ansible pushes authorized_keys to all the boxes -- there's a different keys file for different "clusters" -- dev/prod/staging. Most of the users's keys are the

ansible pushes authorized_keys to all the boxes -- there's a different keys file for different "clusters" -- dev/prod/staging. Most of the users's keys are the same between these files, but it gives you the ability to have users who have access to dev/staging but not prod pretty easily. All of this config lives in the main git repo. Even if your initial solution is just to copy an authorized_keys file to each box, check that into git. You can just have a small shell script checked in as well that copies the relevant file to the relevant boxes... Also, always have a backdoor account that uses a key you have and isn't updated this way so if someone biffs the key file you push, you don't lock yourself out.