使用Ansible创建Ubuntu 2404镜像失败，APT源签名冲突报错

错误详情 #

执行Ansible任务时触发APT源读取错误，核心报错如下：

FAILED! => {"changed": false, "module_stderr": "Traceback (most recent call last):
File \"/tmp/ansible-tmp-1743068631.520732-94183-75803486625763/AnsiballZ_apt_repository.py\", line 107, in
_ansiballz_main()
File \"/tmp/ansible-tmp-1743068631.520732-94183-75803486625763/AnsiballZ_apt_repository.py\", line 99, in _ansiballz_main
invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)
File \"/tmp/ansible-tmp-1743068631.520732-94183-75803486625763/AnsiballZ_apt_repository.py\", line 47, in invoke_module
runpy.run_module(mod_name='ansible.modules.apt_repository', init_globals=dict(_module_fqn='ansible.modules.apt_repository', _modlib_path=modlib_path),
File \"\", line 226, in run_module
File \"\", line 98, in _run_module_code
File \"\", line 88, in _run_code
File \"/tmp/ansible_apt_repository_payload_lau7f97l/ansible_apt_repository_payload.zip/ansible/modules/apt_repository.py\", line 679, in
File \"/tmp/ansible_apt_repository_payload_lau7f97l/ansible_apt_repository_payload.zip/ansible/modules/apt_repository.py\", line 656, in main
File \"/usr/lib/python3/dist-packages/apt/cache.py\", line 157, in init
self.open(progress)
File \"/usr/lib/python3/dist-packages/apt/cache.py\", line 214, in open
self._cache = apt_pkg.Cache(progress)
^^^^^^^^^^^^^^^^^^^^^^^
apt_pkg.Error: E:Conflicting values set for option Signed-By regarding source https://packages.cloud.google.com/apt/ cloud-sdk: /usr/share/keyrings/google-cloud-archive-keyring.gpg != , E:The list of sources could not be read.
Shared connection to 127.0.0.1 closed.", "module_stdout": "", "msg": "MODULE FAILURE
See stdout/stderr for the exact error", "rc": 1}

问题根源 #

你的Ansible任务重复添加了同一个Google Cloud SDK APT源：

• 第一个通过copy模块写入的源包含signed-by=/usr/share/keyrings/google-cloud-archive-keyring.gpg参数
• 第二个通过apt_repository模块添加的源未指定signed-by参数

这导致APT识别到同一源的签名配置冲突，无法正常读取源列表。

修正方案 #

方案一：保留规范的源配置（推荐） #

删除重复的apt_repository任务，保留符合Ubuntu 24.04密钥管理规范的配置（将密钥存储在/usr/share/keyrings/目录并在源中指定signed-by）。修正后的任务如下：

- name: 下载新的Google Cloud GPG密钥
  shell: |
    curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/google-cloud-archive-keyring.gpg
  args:
    creates: /usr/share/keyrings/google-cloud-archive-keyring.gpg

- name: 向APT源添加Google Cloud仓库
  copy:
    dest: /etc/apt/sources.list.d/google-cloud.list
    content: |
      deb [signed-by=/usr/share/keyrings/google-cloud-archive-keyring.gpg] https://packages.cloud.google.com/apt cloud-sdk main

方案二：统一使用apt_repository模块 #

如果偏好使用apt_repository模块，需在repo参数中添加signed-by配置，同时删除copy任务，避免重复：

- name: 下载新的Google Cloud GPG密钥
  shell: |
    curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/google-cloud-archive-keyring.gpg
  args:
    creates: /usr/share/keyrings/google-cloud-archive-keyring.gpg

- name: 添加Google SDK仓库
  apt_repository:
    repo: "deb [signed-by=/usr/share/keyrings/google-cloud-archive-keyring.gpg] https://packages.cloud.google.com/apt cloud-sdk main"
    state: present

验证 #

执行修正后的Ansible playbook后，运行以下命令确认源配置正常：

apt update

若命令无报错，说明源冲突问题已解决。

内容的提问来源于stack exchange，提问作者Deepak