hashicorp/terraform · error

failed to write temp known_hosts file: %s

Error message

failed to write temp known_hosts file: %s

What it means

Raised in buildSSHClientConfig when tf.WriteString fails while writing the @cert-authority entry to the temp known_hosts file. The temp file was created successfully but writing the host key line failed. This prevents the knownhosts callback from being created.

Source

Thrown at internal/communicator/ssh/provisioner.go:348

	hkCallback := ssh.InsecureIgnoreHostKey()

	if opts.hostKey != "" {
		// The knownhosts package only takes paths to files, but terraform
		// generally wants to handle config data in-memory. Rather than making
		// the known_hosts file an exception, write out the data to a temporary
		// file to create the HostKeyCallback.
		tf, err := ioutil.TempFile("", "tf-known_hosts")
		if err != nil {
			return nil, fmt.Errorf("failed to create temp known_hosts file: %s", err)
		}
		defer tf.Close()
		defer os.RemoveAll(tf.Name())

		// we mark this as a CA as well, but the host key fallback will still
		// use it as a direct match if the remote host doesn't return a
		// certificate.
		if _, err := tf.WriteString(fmt.Sprintf("@cert-authority %s %s\n", opts.host, opts.hostKey)); err != nil {
			return nil, fmt.Errorf("failed to write temp known_hosts file: %s", err)
		}
		tf.Sync()

		hkCallback, err = knownhosts.New(tf.Name())
		if err != nil {
			return nil, err
		}
	}

	conf := &ssh.ClientConfig{
		HostKeyCallback: hkCallback,
		User:            opts.user,
	}

	if opts.privateKey != "" {
		if opts.certificate != "" {
			log.Println("using client certificate for authentication")

View on GitHub (pinned to c9def3e214)

Solutions

1. Check disk space and I/O health of the temp directory.
2. Set TMPDIR to a healthy writable location.
3. Re-run terraform apply; if it persists, investigate local storage issues.
4. Verify the host_key value is valid PEM/known_hosts format.

// Validate host_key format before building the SSH config
func validateHostKeyFormat(hostKey string) error {
    trimmed := strings.TrimSpace(hostKey)
    if trimmed == "" {
        return errors.New("host_key is empty")
    }
    // Basic check: known_hosts entries have at least 2 whitespace-separated fields
    fields := strings.Fields(trimmed)
    if len(fields) < 2 {
        return fmt.Errorf("host_key does not look like a valid known_hosts entry: %q", hostKey)
    }
    return nil
}

When it happens

Trigger: After ioutil.TempFile succeeds, the code writes '@cert-authority <host> <hostKey>\n' to the file. The write fails due to a disk I/O error, the file descriptor being invalidated, or the temp filesystem being full.

Common situations: Disk filled between file creation and write, an I/O error on the underlying storage, or the temp filesystem (tmpfs) exhausted its memory allocation. Rare but indicates local storage problems.

Related errors

• failed to create temp known_hosts file: %s
• Upload failed: %v
• Failed to upload script: %v
• Error starting script: %v
• connection type '%s' not supported

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/a573a38af43e026f. Report an issue: GitHub.