Skip to content

Got "repomd.xml signature could not be verified for kubernetes" error when installing Kubernetes from yum repo on Amazon Linux 2 #60134

Closed
Closed
Got "repomd.xml signature could not be verified for kubernetes" error when installing Kubernetes from yum repo on Amazon Linux 2#60134
Labels
area/provider/awsIssues or PRs related to aws providerkind/bugCategorizes issue or PR as related to a bug.sig/releaseCategorizes an issue or PR as relevant to SIG Release.

Description

@AlexStasko
AlexStasko
opened on Feb 21, 2018

Is this a BUG REPORT or FEATURE REQUEST?:
/kind bug

What happened:

I'm trying to install Kubernetes on Amazon Linux 2 as described here, but I get error:

[user@example.com ~]$ sudo yum install -y kubelet kubeadm kubectl
Loaded plugins: langpacks, priorities, update-motd
kubernetes/signature                                                                                                                                                                        |  454 B  00:00:00     
Retrieving key from https://packages.cloud.google.com/yum/doc/yum-key.gpg
Importing GPG key 0xA7317B0F:
 Userid     : "Google Cloud Packages Automatic Signing Key <gc-team@google.com>"
 Fingerprint: d0bc 747f d8ca f711 7500 d6fa 3746 c208 a731 7b0f
 From       : https://packages.cloud.google.com/yum/doc/yum-key.gpg
Retrieving key from https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
kubernetes/signature                                                                                                                                                                        | 1.4 kB  00:00:00 !!! 
https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64/repodata/repomd.xml: [Errno -1] repomd.xml signature could not be verified for kubernetes
Trying other mirror.


 One of the configured repositories failed (Kubernetes),
 and yum doesn't have enough cached data to continue. At this point the only
 safe thing yum can do is fail. There are a few ways to work "fix" this:

     1. Contact the upstream for the repository and get them to fix the problem.

     2. Reconfigure the baseurl/etc. for the repository, to point to a working
        upstream. This is most often useful if you are using a newer
        distribution release than is supported by the repository (and the
        packages for the previous distribution release still work).

     3. Run the command with the repository temporarily disabled
            yum --disablerepo=kubernetes ...

     4. Disable the repository permanently, so yum won't use it by default. Yum
        will then just ignore the repository until you permanently enable it
        again or use --enablerepo for temporary usage:

            yum-config-manager --disable kubernetes
        or
            subscription-manager repos --disable=kubernetes

     5. Configure the failing repository to be skipped, if it is unavailable.
        Note that yum will try to contact the repo. when it runs most commands,
        so will have to try and fail each time (and thus. yum will be be much
        slower). If it is a very temporary problem though, this is often a nice
        compromise:

            yum-config-manager --save --setopt=kubernetes.skip_if_unavailable=true

failure: repodata/repomd.xml from kubernetes: [Errno 256] No more mirrors to try.
https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64/repodata/repomd.xml: [Errno -1] repomd.xml signature could not be verified for kubernetes

What you expected to happen:
Successful installation kubelet kubeadm kubectl

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?:

Environment:

  • Kubernetes version (use kubectl version): I guess should be 1.9.3
  • Cloud provider or hardware configuration: AWS
  • OS (e.g. from /etc/os-release):
NAME="Amazon Linux"
VERSION="2 (2017.12)"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2 (2017.12) LTS Release Candidate"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
HOME_URL="https://amazonlinux.com/"
  • Kernel (e.g. uname -a):
Linux 4.9.76-38.79.amzn2.x86_64 #1 SMP Mon Jan 15 23:35:15 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
  • Install tools:
  • Others:

Activity

  1. k8s-ci-robot
    added
    needs-sigIndicates an issue or PR lacks a `sig/foo` label and requires one.
    kind/bugCategorizes issue or PR as related to a bug.
    on Feb 21, 2018

  2. AlexStasko commented on Feb 22, 2018

    @AlexStasko
    AlexStasko
    on Feb 22, 2018
    Author

    /sig aws

  3. k8s-ci-robot
    added
    sig/aws
    and removed
    needs-sigIndicates an issue or PR lacks a `sig/foo` label and requires one.
    on Feb 22, 2018

  4. AlexStasko commented on Feb 26, 2018

    @AlexStasko
    AlexStasko
    on Feb 26, 2018
    Author

    Any thought?

  5. 3dbrows commented on Mar 8, 2018

    @3dbrows
    3dbrows
    on Mar 8, 2018

    I'm seeing the same. You can get it to work by setting repo_gpgcheck=0 in /etc/yum.repos.d/kubernetes.repo but that is obviously not a real solution.

  6. DylanGraham commented on May 2, 2018

    @DylanGraham
    DylanGraham
    on May 2, 2018
    Member

    You can re-import the keys:
    rpm --import https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg

  7. guilhemmarchand commented on Jun 9, 2018

    @guilhemmarchand
    guilhemmarchand
    on Jun 9, 2018

    Hi,

    Same problem here running, using repo_gpgcheck=0 fixes it but shouldn't that be fixed ?

  8. kiithwarrior commented on Jun 13, 2018

    @kiithwarrior
    kiithwarrior
    on Jun 13, 2018

    repo_gpgcheck=0 worked for me as well, needs a better solution

  9. bjethwan commented on Jun 17, 2018

    @bjethwan
    bjethwan
    on Jun 17, 2018

    It's still failing while I was trying to install kubectl on ec2 with amazon linux

  10. fejta-bot commented on Sep 15, 2018

    @fejta-bot
    fejta-bot
    on Sep 15, 2018

    Issues go stale after 90d of inactivity.
    Mark the issue as fresh with /remove-lifecycle stale.
    Stale issues rot after an additional 30d of inactivity and eventually close.

    If this issue is safe to close now please do so with /close.

    Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
    /lifecycle stale

  11. k8s-ci-robot
    added
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale.
    on Sep 15, 2018

  12. ab0ris commented on Sep 26, 2018

    @ab0ris
    ab0ris
    on Sep 26, 2018

    just faced the same issue on AWS EC@ instance with Amazon Linux 2 installed

  13. zr2d2 commented on Sep 30, 2018

    @zr2d2
    zr2d2
    on Sep 30, 2018

    /remove-lifecycle stale

  14. 51 remaining items

  15. mattsawyer77 commented on Apr 1, 2021

    @mattsawyer77
    mattsawyer77
    on Apr 1, 2021

    It appears that this issue, or one very similar, has recurred in the last few days. We've found that we can't create new nodes currently, and we're getting essentially the same error as the OP.

  16. luk4z7 commented on Apr 1, 2021

    @luk4z7
    luk4z7
    on Apr 1, 2021

    @mattsawyer77 I had the same issue early in this morning, but in centos 7 and gnupg2 2.0.22

  17. jValdron commented on Apr 1, 2021

    @jValdron
    jValdron
    on Apr 1, 2021

    @mattsawyer77 / @luk4z7, see #97077 (comment)

    Solved the issue for me.

    EDIT: Nevermind, it did not :(

  18. dkleissa commented on Apr 1, 2021

    @dkleissa
    dkleissa
    on Apr 1, 2021

    I think I'm agreeing with @mattsawyer77.

    While we're running a different setup (not on Amazon Linux 2), in CentOS7 installs have started to fail with the https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64/repodata/repomd.xml: [Errno -1] repomd.xml signature could not be verified for kubernetes error.

    I can reproduce the issue by starting a centos7 container and trying to install anything.

    Interesting data points:

    • This was working fine as of 6pm EDT on 2021-03-31
    • We noticed first failures around 8am EDT on 2021-04-01
    • If we compare an existing, recent installation that is still up the keys look different, but still fail even on the "old" node.

    Current output when installing:

    kubernetes/x86_64/signature                                                                                                                                                        |  844 B  00:00:00
Retrieving key from https://packages.cloud.google.com/yum/doc/yum-key.gpg
Importing GPG key 0xA7317B0F:
 Userid     : "Google Cloud Packages Automatic Signing Key <gc-team@google.com>"
 Fingerprint: d0bc 747f d8ca f711 7500 d6fa 3746 c208 a731 7b0f
 From       : https://packages.cloud.google.com/yum/doc/yum-key.gpg
Is this ok [y/N]: y
Retrieving key from https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
kubernetes/x86_64/signature                                                                                                                                                        | 1.4 kB  00:00:11 !!!
https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64/repodata/repomd.xml: [Errno -1] repomd.xml signature could not be verified for kubernetes
Trying other mirror.

    output when trying yum commands on older, previously functioning node:

    kubernetes/signature                                                                                                                                                               |  844 B  00:00:00
Retrieving key from https://packages.cloud.google.com/yum/doc/yum-key.gpg
Importing GPG key 0x307EA071:
Userid     : "Rapture Automatic Signing Key (cloud-rapture-signing-key-2021-03-01-08_01_09.pub)"
Fingerprint: 7f92 e05b 3109 3bef 5a3c 2d38 feea 9169 307e a071
From       : https://packages.cloud.google.com/yum/doc/yum-key.gpg
Is this ok [y/N]: y
Retrieving key from https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
kubernetes/signature                                                                                                                                                               | 1.4 kB  00:00:17 !!!
https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64/repodata/repomd.xml: [Errno -1] repomd.xml signature could not be verified for kubernetes
Trying other mirror.
updates

    To reproduce:

    docker run -it centos:centos7 /bin/bash

    then:

    cat <<EOF | tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-\$basearch
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
exclude=kubelet kubeadm kubectl
EOF

    yum list -y kubectl

    Repeating this with docker run -it centos:centos8 /bin/bash works. Note in centos8 gnupg2-2.2.20-2.el8 is installed instead of gnupg2-2.0.22-5.el7_5.

  19. BenTheElder commented on Apr 2, 2021

    @BenTheElder
    BenTheElder
    on Apr 2, 2021
    Member

    current issue is tracked in kubernetes/release#1982 and is not the same as #60134 (comment)

    instead of an issue with the image it's an issue with usage of an expired key

  20. matzew
    added 3 commits that reference this issue on Apr 2, 2021

    Disable repo_gpgcheck for kube repo in build image: This is a fix acc…

    2ea30cc

    Disable repo_gpgcheck for kube repo in build image: This is a fix acc…

    0860806

    Disable repo_gpgcheck for kube repo in build image: This is a fix acc…

    80718ea
  21. openshift-merge-robot
    added a commit that references this issue on Apr 6, 2021

    Disable repo_gpgcheck for kube repo in build image: This is a fix acc…

    2eccc24
  22. matzew
    added a commit that references this issue on Apr 7, 2021

    Disable repo_gpgcheck for kube repo in build image: This is a fix acc…

    ed893e0
  23. openshift-merge-robot
    added a commit that references this issue on Apr 7, 2021

    Disable repo_gpgcheck for kube repo in build image: This is a fix acc…

    4b8e7b5

  24. apmmahesh25 commented on Nov 26, 2021

    @apmmahesh25
    apmmahesh25
    on Nov 26, 2021
    mv /etc/yum.repos.d/kubernetes.repo /etc/yum.repos.d/kubernetes.repo.bak
cat >> /etc/yum.repos.d/kubernetes.repo <<EOF
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
EOF

    retry

  25. ahuffman
    added a commit that references this issue on Apr 4, 2022

    fix: disable gpg checks on yum repo due to "kubernetes/kubernetes#60134"

    93ac700
  26. yggd
    added a commit that references this issue on May 22, 2022

    repomd.xml signature not verified. kubernetes/kubernetes#60134

    14006d1

  27. rafishaik1 commented on Jun 15, 2022

    @rafishaik1
    rafishaik1
    on Jun 15, 2022

    Try this way.It worked for me.
    rpm --import https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
    sudo yum install -y http://mirror.centos.org/centos/7/os/x86_64/Packages/gnupg2-2.0.22-5.el7_5.x86_64.rpm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/provider/awsIssues or PRs related to aws providerkind/bugCategorizes issue or PR as related to a bug.sig/releaseCategorizes an issue or PR as relevant to SIG Release.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions