ssh-rsa + sha1 is no longer allowed by recent openssh

[Takashi Kajinami]

Description
===========
Currently create Key-pair API without actual key content returns the key generated at server side which is formatted in ssh-rsa.

However ssh-rsa is no longer supported by default since openssh 8.8

https://www.openssh.com/txt/release-8.8

```
This release disables RSA signatures using the SHA-1 hash algorithm
by default. This change has been made as the SHA-1 hash algorithm is
cryptographically broken, and it is possible to create chosen-prefix
hash collisions for <USD$50K [1]
```

Actually in current CentOS 9 Stream, SHA1 is disabled by default and ssh-rsa no longer works.
Fedora disabled SHA1/ssh-rsa by default a while ago.

It's be required to support other formats like edcsa which are generally recommended.

[Sylvain Bauza (sylvain-bauza)]

We discussed this during the previous Nova meeting and we agreed on the fact this is a correct issue, but we need to deprecate the generation API (and continue to accept to import the public keys).

As this means a new API microversion, we need a spec for it so we'll discuss this during the next PTG.

Closing the bug.

[Takashi Kajinami (kajinamit)]

Thanks Sylvain.

For the records I found this issue with tempest tests in CentOS9 as tempest uses generated keys by default. I workarounded the issue by changing the key format and making tempest use import api with generated key, but we need to be aware that we'd hit the same issue once Ubuntu version in CI is updated and rsa key is disabled by default.

[sean mooney (sean-k-mooney)]

yep we previously found this issue in relation to the FIPS work which also disables the sha1 based keys

so this Is a know issue which we had previously agree to not fix in nova.

there should be a tempest patch to move the key generation to tempest already for the fips job which you can reused.