Change:
Install containerd: {{< tabs name="tab-cri-containerd-installation" >}} <del> {{% tab name="Ubuntu 16.04" %}} </del> <ins> {{% tab name="Linux" %}} </ins> <del> ```shell # (Install containerd) ## Set up the repository ### Install packages to allow apt to use a repository over HTTPS sudo apt-get update && sudo apt-get install -y apt-transport-https ca-certificates curl software-properties-common ``` ```shell ## Add Docker's official GPG key curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key --keyring /etc/apt/trusted.gpg.d/docker.gpg add - ``` ```shell ## Add Docker apt repository. sudo add-apt-repository  "deb [arch=amd64] https://download.docker.com/linux/ubuntu  $(lsb_release -cs)  stable" ``` ```shell ## Install containerd sudo apt-get update && sudo apt-get install -y containerd.io ``` ```shell # Configure containerd sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml ``` ```shell # Restart containerd sudo systemctl restart containerd ``` {{% /tab %}} {{% tab name="Ubuntu 18.04/20.04" %}} ```shell # (Install containerd) sudo apt-get update && sudo apt-get install -y containerd ``` ```shell # Configure containerd sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml ``` ```shell # Restart containerd sudo systemctl restart containerd ``` {{% /tab %}} {{% tab name="Debian 9+" %}} ```shell # (Install containerd) ## Set up the repository ### Install packages to allow apt to use a repository over HTTPS sudo apt-get update && sudo apt-get install -y apt-transport-https ca-certificates curl software-properties-common ``` </del> <ins> 1. Install the `containerd.io` package from the official Docker repositories. Instructions for setting up the Docker repository for your respective Linux distribution and installing the `containerd.io` package can be found at [Install Docker Engine](https://docs.docker.com/engine/install/#server). </ins> <del> ```shell ## Add Docker's official GPG key curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key --keyring /etc/apt/trusted.gpg.d/docker.gpg add - ``` </del> <ins> 2. Configure containerd: </ins> <del> ```shell ## Add Docker apt repository. sudo add-apt-repository  "deb [arch=amd64] https://download.docker.com/linux/debian  $(lsb_release -cs)  stable" ``` </del> <ins> ```shell sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml ``` </ins> <del> ```shell ## Install containerd sudo apt-get update && sudo apt-get install -y containerd.io ``` </del> <ins> 3. Restart containerd: </ins> <del> ```shell # Set default containerd configuration sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml ``` </del> <ins> ```shell sudo systemctl restart containerd ``` </ins> <del> ```shell # Restart containerd sudo systemctl restart containerd ``` </del> {{% /tab %}} <del> {{% tab name="CentOS/RHEL 7.4+" %}} ```shell # (Install containerd) ## Set up the repository ### Install required packages sudo yum install -y yum-utils device-mapper-persistent-data lvm2 ``` ```shell ## Add docker repository sudo yum-config-manager  --add-repo  https://download.docker.com/linux/centos/docker-ce.repo ``` </del> <ins> {{% tab name="Windows (PowerShell)" %}} </ins> <del> ```shell ## Install containerd sudo yum update -y && sudo yum install -y containerd.io ``` </del> <ins> Start a Powershell session, set `$Version` to the desired version (ex: `$Version=1.4.3`), and then run the following commands: </ins> <del> ```shell ## Configure containerd sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml ``` </del> <ins> 1. Download containerd: </ins> <del> ```shell # Restart containerd sudo systemctl restart containerd ``` {{% /tab %}} {{% tab name="Windows (PowerShell)" %}} </del> <ins> ```powershell curl.exe -L https://github.com/containerd/containerd/releases/download/v$Version/containerd-$Version-windows-amd64.tar.gz -o containerd-windows-amd64.tar.gz tar.exe xvf .containerd-windows-amd64.tar.gz ``` </ins> <del> <br /> Start a Powershell session, set `$Version` to the desired version (ex: `$Version=1.4.3`), and then run the following commands: <br /> </del> <ins> 2. Extract and configure: </ins> <del> ```powershell # (Install containerd) # Download containerd curl.exe -L https://github.com/containerd/containerd/releases/download/v$Version/containerd-$Version-windows-amd64.tar.gz -o containerd-windows-amd64.tar.gz tar.exe xvf .containerd-windows-amd64.tar.gz ``` </del> <ins> ```powershell Copy-Item -Path ".bin" -Destination "$Env:ProgramFilescontainerd" -Recurse -Force cd $Env:ProgramFilescontainerd .containerd.exe config default | Out-File config.toml -Encoding ascii </ins> <del> ```powershell # Extract and configure Copy-Item -Path ".bin" -Destination "$Env:ProgramFilescontainerd" -Recurse -Force cd $Env:ProgramFilescontainerd .containerd.exe config default | Out-File config.toml -Encoding ascii </del> <ins> # Review the configuration. Depending on setup you may want to adjust: # - the sandbox_image (Kubernetes pause image) # - cni bin_dir and conf_dir locations Get-Content config.toml </ins> <del> # Review the configuration. Depending on setup you may want to adjust: # - the sandbox_image (Kubernetes pause image) # - cni bin_dir and conf_dir locations Get-Content config.toml </del> <ins> # (Optional - but highly recommended) Exclude containerd from Windows Defender Scans Add-MpPreference -ExclusionProcess "$Env:ProgramFilescontainerdcontainerd.exe" ``` </ins> <del> # (Optional - but highly recommended) Exclude containerd from Windows Defender Scans Add-MpPreference -ExclusionProcess "$Env:ProgramFilescontainerdcontainerd.exe" ``` </del> <ins> 3. Start containerd: </ins> <del> ```powershell # Start containerd .containerd.exe --register-service Start-Service containerd ``` </del> <ins> ```powershell .containerd.exe --register-service Start-Service containerd ``` </ins> {{% /tab %}} {{< /tabs >}}

Discussion:
The current installation instructions for installing the third party Kubernetes Apt repository on Debian/Ubuntu, goes against best security practice. Currently the signing keys are to . The keychain should be downloaded to (file name to match the name used in ) using or (not as this is deprecated and will be last available in Debian 11 and Ubuntu 22.04) and referred to in as such Page to Update: References:
i read the linked pages and this change seems valid. thank you for bringing this up. would you help us by sending a PR for that? /sig cluster-lifecycle
/priority important-longterm /kind cleanup
/triage accepted
Please see
/sig cli