kubernetes / kubernetes/website
Instructions for `pkgs.k8s.io` should be updated to check GPG fingerprint
- Dominant language
- HTML
- Stars
- 5.4k
- Forks
- 15.7k
- Avg merge
- 4d 18h
- Merged PRs (30d)
- 204
Description
https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/
https://kubernetes.io/blog/2023/08/15/pkgs-k8s-io-introduction/
The current documentations instruct to trust `https://pkgs.k8s.io/core:/stable:/v1.28/deb/Release.key` without checking its fingerprint:
https://github.com/kubernetes/website/blob/833291687fd2a241efd3cb295dc4973af3696942/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md?plain=1#L181-L192
This doesn't seem to be more secure than just relying on HTTPS.
The documentation should be updated to check its fingerprint.
Or, the GPG can be just removed if the HTTPS infrastructure for `https://pkgs.k8s.io` is considered to be trustable.
Contributor guide
Research direction
Start with content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md, especially the instructions around lines 181-192, and review the linked pkgs.k8s.io introduction. Determine how the documentation should address verification of Release.key or its removal. Done means the installation guidance clearly reflects the chosen trust and verification approach.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100