Change:
### Docker <del> On each of your nodes, install Docker CE. The Kubernetes release notes list which versions of Docker are compatible with that version of Kubernetes. Use the following commands to install Docker on your system: {{< tabs name="tab-cri-docker-installation" >}} {{% tab name="Ubuntu 16.04+" %}} ```shell # (Install Docker CE) ## Set up the repository: ### Install packages to allow apt to use a repository over HTTPS sudo apt-get update && sudo apt-get install -y  apt-transport-https ca-certificates curl software-properties-common gnupg2 ``` ```shell # Add Docker's official GPG key: curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key --keyring /etc/apt/trusted.gpg.d/docker.gpg add - ``` ```shell # Add the Docker apt repository: sudo add-apt-repository  "deb [arch=amd64] https://download.docker.com/linux/ubuntu  $(lsb_release -cs)  stable" ``` ```shell # Install Docker CE sudo apt-get update && sudo apt-get install -y  containerd.io=1.2.13-2  docker-ce=5:19.03.11~3-0~ubuntu-$(lsb_release -cs)  docker-ce-cli=5:19.03.11~3-0~ubuntu-$(lsb_release -cs) ``` ```shell ## Create /etc/docker sudo mkdir /etc/docker ``` ```shell # Set up the Docker daemon cat <<EOF | sudo tee /etc/docker/daemon.json { "exec-opts": ["native.cgroupdriver=systemd"], "log-driver": "json-file", "log-opts": { "max-size": "100m" }, "storage-driver": "overlay2" } EOF ``` ```shell # Create /etc/systemd/system/docker.service.d sudo mkdir -p /etc/systemd/system/docker.service.d ``` ```shell # Restart Docker sudo systemctl daemon-reload sudo systemctl restart docker ``` {{% /tab %}} {{% tab name="CentOS/RHEL 7.4+" %}} ```shell # (Install Docker CE) ## Set up the repository ### Install required packages sudo yum install -y yum-utils device-mapper-persistent-data lvm2 ``` ```shell ## Add the Docker repository sudo yum-config-manager --add-repo  https://download.docker.com/linux/centos/docker-ce.repo ``` ```shell # Install Docker CE sudo yum update -y && sudo yum install -y  containerd.io-1.2.13  docker-ce-19.03.11  docker-ce-cli-19.03.11 ``` ```shell ## Create /etc/docker sudo mkdir /etc/docker ``` </del> <ins> 1. On each of your nodes, install the Docker for your Linux distribution as per [Install Docker Engine](https://docs.docker.com/engine/install/#server) </ins> <del> ```shell # Set up the Docker daemon cat <<EOF | sudo tee /etc/docker/daemon.json { "exec-opts": ["native.cgroupdriver=systemd"], "log-driver": "json-file", "log-opts": { "max-size": "100m" }, "storage-driver": "overlay2", "storage-opts": [ "overlay2.override_kernel_check=true" ] } EOF ``` </del> <ins> 2. Configure the Docker daemon, in particular to use systemd for the management of the container’s cgroups. </ins> <del> ```shell # Create /etc/systemd/system/docker.service.d sudo mkdir -p /etc/systemd/system/docker.service.d ``` </del> <ins> ```shell sudo mkdir /etc/docker cat <<EOF | sudo tee /etc/docker/daemon.json { "exec-opts": ["native.cgroupdriver=systemd"], "log-driver": "json-file", "log-opts": { "max-size": "100m" }, "storage-driver": "overlay2" } EOF ``` </ins> <del> ```shell # Restart Docker sudo systemctl daemon-reload sudo systemctl restart docker ``` {{% /tab %}} {{< /tabs >}} </del> <ins> {{< note >}} `overlay2` is the preferred storage driver for systems running Linux kernel version 4.0 or higher, or RHEL or CentOS using version 3.10.0-514 and above. {{< /note >}} </ins> <del> If you want the `docker` service to start on boot, run the following command: </del> <ins> 3. Restart Docker and enable on boot: </ins> <del> ```shell sudo systemctl enable docker ``` </del> <ins> ```shell sudo systemctl enable docker sudo systemctl daemon-reload sudo systemctl restart docker ``` </ins> <del> Refer to the [official Docker installation guides](https://docs.docker.com/engine/installation/) for more information. </del> <ins> {{< note >}} For more information refer to - [Configure the Docker daemon](https://docs.docker.com/config/daemon/) - [Control Docker with systemd](https://docs.docker.com/config/daemon/systemd/) {{< /note >}} </ins>

Discussion:
The current installation instructions for installing the third party Kubernetes Apt repository on Debian/Ubuntu, goes against best security practice. Currently the signing keys are to . The keychain should be downloaded to (file name to match the name used in ) using or (not as this is deprecated and will be last available in Debian 11 and Ubuntu 22.04) and referred to in as such Page to Update: References:
i read the linked pages and this change seems valid. thank you for bringing this up. would you help us by sending a PR for that? /sig cluster-lifecycle
/priority important-longterm /kind cleanup
/triage accepted
Please see
/sig cli