I found two places that describe OpenStack SSH keys, but nothing seems to say whether or not they're generated on VMs.
Generating these on the VMs could lead to problems, since VM images are often so standardized that it may lead to a reduction of randomness applied to the generation of keys.
What OpenStack SSH key generation configuration reduces this potential source of vulnerability, e.g. is there a way to force OpenStack to use a dedicated source of randomness like an HRNG?
I am asking this because I have read here (How can you securely generate keys on AWS?) and other places that SSH keys generated on VMs have slightly more risk than those generated on bare metal due to several vulnerabilities directly related to virtualization.
Also, a technically minded acquaintance pointed out the same issue earlier about the vulnerabilities from potentially weak VM entropy, too, at the RSA conference.
Even if virtualization doesn't reduce entropy, there could still be other problems.
That is why I want to know,
How do I reduce the vulnerability of the OpenStack SSH key generation process?
OpenStack can inject a public ssh key into an instance on launch --https://www.mirantis.com/blog/openstack-security-tip-create-a-keypair-for-accessing-vms/
https://review.openstack.org/#/c/156970/ (Not sure if this is related, but it came up in my brief googling.)