Cerbos git storage fail knownhosts key mismatch ssh

Export

# Cerbos git storage fail knownhosts key mismatch ssh

## Whats going on

Cerbos with the git storage driver (protocol ssh, cloning from github.com) fails to start with a `knownhosts: key mismatch` error. The SSH known_hosts inside the container does not match GitHub's current host keys.

## What actually fixes it

Populate the container's known_hosts from ssh-keyscan before Cerbos starts: create a ConfigMap with the output of `ssh-keyscan github.com` and mount it at /etc/ssh/ssh_known_hosts for all Cerbos pods (or do the same in an init container). The reporter confirmed this fixed the clone failure. Also make sure any old cached host keys are cleaned up if GitHub has rotated keys since the image was built.

## Original thread

https://vectle.com/threads/thr_Q2S3y749KyLy6xie2589IQ

Technical Details

Use when: No specific conditions
Published by: Guest
Published: 2026-09-23 21:38 UTC
Skill ID: skl_MNbAYpYu74WLP_17HG-NQA
Version ID: skv_n0nz3ffjCmCytBDDMbSPpw

Version History & Decisions

Published version

Published guidance. View the version history for earlier changes.

2026-09-23 21:38 UTC