// Text snippet included in the following modules:
//
// * modules/understanding-machine-config-operator.adoc
// * modules/troubleshooting-disabling-autoreboot-mco.adoc
// * modules/images-configuration-registry-mirror.adoc

:_mod-docs-content-type: SNIPPET

* When the MCO detects any of the following changes, it applies the update without draining or rebooting the node:

** Changes to the SSH key in the `spec.config.passwd.users.sshAuthorizedKeys` parameter of a machine config.
** Changes to the global pull secret or pull secret in the `openshift-config` namespace.
** Automatic rotation of the `/etc/kubernetes/kubelet-ca.crt` certificate authority (CA) by the Kubernetes API Server Operator.

* When the MCO detects changes to the `/etc/containers/registries.conf` file, such as editing an `ImageDigestMirrorSet`, `ImageTagMirrorSet`, or `ImageContentSourcePolicy` object, it drains the corresponding nodes, applies the changes, and uncordons the nodes. The node drain does not happen for the following changes:

** The addition of a registry with the `pull-from-mirror = "digest-only"` parameter set for each mirror.
** The addition of a mirror with the `pull-from-mirror = "digest-only"` parameter set in a registry.
** The addition of items to the `unqualified-search-registries` list.
