release: Ubuntu kubernetes-xenial public key is not available: NO_PUBKEY B53DC80D13EDEF05

I had this happening right now, even if the key file was there and even if the value was correctly pulled from https://packages.cloud.google.com/apt/doc/apt-key.gpg.

I have fixed it by using a different URL for the key: https://dl.k8s.io/apt/doc/apt-key.gpg which I found here https://github.com/kubernetes/k8s.io/pull/4837#issuecomment-1446426585

curl -fsSLo /etc/apt/keyrings/kubernetes-archive-keyring.gpg https://dl.k8s.io/apt/doc/apt-key.gpg

I think the reproducer would be running apt update in an existing installation without manually updating the key. I ran into the same problem and just curling the new key fixed it for me. Note that the download location in the Kubernetes help pages changed and you might have to run sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg instead or update the location of the key file.

@khteh I can reproduce the apt-key behaviour, but it might be unrelated to the Kubernetes key. If you manually put the key in /etc/apt/trusted.gpg.d/ apt-key list shows it correctly and the apt update works.

Referring to https://github.com/kubernetes/k8s.io/pull/4837

They have updated their host address, so now we should update it to use the key from https://dl.k8s.io/apt/doc/apt-key.gpg. Then use something like:

sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://dl.k8s.io/apt/doc/apt-key.gpg
echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo apt-get update -y

Don’t add trusted=yes! This is dangerous and will tell apt to ignore the result of key verification.

The error I saw:

Get:2 https://packages.cloud.google.com/apt kubernetes-xenial InRelease [8,993 B]
Err:2 https://packages.cloud.google.com/apt kubernetes-xenial InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B53DC80D13EDEF05
Reading package lists... Done
W: GPG error: https://packages.cloud.google.com/apt kubernetes-xenial InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B53DC80D13EDEF05
E: The repository 'https://apt.kubernetes.io kubernetes-xenial InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.

The fix was almost the same as the debian comment above:

sudo mkdir -p /etc/apt/keyrings
echo "deb [signed-by=/etc/apt/keyrings/kubernetes.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes.gpg

sudo mkdir -p /etc/apt/keyrings
echo "deb [signed-by=/etc/apt/keyrings/kubernetes.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes.gpg

From below

On Ubuntu 20.04.6, there is no /etc/apt/keyrings directory to start with

Please instead read this advice (quoting from the docs):

Note: In releases older than Debian 12 and Ubuntu 22.04, /etc/apt/keyrings does not exist by default. You can create this directory if you need to, making it world-readable but writeable only by admins.

For the Debian project explanation of where to put the trust data, read https://wiki.debian.org/DebianRepository/UseThirdParty#OpenPGP_certificate_distribution

Please also avoid recommending that Kubernetes users change the system-level package trust within /etc/apt/trusted.gpg.d. We’d much rather follow Debian’s recommended approach, which also states:

The certificate MUST NOT be placed in /etc/apt/trusted.gpg.d or loaded by apt-key add.

I used the information provided here: https://cloud.google.com/compute/docs/troubleshooting/known-issues#keyexpired-2

Specifically:

Command (Ubuntu): curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -

Command (Debian): curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -

Worked fine on the latest Debian Bullseye + Ubuntu 22.04.5 releases.

Cheers

This script worked for me on Ubuntu 22.04.2 LTS using WSL

curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --yes --dearmor -o /usr/share/keyrings/kubernetes-archive-keyring.gpg

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list > /dev/null

I’m seeing the same issue on my Ubuntu 20.04.5 machine:

$ sudo apt update             
...
Err:2 https://packages.cloud.google.com/apt kubernetes-xenial InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B53DC80D13EDEF05
...
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://packages.cloud.google.com/apt kubernetes-xenial InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B53DC80D13EDEF05
W: Failed to fetch https://apt.kubernetes.io/dists/kubernetes-xenial/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B53DC80D13EDEF05
W: Some index files failed to download. They have been ignored, or old ones used instead.

I believe the easiest solution is to download the https://packages.cloud.google.com/apt/doc/apt-key.gpg file and rename it to .asc. Then you don’t need to worry about dearmoring the file.

The instructions then become:

sudo curl -fsSLo /etc/apt/keyrings/kubernetes-archive-keyring.asc https://packages.cloud.google.com/apt/doc/apt-key.gpg
echo "deb [signed-by=/etc/apt/keyrings/kubernetes-archive-keyring.asc] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list

If you’re getting this error on Raspberry Pi OS as of the date of this post then try:

sudo curl -fsSLo /etc/apt/trusted.gpg.d/kubernetes-archive-keyring.gpg https://dl.k8s.io/apt/doc/apt-key.gpg

echo "deb [signed-by=/etc/apt/trusted.gpg.d/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list

I have the same issue and none of the workarounds are working. I’ve tried all the commands listed here and in the Kubectl installation. I am still getting this error upon running apt-get update:

Get:4 https://packages.cloud.google.com/apt kubernetes-xenial InRelease [8993 B]
Err:4 https://packages.cloud.google.com/apt kubernetes-xenial InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B53DC80D13EDEF05

DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04.5 LTS"

Ran into this issue today while making a debian container image.
None of the comments I read here worked, here’s what worked for me:

mkdir -p /etc/apt/keyrings
echo "deb [signed-by=/etc/apt/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /etc/apt/keyrings/cloud.google.gpg

@jtele2 thanks for reference for for the kubectl installation.

W: Failed to fetch https://apt.kubernetes.io/dists/kubernetes-xenial/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B53DC80D13EDEF05

After these commands: sudo curl -fsSLo /etc/apt/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg echo "deb [signed-by=/etc/apt/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list the warning has gone.

@saschagrunert This line is failing on my machine: curl -fsSLo /etc/apt/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg

$ curl -fsSLo /etc/apt/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg
curl: (23) Failed writing body (0 != 1210)

The recommendation from @aronneberg worked for me. After running sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg, I am able to apt update normally.

Linux deps

RUN apt-get update -y && apt-get install -y --no-install-recommends --no-install-suggests  ca-certificates curl gpg

Kubernetes install

RUN mkdir -p /etc/apt/keyrings && mkdir -p /root/.kube/
RUN curl -fsSL "https://packages.cloud.google.com/apt/doc/apt-key.gpg" | gpg --dearmor -o /etc/apt/trusted.gpg.d/kubernetes-archive-keyring.gpg
RUN echo 'deb http://apt.kubernetes.io/ kubernetes-xenial main' > /etc/apt/sources.list.d/kubernetes.list

RUN apt-get update -y -qq && apt-get install -y -qq --no-install-recommends --no-install-suggests kubectl

This worked for me. Thanks. 😃

Worked for me with the modern way as well (ubuntu server 22.04).

curl -fsSL “https://packages.cloud.google.com/apt/doc/apt-key.gpg” | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/kubernetes-archive-keyring.gpg

echo ‘deb https://packages.cloud.google.com/apt kubernetes-xenial main’ > /etc/apt/sources.list.d/kubernetes.list

Agreed! Looks like it is just a docs update needed. I did previously experience the HTTP 500 responses but these are responding as expected now. The GPG key present at https://packages.cloud.google.com/apt/doc/apt-key.gpg was fine, but I needed to run the following to allow it’s addition to the sources.list.d entry:

curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /etc/apt/keyrings/kubernetes-archive-keyring.gpg

I was then able to add the following apt source entry which stopped the NO_PUBKEY issue occurring. I suspect that this is due to some kind of deprecated key format since I see apt-key’s documentation up till 21.10 doesn’t show a deprecation of apt-key add. In the deprecation notes thereafter, the key must be:

binary OpenPGP format (also known as “GPG key public ring”)

You can see the difference in the file output:

root@kube-1:/etc/apt/keyrings# curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg > old-format.gpg
root@kube-1:/etc/apt/keyrings# curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /etc/apt/keyrings/kubernetes-archive-keyring.gpg
root@kube-1:/etc/apt/keyrings# file ./old-format.gpg
./old-format.gpg: PGP public key block Public-Key (old)
root@kube-1:/etc/apt/keyrings# file ./kubernetes-archive-keyring.gpg
./kubernetes-archive-keyring.gpg: OpenPGP Public Key Version 4, Created Sat May 21 09:50:12 2022, RSA (Encrypt or Sign, 2048 bits); User ID; Signature; OpenPGP Certificate

On Ubuntu 20.04.6, there is no /etc/apt/keyrings directory to start with

Please instead read this advice (quoting from the docs):

Note: In releases older than Debian 12 and Ubuntu 22.04, /etc/apt/keyrings does not exist by default. You can create this directory if you need to, making it world-readable but writeable only by admins.

For the Debian project explanation of where to put the trust data, read https://wiki.debian.org/DebianRepository/UseThirdParty#OpenPGP_certificate_distribution

Please also avoid recommending that Kubernetes users change the system-level package trust within /etc/apt/trusted.gpg.d. We’d much rather follow Debian’s recommended approach, which also states:

The certificate MUST NOT be placed in /etc/apt/trusted.gpg.d or loaded by apt-key add.

I have tried all suggested commands. Unsuccessfully. The error remains the same: NO_PUBKEY B53DC80D13EDEF05

follow https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/#install-using-native-package-management

I’m on a Ubuntu 20.04.5 machine and the @aronneberg workaround worked for me while @N3X14 workaround don’t.

Solved for me using the modern way mentioned many times on this thread:

From (Old)

curl -s \
    https://packages.cloud.google.com/apt/doc/apt-key.gpg \
    -o /etc/apt/trusted.gpg.d/packages-cloud-google-apt.gpg && \

To (New)

curl -fsSL "https://packages.cloud.google.com/apt/doc/apt-key.gpg" | gpg --dearmor -o /etc/apt/trusted.gpg.d/kubernetes-archive-keyring.gpg && \

It was mentioned above you could change the extension from .gpg to .asc w/o dearmor but i have not tested it, e.g

curl -s \
    https://packages.cloud.google.com/apt/doc/apt-key.gpg \
    -o /etc/apt/trusted.gpg.d/packages-cloud-google-apt.asc && \

Solved for me using the modern way mentioned many times on this thread:

From (Old)

curl -s \
    https://packages.cloud.google.com/apt/doc/apt-key.gpg \
    -o /etc/apt/trusted.gpg.d/packages-cloud-google-apt.gpg && \

To (New)

curl -fsSL "https://packages.cloud.google.com/apt/doc/apt-key.gpg" | gpg --dearmor -o /etc/apt/trusted.gpg.d/kubernetes-archive-keyring.gpg && \

Note that /etc/apt/keyrings is deprecated in some distros in favor of sudo gpg --dearmor with /etc/apt/trusted.gpg.d/

@crisbal you saved my day. it works

FIXED!

sudo apt update

Err:2 https://packages.cloud.google.com/apt kubernetes-xenial InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B53DC80D13EDEF05

sudo curl -fsSLo /etc/apt/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg

curl: (23) Failed writing body (0 != 1210)

sudo mkdir /etc/apt/keyrings
sudo curl -fsSLo /etc/apt/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg
sudo apt update

Get:7 https://packages.cloud.google.com/apt kubernetes-xenial/main amd64 Packages [65.7 kB]

It seems curl is unable to create the keyrings folder inside the /etc/apt/ directory. I just created it manually and it worked!

Please see the email thread - https://groups.google.com/a/kubernetes.io/g/dev/c/gR5xDzzIcW8/m/SK5ARWkGAQAJ

and the work around in that thread or here - https://github.com/kubernetes/k8s.io/pull/4837#issuecomment-1446426585

/close

Works for me by following gobygo-rgb suggestions.

RUN echo “deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://apt.kubernetes.io/ kubernetes-xenial main” | tee /etc/apt/sources.list.d/kubernetes.list

still facing this issue please hep me:

@crisbal your updated key source worked for me, but I had to put it in /usr/share/keyrings to update my existing installation. I don’t know if I should uninstall and reinstall so it uses /etc/apt/trusted.gpg.d instead, since @nyetwurk says that’s the modern way.

Here’s the fix that worked for me:

sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://dl.k8s.io/apt/doc/apt-key.gpg

Anahtar dosyası orada olsa ve değer doğru bir şekilde https://packages.cloud.google.com/apt/doc/apt-key.gpg.

Anahtar için farklı bir URL kullanarak düzelttim: https://dl.k8s.io/apt/doc/apt-key.gpgburada bulduğum kubernetes/k8s.io#4837 (yorum)

curl -fsSLo /etc/apt/keyrings/kubernetes-archive-keyring.gpg https://dl.k8s.io/apt/doc/apt-key.gpg

it is working for me. you survived my cluster friend thank you 😃

seriously saved the day, literally was trying to reinstall kubectl and this shit happened. I almost needed a new screen. @crisbal u saved a screen from a screw driver in the middle

@crisbal only fix that works.

words for google: W: GPG error: https://packages.cloud.google.com/apt kubernetes-xenial InRelease: The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY E: The repository ‘https://apt.kubernetes.io kubernetes-xenial InRelease’ is not signed.