{"record":{"id":"a573a38af43e026f","repo":"hashicorp/terraform","slug":"failed-to-write-temp-known-hosts-file-s","errorCode":null,"errorMessage":"failed to write temp known_hosts file: %s","messagePattern":"failed to write temp known_hosts file: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/communicator/ssh/provisioner.go","lineNumber":348,"sourceCode":"\thkCallback := ssh.InsecureIgnoreHostKey()\n\n\tif opts.hostKey != \"\" {\n\t\t// The knownhosts package only takes paths to files, but terraform\n\t\t// generally wants to handle config data in-memory. Rather than making\n\t\t// the known_hosts file an exception, write out the data to a temporary\n\t\t// file to create the HostKeyCallback.\n\t\ttf, err := ioutil.TempFile(\"\", \"tf-known_hosts\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create temp known_hosts file: %s\", err)\n\t\t}\n\t\tdefer tf.Close()\n\t\tdefer os.RemoveAll(tf.Name())\n\n\t\t// we mark this as a CA as well, but the host key fallback will still\n\t\t// use it as a direct match if the remote host doesn't return a\n\t\t// certificate.\n\t\tif _, err := tf.WriteString(fmt.Sprintf(\"@cert-authority %s %s\\n\", opts.host, opts.hostKey)); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to write temp known_hosts file: %s\", err)\n\t\t}\n\t\ttf.Sync()\n\n\t\thkCallback, err = knownhosts.New(tf.Name())\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\tconf := &ssh.ClientConfig{\n\t\tHostKeyCallback: hkCallback,\n\t\tUser:            opts.user,\n\t}\n\n\tif opts.privateKey != \"\" {\n\t\tif opts.certificate != \"\" {\n\t\t\tlog.Println(\"using client certificate for authentication\")\n","sourceCodeStart":330,"sourceCodeEnd":366,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/communicator/ssh/provisioner.go#L330-L366","documentation":"Raised in buildSSHClientConfig when tf.WriteString fails while writing the @cert-authority entry to the temp known_hosts file. The temp file was created successfully but writing the host key line failed. This prevents the knownhosts callback from being created.","triggerScenarios":"After ioutil.TempFile succeeds, the code writes '@cert-authority <host> <hostKey>\\n' to the file. The write fails due to a disk I/O error, the file descriptor being invalidated, or the temp filesystem being full.","commonSituations":"Disk filled between file creation and write, an I/O error on the underlying storage, or the temp filesystem (tmpfs) exhausted its memory allocation. Rare but indicates local storage problems.","solutions":["Check disk space and I/O health of the temp directory.","Set TMPDIR to a healthy writable location.","Re-run terraform apply; if it persists, investigate local storage issues.","Verify the host_key value is valid PEM/known_hosts format."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate host_key format before building the SSH config\nfunc validateHostKeyFormat(hostKey string) error {\n    trimmed := strings.TrimSpace(hostKey)\n    if trimmed == \"\" {\n        return errors.New(\"host_key is empty\")\n    }\n    // Basic check: known_hosts entries have at least 2 whitespace-separated fields\n    fields := strings.Fields(trimmed)\n    if len(fields) < 2 {\n        return fmt.Errorf(\"host_key does not look like a valid known_hosts entry: %q\", hostKey)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate the host_key value is a proper known_hosts entry before use.","Ensure the temp directory has free disk space for the known_hosts file.","Set TMPDIR to a reliable local filesystem."],"tags":["ssh","host-key","known-hosts","temp-file","disk-io","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}