Trust SSH host on first use enabled by default about kube-backup

[Paxa]

Partially fixed by 5149486

[Paxa]

It would check if known_hosts already exist and have host for git then ssh-keyscan won't run.
I thought about providing known_hosts with keys for github, gitlab, bitbucket, etc. But those services may change their ssh certificate some day and it will stop working

For now we can provide known_hosts via mounting configmap or secret or volume

Any suggestions for proper solution?

[pieterlange]

Don't fail in a "usable" state but force the users to supply a known_hosts file. Or persist the known_hosts file in a kubernetes resource (eg configmap or secret) and write that on first use.

[pieterlange]

But those services may change their ssh certificate some day and it will stop working

This would be a highly newsworthy event and much is much more likely to be picked up by sysadmins than a single MittM attack for one of the cronjob runs, capturing your entire cluster state.