.. _installation:

=======================
On-Premises Deployments
=======================

You can install |cp| in the environment of your choice.

.. note::
   
   For public and private cloud environments, you can install |cp| using :ref:`Confluent Operator <operator-about-intro>`.

.. _on-prem-production:

-----------------------
Production Environments
-----------------------

Use these installation methods to deploy a production-ready multi-node |cp| environment.

.. plan for revised TOC: Manual Install using Kafka CLI; Docker

- :ref:`prod-kafka-cli-install`
- :ref:`systemd-ubuntu-debian-install`
- :ref:`systemd-rhel-centos-install`

-----------------------
Development Environment
-----------------------

Use these installation methods to quickly get a |cp| development environment up
and running on your laptop.

- :ref:`ce-quickstart`
- :ref:`image_reference`

.. _on-prem-gpg-signing-keys:

======================
Confluent Signing Keys
======================

- **4096R/8b1da6120c2bf624 (2021-05-03): Confluent Packaging <packages@confluent.io>**

  Fingerprint: ``cbbb 821e 8faf 364f 7983 5c43 8b1d a612 0c2b f624``

  Status: Active


- **4096R/670540c841468433 (2015-02-06): Confluent Packaging <packages@confluent.io>**

  Fingerprint: ``1a77 041e 0314 e6c5 a486 524e 6705 40c8 4146 8433``

  Status: `Revoked <https://www.confluent.io/blog/confluent-update-regarding-codecov-incident/>`_

-------------------
Revoking Older Keys
-------------------

Consult your operating system or software's manual pages for revoking GPG keys. Below are common methods of revoking older keys.
The examples below assume you wish to revoke your trust in an older key-id ``670540c841468433`` (Shorter form ``41468433``)

^^^^^^^^^^^^^^^^^^
Revoking in GnuPGP 
^^^^^^^^^^^^^^^^^^

.. codewithvars:: bash
    
    gpg --delete-key 41468433
    gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 8b1da6120c2bf624


^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Revoking in Debian Linux Based Distributions
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

If you see Apt showing you an error similar to:

- Err:4 ``https://packages.confluent.io/deb/|version|`` stable InRelease

  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY KEY_ID

  Reading package lists... Done

  W: GPG error: ``https://packages.confluent.io/deb/|version|`` stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY KEY_ID

  E: The repository '``https://packages.confluent.io/deb/|version|`` stable InRelease' is not signed.

  N: Updating from such a repository can't be done securely, and is therefore disabled by default.

  N: See apt-secure(8) manpage for repository creation and user configuration details.


Then you should revoke the old key and import the latest:

.. codewithvars:: bash
    
    sudo apt-key del 41468433
    wget -qO - https://packages.confluent.io/deb/|version|/archive.key | sudo apt-key add -

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Revoking in Redhat Linux Based Distributions
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

If you see a Yum/Dnf showing you a warning:
 
- warning: /path/to/new/package: Header V4 RSA/SHA1 Signature, key ID KEY_ID: NOKEY

Then you should revoke the old key and import the latest. Note that internally RPM stores imported GPG keys as gpg-pubkey-${FINGER_PRINT}-${CREATION_TIME}

.. codewithvars:: bash
    
    sudo rpm -e gpg-pubkey-41468433-54d512a8
    sudo rpm --import https://packages.confluent.io/rpm/|version|/archive.key


.. toctree::
    :maxdepth: 1
    :hidden:

    ZIP and TAR <zip-tar>
    Ubuntu and Debian <deb-ubuntu>
    RHEL and CentOS <rhel-centos>
    Docker <../docker/installation/index>
    Confluent CLI <../../quickstart/ce-quickstart>
    ../docker/index