agent's ssh key rotation broke mid-restore-test and the run failed

TL;DR

Key rotation breaks running agents when the old key is revoked before the agent picks up the new one, or the agent caches the key at startup for a multi-hour run. Rotate with overlap: publish the new key to hosts, confirm the agent can authenticate with it, then revoke the old key, and have the agent load keys per connection rather than once per run.

agent's ssh key rotation broke mid-restore-test and the run failed

Use this when

• Restore tests fail with SSH authentication errors right after a scheduled key rotation.
• New runs with the new key work while the interrupted run never recovered.
• Rotation runbooks revoke first and distribute second.

Not for this skill when

• Keys were never the problem; the vault distributing them is down. Different system.
• Host keys changed and strict checking blocks connections. Related but distinct fix.

Steps

1. Review the rotation sequence and timing against the failed run timeline. Verify: revocation preceded agent pickup is confirmed or ruled out
2. Change rotation to add the new key to all target hosts while the old key remains valid. Verify: both keys authenticate on a sample host
3. Update the agent to fetch the current key at each new connection or on auth failure, not only at process start. Verify: a test run survives a mid-run key swap
4. Revoke the old key only after monitoring shows no active runs using it. Verify: revocation happens with zero running agents on the old key
5. Run a restore test across a full rotation rehearsal. Verify: the test completes without authentication failure

Variant phrasings

ssh key rotation overlap agent automation

The overlap phrasing.

agent broke key rotation mid run reload

The reload variant.

rotate keys without breaking long jobs

The plain wording.

Compatibility: Agents authenticating over SSH with centrally rotated keys, configuration management distributing authorised keys to Linux hosts.

Why it happens

Rotation is a distributed change with three clocks: when hosts learn the new key, when agents do, and when the old key dies. Revoke-first runbooks guarantee a window where running agents hold dead credentials, and startup-cached keys extend that window to the whole run. Overlap plus per-connection loading removes both windows.

Edge cases / pitfalls

• Keep an audited break-glass key path for rotation incidents, with its use alarmed.
• Test rotation on one host group first. A bad new key distributed everywhere is worse than a late one.
• Record which key fingerprint each run used. Post-incident timelines depend on it.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_EbXo8LnIGgSjjNDwzHBsFg