[lathiat]

You can still configure it to be key only, you just need to put your own override as a file in /etc/ssh/sshd_config.d/ rather than /etc/ssh/sshd_config. The files are read ins order, so your filename needs to sort after the 50-cloud-init.conf file.

This would work: echo "PasswordAuthentication no" > /etc/ssh/sshd_config.d/60-password-auth.conf

[speleding]

With sshd configuration the first option is the one that sticks, so you need to make sure it sorts BEFORE the 50-cloud-init.conf file.