Configuration updates for access-restricted hosts

A computer-implemented method, comprising:

• restricting communication between a management system of an environment and a computing device operating in the environment, wherein the computing device after the restricting is unable to receive management information from the management system;
• determining updated configuration information for the environment;
• determining a number of a plurality operators to establish a quorum of operators required to sign a command;
• requesting the quorum of operators to cryptographically sign the command indicating the updated configuration information;
• transmitting the command to the computing device based at least in part on whether the quorum of operators cryptographically signs the command;
• causing the computing device to verify that cryptographic signatures from the quorum of operators satisfy at least one signature criterion;
• causing the computing device to store the updated configuration information to ephemeral storage, for operation of the computing device, and to local persistent storage on the computing device;
• performing a reboot of the computing device;
• causing the computing device to re-verify that the cryptographic signatures from the quorum of operators satisfy the at least one signature criterion, and
• after causing the computing device to re-verify that the cryptographic signatures satisfy the at least one signature criterion, causing the computing device to load the updated configuration information from the local persistent storage into the ephemeral storage for operation of the computing device without contacting the management system.

A system, comprising:

• at least one processor;
• and
• memory including instructions that, when executed by the at least one processor, cause the system to:
• prevent communication between a management system of an environment and a computing device operating in the environment, wherein the computing device after the restricting is unable to receive management information from the management system;
• determine updated configuration information for the environment;
• determine a number of a plurality operators to establish a quorum of operators required to sign a command;
• request the quorum of operators to cryptographically sign the command indicating the updated configuration information;
• transmit the command to the computing device based at least in part on whether the quorum of operators cryptographically signs the command;
• cause the computing device to verify that cryptographic signatures from the quorum of operators satisfy a signature criterion;
• cause the computing device to store the updated configuration information to ephemeral storage, for operation of the computing device, and to local persistent storage on the computing device;
• perform a reboot of the computing device;
• cause the computing device to re-verify that the cryptographic signatures from the quorum of operators satisfy the signature criterion;
• and
• after causing the computing device to re-verify that the cryptographic signatures satisfy the at least one signature criterion, causing the computing device to load the updated configuration information from the local persistent storage into the ephemeral storage for operation of the computing device without contacting the management system.