For beta cluster, we still have a hiera key for mediawiki::users::mwdeploy_pub_key which is referenced both on Wikitech hiera page and in puppet in hieradata/labs/deployment-prep/common.yaml.

That key was apparently on the deployment host as /home/mwdeploy/.ssh/authorized_keys. It is no more referenced everywhere and should be dropped from hiera as well as from the host. The key is now managed by keyholder and the public key on host is under /etc/ssh/userkeys/mwdeploy/.

The reason that hiera key is no more used is due to the cleanup patch rOPUP3ad195134847: keyholder key cleanup for T132747 which notably does:

     ssh::userkey { 'mwdeploy':
-        content => $mwdeploy_pub_key,
+        content => secret('keyholder/mwdeploy.pub'),
     }

Hence the hiera override is no more of any use. labs/private.git is used instead.