Use GPG key signing

Author: deric

manifests/repos.pp

@@ -71,17 +71,37 @@
     }
     case $facts['os']['family'] {
       'Debian': {
-        $codename = fact('os.distro.codename')
-        apt::source { 'kubernetes':
-          location => pick($kubernetes_apt_location,"https://pkgs.k8s.io/core:/stable:/v${minor_version}/deb"),
-          release  => pick($kubernetes_apt_release, '/'),
-          repos    => $_repos,
-          key      => {
-            'id'     => pick($kubernetes_key_id,'DE15B14486CD377B9E876E1A234654DA9A296436'),
-            'source' => pick($kubernetes_key_source,"https://pkgs.k8s.io/core:/stable:/v${minor_version}/deb/Release.key"),
-          },
+        if $kubernetes_apt_location =~ String[1] {
+          apt::source { 'kubernetes':
+            location => pick($kubernetes_apt_location,"https://pkgs.k8s.io/core:/stable:/v${minor_version}/deb"),
+            release  => pick($kubernetes_apt_release, '/'),
+            repos    => $_repos,
+            key      => {
+              'id'     => $kubernetes_key_id,
+              'source' => $kubernetes_key_source,
+            },
+          }
+        } else {
+          # For pkgs.k8s.io use GPG siging key
+          $_keyring = '/etc/apt/keyrings/kubernetes-apt-keyring.gpg'
+          archive { '/tmp/kubernetes-apt-keyring.gpg':
+            source          => "https://pkgs.k8s.io/core:/stable:/v${minor_version}/deb/Release.key",
+            extract         => true,
+            extract_path    => '/etc/apt/keyrings/',
+            extract_command => 'gpg --dearmor < %s > kubernetes-apt-keyring.gpg',
+            creates         => $_keyring,
+          }
+
+          apt::source { 'kubernetes':
+            location => pick($kubernetes_apt_location,"https://pkgs.k8s.io/core:/stable:/v${minor_version}/deb"),
+            release  => pick($kubernetes_apt_release, '/'),
+            repos    => $_repos,
+            keyring  => $_keyring,
+            require  => Archive['/tmp/kubernetes-apt-keyring.gpg'],
+          }
         }
 
+        $codename = fact('os.distro.codename')
         if ($container_runtime == 'docker' and $manage_docker == true) or
         ($container_runtime == 'cri_containerd' and $containerd_install_method == 'package') {
           apt::source { 'docker':

spec/classes/repos_spec.rb

@@ -48,13 +48,13 @@
         ensure: 'present',
         location: 'https://pkgs.k8s.io/core:/stable:/v1.28/deb',
         release: '/',
-        key: { 'id' => 'DE15B14486CD377B9E876E1A234654DA9A296436', 'source' => 'https://pkgs.k8s.io/core:/stable:/v1.28/deb/Release.key' },
+        keyring: '/etc/apt/keyrings/kubernetes-apt-keyring.gpg',
       )
     }
 
     it {
       expect(subject).to contain_file('/etc/apt/sources.list.d/kubernetes.list')
-      .with_content(%r{^deb https://pkgs.k8s.io/core:/stable:/v1.28/deb /\s$})
+        .with_content(%r{^deb \[signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg\] https://pkgs.k8s.io/core:/stable:/v1.28/deb /\s$})
     }
 
     it {