You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
Our Terraform modules are located in private GIT repositories and we use SSH to clone these modules.
Cloning these Terraform modules using Terranetes works fine because the setup container has the following ssh_config:
StrictHostKeyChecking no
UserKnownHostsFile=/dev/null
This configuration disables the host key verification. Please note that this is also a potential security vulnerability. Normally, SSH checks the host key against a known list to ensure you’re connecting to the correct server. By setting StrictHostKeyChecking to no, you bypass this check, which can lead to connecting to untrusted or malicious servers without any warning.
In addition to this potential vulnerability we also have some Terraform modules with child Terraform modules, the child modules are cloned by Terraform within the init container, which does not have the ssh_config, disabling the host key verification. This causes the following error to occur:
│ on main.tf line 23:
│ 23: module "child-module" {
│
│ Could not download module "child-module" (main.tf:23)
│ source code from
│ "git::ssh://[email protected]:443/child-module.git":
│ error downloading
│ 'ssh://[email protected]:443/child-module.git':
│ /usr/bin/git exited with 128: Cloning into
│ '.terraform/modules/child-module'...
│ Host key verification failed.
│ fatal: Could not read from remote repository.
The host key verification fails because the known_hosts file is not configured.
Describe the solution you'd like
It would be nice if we can mount a known_hosts file into the init and setup container. And remove the potential insecure ssh_config from the setup container.
Describe alternatives you've considered
We now use our own job.yaml where we add a known_hosts volume mount. But this is hard to maintain.
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
Our Terraform modules are located in private GIT repositories and we use SSH to clone these modules.
Cloning these Terraform modules using Terranetes works fine because the
setup
container has the following ssh_config:This configuration disables the host key verification. Please note that this is also a potential security vulnerability. Normally, SSH checks the host key against a known list to ensure you’re connecting to the correct server. By setting
StrictHostKeyChecking
tono
, you bypass this check, which can lead to connecting to untrusted or malicious servers without any warning.In addition to this potential vulnerability we also have some Terraform modules with child Terraform modules, the child modules are cloned by Terraform within the
init
container, which does not have the ssh_config, disabling the host key verification. This causes the following error to occur:The host key verification fails because the
known_hosts
file is not configured.Describe the solution you'd like
It would be nice if we can mount a
known_hosts
file into theinit
andsetup
container. And remove the potential insecuressh_config
from thesetup
container.Describe alternatives you've considered
We now use our own
job.yaml
where we add a known_hosts volume mount. But this is hard to maintain.The text was updated successfully, but these errors were encountered: