Kubernetes GitRepo Volume Vulnerability Allows Unauthorized Access to Local Repositories

A vulnerability exists in Kubernetes clusters using the deprecated in-tree gitRepo volume feature, which allows cloning of git repositories from other pods on the same node. This issue affects all Kubernetes versions and could enable a user with pod creation permissions to access local git repositories of other pods.

Impact

Exploitation of this vulnerability could lead to unauthorized access to local git repositories of other pods on the same node.

Remediation

To address this vulnerability, use an init container to perform the git clone operation and mount the directory into the pod's container. Additionally, restrict the use of gitRepo volumes in the cluster using ValidatingAdmissionPolicy or the Restricted pod security standard policy.