Eliminate the need for a shell

[bgrant0607]

Either replace use of the git CLI with go-git or libgit2, like ArgoCD and Flux, or otherwise eliminate the need for a shell (reimplement submodules?).

[thockin]

I tried to removed the shell and git clone failed. It doesn't pass even the most trivial e2e test.

Looking at go-git, some of what we need (rev-parse, ls-remote, and worktree at least) are not supported. Worktree is pretty important. There may be workarounds, but it's not a drop-in.

libgit2 would require CGO, which is a can of worms which we can evaluate.

[bgrant0607]

Thanks for checking, and for describing the obstacles.

I opened this as a place for interested parties to look and/or comment.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[thockin]

For kicks, I tried this against my current working branch, which has some huge changes, including #691

I can make it run without a shell EXCEPT FOR submodules. If I set submodules=off it seems to run.

I don't know what we want to do with that information.

[sboardwell]

What would removing the shell mean for exechook-command actions?

[thockin]

The exechooks mechanism doesn't depend on a shell, but I suspect many exechooks are written as shell scripts.

Assuming we got rid of the shell, I suspect we would want to produce 2 images - with and without shell, or make sure people could build their own images on top of the shell-free one, or something.

But as it stands, we still need the shell, so....

[sboardwell]

Yes, I was already looking at adding curl in order to use it in an exechook-command

❯ cat Dockerfile
FROM registry.k8s.io/git-sync/git-sync:v3.6.6
ADD  --chmod=655 https://github.com/moparisthebest/static-curl/releases/download/v8.0.1/curl-amd64 /bin/curl

❯ docker image ls| grep 3.6.6           
git-sync                            v3.6.6-curl   8f391e1a6dd1   About a minute ago   165MB
registry.k8s.io/git-sync/git-sync   v3.6.6        ab1b1c64ba67   6 days ago           162MB