search

sighupio / fury-kubernetes-on-premises

Kubernetes Fury Distribution On-Premises Core Module: Create on-prem Kubernetes Clusters
BSD 3-Clause "New" or "Revised" License
7 stars 4 forks source link

Google's GPG key for APT has been rotated #42

Closed ralgozino closed 7 months ago

ralgozino commented 1 year ago

Our kube-common role has a hardcoded value for the Public GPG key ID for the Google Cloud APT repository that is used to install Kubernetes packages:

https://github.com/sighupio/fury-kubernetes-on-premises/blob/b4bfa03638a1c7e253be73bca6e08f61d2258938/roles/kube-node-common/vars/main.yml#L7

the new key ID is:

$ curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg -v -
gpg: enabled compatibility flags:
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2022-05-21 [SC]
      A362B822F6DEDC652817EA46B53DC80D13EDEF05
uid           Rapture Automatic Signing Key (cloud-rapture-signing-key-2022-03-07-08_01_01.pub)
sig        B53DC80D13EDEF05 2022-05-21   [selfsig]
sub   rsa2048 2022-05-21 [E]
sig        B53DC80D13EDEF05 2022-05-21   [keybind]

so

A362B822F6DEDC652817EA46B53DC80D13EDEF05

This key seems to get rotated often, should we evaluate dropping the hardcoded ID in the ansible role? Otherwise each time we'll have to patch most of the latest on-prem releases.

Another option, that would require manual intervention from the user, would be to document this case and explain how to override the ID. The issue with this approach is that it is not possible to override a single key of a dictionary without changing the merge behaviour for all the roles.

I tried overriding it in the hosts.ini, did not work, migrated all my inventory to hosts.yaml, it did not work either (it doesn't even complain, the custom value gets ignored). The only way to override the value was using the extra vars flag: ansible-playbook 3.cluster.yml --extra-vars='{"kubernetes_repo": {"apt_gpg_key_id": "A362B822F6DEDC652817EA46B53DC80D13EDEF05"}}'

So, if we want to go with override I think we'll need to do a little refactoring and maybe use a single var for the GPG Key ID.

ralgozino commented 7 months ago

closing because Google's repo has been deprecated and packages are installed from a Kubernetes community instead, there's no indication of the key rotating in the installation instructions: https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#installing-kubeadm-kubelet-and-kubectl