I was wondering how different places handle how dev's get access to servers. A shared key? A gatekeeper? Public keys added to all servers?
What practices and tools do you use in order to manage this?
We have a simple Puppet recipe that creates a user, group and home, sets the correct permissions/groups and installs the public key. It will also remove users if they leave the company.
The script reads all users' details from YAML so if there are any changes, we push the YAML to all servers and run the script. It's not as automated as Puppet-Agent, but it's fine for a small number of servers.
Even if your initial solution is just to copy an authorized_keys file to each box, check that into git. You can just have a small shell script checked in as well that copies the relevant file to the relevant boxes...
Also, always have a backdoor account that uses a key you have and isn't updated this way so if someone biffs the key file you push, you don't lock yourself out.
RedHat distros have a perl(i think?) script that can be used to do the key lookup, and you just need a small schema extension to allow the storage of the public keys in the directory.
In my old company my team maintained a bunch of microservices running on AWS. we used basically the same strategy, except there was one key for each service. Our application server ran on our own datacenter. Access to that was granted through LDAP, not SSH keys.