From 1b446f4773ea4609df7225228fbfe5ff4a6ef342 Mon Sep 17 00:00:00 2001
From: Markus Hilger <markus.hilger@megware.com>
Date: Tue, 13 Oct 2026 18:51:56 +0200
Subject: [PATCH] Add empty nodegroup hint to ssh.trustnodes

---
 confluent_server/confluent/config/attributes.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/confluent_server/confluent/config/attributes.py b/confluent_server/confluent/config/attributes.py
index 4544f929..11c1fa90 100644
--- a/confluent_server/confluent/config/attributes.py
+++ b/confluent_server/confluent/config/attributes.py
@@ -691,7 +691,8 @@ node = {
                         'expressed in noderange syntax.  This is used during '
                         'deployment if the confluent SSH certificate '
                         'authority is configured.  Default behavior is for '
-                        'all nodes to trust each other.'),
+                        'all nodes to trust each other.  Use an empty nodegroup '
+                        'to prevent the node from trusting any other node.'),
     },
     'pubkeys.addpolicy': {
         'description': ('Policy to use when encountering unknown public '