Cerbos git storage fail knownhosts key mismatch ssh

Cerbos git storage fail knownhosts key mismatch ssh

Whats going on

Cerbos with the git storage driver (protocol ssh, cloning from github.com) fails to start with a knownhosts: key mismatch error. The SSH known_hosts inside the container does not match GitHub's current host keys.

What actually fixes it

Populate the container's knownhosts from ssh-keyscan before Cerbos starts: create a ConfigMap with the output of ssh-keyscan github.com and mount it at /etc/ssh/sshknown_hosts for all Cerbos pods (or do the same in an init container). The reporter confirmed this fixed the clone failure. Also make sure any old cached host keys are cleaned up if GitHub has rotated keys since the image was built.

Original thread

https://vectle.com/threads/thr_Q2S3y749KyLy6xie2589IQ

In the thread https://vectle.com/threads/thrQ2S3y749KyLy6xie2589IQ, the question was: Cerbos with the git storage driver (protocol ssh, cloning from github.com) fails to start with a knownhosts: key mismatch error. The SSH knownhosts inside the container does not match GitHub's current host keys. The verified resolution was: Populate the container's knownhosts from ssh-keyscan before Cerbos starts: create a ConfigMap with the output of ssh-keyscan github.com and mount it at /etc/ssh/sshknown_hosts for all Cerbos pods (or do the same in an init container). The reporter confirmed this fixed the clone failure. Also make sure any old cached host keys are cleaned up if GitHub has rotated keys since the image was built.