juju-deployer fills up ~/.ssh/known_hosts

[Thomi Richards]

Every time we deploy something with juju-deployer, we get new entries in ~/.ssh/known_hosts. This is fine, until we try and re-deploy something that happens to be given the same IP address as an earlier (now dead) nova instance. When that happens, the deployment fails and we get:

---
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
<redacted fingerprint>.
Please contact your system administrator.
Add correct host key in /home/stg-ue-ci-engineering/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /home/stg-ue-ci-engineering/.ssh/known_hosts:26
  remove with: ssh-keygen -f "/home/stg-ue-ci-engineering/.ssh/known_hosts" -R 10.35.152.42
Keyboard-interactive authentication is disabled to avoid man-in-the-middle attacks.
---

Either juju-deployer shouldn't add to ~/.ssh/known_hosts, or juju destroy-* commands should take care of clearing out those entries in known_hosts.

[Kapil Thangavelu (hazmat)]

that's rather odd. deployer doesn't ever use ssh. juju bootstrap does, but else juju doesn't unless your explicitly using juju scp/ssh commands, which sounds more like things outside of deployer config/bundle syntax.

[Stuart Bishop (stub)]

This isn't juju-deployer, it is juju-core behavior. 'juju ssh' fills ~/.ssh/known_hosts. 'juju run' fills ~root/.ssh/known_hosts.

[Stuart Bishop (stub)]

Which version of juju? Per Bug #1325837 , this issue should no longer be happening with modern Juju.

[Thomi Richards (thomir-deactivatedaccount)]

Ahh, sorry for the mis-filing of this bug.

@Stuart: the juju version is 1.20.11-0ubuntu0.14.04.1, which is what's installed on wendigo.