{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/38579454","id":38579454,"diff_hunk":"@@ -0,0 +1,302 @@\n+<!-- BEGIN MUNGE: UNVERSIONED_WARNING -->\n+\n+<!-- BEGIN STRIP_FOR_RELEASE -->\n+\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+\n+<h2>PLEASE NOTE: This document applies to the HEAD of the source tree</h2>\n+\n+If you are using a released version of Kubernetes, you should\n+refer to the docs that go with that version.\n+\n+<strong>\n+The latest 1.0.x release of this document can be found\n+[here](http://releases.k8s.io/release-1.0/docs/proposals/apiserver_watch.md).\n+\n+Documentation for other releases can be found at\n+[releases.k8s.io](http://releases.k8s.io).\n+</strong>\n+--\n+\n+<!-- END STRIP_FOR_RELEASE -->\n+\n+<!-- END MUNGE: UNVERSIONED_WARNING -->\n+\n+## Abstract\n+\n+A proposal for refactoring `SecurityContext` to have pod-level and container-level attributes in\n+order to correctly model pod- and container-level security concerns.\n+\n+## Motivation\n+\n+Currently, containers have a `SecurityContext` attribute which contains information about the\n+security settings the container uses.  A container-level context lacks the ability, however, to\n+express notions that are really pod-level:\n+\n+1.  Whether the pod should use a host kernel namespace such as the host network, IPC, or PID\n+    namespace\n+2.  Pod-level attributes that apply to all containers\n+3.  Default container-level attributes that containers can override\n+\n+A pod-level security context will:\n+\n+1.  Allow users to cleanly express security settings that are applicable to the entire pod\n+2.  Allow users to express defaults for container-level settings and override only the settings that\n+    need to be differentiated from the defaults in individual containers\n+\n+Goals of this design:\n+\n+1.  Describe the use cases for which a pod-level security context is necessary\n+2.  Describe the model changes and associated implementation changes for the refactor\n+\n+## Constraints and assumptions\n+\n+1.  We will not design for intra-pod security; we are not currently concerned about isolating\n+    containers in the same pod from one another\n+1.  We will design for backward compatibility with the current V1 API\n+\n+## Use Cases\n+\n+1.  As a developer, I want to correctly model security attributes which belong to an entire pod\n+2.  As a user, I want to be able to specify a default set of container-level security attributes for\n+    all containers in a pod\n+3.  As a user, I want to be able to override certain container-level security attributes for\n+    individual containers as needed\n+\n+### Use Case: Pod level security attributes\n+\n+Some security attributes make sense only to model at the pod level.  For example, it is a\n+fundamental property of pods that all containers in a pod share the same network namespace.\n+Therefore, using the host namespace makes sense to model at the pod level only, and indeed, today\n+it is part of the `PodSpec`.  Other host namespace support is currently being added and these will\n+also be pod-level settings; it makes sense to model them as a pod-level collection of security\n+attributes.\n+\n+### Use Case: Default security context for all containers\n+\n+By default, all containers in a pod should share the same security settings, and those settings\n+should only have to be specified once.  If users are forced to specify the same settings for each\n+container, it requires more complex validations and allows for transcription errors between\n+containers\n+\n+Additionally, use cases for sharing resources such as volumes are much easier to implement if a user\n+can describe a pod-level security context.\n+\n+### Use Case: Override pod security context for container\n+\n+Some use cases require the containers in a pod to run with different security settings.  As an\n+example, a user may want to have a pod with two containers, one of which runs as root with the\n+privileged setting, and one that runs as a non-root UID.  To support use cases like this, it should\n+be possible to override appropriate (ie, not intrinsically pod-level) security settings for\n+individual containers.\n+\n+## Analysis\n+\n+### SELinux context: pod- or container- level?\n+\n+Currently, SELinux context is specifiable only at the container level.  This is an inconvenient\n+factoring for sharing volumes and other SELinux-secured resources between containers because there\n+is no way in SELinux to share resources between processes with different MCS labels except to\n+remove MCS labels from the shared resource.  This is a big security risk: _any container_ in the\n+system can work with a resource which has the same SELinux context as it and no MCS labels.  Since\n+we are also not interested in isolating containers in a pod from one another, the SELinux context\n+should be shared by all containers in a pod to facilitate isolation from the containers in other\n+pods and sharing resources amongst all the containers of a pod.\n+\n+### Pod-level supplemental groups\n+\n+The [generalized non-root and SELinux support for volumes](https://github.com/kubernetes/kubernetes/pull/12944)\n+pull request describes in detail the cases for sharing volumes using supplemental groups.  The\n+easiest way to share resources among containers running as different UID/primary GID combinations is\n+to make them owned by a supplemental group that all containers run as.  Therefore, there should be a\n+pod-level supplemental group field that cannot be overridden in containers.\n+\n+### Backward compatibility","path":"docs/proposals/pod-security-context.md","position":123,"original_position":123,"commit_id":"a6f390720a90d238671e7cc9ca30361a8566fd6f","original_commit_id":"a6f390720a90d238671e7cc9ca30361a8566fd6f","user":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"body":"You should link to https://github.com/kubernetes/kubernetes/blob/master/docs/devel/api_changes.md","created_at":"2015-09-02T20:23:09Z","updated_at":"2015-09-02T20:23:09Z","html_url":"https://github.com/kubernetes/kubernetes/pull/12823#discussion_r38579454","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/12823","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/38579454"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/12823#discussion_r38579454"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/12823"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/12823","id":42632656,"html_url":"https://github.com/kubernetes/kubernetes/pull/12823","diff_url":"https://github.com/kubernetes/kubernetes/pull/12823.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/12823.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/12823","number":12823,"state":"open","locked":false,"title":"WIP: pod-level security context proposal","user":{"login":"pmorie","id":366488,"avatar_url":"https://avatars.githubusercontent.com/u/366488?v=3","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},"body":"Proposal for differentiating pod-level and container-level security contexts.\r\n\r\n@bgrant0607 @erictune @smarterclayton @pweil- @eparis","created_at":"2015-08-17T20:51:58Z","updated_at":"2015-09-02T20:23:09Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9291f0e945b9e05e0afc8830b4a11e05072004a4","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/12823/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/12823/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/12823/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/a6f390720a90d238671e7cc9ca30361a8566fd6f","head":{"label":"pmorie:pod-sc","ref":"pod-sc","sha":"a6f390720a90d238671e7cc9ca30361a8566fd6f","user":{"login":"pmorie","id":366488,"avatar_url":"https://avatars.githubusercontent.com/u/366488?v=3","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},"repo":{"id":21654452,"name":"kubernetes","full_name":"pmorie/kubernetes","owner":{"login":"pmorie","id":366488,"avatar_url":"https://avatars.githubusercontent.com/u/366488?v=3","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/pmorie/kubernetes","description":"Container Cluster Manager","fork":true,"url":"https://api.github.com/repos/pmorie/kubernetes","forks_url":"https://api.github.com/repos/pmorie/kubernetes/forks","keys_url":"https://api.github.com/repos/pmorie/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pmorie/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pmorie/kubernetes/teams","hooks_url":"https://api.github.com/repos/pmorie/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/pmorie/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/pmorie/kubernetes/events","assignees_url":"https://api.github.com/repos/pmorie/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/pmorie/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/pmorie/kubernetes/tags","blobs_url":"https://api.github.com/repos/pmorie/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pmorie/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pmorie/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/pmorie/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pmorie/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/pmorie/kubernetes/languages","stargazers_url":"https://api.github.com/repos/pmorie/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/pmorie/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/pmorie/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/pmorie/kubernetes/subscription","commits_url":"https://api.github.com/repos/pmorie/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/pmorie/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/pmorie/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/pmorie/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/pmorie/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/pmorie/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pmorie/kubernetes/merges","archive_url":"https://api.github.com/repos/pmorie/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pmorie/kubernetes/downloads","issues_url":"https://api.github.com/repos/pmorie/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/pmorie/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/pmorie/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/pmorie/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pmorie/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/pmorie/kubernetes/releases{/id}","created_at":"2014-07-09T14:06:25Z","updated_at":"2015-08-13T02:02:33Z","pushed_at":"2015-09-02T05:58:56Z","git_url":"git://github.com/pmorie/kubernetes.git","ssh_url":"git@github.com:pmorie/kubernetes.git","clone_url":"https://github.com/pmorie/kubernetes.git","svn_url":"https://github.com/pmorie/kubernetes","homepage":null,"size":104255,"stargazers_count":1,"watchers_count":1,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":1,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"1919d7fa0edb188ecac71d7f94026c9ad937bce2","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Container Cluster Manager from Google","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","created_at":"2014-06-06T22:56:04Z","updated_at":"2015-09-02T20:15:01Z","pushed_at":"2015-09-02T20:13:16Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":405720,"stargazers_count":10030,"watchers_count":10030,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":2441,"mirror_url":null,"open_issues_count":1699,"forks":2441,"open_issues":1699,"watchers":10030,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/12823"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/12823"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/12823"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/12823/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/12823/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/12823/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/a6f390720a90d238671e7cc9ca30361a8566fd6f"}}}}