What is a bit weird to me in general for this recipe is it appears to generate a key every time it runs which would not idempotent behavior. 
So once /var/lib/nova is created the: unless nova_home_dir.nil? or nova_home_dir.empty? condition is always true therefore are we are always creating a new key?  
Perhaps I am missing something in the ssh-kegen arguments which tells it to never overwrite key?  Doesn’t appear so though –q is quiet, -t type, and –f is the file path.