diff --git a/Makefile b/Makefile
index af56045..1844d67 100644
--- a/Makefile
+++ b/Makefile
@@ -82,7 +82,7 @@
 	@echo "Please specify a target (config, build, teardown, ...)"
 
 # Config file generation
-config: $(CONFIG_FILES)
+config: $(CONFIG_FILES) $(PODCONFIG_PATH)
 
 $(CONFIG_FILES):
 	ansible-playbook -i 'localhost,' --extra-vars="cord_podconfig='$(PODCONFIG_PATH)' genconfig_dir='$(GENCONFIG_D)' scenarios_dir='$(SCENARIOS_D)'" $(BUILD)/ansible/genconfig.yml $(LOGCMD)
@@ -99,13 +99,6 @@
 
 # Utility targets
 
-xos-teardown: xos-update-images
-	$(ANSIBLE_PB) $(PI)/teardown-playbook.yml $(LOGCMD)
-	rm -f $(M)/onboard-profile $(M)/local-onboard-profile
-
-xos-update-images: clean-images
-	rm -f $(M)/start-xos $(M)/local-start-xos
-
 ansible-ping:
 	$(ANSIBLE) -m ping all $(LOGCMD)
 
@@ -118,14 +111,9 @@
 compute-node-refresh:
 	$(SSH_HEAD) "cd /opt/cord/build; $(ANSIBLE_PB_MAAS) $(PI)/compute-node-refresh-playbook.yml" $(LOGCMD)
 
-vagrant-destroy:
-	$(VAGRANT) destroy $(LOGCMD)
-	rm -f $(M)/vagrant-up
-
 clean-images:
 	rm -f $(M)/docker-images $(M)/local-docker-images $(M)/core-image $(M)/local-core-image $(M)/build-maas-images $(M)/build-onos-apps $(M)/publish-maas-images $(M)/publish-docker-images $(M)/publish-onos-apps
 
-
 clean-genconfig:
 	rm -f $(CONFIG_FILES)
 
@@ -139,12 +127,28 @@
 clean-local: clean-profile clean-genconfig
 	rm -f $(LOCAL_MILESTONES)
 
+.PHONY: docs
+docs:
+	cd docs; make
+
 local-ubuntu-dev-env:
 	$(ANSIBLE_PB) $(PI)/bootstrap-dev-env.yml $(LOGCMD)
 
+vagrant-destroy:
+	$(VAGRANT) destroy $(LOGCMD)
+	rm -f $(M)/vagrant-up
+
+xos-teardown: xos-update-images
+	$(ANSIBLE_PB) $(PI)/teardown-playbook.yml $(LOGCMD)
+	rm -f $(M)/onboard-profile $(M)/local-onboard-profile
+
+xos-update-images: clean-images
+	rm -f $(M)/start-xos $(M)/local-start-xos
+
 
 # == PREREQS == #
 VAGRANT_UP_PREREQS     ?=
+COPY_CORD_PREREQS      ?=
 CORD_CONFIG_PREREQS    ?=
 COPY_CONFIG_PREREQS    ?=
 PREP_BUILDNODE_PREREQS ?=
@@ -178,7 +182,11 @@
 	$(VAGRANT) ssh-config $(VAGRANT_VMS) > $(SSH_CONFIG)
 	touch $@
 
-$(M)/copy-cord: | $(M)/vagrant-up
+$(M)/config-ssh-key: | $(M)/vagrant-up
+	$(ANSIBLE_PB) $(BUILD)/ansible/config-ssh-key.yml $(LOGCMD)
+	touch $@
+
+$(M)/copy-cord: | $(M)/vagrant-up $(COPY_CORD_PREREQS)
 	$(ANSIBLE_PB) $(PI)/copy-cord-playbook.yml $(LOGCMD)
 	touch $@
 
diff --git a/ansible/config-ssh-key.yml b/ansible/config-ssh-key.yml
new file mode 100644
index 0000000..0e31b8c
--- /dev/null
+++ b/ansible/config-ssh-key.yml
@@ -0,0 +1,43 @@
+---
+# config-ssh-key.yml - creates a ssh key on config node, has head node trust it
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- hosts: config
+  vars:
+    - ssh_keysize: 4096
+    - ssh_keytype: rsa
+
+  tasks:
+    - name: Create config ssh key
+      user:
+        name: "{{ ansible_user_id }}"
+        generate_ssh_key: yes
+        ssh_key_comment: cord-config-key
+        ssh_key_type: "{{ ssh_keytype }}"
+        ssh_key_bits: "{{ ssh_keysize }}"
+
+    - name: Retrieve ssh pubkey using slurp
+      slurp:
+        src: "{{ ansible_env.HOME }}/.ssh/id_{{ ssh_keytype }}.pub"
+      register: config_pubkey
+
+- hosts: head
+  tasks:
+    - name: Add config ssh key to head node
+      authorized_key:
+        user: "{{ ansible_user_id }}"
+        key: "{{ hostvars[groups['config'][0]].config_pubkey.content | b64decode }}"
+
diff --git a/ansible/roles/genconfig/templates/config.mk.j2 b/ansible/roles/genconfig/templates/config.mk.j2
index ef2351b..1a6e8a8 100644
--- a/ansible/roles/genconfig/templates/config.mk.j2
+++ b/ansible/roles/genconfig/templates/config.mk.j2
@@ -1,4 +1,3 @@
-
 {#
 Copyright 2017-present Open Networking Foundation
 
@@ -14,8 +13,6 @@
 See the License for the specific language governing permissions and
 limitations under the License.
 #}
-
-
 # config.mk - generated from ansible/roles/genconfig/templates/config.mk.j2
 # ** DO NOT EDIT THIS FILE MANUALLY! **
 # Edit the Pod Config (or Scenario) and rerun `make config` to regenerate it
@@ -55,6 +52,9 @@
 {% if vagrant_up_prereqs is defined %}
 VAGRANT_UP_PREREQS      = $(M)/{{ vagrant_up_prereqs | join(" $(M)/") }}
 {% endif %}
+{% if copy_cord_prereqs is defined %}
+COPY_CORD_PREREQS       = $(M)/{{ copy_cord_prereqs | join(" $(M)/") }}
+{% endif %}
 {% if cord_config_prereqs is defined %}
 CORD_CONFIG_PREREQS     = $(M)/{{ cord_config_prereqs | join(" $(M)/") }}
 {% endif %}
diff --git a/podconfig/rcord-physical.yml b/podconfig/rcord-physical.yml
index 80f47d8..af602dc 100644
--- a/podconfig/rcord-physical.yml
+++ b/podconfig/rcord-physical.yml
@@ -1,3 +1,4 @@
+---
 
 # Copyright 2017-present Open Networking Foundation
 #
@@ -14,7 +15,6 @@
 # limitations under the License.
 
 
----
 # rcord-physical-example Pod Config
 # Example configuration for a physical R-CORD pod
 
@@ -57,6 +57,9 @@
 docker_images_prereqs:
   - prep-headnode
 
+copy_cord_prereqs:
+  - config-ssh-key
+
 # node topology
 physical_node_list:
   - name: head1
@@ -80,4 +83,4 @@
       ansible_user: cord
       ansible_ssh_pass: cord
 
-  compute:
\ No newline at end of file
+  compute: