.com/openstack/tripleo-heat-templates/blob/master/extraconfig/post_deploy/undercloud_post.sh#L46

if [ ! -f $HOMEDIR/.ssh/id_rsa ]; then
    ssh-keygen -b 1024 -N '' -f $HOMEDIR/.ssh/id_rsa
fi

Unfortunately the latest crypto-policies rpm now enforces a minimum key size of 2048 via:

$ grep RSAMinSize /etc/crypto-policies/back-ends/openssh.config
RSAMinSize 2048

this breaks ssh to the overcloud nodes.

I proposed we let ssh-keygen pick a default based on the os policies here: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/854602 .

We should probably look into how we can prevent this change from breaking existing environments where the key needs to be rotated (maybe we can leverage https://bugzilla.redhat.com/show_bug.cgi?id=2025933 ?)

rpm version:

crypto-policies-20220815-1.git0fbe86f.el9.noarch

[root@undercloud-0 ~]# rpm -q --changelog crypto-policies-20220815-1.git0fbe86f.el9.noarch
* Mon Aug 15 2022 Alexander Sosedkin <asosedkin> - 20220815-1.git0fbe86f                                                                                                                                                                                                                                                                    
- openssh: add RSAMinSize option following min_rsa_size