kubernetes / kubernetes/website

Instructions for `pkgs.k8s.io` should be updated to check GPG fingerprint

Open
#42,718 15 comments 2 reactions 0 assignees View on GitHub
language/en lifecycle/frozen needs-triage priority/awaiting-more-evidence sig/security
Dominant language
HTML
Stars
5.4k
Forks
15.7k
Avg merge
4d 18h
Merged PRs (30d)
204

Description

https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/
https://kubernetes.io/blog/2023/08/15/pkgs-k8s-io-introduction/

The current documentations instruct to trust `https://pkgs.k8s.io/core:/stable:/v1.28/deb/Release.key` without checking its fingerprint:

https://github.com/kubernetes/website/blob/833291687fd2a241efd3cb295dc4973af3696942/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md?plain=1#L181-L192

This doesn't seem to be more secure than just relying on HTTPS.
The documentation should be updated to check its fingerprint.
Or, the GPG can be just removed if the HTTPS infrastructure for `https://pkgs.k8s.io` is considered to be trustable.

Contributor guide

Open the contributing guide

Research direction

Start with content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md, especially the instructions around lines 181-192, and review the linked pkgs.k8s.io introduction. Determine how the documentation should address verification of Release.key or its removal. Done means the installation guidance clearly reflects the chosen trust and verification approach.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
documentation, security
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.