<p>I'm very new to Ansible and I'm trying to install kubectl on an EC2 instance (Ubuntu 18.04) for a class.</p>
<p>I have ran the playbook and it went well until it hit task 4 then threw the following error:</p>
<blockquote>
<p>fatal: [localhost]: FAILED! =&gt; {&quot;changed&quot;: false, &quot;msg&quot;: &quot;Failed to update apt cache: W:Updating from such a repository can't be done securely, and is therefore disabled by default., W:See apt-secure(8) manpage for repository creation and user configuration details., W:GPG error: <a href="https://packages.cloud.google.com/apt" rel="nofollow noreferrer">https://packages.cloud.google.com/apt</a> kubernetes-xenial InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY FEEA9169307EA071 NO_PUBKEY 8B57C5C2836F4BEB, E:The repository 'https://apt.kubernetes.io kubernetes-xenial InRelease' is not signed.&quot;}</p>
</blockquote>
<p>It now throws the same error on task 1 whenever I try to run it again. Can someone advise me on how to fix this?</p>
<p>This is the playbook I have written, it's based on an exercise I completed for installing Docker using Ansible and the commands given to me for installing kubectl:</p>
<pre><code>- name: A playbook to install kubectl on a VM
  hosts: localhost
  user: ubuntu
  become: yes

  tasks:
  - name: 1. Update APT Package Manager
    apt:
      update_cache: yes

  - name: 2. Install dependency packages
    apt:
      name={{ item }}
    with_items:
      - apt-transport-https
      - ca-certificates
      - curl
      - gnupg-agent
      - software-properties-common

  - name: 3. Get APT Key
    shell:
      cmd: curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
      cmd: echo &quot;deb https://apt.kubernetes.io/ kubernetes-xenial main&quot; | sudo tee -a /etc/apt/sources.list.d/kubernetes.list

  - name: 4. Update Packages
    apt:
      update_cache: yes

  - name: 5. Install Kubectl
    apt:
      update_cache: yes
      name: kubectl

</code></pre>

<p>Regarding the part</p>
<pre><code>- name: 3. Get APT Key
    shell:
      cmd: curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
      cmd: echo &quot;deb https://apt.kubernetes.io/ kubernetes-xenial main&quot; | sudo tee -a /etc/apt/sources.list.d/kubernetes.list
</code></pre>
<p>The <a href="https://docs.ansible.com/ansible/latest/collections/ansible/builtin/shell_module.html" rel="nofollow noreferrer"><code>shell</code></a>_module will only execute the second <code>cmd</code>. Ansible can only pass one of the parameters to the module, the last one.</p>
<p>To <a href="https://docs.ansible.com/ansible/latest/collections/ansible/builtin/get_url_module.html" rel="nofollow noreferrer">download files from HTTPS to node</a> you may use the <a href="https://docs.ansible.com/ansible/latest/collections/ansible/builtin/get_url_module.html#examples" rel="nofollow noreferrer"><code>get_url</code></a>_module, followed by an <a href="https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_key_module.html" rel="nofollow noreferrer"><code>apt_key</code></a>_module task to <a href="https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_key_module.html#examples" rel="nofollow noreferrer">add an apt key</a>.</p>
<pre><code>- name: Download apt key
  get_url:
    url: https://packages.cloud.google.com/apt/doc/apt-key.gpg
    dest: /tmp # or /etc/pki/rpm-gpg depending on the infrastructure

- name: Add a key from a file
  ansible.builtin.apt_key:
    file: /tmp/apt-key.gpg
    state: present
</code></pre>
<p>You could also add it by</p>
<pre><code>- name: Add an Apt signing key, uses whichever key is at the URL
  ansible.builtin.apt_key:
    url: https://packages.cloud.google.com/apt/doc/apt-key.gpg
    state: present
</code></pre>
<p>or if you know the key ID already</p>
<pre><code>- name: Add missing Apt signing key by ID from a keyserver
  ansible.builtin.apt_key:
   keyserver: keyserver.ubuntu.com
   id: &quot;{{ KEY_ID }}&quot;
</code></pre>
