{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/63445","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/63445/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/63445/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/63445/events","html_url":"https://github.com/kubernetes/kubernetes/pull/63445","id":320386074,"node_id":"MDExOlB1bGxSZXF1ZXN0MTg2MDY5MzQ3","number":63445,"title":"core v1: deprecate the gitRepo volume type","user":{"login":"ericchiang","id":2342749,"node_id":"MDQ6VXNlcjIzNDI3NDk=","avatar_url":"https://avatars1.githubusercontent.com/u/2342749?v=4","gravatar_id":"","url":"https://api.github.com/users/ericchiang","html_url":"https://github.com/ericchiang","followers_url":"https://api.github.com/users/ericchiang/followers","following_url":"https://api.github.com/users/ericchiang/following{/other_user}","gists_url":"https://api.github.com/users/ericchiang/gists{/gist_id}","starred_url":"https://api.github.com/users/ericchiang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericchiang/subscriptions","organizations_url":"https://api.github.com/users/ericchiang/orgs","repos_url":"https://api.github.com/users/ericchiang/repos","events_url":"https://api.github.com/users/ericchiang/events{/privacy}","received_events_url":"https://api.github.com/users/ericchiang/received_events","type":"User","site_admin":false},"labels":[{"id":414883982,"node_id":"MDU6TGFiZWw0MTQ4ODM5ODI=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/approved","name":"approved","color":"0ffa16","default":false},{"id":477397086,"node_id":"MDU6TGFiZWw0NzczOTcwODY=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":261005360,"node_id":"MDU6TGFiZWwyNjEwMDUzNjA=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/api-change","name":"kind/api-change","color":"c7def8","default":false},{"id":354968448,"node_id":"MDU6TGFiZWwzNTQ5Njg0NDg=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note-action-required","name":"release-note-action-required","color":"c2e0c6","default":false},{"id":169428334,"node_id":"MDU6TGFiZWwxNjk0MjgzMzQ=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/storage","name":"sig/storage","color":"d2b48c","default":false},{"id":253450934,"node_id":"MDU6TGFiZWwyNTM0NTA5MzQ=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/M","name":"size/M","color":"eebb00","default":false}],"state":"open","locked":false,"assignee":{"login":"msau42","id":24448061,"node_id":"MDQ6VXNlcjI0NDQ4MDYx","avatar_url":"https://avatars3.githubusercontent.com/u/24448061?v=4","gravatar_id":"","url":"https://api.github.com/users/msau42","html_url":"https://github.com/msau42","followers_url":"https://api.github.com/users/msau42/followers","following_url":"https://api.github.com/users/msau42/following{/other_user}","gists_url":"https://api.github.com/users/msau42/gists{/gist_id}","starred_url":"https://api.github.com/users/msau42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msau42/subscriptions","organizations_url":"https://api.github.com/users/msau42/orgs","repos_url":"https://api.github.com/users/msau42/repos","events_url":"https://api.github.com/users/msau42/events{/privacy}","received_events_url":"https://api.github.com/users/msau42/received_events","type":"User","site_admin":false},"assignees":[{"login":"liggitt","id":980082,"node_id":"MDQ6VXNlcjk4MDA4Mg==","avatar_url":"https://avatars0.githubusercontent.com/u/980082?v=4","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},{"login":"msau42","id":24448061,"node_id":"MDQ6VXNlcjI0NDQ4MDYx","avatar_url":"https://avatars3.githubusercontent.com/u/24448061?v=4","gravatar_id":"","url":"https://api.github.com/users/msau42","html_url":"https://github.com/msau42","followers_url":"https://api.github.com/users/msau42/followers","following_url":"https://api.github.com/users/msau42/following{/other_user}","gists_url":"https://api.github.com/users/msau42/gists{/gist_id}","starred_url":"https://api.github.com/users/msau42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msau42/subscriptions","organizations_url":"https://api.github.com/users/msau42/orgs","repos_url":"https://api.github.com/users/msau42/repos","events_url":"https://api.github.com/users/msau42/events{/privacy}","received_events_url":"https://api.github.com/users/msau42/received_events","type":"User","site_admin":false}],"milestone":null,"comments":17,"created_at":"2018-05-04T18:43:10Z","updated_at":"2018-05-31T22:00:36Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/63445","html_url":"https://github.com/kubernetes/kubernetes/pull/63445","diff_url":"https://github.com/kubernetes/kubernetes/pull/63445.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/63445.patch"},"body":"gitRepo stopped accepting new features nearly 2 years ago https://github.com/kubernetes/kubernetes/issues/17676#issuecomment-228650586 and today this behavior can easily be achieved through an init container. The kubelet shelling out to git in the host namespace can also be a security issue on un-trusted repos, as was demonstrated by [CVE-2017-1000117](https://groups.google.com/forum/#!topic/kubernetes-announce/CTLXJ74cu8M). Our own documentation even alludes to this volume type being removed in the future:\r\n\r\n> In the future, such volumes may be moved to an even more decoupled model, rather than extending the Kubernetes API for every such use case.\r\n\r\nhttps://kubernetes.io/docs/concepts/storage/volumes/#gitrepo\r\n\r\nCloses https://github.com/kubernetes/kubernetes/issues/60999\r\n\r\n```release-note-action-required\r\nThe GitRepo volume type is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container.\r\n```\r\n\r\n/release-note-action-required\r\n\r\nInstead of this:\r\n\r\n```yaml\r\napiVersion: v1\r\nkind: Pod\r\nmetadata:\r\n  name: server\r\nspec:\r\n  containers:\r\n  - image: nginx\r\n    name: nginx\r\n    volumeMounts:\r\n    - mountPath: /mypath\r\n      name: git-volume\r\n  volumes:\r\n  - name: git-volume\r\n    gitRepo:\r\n      repository: \"git@somewhere:me/my-git-repository.git\"\r\n      revision: \"22f1d8406d464b0c0874075539c1f2e96c253775\"\r\n```\r\n\r\nDo this:\r\n\r\n```yaml\r\napiVersion: v1\r\nkind: ConfigMap\r\nmetadata:\r\n  name: git-clone\r\ndata:\r\n  git-clone.sh: |\r\n    #!/bin/sh -e\r\n    git clone $1 $3\r\n    cd $3\r\n    git reset --hard $2\r\n---\r\napiVersion: v1\r\nkind: Pod\r\nmetadata:\r\n  name: server\r\nspec:\r\n  initContainers:\r\n  - name: git-clone\r\n    image: alpine/git # Any image with git will do\r\n    command:\r\n    - /usr/local/git/git-clone.sh\r\n    args:\r\n    - \"https://somewhere/me/my-git-repository.git\"\r\n    - \"22f1d8406d464b0c0874075539c1f2e96c253775\"\r\n    - \"/mypath\"\r\n    volumeMounts:\r\n    - name: git-clone\r\n      mountPath: /usr/local/git\r\n    - name: git-repo\r\n      mountPath: /mypath\r\n  containers:\r\n  - image: nginx\r\n    name: nginx\r\n    volumeMounts:\r\n    - mountPath: /mypath\r\n      name: git-volume\r\n  volumes:\r\n  - name: git-volume\r\n    emptyDir: {}\r\n  - name: git-clone\r\n    configMap:\r\n      name: git-clone\r\n      defaultMode: 0755\r\n```"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/393694720","html_url":"https://github.com/kubernetes/kubernetes/pull/63445#issuecomment-393694720","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/63445","id":393694720,"node_id":"MDEyOklzc3VlQ29tbWVudDM5MzY5NDcyMA==","user":{"login":"msau42","id":24448061,"node_id":"MDQ6VXNlcjI0NDQ4MDYx","avatar_url":"https://avatars3.githubusercontent.com/u/24448061?v=4","gravatar_id":"","url":"https://api.github.com/users/msau42","html_url":"https://github.com/msau42","followers_url":"https://api.github.com/users/msau42/followers","following_url":"https://api.github.com/users/msau42/following{/other_user}","gists_url":"https://api.github.com/users/msau42/gists{/gist_id}","starred_url":"https://api.github.com/users/msau42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msau42/subscriptions","organizations_url":"https://api.github.com/users/msau42/orgs","repos_url":"https://api.github.com/users/msau42/repos","events_url":"https://api.github.com/users/msau42/events{/privacy}","received_events_url":"https://api.github.com/users/msau42/received_events","type":"User","site_admin":false},"created_at":"2018-05-31T22:00:36Z","updated_at":"2018-05-31T22:00:36Z","author_association":"MEMBER","body":"/lgtm"}}
{"actor":{"display_login":"msau42"}}