Spotted when installing zuul-merger on contint2001. A git clone from gerrit.wikimedia.org failed waiting for the ssh host key to be accepted.
From the puppet module wikidatabuilder, we should use something like:
[gerrit.wikimedia.org]:29418,[208.80.154.81]:29418 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQCF8pwFLehzCXhbF1jfHWtd9d1LFq2NirpEBQYs7AOrGwQ/6ZZI0gvZFYiEiaw1o+F1CMfoHdny1VfWOJF3mJ1y9QMKAacc8/Z3tG39jBKRQCuxmYLO1SWymv7/Uvx9WQlkNRoTdTTa9OJFy6UqvLQEXKYaokfMIUHZ+oVFf1CgQ==
Change 337283 had a related patch set uploaded (by Hashar):
Role to provide Gerrit ssh host key on port 29418
There is a couple patches for this though I haven't pushed to get them reviewed/deployed :-(
Change 337284 had a related patch set uploaded (by Hashar; owner: Hashar):
[operations/puppet@production] wikidatabuilder: ship Gerrit ssh host key via a role
gerrit will change it's host key when we upgrade to gerrit 2.14.2. it will use the newer ssh key formats but supports older keys for backwards compat. But will try to use the newer one over the older one where possible.
I wonder if we could add gerrit's SSH key to the auto-generated /etc/ssh/ssh_known_hosts like we do for all machines non-service IPs (cobalt is in there, for example). Then nobody would ever need to worry about updating it in a dozen places.
Change 337284 abandoned by Hashar:
wikidatabuilder: ship Gerrit ssh host key via a role