My team has an Ansible hub, from which we manage several nodes. To do so, we ssh to the hub, and sudo to a shared "ansible" user. This user has an ssh keypair, which all the nodes have in their authorized_keys file.
This works, but it means that everyone has access to all nodes at all times.
What I'd like is some approach that lets us restrict users so they can only access certain nodes. We could add/remove individuals' keys from each node's authorized_keys as needed, but this seems like a lot to manage. I'd like something that's easy to manage, so that we can quickly authorize/deauthorize a user for different nodes.
Does anyone have a strategy like this? I was thinking of using signed ssh keys to grant temporary access, but haven't really explored it.