Flux GitRepository SSH "host key verification" error in CI

source-controller cloned over SSH and could not verify the server host key. The known_hosts entry in the referenced secret is missing or does not match the key the git host presented, so the connection is refused.

What this error means

A GitRepository using an ssh:// URL reports "False" with a message about host key verification or a knownhosts mismatch. flux get sources git shows the source stuck.

ssh: handshake failed: knownhosts: key mismatch

Common causes

The secret has no or a stale known_hosts entry

The SSH secret is missing the known_hosts key, or it holds an old host key after the git host rotated its keys, so verification fails.

The identity key is not authorized on the host

The identity private key in the secret is not registered as a deploy key or is missing its matching public key, so SSH cannot authenticate even after the host is trusted.

How to fix it

Regenerate the SSH secret with a fresh known_hosts

1. Recreate the git secret so flux create secret git scans and pins the current host key.
2. Add the printed public key as a deploy key on the repository.
3. Reconcile the source and confirm it reaches Ready.

flux create secret git infra-ssh \
  --url=ssh://git@github.com/acme/infra \
  --ssh-key-algorithm=ecdsa
flux reconcile source git infra --with-source

Verify the known_hosts value matches the host

Compare the stored key with the host key using ssh-keyscan when a mismatch persists after rotation.

ssh-keyscan github.com

How to prevent it

• Pin known_hosts in the secret and refresh it when the host rotates keys.
• Register the generated public key as a read-only deploy key.
• Prefer flux create secret git so the host key is scanned correctly.

Related guides