SSH keys in LDAP (used for Cloud VPS/Toolforge) can be managed via toolsadmin or wikitech. That being said you do seem to have an SSH key defined in the puppet repo, but that shouldn't affect anything since you don't have a production shell account (ensure: absent).

Change 704779 had a related patch set uploaded (by Samtar; author: Samtar):

[operations/puppet@production] Update SSH key for samtar

https://gerrit.wikimedia.org/r/704779

In T286714#7214967, @Majavah wrote:

SSH keys in LDAP (used for Cloud VPS/Toolforge) can be managed via toolsadmin or wikitech. That being said you do seem to have an SSH key defined in the puppet repo, but that shouldn't affect anything since you don't have a production shell account (ensure: absent).

Hey Majavah, very good point, thank you :-) - was more of a "if it's there, it may as well be right!" thing.

Patch is there, will defer to the powers to be as to how to handle it (i.e. SSH key could always be removed entirely if that makes more sense?)

I'd recommend just removing any existing SSH keys for samtar, and adding them iff shell access to production is granted.

In T286714#7215003, @Vgutierrez wrote:

I'd recommend just removing any existing SSH keys for samtar, and adding them iff shell access to production is granted.

Sounds reasonable! Will amend the patch :-)

Change 704779 merged by Vgutierrez:

[operations/puppet@production] Remove SSH key for samtar

https://gerrit.wikimedia.org/r/704779