Ansible SSH host key checking failure in CI

SSH refused to connect because the target host key is not in known_hosts. On ephemeral CI runners with fresh, short-lived targets this happens by default since nothing has been trusted yet.

What this error means

A host is UNREACHABLE with "Host key verification failed" or a known_hosts prompt. It is an authenticity check failure -- distinct from a network-level unreachable -- on first contact with a new host.

ansible

fatal: [web01]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to
the host via ssh: Host key verification failed.", "unreachable": true}

Common causes

Target not in known_hosts

A fresh runner has an empty known_hosts, and a newly created target has a key never seen before, so strict checking rejects it.

Changed host key

A rebuilt host reusing an address presents a new key that conflicts with a stale known_hosts entry.

How to fix it

Pre-populate known_hosts (preferred) or disable checking deliberately

Add the target key with ssh-keyscan for ephemeral hosts; only disable host key checking when the network path is already trusted.

.github/workflows/ci.yml

ssh-keyscan -H web01 >> ~/.ssh/known_hosts
ansible-playbook -i inventory site.yml
# trusted-network escape hatch only:
# export ANSIBLE_HOST_KEY_CHECKING=False

Handle rebuilt hosts

Remove stale known_hosts entries when a host is rebuilt (ssh-keygen -R host).
Re-scan the new key with ssh-keyscan.
For fleets of ephemeral hosts, automate key population in the pipeline.

How to prevent it

Populate known_hosts with ssh-keyscan for ephemeral targets.
Clear stale entries when hosts are rebuilt.
Disable host key checking only on trusted, isolated networks.