After update the .Spec.ServiceAccountSigningKey , hc reports ReconciliationError "configuration is invalid: invalid service account signing key: existing
       control plane service account signing key does not match private key", until I delete the sa-signing-key secret in the hcp namespace manually, this error is gone and new  sa-signing-key secret created with new update sa key.
    

4.22.0-0.nightly-2025-12-29-152753
    

always
    

    1. openssl genrsa -traditional -out rsa_pkcs1_private.key 2048 
oc set data secret/xiuwang-aks-hc-cn2119-dsa-token-issuer-key --from-file=key=${PATH}/feature-OCPSTRAT-2533/key3/rsa_pkcs1_private.key  -n clusters
    2. oc get hc xiuwang-aks-hc-cn2119-d -n  clusters
 - lastTransitionTime: "2025-12-30T06:47:34Z"
     message: 'ValidConfiguration condition is false: invalid service account signing
       key: existing control plane service account signing key does not match private
       key'
     observedGeneration: 5
     reason: Blocked
     status: "False"
     type: Progressing
   - lastTransitionTime: "2025-12-30T06:47:34Z"
     message: Required platform credentials are found
     observedGeneration: 2
     reason: AsExpected
     status: "True"
     type: PlatformCredentialsFound
   - lastTransitionTime: "2025-12-30T09:24:03Z"
     message: 'configuration is invalid: invalid service account signing key: existing
       control plane service account signing key does not match private key'
     observedGeneration: 5
     reason: ReconciliationError
     status: "False"
     type: ReconciliationSucceeded" 
    3.Delete the secret 
oc delete secret sa-signing-key -n clusters-xiuwang-aks-hc-cn2119-d
4. oc get secret | grep sa
sa-signing-key                                          Opaque                           2      3m59s
5. oc get secret sa-signing-key -n "${HCP_NAMESPACE}" \                                                               
  -o jsonpath='{.data.service-account\.key}' |base64 -d  > /tmp/current-key.pem
6.  diff -uNr /tmp/current-key.pem rsa_pkcs1_private.key
sa-signing-key secret has been updated to use new sa key
    

Should update sa-signing-key secret automaticlly after update Spec.ServiceAccountSigningKey secret