Release.key URL redirect causes problem with Cloud Init and gpg about k8s.io

[ScottS-byte]

Tickle this as it still happens.

[BenTheElder]

/sig release
@xmudrii

[BenTheElder]

Should the documentation be update to reflect this issue?

This seems like a cloud-init bug, if anything?

How stable is the redirect URL?

Officially you should not depend on implementation details. We could have to switch backing hosts at any time. It is community run, funded on donations from vendors, and subject to change at any time.

For registry.k8s.io (container images) that is documented at https://registry.k8s.io#stability

I don't think we have a landing page or separate docs for pkgs.k8s.io currently.

Sorry for the delayed response, most of us are doing a LOT these days.

[BenTheElder]

Lots of services serve 302 to current hosts, cloud-init really ought to have a curl -L equivalent for this IMHO ...

[johnmanko]

@BenTheElder

If you look at the error, it's gpg that fails before the keyserver specified in the docs is a 302 redirect. gpg doesn't like that.

See my community question to get around this issue, notably "gpg doesn't have a built-in option to automatically follow redirects": https://serverfault.com/questions/1149572/cloud-init-cant-create-apt-source-from-k8s-io-due-to-302-redirect

I agree that this is Cloud Init, or rather gpg, issue at it's core, but I'm surprised that the docs don't at least mention the gpg restriction - that seems like it would be a common issue that users would face following the docs.

Anyway, if nothing else, it's documented here.

[xmudrii]

Should the documentation be update to reflect this issue?

The documentation covers a way that's known to work; it's to use curl and gpg combined together to the import the key. If you don't want to follow that, it's up to you to figure out the details. I don't think that we should have every possible combination documented.

This is in my opinion a topic for SIG Docs rather than SIG Release, I recommend reaching out to them if you think that the documentation should be improved.

How stable is the redirect URL?

@BenTheElder clearly described this (thank you!), we don't provide any guarantees on what URL is actually used by pkgs.k8s.io, that can be changed at any time and without any prior notification. If cloud-init can't handle this, I recommend finding another way around this.

This is documented in the official announcement, although it would be nice if pkgs.k8s.io had a landing page with the relevant information.

[xmudrii]

I created a new issue to track adding a landing page for pkgs.k8s.io: kubernetes/release#3496
I think we can close this issue because there's nothing else that we can do on our side. If you have any further questions or issues, please reopen this issue or create a new one.
/close

[k8s-ci-robot]

@xmudrii: Closing this issue.

In response to this:

I created a new issue to track adding a landing page for pkgs.k8s.io: kubernetes/release#3496
I think we can close this issue because there's nothing else that we can do on our side. If you have any further questions or issues, please reopen this issue or create a new one.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.