【发布时间】：2023-03-17 20:19:01
【问题描述】：
我在 ansible 中有一本剧本，它从具有无效密钥的存储库安装软件包：
- name: Add Cloudera key
apt_key:
keyserver: keys.gnupg.net
id: F36A89E33CC1BD0F71079007327574EE02A818DD
- name: Install Cloudera packages
apt:
name: {{ item }}
update_cache: yes
state: latest
allow_unautenticated: yes
with_items:
- sudo
- libssl-dev
- ....
但是ansible更新缓存失败：
"msg": "Failed to update apt cache: W:GPG error: http://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh jessie-cdh5 InRelease: The following signatures were invalid: F36A89E33CC1BD0F71079007327574EE02A818DD, E:The repository 'http://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh jessie-cdh5 InRelease' is not signed."
即使allow_unauthenticated 选项或force 选项设置为yes。如何用这些关键问题更新缓存？
EDIT 重现此行为的apt 命令是：
sudo wget 'https://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh/cloudera.list' \ -O /etc/apt/sources.list.d/cloudera.list
sudo apt-get update
W: GPG error: http://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh jessie-cdh5 InRelease: The following signatures were invalid: F36A89E33CC1BD0F71079007327574EE02A818DD
W: The repository 'http://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh jessie-cdh5 InRelease' is not signed.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.
但我可以继续发出命令
sudo apt-get install hadoop-hdfs-namenode
并在警告后安装包。 Ansible 正在考虑上面的警告 (W The following signatures were invalid)，这是来自 Cloudera 方面的错误，它提供了错误的密钥或错误的签名存储库，但继续前进并安装了包：
dpkg -l | grep hadoop-hdfs-namenode
ii hadoop-hdfs-namenode 2.6.0+cdh5.14.2+2748-1.cdh5.14.2.p0.11~jessie-cdh5.14.2 all Name Node for Hadoop
所以我想要实现的是 Ansible 重现了这种行为：执行 apt-get update 命令并继续，而无需退出更新部分。 Ansible 可以使用 allow_unauthenticated 选项从未签名的存储库安装包。
EDIT #2：完整的 ansible 命令如下：
iveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/user/.ansible/cp/be00dd5395 -tt 192.168.9.22 '/bin/sh -c '"'"'sudo -H -S -n -u root /bin/sh -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-thnmveqcmiwmvbdbabglejbbsaidohqe; /usr/bin/python /home/user/.ansible/tmp/ansible-tmp-1528224540.4225562-47865757921408/apt.py'"'"'"'"'"'"'"'"' && sleep 0'"'"''
Escalation succeeded
<192.168.9.22> (1, b'\r\n{"msg": "Failed to update apt cache: W:GPG error: http://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh jessie-cdh5 InRelease: The following signatures were invalid: F36A89E33CC1BD0F71079007327574EE02A818DD, E:The repository \'http://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh jessie-cdh5 InRelease\' is not signed.", "failed": true, "exception": " File \\"/tmp/ansible_RDFb3C/ansible_module_apt.py\\", line 991, in main\\n cache.update()\\n File \\"/usr/lib/python2.7/dist-packages/apt/cache.py\\", line 464, in update\\n raise FetchFailedException(e)\\n", "invocation": {"module_args": {"dpkg_options": "force-confdef,force-confold", "upgrade": null, "force": false, "force_apt_get": false, "install_recommends": null, "package": ["sudo", "build-essential", "python-dev", "python3-dev", "openjdk-8-jdk", "git", "libssl-dev", "libsqlite3-dev", "zlib1g-dev", "bzip2", "libreadline-dev", "vim", "rsync", "apt-transport-https", "vsftpd", "ftp", "tmux", "postgresql", "postgresql-client", "libpq-dev", "python-psycopg2", "ntp", "r-base"], "autoclean": false, "name": ["sudo", "build-essential", "python-dev", "python3-dev", "openjdk-8-jdk", "git", "libssl-dev", "libsqlite3-dev", "zlib1g-dev", "bzip2", "libreadline-dev", "vim", "rsync", "apt-transport-https", "vsftpd", "ftp", "tmux", "postgresql", "postgresql-client", "libpq-dev", "python-psycopg2", "ntp", "r-base"], "purge": false, "allow_unauthenticated": true, "state": "latest", "autoremove": false, "update_cache": true, "default_release": null, "only_upgrade": false, "deb": null, "cache_valid_time": 0}}}\r\n', b'Shared connection to 192.168.9.22 closed.\r\n')
<192.168.9.22> ESTABLISH SSH CONNECTION FOR USER: None
<192.168.9.22> SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/user/.ansible/cp/be00dd5395 192.168.9.22 '/bin/sh -c '"'"'rm -f -r /home/user/.ansible/tmp/ansible-tmp-1528224540.4225562-47865757921408/ > /dev/null 2>&1 && sleep 0'"'"''
<192.168.9.22> (0, b'', b'')
The full traceback is:
File "/tmp/ansible_RDFb3C/ansible_module_apt.py", line 991, in main
cache.update()
File "/usr/lib/python2.7/dist-packages/apt/cache.py", line 464, in update
raise FetchFailedException(e)
failed: [192.168.9.22] (item=['sudo', 'build-essential', 'python-dev', 'python3-dev', 'openjdk-8-jdk', 'git', 'libssl-dev', 'libsqlite3-dev', 'zlib1g-dev', 'bzip2', 'libreadline-dev', 'vim', 'rsync', 'apt-transport-https', 'vsftpd', 'ftp', 'tmux', 'postgresql', 'postgresql-client', 'libpq-dev', 'python-psycopg2', 'ntp', 'r-base']) => {
"changed": false,
"invocation": {
"module_args": {
"allow_unauthenticated": true,
"autoclean": false,
"autoremove": false,
"cache_valid_time": 0,
"deb": null,
"default_release": null,
"dpkg_options": "force-confdef,force-confold",
"force": false,
"force_apt_get": false,
"install_recommends": null,
"name": [
"sudo",
"build-essential",
"python-dev",
"python3-dev",
"openjdk-8-jdk",
"git",
"libssl-dev",
"libsqlite3-dev",
"zlib1g-dev",
"bzip2",
"libreadline-dev",
"vim",
"rsync",
"apt-transport-https",
"vsftpd",
"ftp",
"tmux",
"postgresql",
"postgresql-client",
"libpq-dev",
"python-psycopg2",
"ntp",
"r-base"
],
"only_upgrade": false,
"package": [
"sudo",
"build-essential",
"python-dev",
"python3-dev",
"openjdk-8-jdk",
"git",
"libssl-dev",
"libsqlite3-dev",
"zlib1g-dev",
"bzip2",
"libreadline-dev",
"vim",
"rsync",
"apt-transport-https",
"vsftpd",
"ftp",
"tmux",
"postgresql",
"postgresql-client",
"libpq-dev",
"python-psycopg2",
"ntp",
"r-base"
],
"purge": false,
"state": "latest",
"update_cache": true,
"upgrade": null
}
},
"item": [
"sudo",
"build-essential",
"python-dev",
"python3-dev",
"openjdk-8-jdk",
"git",
"libssl-dev",
"libsqlite3-dev",
"zlib1g-dev",
"bzip2",
"libreadline-dev",
"vim",
"rsync",
"apt-transport-https",
"vsftpd",
"ftp",
"tmux",
"postgresql",
"postgresql-client",
"libpq-dev",
"python-psycopg2",
"ntp",
"r-base"
],
"msg": "Failed to update apt cache: W:GPG error: http://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh jessie-cdh5 InRelease: The following signatures were invalid: F36A89E33CC1BD0F71079007327574EE02A818DD, E:The repository 'http://archive.cloudera.com/cdh5/debian/jessie/amd64/cdh jessie-cdh5 InRelease' is not signed."
}
【问题讨论】：
-
apt 实际上会更新缓存，即使有警告，如果发出
apt install命令，则会出现提示，如果接受，则继续安装。似乎 ansible 将有关键的警告视为错误，并且本应解决此问题的两个参数都不起作用。 -
正是我所做的。我用
-vvv重新运行了命令，即使有消息，apt部分有效，而 ansible 部分无效。我正在尝试提出一些解决方案，因为我不想放弃 ansible 并手动完成这部分，而且我无法从 Cloudera 更改签名密钥。例如，从外部存储库添加密钥和安装包的相同过程适用于 CRAN R。 -
我更新了问题以反映我认为您在问什么。
-
顺便说一句，供应商似乎意识到了这个问题，但没有提供解决方案：community.cloudera.com/t5/CDH-Manual-Installation/…