Use ensure_resource to fix ssh_known_hosts permissions and avoid possible conflict.