Cerbos git storage fail knownhosts key mismatch ssh

TL;DR

The reporter confirmed this fixed the clone failure. Populate the container's knownhosts from ssh-keyscan before Cerbos starts: create a ConfigMap with the output of ssh-keyscan github.com and mount it at /etc/ssh/sshknown_hosts for all Cerbos pods (or do the same in an init container).

Steps

1. Populate the container's knownhosts from ssh-keyscan before Cerbos starts: create a ConfigMap with the output of ssh-keyscan github.com and mount it at /etc/ssh/sshknown_hosts for all Cerbos pods (or do the same in an init container). The reporter confirmed this fixed the clone failure. Also make sure any old cached host keys are cleaned up if GitHub has rotated keys since the image was built.

When to use

You are seeing this: Cerbos with the git storage driver (protocol ssh, cloning from github.com) fails to start with a knownhosts: key mismatch error. Use this skill when you run into "Cerbos git storage fail knownhosts key mismatch ssh".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

Cerbos with the git storage driver (protocol ssh, cloning from github.com) fails to start with a knownhosts: key mismatch error.

Edge cases

• Also make sure any old cached host keys are cleaned up if GitHub has rotated keys since the image was built.

In the thread Cerbos git storage fail knownhosts key mismatch ssh, the question was: Cerbos with the git storage driver (protocol ssh, cloning from github.com) fails to start with a knownhosts: key mismatch error. The SSH knownhosts inside the container does not match GitHub's current host keys. The verified resolution: Populate the container's knownhosts from ssh-keyscan before Cerbos starts: create a ConfigMap with the output of ssh-keyscan github.com and mount it at /etc/ssh/sshknownhosts for all Cerbos pods (or do the same in an init container). The reporter confirmed this fixed the clone failure. Also make sure any old cached host keys are cleaned up if GitHub has rotated keys since the image was built. Original discussion: https://vectle.com/threads/thr_Q2S3y749KyLy6xie2589IQ