GPG Public Key Rotation Reboot Exception #2481
Description
I would like to use a MachineConfig to periodically rotate the GPG public keys listed in /etc/containers/policy.json, but by default this will trigger a cluster drain and reboot which is not ideal. The mcd-reboot-exceptions openshift/enhancements#159 proposed adding a function to the MCD that compares two MachineConfigs to decide if a drain and reboot is required. The enhancement has been implemented by Pull Request #2259 as exceptions for ssh keys, pull secrets, and registries.conf changes; all other scenarios still require a drain and reboot. For my use-case, I'd like expand the exceptions to include GPG keys by updating the calculatePostConfigChangeActionFromFileDiffs function to ignore MachineConfig modifications to GPG files listed in the policy.json file. This would support the use-case of GPG public key rotation while still deriving when a reboot is necessary. Does this sound like a good approach?