Change:
The current installation instructions for installing the third party Kubernetes Apt repository on Debian/Ubuntu, goes against best security practice. Currently the signing keys are to . The keychain should be downloaded to (file name to match the name used in ) using or (not as this is deprecated and will be last available in Debian 11 and Ubuntu 22.04) and referred to in as such Page to Update: References:
i read the linked pages and this change seems valid. thank you for bringing this up. would you help us by sending a PR for that? /sig cluster-lifecycle
/priority important-longterm /kind cleanup
/triage accepted
Please see
/sig cli

Discussion:
### containerd <del> This section contains the necessary steps to use `containerd` as CRI runtime. </del> <ins> This section contains the necessary steps to use containerd as CRI runtime. </ins> Use the following commands to install Containerd on your system:

Install containerd: {{< tabs name="tab-cri-containerd-installation" >}} <del> {{% tab name="Ubuntu 16.04" %}} </del> <ins> {{% tab name="Linux" %}} </ins> <del> ```shell # (Install containerd) ## Set up the repository ### Install packages to allow apt to use a repository over HTTPS sudo apt-get update && sudo apt-get install -y apt-transport-https ca-certificates curl software-properties-common ``` ```shell ## Add Docker's official GPG key curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key --keyring /etc/apt/trusted.gpg.d/docker.gpg add - ``` ```shell ## Add Docker apt repository. sudo add-apt-repository  "deb [arch=amd64] https://download.docker.com/linux/ubuntu  $(lsb_release -cs)  stable" ``` ```shell ## Install containerd sudo apt-get update && sudo apt-get install -y containerd.io ``` ```shell # Configure containerd sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml ``` ```shell # Restart containerd sudo systemctl restart containerd ``` {{% /tab %}} {{% tab name="Ubuntu 18.04/20.04" %}} ```shell # (Install containerd) sudo apt-get update && sudo apt-get install -y containerd ``` ```shell # Configure containerd sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml ``` ```shell # Restart containerd sudo systemctl restart containerd ``` {{% /tab %}} {{% tab name="Debian 9+" %}} ```shell # (Install containerd) ## Set up the repository ### Install packages to allow apt to use a repository over HTTPS sudo apt-get update && sudo apt-get install -y apt-transport-https ca-certificates curl software-properties-common ``` </del> <ins> 1. Install the `containerd.io` package from the official Docker repositories. Instructions for setting up the Docker repository for your respective Linux distribution and installing the `containerd.io` package can be found at [Install Docker Engine](https://docs.docker.com/engine/install/#server). </ins> <del> ```shell ## Add Docker's official GPG key curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key --keyring /etc/apt/trusted.gpg.d/docker.gpg add - ``` </del> <ins> 2. Configure containerd: </ins> <del> ```shell ## Add Docker apt repository. sudo add-apt-repository  "deb [arch=amd64] https://download.docker.com/linux/debian  $(lsb_release -cs)  stable" ``` </del> <ins> ```shell sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml ``` </ins> <del> ```shell ## Install containerd sudo apt-get update && sudo apt-get install -y containerd.io ``` </del> <ins> 3. Restart containerd: </ins> <del> ```shell # Set default containerd configuration sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml ``` </del> <ins> ```shell sudo systemctl restart containerd ``` </ins> <del> ```shell # Restart containerd sudo systemctl restart containerd ``` </del> {{% /tab %}} <del> {{% tab name="CentOS/RHEL 7.4+" %}} ```shell # (Install containerd) ## Set up the repository ### Install required packages sudo yum install -y yum-utils device-mapper-persistent-data lvm2 ``` ```shell ## Add docker repository sudo yum-config-manager  --add-repo  https://download.docker.com/linux/centos/docker-ce.repo ``` </del> <ins> {{% tab name="Windows (PowerShell)" %}} </ins> <del> ```shell ## Install containerd sudo yum update -y && sudo yum install -y containerd.io ``` </del> <ins> Start a Powershell session, set `$Version` to the desired version (ex: `$Version=1.4.3`), and then run the following commands: </ins> <del> ```shell ## Configure containerd sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml ``` </del> <ins> 1. Download containerd: </ins> <del> ```shell # Restart containerd sudo systemctl restart containerd ``` {{% /tab %}} {{% tab name="Windows (PowerShell)" %}} </del> <ins> ```powershell curl.exe -L https://github.com/containerd/containerd/releases/download/v$Version/containerd-$Version-windows-amd64.tar.gz -o containerd-windows-amd64.tar.gz tar.exe xvf .containerd-windows-amd64.tar.gz ``` </ins> <del> <br /> Start a Powershell session, set `$Version` to the desired version (ex: `$Version=1.4.3`), and then run the following commands: <br /> </del> <ins> 2. Extract and configure: </ins> <del> ```powershell # (Install containerd) # Download containerd curl.exe -L https://github.com/containerd/containerd/releases/download/v$Version/containerd-$Version-windows-amd64.tar.gz -o containerd-windows-amd64.tar.gz tar.exe xvf .containerd-windows-amd64.tar.gz ``` </del> <ins> ```powershell Copy-Item -Path ".bin" -Destination "$Env:ProgramFilescontainerd" -Recurse -Force cd $Env:ProgramFilescontainerd .containerd.exe config default | Out-File config.toml -Encoding ascii </ins> <del> ```powershell # Extract and configure Copy-Item -Path ".bin" -Destination "$Env:ProgramFilescontainerd" -Recurse -Force cd $Env:ProgramFilescontainerd .containerd.exe config default | Out-File config.toml -Encoding ascii </del> <ins> # Review the configuration. Depending on setup you may want to adjust: # - the sandbox_image (Kubernetes pause image) # - cni bin_dir and conf_dir locations Get-Content config.toml </ins> <del> # Review the configuration. Depending on setup you may want to adjust: # - the sandbox_image (Kubernetes pause image) # - cni bin_dir and conf_dir locations Get-Content config.toml </del> <ins> # (Optional - but highly recommended) Exclude containerd from Windows Defender Scans Add-MpPreference -ExclusionProcess "$Env:ProgramFilescontainerdcontainerd.exe" ``` </ins> <del> # (Optional - but highly recommended) Exclude containerd from Windows Defender Scans Add-MpPreference -ExclusionProcess "$Env:ProgramFilescontainerdcontainerd.exe" ``` </del> <ins> 3. Start containerd: </ins> <del> ```powershell # Start containerd .containerd.exe --register-service Start-Service containerd ``` </del> <ins> ```powershell .containerd.exe --register-service Start-Service containerd ``` </ins> {{% /tab %}} {{< /tabs >}}

### Docker <del> On each of your nodes, install Docker CE. The Kubernetes release notes list which versions of Docker are compatible with that version of Kubernetes. Use the following commands to install Docker on your system: {{< tabs name="tab-cri-docker-installation" >}} {{% tab name="Ubuntu 16.04+" %}} ```shell # (Install Docker CE) ## Set up the repository: ### Install packages to allow apt to use a repository over HTTPS sudo apt-get update && sudo apt-get install -y  apt-transport-https ca-certificates curl software-properties-common gnupg2 ``` ```shell # Add Docker's official GPG key: curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key --keyring /etc/apt/trusted.gpg.d/docker.gpg add - ``` ```shell # Add the Docker apt repository: sudo add-apt-repository  "deb [arch=amd64] https://download.docker.com/linux/ubuntu  $(lsb_release -cs)  stable" ``` ```shell # Install Docker CE sudo apt-get update && sudo apt-get install -y  containerd.io=1.2.13-2  docker-ce=5:19.03.11~3-0~ubuntu-$(lsb_release -cs)  docker-ce-cli=5:19.03.11~3-0~ubuntu-$(lsb_release -cs) ``` ```shell ## Create /etc/docker sudo mkdir /etc/docker ``` ```shell # Set up the Docker daemon cat <<EOF | sudo tee /etc/docker/daemon.json { "exec-opts": ["native.cgroupdriver=systemd"], "log-driver": "json-file", "log-opts": { "max-size": "100m" }, "storage-driver": "overlay2" } EOF ``` ```shell # Create /etc/systemd/system/docker.service.d sudo mkdir -p /etc/systemd/system/docker.service.d ``` ```shell # Restart Docker sudo systemctl daemon-reload sudo systemctl restart docker ``` {{% /tab %}} {{% tab name="CentOS/RHEL 7.4+" %}} ```shell # (Install Docker CE) ## Set up the repository ### Install required packages sudo yum install -y yum-utils device-mapper-persistent-data lvm2 ``` ```shell ## Add the Docker repository sudo yum-config-manager --add-repo  https://download.docker.com/linux/centos/docker-ce.repo ``` ```shell # Install Docker CE sudo yum update -y && sudo yum install -y  containerd.io-1.2.13  docker-ce-19.03.11  docker-ce-cli-19.03.11 ``` ```shell ## Create /etc/docker sudo mkdir /etc/docker ``` </del> <ins> 1. On each of your nodes, install the Docker for your Linux distribution as per [Install Docker Engine](https://docs.docker.com/engine/install/#server) </ins> <del> ```shell # Set up the Docker daemon cat <<EOF | sudo tee /etc/docker/daemon.json { "exec-opts": ["native.cgroupdriver=systemd"], "log-driver": "json-file", "log-opts": { "max-size": "100m" }, "storage-driver": "overlay2", "storage-opts": [ "overlay2.override_kernel_check=true" ] } EOF ``` </del> <ins> 2. Configure the Docker daemon, in particular to use systemd for the management of the container’s cgroups. </ins> <del> ```shell # Create /etc/systemd/system/docker.service.d sudo mkdir -p /etc/systemd/system/docker.service.d ``` </del> <ins> ```shell sudo mkdir /etc/docker cat <<EOF | sudo tee /etc/docker/daemon.json { "exec-opts": ["native.cgroupdriver=systemd"], "log-driver": "json-file", "log-opts": { "max-size": "100m" }, "storage-driver": "overlay2" } EOF ``` </ins> <del> ```shell # Restart Docker sudo systemctl daemon-reload sudo systemctl restart docker ``` {{% /tab %}} {{< /tabs >}} </del> <ins> {{< note >}} `overlay2` is the preferred storage driver for systems running Linux kernel version 4.0 or higher, or RHEL or CentOS using version 3.10.0-514 and above. {{< /note >}} </ins> <del> If you want the `docker` service to start on boot, run the following command: </del> <ins> 3. Restart Docker and enable on boot: </ins> <del> ```shell sudo systemctl enable docker ``` </del> <ins> ```shell sudo systemctl enable docker sudo systemctl daemon-reload sudo systemctl restart docker ``` </ins> <del> Refer to the [official Docker installation guides](https://docs.docker.com/engine/installation/) for more information. </del> <ins> {{< note >}} For more information refer to - [Configure the Docker daemon](https://docs.docker.com/config/daemon/) - [Control Docker with systemd](https://docs.docker.com/config/daemon/systemd/) {{< /note >}} </ins>

{{< tabs name="k8s_install" >}} {{% tab name="Debian-based distributions" %}} <del> ```bash sudo apt-get update && sudo apt-get install -y apt-transport-https curl curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add - cat <<EOF | sudo tee /etc/apt/sources.list.d/kubernetes.list deb https://apt.kubernetes.io/ kubernetes-xenial main EOF sudo apt-get update sudo apt-get install -y kubelet kubeadm kubectl sudo apt-mark hold kubelet kubeadm kubectl ``` </del> <ins> 1. Update the `apt` package index and install packages needed to use the Kubernetes `apt` repository: ```shell sudo apt-get update sudo apt-get install -y apt-transport-https ca-certificates curl ``` 2. Download the Google Cloud public signing key: ```shell sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg ``` 3. Add the Kubernetes `apt` repository: ```shell echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list ``` 4. Update `apt` package index, install kubelet, kubeadm and kubectl, and pin their version: ```shell sudo apt-get update sudo apt-get install -y kubelet kubeadm kubectl sudo apt-mark hold kubelet kubeadm kubectl ``` </ins> {{% /tab %}} {{% tab name="Red Hat-based distributions" %}} ```bash

### Install using native package management {{< tabs name="kubectl_install" >}} <del> {{< tab name="Ubuntu, Debian or HypriotOS" codelang="bash" >}} sudo apt-get update && sudo apt-get install -y apt-transport-https gnupg2 curl curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add - echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee -a /etc/apt/sources.list.d/kubernetes.list sudo apt-get update sudo apt-get install -y kubectl {{< /tab >}} </del> <ins> {{% tab name="Debian-based distributions" %}} 1. Update the `apt` package index and install packages needed to use the Kubernetes `apt` repository: ```shell sudo apt-get update sudo apt-get install -y apt-transport-https ca-certificates curl ``` 2. Download the Google Cloud public signing key: ```shell sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg ``` 3. Add the Kubernetes `apt` repository: ```shell echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list ``` 4. Update `apt` package index with the new repository and install kubectl: ```shell sudo apt-get update sudo apt-get install -y kubectl ``` {{% /tab %}} </ins> <del> {{< tab name="CentOS, RHEL or Fedora" codelang="bash" >}}cat <<EOF > /etc/yum.repos.d/kubernetes.repo </del> <ins> {{< tab name="Red Hat-based distributions" codelang="bash" >}} cat <<EOF > /etc/yum.repos.d/kubernetes.repo </ins> [kubernetes] name=Kubernetes baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64