kubernetes
/
website
mirror of https://github.com/kubernetes/website.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #45501 from SaranBalaji90/GitRepoVolume 

Add CEL Expression to restrict GitRepo volume usage
This commit is contained in:
Kubernetes Prow Robot 2024-04-02 01:43:53 -07:00 committed by GitHub
parent 1f95dc8990 ab0b655ccd
commit 41e5f71695
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
content/en/docs/concepts/storage/volumes.md
View File

@ -311,9 +311,23 @@ third party storage driver instead.
### gitRepo (deprecated) {#gitrepo}
{{< warning >}}
The `gitRepo` volume type is deprecated. To provision a container with a git repo, mount an
[EmptyDir](#emptydir) into an InitContainer that clones the repo using git, then mount the
The `gitRepo` volume type is deprecated.
To provision a Pod that has a Git repository mounted, you can
mount an
[`emptyDir`](#emptydir) volume into an [init container](/docs/concepts/workloads/pods/init-containers/) that
clones the repo using Git, then mount the
[EmptyDir](#emptydir) into the Pod's container.
---
You can restrict the use of `gitRepo` volumes in your cluster using
[policies](/docs/concepts/policy/) such as
[ValidatingAdmissionPolicy](/docs/reference/access-authn-authz/validating-admission-policy/).
You can use the following Common Expression Language (CEL) expression as
part of a policy to reject use of `gitRepo` volumes:
`!has(object.spec.volumes) || !object.spec.volumes.exists(v, has(v.gitRepo))`.
{{< /warning >}}
A `gitRepo` volume is an example of a volume plugin. This plugin