{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/12107","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/12107/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/12107/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/12107/events","html_url":"https://github.com/kubernetes/kubernetes/issues/12107","id":98472621,"number":12107,"title":"ABAC mode doesn't limit users acess to other namespaces","user":{"login":"onorua","id":407040,"avatar_url":"https://avatars.githubusercontent.com/u/407040?v=3","gravatar_id":"","url":"https://api.github.com/users/onorua","html_url":"https://github.com/onorua","followers_url":"https://api.github.com/users/onorua/followers","following_url":"https://api.github.com/users/onorua/following{/other_user}","gists_url":"https://api.github.com/users/onorua/gists{/gist_id}","starred_url":"https://api.github.com/users/onorua/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/onorua/subscriptions","organizations_url":"https://api.github.com/users/onorua/orgs","repos_url":"https://api.github.com/users/onorua/repos","events_url":"https://api.github.com/users/onorua/events{/privacy}","received_events_url":"https://api.github.com/users/onorua/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/component/apiserver","name":"component/apiserver","color":"0052cc"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/support","name":"kind/support","color":"eb6420"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/CSI","name":"team/CSI","color":"d2b48c"}],"state":"closed","locked":false,"assignee":{"login":"mikedanese","id":1787169,"avatar_url":"https://avatars.githubusercontent.com/u/1787169?v=3","gravatar_id":"","url":"https://api.github.com/users/mikedanese","html_url":"https://github.com/mikedanese","followers_url":"https://api.github.com/users/mikedanese/followers","following_url":"https://api.github.com/users/mikedanese/following{/other_user}","gists_url":"https://api.github.com/users/mikedanese/gists{/gist_id}","starred_url":"https://api.github.com/users/mikedanese/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikedanese/subscriptions","organizations_url":"https://api.github.com/users/mikedanese/orgs","repos_url":"https://api.github.com/users/mikedanese/repos","events_url":"https://api.github.com/users/mikedanese/events{/privacy}","received_events_url":"https://api.github.com/users/mikedanese/received_events","type":"User","site_admin":false},"milestone":null,"comments":8,"created_at":"2015-07-31T21:17:17Z","updated_at":"2015-08-26T21:30:26Z","closed_at":"2015-08-26T21:30:26Z","body":"### what I have \r\n_kube cluster version:_\r\n```\r\n./kube-apiserver --version \r\nKubernetes v1.0.0-1057-ged9975b0310eaf\r\n```\r\n _auth_policy.json:_\r\n```\r\n{\"user\":\"admin\"}\r\n{\"user\":\"monitoring\", \"readonly\": true}\r\n{\"user\":\"scheduler\", \"readonly\": true, \"resource\": \"pods\"}\r\n{\"user\":\"scheduler\", \"resource\": \"bindings\"}\r\n{\"user\":\"kubelet\",  \"readonly\": true, \"resource\": \"pods\"}\r\n{\"user\":\"kubelet\",  \"readonly\": true, \"resource\": \"services\"}\r\n{\"user\":\"kubelet\",  \"readonly\": true, \"resource\": \"endpoints\"}\r\n{\"user\":\"kubelet\", \"resource\": \"events\"}\r\n{\"user\":\"discover\", \"ns\": \"discover\"}\r\n```\r\n_kube-apiserver startup parameteres:_\r\n```\r\n/usr/local/bin/kube-apiserver --address=0.0.0.0 --admission_control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota --service-cluster-ip-range=10.116.0.0/23 --client_ca_file=/srv/kubernetes/ca.crt --basic_auth_file=/srv/kubernetes/basic_auth.csv --authorization-mode=ABAC --authorization-policy-file=/srv/kubernetes/auth_policy.json --tls_cert_file=/srv/kubernetes/server.cert --tls_private_key_file=/srv/kubernetes/server.key --secure_port=6443 --token_auth_file=/srv/kubernetes/known_tokens.csv --v=2 --cors_allowed_origins=.* --etcd-config=/etc/kubernetes/etcd.config --allow_privileged=False\r\n```\r\n_token authorization in known_tokens.csv_\r\n```\r\n72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ,discover,discover\r\n```\r\n_kubeconfig for kubectl: cat .kube/config _\r\n```\r\napiVersion: v1\r\nclusters:\r\n- cluster:\r\n    insecure-skip-tls-verify: true\r\n    server: \"https://10.116.0.1\"\r\n  name: local\r\ncontexts:\r\n- context:\r\n    cluster: local\r\n    user: discover\r\n    namespace: discover\r\n  name: discover\r\ncurrent-context: discover\r\nkind: Config\r\npreferences: {}\r\nusers:\r\n- name: discover\r\n  user:\r\n    token: 72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ\r\n```\r\n\r\n### what I do\r\n```\r\nkubectl get namespaces\r\nNAME                  LABELS    STATUS\r\ndefault               <none>    Active\r\ninfra                 <none>    Active\r\nkube-system           <none>    Active\r\nobjects               <none>    Active\r\n\r\n~$ kubectl --namespace=infra get rc\r\nCONTROLLER           CONTAINER(S)      IMAGE(S)                 SELECTOR                             REPLICAS\r\ndocker-registry-v1   docker-registry   registry:2.0.0           k8s-app=docker-registry,version=v1   1\r\nzabbix-proxy-v1      zabbix-proxy      otechlabs/zabbix_proxy   k8s-app=zabbix-proxy,version=v1      1\r\n\r\n~$ kubectl --namespace=infra get  po\r\nNAME                       READY     STATUS    RESTARTS   AGE\r\ndocker-registry-v1-u7nvo   0/1       Pending   0          20m\r\nzabbix-proxy-v1-xnsep      0/1       Pending   0          20m\r\n\r\n~$ kubectl --namespace=infra delete po zabbix-proxy-v1-xnsep\r\npod \"zabbix-proxy-v1-xnsep\" deleted\r\n\r\n~$ kubectl --namespace=infra get  po\r\nNAME                       READY     STATUS    RESTARTS   AGE\r\ndocker-registry-v1-u7nvo   0/1       Pending   0          21m\r\nzabbix-proxy-v1-pavzv      0/1       Pending   0          -30s\r\n\r\n~$ kubectl --v=10 --namespace=infra get  rc\r\nI0731 21:14:46.401721     257 debugging.go:101] curl -k -v -XGET  -H \"User-Agent: kubectl/v1.0.0 (linux/amd64) kubernetes/ed9975b\" -H \"Authorization: Bearer 72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ\" https://10.116.0.1/api\r\nI0731 21:14:46.468688     257 debugging.go:120] GET https://10.116.0.1/api 200 OK in 66 milliseconds\r\nI0731 21:14:46.468724     257 debugging.go:126] Response Headers:\r\nI0731 21:14:46.468736     257 debugging.go:129]     Content-Type: application/json\r\nI0731 21:14:46.468748     257 debugging.go:129]     Date: Fri, 31 Jul 2015 21:15:42 GMT\r\nI0731 21:14:46.468759     257 debugging.go:129]     Content-Length: 32\r\nI0731 21:14:46.468792     257 request.go:748] Response Body: {\r\n  \"versions\": [\r\n    \"v1\"\r\n  ]\r\n}\r\nI0731 21:14:46.469095     257 debugging.go:101] curl -k -v -XGET  -H \"User-Agent: kubectl/v1.0.0 (linux/amd64) kubernetes/ed9975b\" -H \"Authorization: Bearer 72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ\" https://10.116.0.1/api/v1/namespaces/infra/replicationcontrollers\r\nI0731 21:14:46.530797     257 debugging.go:120] GET https://10.116.0.1/api/v1/namespaces/infra/replicationcontrollers 200 OK in 61 milliseconds\r\nI0731 21:14:46.530831     257 debugging.go:126] Response Headers:\r\nI0731 21:14:46.530844     257 debugging.go:129]     Content-Type: application/json\r\nI0731 21:14:46.530856     257 debugging.go:129]     Date: Fri, 31 Jul 2015 21:15:42 GMT\r\nI0731 21:14:46.530912     257 request.go:748] Response Body: {\"kind\":\"ReplicationControllerList\",\"apiVersion\":\"v1\",\"metadata\":{\"selfLink\":\"/api/v1/namespaces/infra/replicationcontrollers\",\"resourceVersion\":\"10119186\"},\"items\":[{\"metadata\":{\"name\":\"docker-registry-v1\",\"namespace\":\"infra\",\"selfLink\":\"/api/v1/namespaces/infra/replicationcontrollers/docker-registry-v1\",\"uid\":\"51b1c5f1-1fd3-11e5-a2d1-b083fec18c38\",\"resourceVersion\":\"10109207\",\"creationTimestamp\":\"2015-07-01T09:26:57Z\",\"labels\":{\"k8s-app\":\"docker-registry-v1\",\"sc01p-service\":\"true\"}},\"spec\":{\"replicas\":1,\"selector\":{\"k8s-app\":\"docker-registry\",\"version\":\"v1\"},\"template\":{\"metadata\":{\"creationTimestamp\":null,\"labels\":{\"k8s-app\":\"docker-registry\",\"sc01p-service\":\"true\",\"version\":\"v1\"}},\"spec\":{\"volumes\":[{\"name\":\"docker-images-storage\",\"hostPath\":{\"path\":\"/var/persistent_data/infra/docker-registry\"}}],\"containers\":[{\"name\":\"docker-registry\",\"image\":\"registry:2.0.0\",\"ports\":[{\"name\":\"docker-registry\",\"containerPort\":5000,\"protocol\":\"TCP\"}],\"env\":[{\"name\":\"REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY\",\"value\":\"/var/lib/registry\"}],\"resources\":{},\"volumeMounts\":[{\"name\":\"docker-images-storage\",\"mountPath\":\"/var/lib/registry\"}],\"livenessProbe\":{\"tcpSocket\":{\"port\":5000},\"initialDelaySeconds\":30,\"timeoutSeconds\":5},\"terminationMessagePath\":\"/dev/termination-log\",\"imagePullPolicy\":\"IfNotPresent\"}],\"restartPolicy\":\"Always\",\"dnsPolicy\":\"Default\",\"nodeSelector\":{\"zone\":\"common\"}}}},\"status\":{\"replicas\":1}},{\"metadata\":{\"name\":\"zabbix-proxy-v1\",\"namespace\":\"infra\",\"selfLink\":\"/api/v1/namespaces/infra/replicationcontrollers/zabbix-proxy-v1\",\"uid\":\"0f383d9a-1fcb-11e5-a2d1-b083fec18c38\",\"resourceVersion\":\"10116339\",\"creationTimestamp\":\"2015-07-01T08:27:49Z\",\"labels\":{\"k8s-app\":\"zabbix-proxy-v1\",\"sc01p-service\":\"true\"}},\"spec\":{\"replicas\":1,\"selector\":{\"k8s-app\":\"zabbix-proxy\",\"version\":\"v1\"},\"template\":{\"metadata\":{\"creationTimestamp\":null,\"labels\":{\"k8s-app\":\"zabbix-proxy\",\"sc01p-service\":\"true\",\"version\":\"v1\"}},\"spec\":{\"volumes\":[{\"name\":\"zabbix-proxy-config\",\"secret\":{\"secretName\":\"zabbix-proxy-config\"}}],\"containers\":[{\"name\":\"zabbix-proxy\",\"image\":\"otechlabs/zabbix_proxy\",\"args\":[\"/usr/local/bin/bg2fg\",\"-c\",\"/usr/sbin/zabbix_proxy -c /opt/zabbix/zabbix-proxy.conf\",\"-p\",\"/var/run/zabbix/zabbix_proxy.pid\"],\"ports\":[{\"name\":\"zabbix-proxy\",\"containerPort\":10051,\"protocol\":\"TCP\"}],\"resources\":{},\"volumeMounts\":[{\"name\":\"zabbix-proxy-config\",\"readOnly\":true,\"mountPath\":\"/opt/zabbix/\"}],\"livenessProbe\":{\"tcpSocket\":{\"port\":10051},\"initialDelaySeconds\":30,\"timeoutSeconds\":5},\"terminationMessagePath\":\"/dev/termination-log\",\"imagePullPolicy\":\"IfNotPresent\"}],\"restartPolicy\":\"Always\",\"dnsPolicy\":\"Default\",\"nodeSelector\":{\"zone\":\"common\"}}}},\"status\":{\"replicas\":1}}]}\r\nCONTROLLER           CONTAINER(S)      IMAGE(S)                 SELECTOR                             REPLICAS\r\ndocker-registry-v1   docker-registry   registry:2.0.0           k8s-app=docker-registry,version=v1   1\r\nzabbix-proxy-v1      zabbix-proxy      otechlabs/zabbix_proxy   k8s-app=zabbix-proxy,version=v1      1\r\n```\r\n\r\n### expected result\r\nI expected to get forbidden error instead of deleting pod/rc or any other object, I would like to also forbid namespaces listing for the user. In current state it has no difference with AlwaysAllow mode. "},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/135175773","html_url":"https://github.com/kubernetes/kubernetes/issues/12107#issuecomment-135175773","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/12107","id":135175773,"user":{"login":"goltermann","id":9358478,"avatar_url":"https://avatars.githubusercontent.com/u/9358478?v=3","gravatar_id":"","url":"https://api.github.com/users/goltermann","html_url":"https://github.com/goltermann","followers_url":"https://api.github.com/users/goltermann/followers","following_url":"https://api.github.com/users/goltermann/following{/other_user}","gists_url":"https://api.github.com/users/goltermann/gists{/gist_id}","starred_url":"https://api.github.com/users/goltermann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/goltermann/subscriptions","organizations_url":"https://api.github.com/users/goltermann/orgs","repos_url":"https://api.github.com/users/goltermann/repos","events_url":"https://api.github.com/users/goltermann/events{/privacy}","received_events_url":"https://api.github.com/users/goltermann/received_events","type":"User","site_admin":false},"created_at":"2015-08-26T21:30:26Z","updated_at":"2015-08-26T21:30:26Z","body":"We’re going through old support issues and asking everyone to direct your questions to [stackoverflow](http://stackoverflow.com/questions/tagged/kubernetes). \r\n\r\nWe are trying to consolidate the channels to which questions for help/support are posted so that we can improve our efficiency in responding to your requests, and to make it easier for you to find answers to frequently asked questions and how to address common use cases. \r\n\r\nWe regularly see messages posted in multiple forums, with the full response thread only in one place or, worse, spread across multiple forums. Also, the large volume of support issues on github is making it difficult for us to use issues to identify real bugs.\r\n\r\nThe Kubernetes team scans stackoverflow on a regular basis, and will try to ensure your questions don't go unanswered."}}