# k8s/awoooi-prod/04-repair-known-hosts-template.yaml
# known_hosts Secret Template — 不含實際主機指紋 (需手動建立)
# 2026-04-06 Claude Code: Sprint 3 Security Fix A1
#
# 建立方式:
#   ssh-keyscan -H 192.168.0.110 > /tmp/known_hosts
#   ssh-keyscan -H 192.168.0.188 >> /tmp/known_hosts
#   kubectl create secret generic awoooi-repair-known-hosts \
#     -n awoooi-prod \
#     --from-file=known_hosts=/tmp/known_hosts
#
# 驗證:
#   kubectl get secret awoooi-repair-known-hosts -n awoooi-prod
#
# 安全說明:
#   - known_hosts 存 K8s Secret，掛載至 /etc/repair-ssh/known_hosts
#   - SSH 命令使用 -o UserKnownHostsFile=/etc/repair-ssh/known_hosts
#   - 移除關閉 SSH host key 驗證的危險參數
apiVersion: v1
kind: Secret
metadata:
  name: awoooi-repair-known-hosts
  namespace: awoooi-prod
  annotations:
    awoooi.io/secret-type: "ssh-known-hosts"
    awoooi.io/created: "2026-04-06"
type: Opaque
# data: 不在版控中 — 使用上方 ssh-keyscan 指令建立
