Ansible "Host key verification failed" / known_hosts in CI

SSH would not connect because the target host key is not in known_hosts and host key checking is enabled. A clean CI runner starts with an empty known_hosts, so the very first connection to each host fails this check.

What this error means

The play fails at setup with "UNREACHABLE! ... Failed to connect to the host via ssh: Host key verification failed." even though the key and user are correct.

ansible

fatal: [db1]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the
host via ssh: Host key verification failed.", "unreachable": true}

Common causes

Empty known_hosts on a fresh runner

Each CI job starts clean, so no host key is cached and strict checking refuses the unknown host.

Host key changed after a rebuild

A reprovisioned host presents a new key that does not match a pre-seeded known_hosts entry, so verification fails.

How to fix it

Pre-seed known_hosts with ssh-keyscan

Run ssh-keyscan against each target host at the start of the job.
Append the output to ~/.ssh/known_hosts.
Run the playbook with host key checking left enabled.

Terminal

mkdir -p ~/.ssh && chmod 700 ~/.ssh
ssh-keyscan -H web1 db1 >> ~/.ssh/known_hosts
ansible-playbook -i inventory site.yml

Disable host key checking only for ephemeral hosts

For throwaway CI hosts where you cannot pre-seed keys, disable the check explicitly. Prefer ssh-keyscan for persistent infrastructure.

.github/workflows/ci.yml

env:
  ANSIBLE_HOST_KEY_CHECKING: 'False'

How to prevent it

Seed known_hosts with ssh-keyscan as a setup step.
Cache or commit pinned host keys for stable infrastructure.
Only disable host key checking for ephemeral, throwaway hosts.