protocol/ssh/hostkey/callbacks.go:162 has a TODO noting host-key checking doesn't support StrictHostKeyChecking=accept-new semantics (trust and record a new host's key on first connect, but still reject later mismatches).
This is also the root cause of a k0sctl-side symptom: conflicting known_hosts entries between openssh and k0sctl's own SSH client (k0sctl#813).
Filing to confirm the intended semantics before sending a fix, given this is host-key verification and worth getting exactly right.
protocol/ssh/hostkey/callbacks.go:162 has a TODO noting host-key checking doesn't support
StrictHostKeyChecking=accept-newsemantics (trust and record a new host's key on first connect, but still reject later mismatches).This is also the root cause of a k0sctl-side symptom: conflicting known_hosts entries between openssh and k0sctl's own SSH client (k0sctl#813).
Filing to confirm the intended semantics before sending a fix, given this is host-key verification and worth getting exactly right.