core v1: deprecate the gitRepo volume type

[ericchiang]

gitRepo stopped accepting new features nearly 2 years ago #17676 (comment) and today this behavior can easily be achieved through an init container. The kubelet shelling out to git in the host namespace can also be a security issue on un-trusted repos, as was demonstrated by CVE-2017-1000117. Our own documentation even alludes to this volume type being removed in the future:

In the future, such volumes may be moved to an even more decoupled model, rather than extending the Kubernetes API for every such use case.

https://kubernetes.io/docs/concepts/storage/volumes/#gitrepo

Edit: CVE 2018-11235 which also impacts this volume type was announced while this PR was open.

Closes #60999

The GitRepo volume type is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container.

/release-note-action-required

Instead of this:

apiVersion: v1
kind: Pod
metadata:
  name: server
spec:
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - mountPath: /mypath
      name: git-volume
  volumes:
  - name: git-volume
    gitRepo:
      repository: "git@somewhere:me/my-git-repository.git"
      revision: "22f1d8406d464b0c0874075539c1f2e96c253775"

Do this:

apiVersion: v1
kind: ConfigMap
metadata:
  name: git-clone
data:
  git-clone.sh: |
    #!/bin/sh -e
    REPO=$1
    REF=$2
    DIR=$3
    # Init Containers will re-run on Pod restart. Remove the directory's contents
    # and reprovision when this happens.
    if [ -d "$DIR" ]; then
        rm -rf $( find $DIR -mindepth 1 )
    fi
    git clone $REPO $DIR
    cd $DIR
    git reset --hard $REF
---
apiVersion: v1
kind: Pod
metadata:
  name: server
spec:
  initContainers:
  - name: git-clone
    image: alpine/git # Any image with git will do
    command:
    - /usr/local/git/git-clone.sh
    args:
    - "https://somewhere/me/my-git-repository.git"
    - "22f1d8406d464b0c0874075539c1f2e96c253775"
    - "/mypath"
    volumeMounts:
    - name: git-clone
      mountPath: /usr/local/git
    - name: git-repo
      mountPath: /mypath
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - mountPath: /mypath
      name: git-volume
  volumes:
  - name: git-volume
    emptyDir: {}
  - name: git-clone
    configMap:
      name: git-clone
      defaultMode: 0755

[ericchiang]

cc @kubernetes/sig-storage-pr-reviews
cc @tallclair

[msau42]

/lgtm

[liggitt]

as much as I'd be happy to see this deprecated/removed, just dropping the field from v1 would fall outside of kube deprecation policies.

in additional to deciding if this is an acceptable deviation (@kubernetes/sig-storage-api-reviews @kubernetes/api-approvers), and documenting why, we should think through how this removal would actually be accomplished without breaking existing data (simply dropping the field would leave previously valid objects as invalid pod templates with volumes with no source)

[ericchiang]

Sent a docs only PR for the meantime kubernetes/website#8429

[tallclair]

What do you think about at least marking this as deprecated in 1.11, even if it takes a long time to get it removed?

[ericchiang]

@tallclair I still have a PR open to strike it from the docs. kubernetes/website#8429

I think that's good enough.

[ericchiang]

/retest

[bgrant0607]

This will also need an "action required" release note.

[ericchiang]

/test pull-kubernetes-kubemark-e2e-gce-big

[ericchiang]

/retest

[ericchiang]

/test pull-kubernetes-kubemark-e2e-gce-big

[msau42]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ericchiang, liggitt, msau42

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• api/OWNERS [liggitt]
• docs/api-reference/OWNERS [liggitt]
• pkg/apis/core/OWNERS [liggitt]
• staging/src/k8s.io/api/OWNERS [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-github-robot]

[MILESTONENOTIFIER] Milestone Pull Request: Up-to-date for process

@ericchiang @liggitt @msau42

Pull Request Labels

• sig/storage: Pull Request will be escalated to these SIGs if needed.
• priority/important-longterm: Escalate to the pull request owners; move out of the milestone after 1 attempt.
• kind/cleanup: Adding tests, refactoring, fixing old bugs.

Help

• Additional instructions
• Commands for setting labels

[k8s-github-robot]

/test all [submit-queue is verifying that this PR is safe to merge]

[k8s-github-robot]

Automatic merge from submit-queue (batch tested with PRs 63445, 63820). If you want to cherry-pick this change to another branch, please follow the instructions here.

[k8s-ci-robot]

@ericchiang: The following tests failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
pull-kubernetes-e2e-gce	f8f5f04	link	/test pull-kubernetes-e2e-gce
pull-kubernetes-kubemark-e2e-gce-big	f8f5f04	link	/test pull-kubernetes-kubemark-e2e-gce-big

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[sebgoa]

fwiw in @ericchiang example at the top, git-repo reference in initContainers should be git-volume

[gsemet]

Typo fixed:

apiVersion: v1
kind: ConfigMap
metadata:
  name: git-clone
data:
  git-clone.sh: |
    #!/bin/sh -e
    REPO=$1
    REF=$2
    DIR=$3
    # Init Containers will re-run on Pod restart. Remove the directory's contents
    # and reprovision when this happens.
    if [ -d "$DIR" ]; then
        rm -rf $( find $DIR -mindepth 1 )
    fi
    git clone $REPO $DIR
    cd $DIR
    git reset --hard $REF
---
apiVersion: v1
kind: Pod
metadata:
  name: server
spec:
  initContainers:
  - name: git-clone
    image: alpine/git # Any image with git will do
    command:
    - /usr/local/git/git-clone.sh
    args:
    - "https://somewhere/me/my-git-repository.git"
    - "22f1d8406d464b0c0874075539c1f2e96c253775"
    - "/repo"
    volumeMounts:
    - name: git-clone
      mountPath: /usr/local/git
    - name: git-repo
      mountPath: /repo
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - mountPath: /mypath/to/my/repo
      name: git-repo
  volumes:
  - name: git-repo
    emptyDir: {}
  - name: git-clone
    configMap:
      name: git-clone
      defaultMode: 0755