Replace usage of apt_key in ansible tasks

[mboersma]

Is your feature request related to a problem? Please describe.

Image builder is using the Ansible apt_key module, but it is deprecated as specified in the module notes. It may stop working with Ubuntu 24.04.

Describe the solution you'd like

A more future-proof way is using the get_url module as described in this blog post, for example.

I tried that approach in #1280 but could not get it to work on Ubuntu 20.04, only 22.04, so I stuck with the working apt_key approach for now.

Describe alternatives you've considered

Additional context

/kind feature

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[mboersma]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[richardcase]

/reopen

[k8s-ci-robot]

@richardcase: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[cunningr]

Today we seem to be hitting an issue related to this whilst trying to build Ubuntu 22.04:

    qemu: TASK [kubernetes : Add the Kubernetes repo key] ********************************
    qemu: fatal: [default]: FAILED! => {"after": ["D94AA3F0EFE21092", "871920D1991BC93C"], "before": ["D94AA3F0EFE21092", "871920D1991BC93C"], "changed": true, "fp": "234654DA9A296436", "id": "234654DA9A296436", "key_id": "234654DA9A296436", "msg": "apt-key did not return an error, but failed to add the key (check that the id is correct and *not* a subkey)", "short_id": "9A296436"}
    qemu:
    qemu: PLAY RECAP *********************************************************************
    qemu: default                    : ok=39   changed=32   unreachable=0    failed=1    skipped=293  rescued=0    ignored=0

[iainstott-thg]

Today we seem to be hitting an issue related to this whilst trying to build Ubuntu 22.04:

    qemu: TASK [kubernetes : Add the Kubernetes repo key] ********************************
    qemu: fatal: [default]: FAILED! => {"after": ["D94AA3F0EFE21092", "871920D1991BC93C"], "before": ["D94AA3F0EFE21092", "871920D1991BC93C"], "changed": true, "fp": "234654DA9A296436", "id": "234654DA9A296436", "key_id": "234654DA9A296436", "msg": "apt-key did not return an error, but failed to add the key (check that the id is correct and *not* a subkey)", "short_id": "9A296436"}
    qemu:
    qemu: PLAY RECAP *********************************************************************
    qemu: default                    : ok=39   changed=32   unreachable=0    failed=1    skipped=293  rescued=0    ignored=0

I just hit this issue, and it was because the GPG Repo Key for the version of Kubernetes I was trying to build had expired. Bumped up the version to 1.28 and building started again.

[cunningr]

Indeed - I was able to hack around it by hard coding the APT repo version in that ansible task to one that works and still building with the k8s version I actually need. Unfortunately we can't just take whatever version of k8s happens to have a valid APT key and the cluster-api image builder automation uses the k8s version to build the APT repo string.