Ansible warning that host key has changed, even though I've taken multiple steps to prevent this warning

Question

I've followed the recommendations I could find to prevent this from happening. I am using Vagrant, but once the boxes are spun, I'd like to do things with the ansible command sometimes.

$ grep host_key /etc/ansible/ansible.cfg                                                                                                               
host_key_checking = False

$ grep kafka01 ./inventory
kafka01 ansible_host=127.0.0.1 ansible_port=2231 ansible_user='vagrant' ansible_ssh_private_key_file='/home/me/project/project/.vagrant/machines/kafka01/virtualbox/private_key' ansible_ssh_common_args='-o StrictHostKeyChecking=no'

$ export ANSIBLE_HOST_KEY_CHECKING=False
$ ansible kafka01 -m ping -i ./inventory                                                                                                               

 [WARNING]: Unhandled error in Python interpreter discovery for host kafka01: Failed to connect to the host via ssh: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  @    WARNING:
REMOTE HOST IDENTIFICATION HAS CHANGED!     @  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!  Someone could be eavesdropping on
you right now (man-in-the-middle attack)!  It is also possible that a host key has just been changed.  The fingerprint for the ECDSA key sent by the remote host is
SHA256:jn5ClU5g566Gsvobf8Xc45DJnIiAllN+RJkg35Nf9KE.  Please contact your system administrator.  Add correct host key in /home/me/.ssh/known_hosts to get rid of this message.  Offending ECDSA key
in /home/me/.ssh/known_hosts:19    remove with:    ssh-keygen -f "/home/me/.ssh/known_hosts" -R "[127.0.0.1]:2231"  ECDSA host key for [127.0.0.1]:2231 has changed and you have requested strict
checking.  Host key verification failed.

kafka01 | UNREACHABLE! => {
.....

What's going on here?

Edit: No, I don't want to keep deleting the key. I destroy/build these over and over again. I want to find the correct, long-term solution.

Answer 1

You can add this in inventory:

ansible_ssh_common_args="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"

It's ignoring check host and setting /dev/null as Known host file.

Answer 2

An alternative sintax to Dilson Rainov's answer, more ansible 2.x style (I think).

In your inventory define the host as:

vagrant-local:
      ansible_host: 192.168.33.10
      ansible_user: vagrant
      ansible_ssh_private_key_file: .vagrant/machines/default/virtualbox/private_key
      UserKnownHostsFile: /dev/null
      StrictHostKeyChecking: no
      ansible_python_interpreter: /usr/bin/python3

• UserKnownHostsFile causes the check of the host fingerprint on an always empty file (replacing the check inside ~/.ssh/known_hosts)
• StrictHostKeyChecking allows ssh to connect without the user confirming the detected fingerprint from the vagrant host