{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/3889","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/3889/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/3889/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/3889/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/3889","id":55810137,"number":3889,"title":"Authorization Policy should be able to require \"trusted images\"","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-01-28T20:23:35Z","updated_at":"2015-01-28T20:25:41Z","closed_at":null,"body":"First, need to define what a \"trusted\" image is:\r\n  1. docker image name has some prefix.\r\n  1. define an \"image\" resource, which has labels (as has previously been proposed, and may already exist in openshift) \r\nSuggest definitely doing the first, since this is composible with people's existing use of docker.  Also consider second if openShift folks want it.\r\n\r\nSecond, need a way to further restrict a policy which allows pod creation to require all images to be trusted.   Amazon IAM has \"Cond\" sections in their policy, and they predefine certain condition matchers.  \r\n\r\nWe might have something like this:\r\n```\r\n{User:\"alice\", Kind:\"pods\", Namespace:\"prod\", Conds: [{Cond:\"ContImagesHaveImagePrefix\", Arg1:\"quay.io/alicecorp/trusted\"}]}\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/71909076","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/3889#issuecomment-71909076","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/3889","id":71909076,"user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"created_at":"2015-01-28T20:25:41Z","updated_at":"2015-01-28T20:25:41Z","body":"The motivating use case is a SoX-type requirement that \"production\" pods have images built using a approved process, but still allowing developers to use ad-hoc builds in \"non-production\" scenarios."}}