apt-key deprecated

apt-key has been deprecated. The reason is explained in 1 (the way apt-key works, adding all the keys to a single /etc/apt/trusted.gpg file, and trusting all the keys for packages irrespective of )

From the apt-key manpage:

 DEPRECATION
  
 Except for using apt-key del in maintainer scripts, the use of apt-key is deprecated. This
 section shows how to replace existing use of apt-key.
  
 If your existing use of apt-key add looks like this:
  
 wget -qO- https://myrepo.example/myrepo.asc | sudo apt-key add -
  
 Then you can directly replace this with (though note the recommendation below):
  
 wget -qO- https://myrepo.example/myrepo.asc | sudo tee /etc/apt/trusted.gpg.d/myrepo.asc
  
 Make sure to use the "asc" extension for ASCII armored keys and the "gpg" extension for
 the binary OpenPGP format (also known as "GPG key public ring"). The binary OpenPGP format
 works for all apt versions, while the ASCII armored format works for apt version >= 1.4.
  
 Recommended: Instead of placing keys into the /etc/apt/trusted.gpg.d directory, you can
 place them anywhere on your filesystem by using the Signed-By option in your sources.list
 and pointing to the filename of the key. See sources.list(5) for details. Since APT 2.4,
 /etc/apt/keyrings is provided as the recommended location for keys not managed by
 packages. When using a deb822-style sources.list, and with apt version >= 2.4, the
 Signed-By option can also be used to include the full ASCII armored keyring directly in
 the sources.list without an additional file

The deb822-style format to describe repositories is explained in detail in the sources.list manpages. A simple example comparing the traditional and deb822-style formats (from the manpages):

 As an example, the sources for your distribution could look like this in one-line-style
 format:
  
     deb http://us.archive.ubuntu.com/ubuntu lunar main restricted
     deb http://security.ubuntu.com/ubuntu lunar-security main restricted
     deb http://us.archive.ubuntu.com/ubuntu lunar-updates main restricted
  
 or like this in deb822 style format:
  
     Types: deb
     URIs: http://us.archive.ubuntu.com/ubuntu
     Suites: lunar lunar-updates
     Components: main restricted
  
     Types: deb
     URIs: http://security.ubuntu.com/ubuntu
     Suites: lunar-security
     Components: main restricted

For an example on how to remove old keys causing warnings, see 2

For ansible, use the module deb822_repository instead of apt_key and apt_repository. Example:

...
vars:
    k8s_node_pre_k8s_pkg_version: 1.32.2-1.1
...
tasks:
...
    - name: Configure k8s repository
        ansible.builtin.deb822_repository:
        name: kubernetes
        types: deb
        uris: "https://pkgs.k8s.io/core:/stable:/v{{ k8s_node_pre_k8s_pkg_version[0:4] }}/deb/"
        suites: /
        signed_by: "https://pkgs.k8s.io/core:/stable:/v{{ k8s_node_pre_k8s_pkg_version[0:4] }}/deb/Release.key"

This will create these 2 files in the target:

# cat /etc/apt/sources.list.d/kubernetes.sources
X-Repolib-Name: kubernetes
Signed-By: /etc/apt/keyrings/kubernetes.asc
Suites: /
Types: deb
URIs: https://pkgs.k8s.io/core:/stable:/v1.32/deb/
  
# cat /etc/apt/keyrings/kubernetes.asc
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.5 (GNU/Linux)

mQENBGMHoXcBCADukGOEQyleViOgtkMVa7hKifP6POCTh+98xNW4TfHK/nBJN2sm
...
-----END PGP PUBLIC KEY BLOCK-----

apt-key deprecated

References

See Also: