The -u core isn't really needed, the core user is the default. But this does something like: -a nova-agent

Without an action such as -a update-ssh-keys just regenerates authorized_keys based on the current set in authorized_keys.d so as-is this command isn't doing anything. Also the grep shouldn't be required, as long as the original authorized_keys file is valid you can feed it in directly: update-ssh-keys -a nova-agent $SSH_CONF