Ansible SSH host key checking failure in CI

By Kaveh Alemi·Latchkey

SSH refused to connect because the target host key is not in known_hosts. On ephemeral CI runners with fresh, short-lived targets this happens by default since nothing has been trusted yet.

What this error means

A host is UNREACHABLE with "Host key verification failed" or a known_hosts prompt. It is an authenticity check failure -- distinct from a network-level unreachable -- on first contact with a new host.

ansible

fatal: [web01]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to
the host via ssh: Host key verification failed.", "unreachable": true}

Diagnose it: init, state, or credentials?

Terraform failures in CI are dominated by backend and credential problems rather than configuration errors. Confirm the runner can initialise, authenticate, and lock state before reading the plan.

Terminal

terraform init -backend=true -input=false
terraform validate
terraform providers
terraform plan -input=false -no-color -detailed-exitcode
#   0 = no changes, 2 = changes, 1 = error

Common causes

Target not in known_hosts

A fresh runner has an empty known_hosts, and a newly created target has a key never seen before, so strict checking rejects it.

Changed host key

A rebuilt host reusing an address presents a new key that conflicts with a stale known_hosts entry.

How to fix it

Pre-populate known_hosts (preferred) or disable checking deliberately

Add the target key with ssh-keyscan for ephemeral hosts; only disable host key checking when the network path is already trusted.

.github/workflows/ci.yml

ssh-keyscan -H web01 >> ~/.ssh/known_hosts
ansible-playbook -i inventory site.yml
# trusted-network escape hatch only:
# export ANSIBLE_HOST_KEY_CHECKING=False

Handle rebuilt hosts

Remove stale known_hosts entries when a host is rebuilt (ssh-keygen -R host).
Re-scan the new key with ssh-keyscan.
For fleets of ephemeral hosts, automate key population in the pipeline.

How to prevent it

Populate known_hosts with ssh-keyscan for ephemeral targets.
Clear stale entries when hosts are rebuilt.
Disable host key checking only on trusted, isolated networks.

Frequently asked questions

What causes Ansible SSH host key checking failure in CI?

There are 2 common causes: target not in known_hosts and changed host key. A fresh runner has an empty known_hosts, and a newly created target has a key never seen before, so strict checking rejects it.

How do I fix Ansible SSH host key checking failure in CI?

There are 2 fixes depending on which cause you have: pre-populate known_hosts (preferred) or disable checking deliberately and handle rebuilt hosts. Work through them in order, since the first is the most common.

What does Ansible SSH host key checking failure in CI actually mean?

A host is UNREACHABLE with "Host key verification failed" or a known_hosts prompt.

How do I stop Ansible SSH host key checking failure in CI happening again?

Populate known_hosts with ssh-keyscan for ephemeral targets. The prevention section lists 3 changes that keep it from recurring.