{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2483","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2483/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2483/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2483/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/2483","id":49476542,"number":2483,"title":"Kubelet to understand pods, and to be able to pull from apiserver","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/api%2Fkubelet","name":"api/kubelet","color":"fbca04"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/component%2Fkubelet","name":"component/kubelet","color":"0052cc"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/priority%2FP1","name":"priority/P1","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":19,"created_at":"2014-11-20T01:07:36Z","updated_at":"2015-01-03T02:50:18Z","closed_at":null,"body":"Several inter-related goals:\r\n 1. Kubelet continues to be usable in isolation, as well as in a Kubernetes cluster. *(composability)*\r\n 1. Config defined in terms of Pods should work both with an apiserver, and directly with Kubelets *(bootstraping, debugging, composability)*\r\n 1. Kubelet's can only see pods that they need to see *(security)*\r\n 1. Don't create more apiserver API objects than necessary *(ease of understanding)*\r\n 1. Node etcd need not be connected to master etcd. *(security, isolation, scalability)*\r\n 1. Not have clients (be they kubectl, or kubelets or whatever) depend on the storage layer of the apiserver. *(abstraction, allowing multiple implementations of the API)*\r\n\r\nCurrent state:\r\n 1. Kubelet can read container manifest from a local file.  Or from an URL.  Used by [Google ContainerVM](https://cloud.google.com/compute/docs/containers/container_vms).\r\n 1. Kubelets can read boundPods from their local etcd, which is connected to the master machine's etcd.\r\n 1. Kubelets can talk to the apiserver, and do write /events.  They don't read /pods or /boundPods.\r\n\r\nSuggested changes:\r\n 1. Kubelet learns the definition of type Pods. \r\n 1. Kubelet can read json pod definitions from local files or URLs. \r\n    -  It also still supports containerManifests for the foreseeable future, with some way for it to determine which type to expect from a source.\r\n 1. In a \"typical\" Kubernetes cluster, a Kubelet watches /api/v1beta3/pods for what pods it should run. \r\n 1. Get rid of BoundPod and BoundPods since nothing reads them anymore.\r\n 1. Add a Host field to the PodStatus (but not PodSpec).  \r\n 1. When scheduler writes a Binding, the PodStatus.Host is be set and resourceVersion is updated.  \r\n 1. A cluster is bootstrapped by first starting one or more VMs with, \r\n \r\nConcerns that may be raised and responses:\r\n\r\n**Q1:** Are changes to the set of pods bound made by the scheduler machine atomic or eventually consistent?\r\n\r\n**A1:** It could work either way.  If we want atomic behavior, we could implement that in apiserver more readily that we could when we directly expose our storage via etcd.\r\n\r\n**Q2:** Should the kubelet be allowed to see CurrentState (now PodStatus in v1beta3)?  It generates (some of) the status, so why let it see that?\r\n\r\n**A2:** We could implement this if it is important.  Kubelet would watch pods with a selector that matches only pods with PodStatus.Host == kubelets hostname, and could use a field selector so that only PodSpec and not PodStatus is returned.\r\n\r\n**Q3:** How do we prevent Kubelets from seeing other node's pods.\r\n**A3:** There are a couple of ways I can think to do this with small changes to our current authorization policy.   \r\n  1. One way is to have a distinguished \"kubelet\" user and special case its authorization.  \r\n  1. Another is to create a new policy as each \"kubelet\" is added which matches on the SourceIP of the request, and requires a selector to be part of the request which selects on \"PodStatus.Host=$SourceIP\".    This may make some assumptions about the network security of the cluster, but seems like it could work.\r\n  1. A variation on the previous is to only have one line of policy for all kubelets, but have a \"condition\" field in the policy that checks that PodStatus.Host matches SourceIP.\r\n  1. Another variation is to have a different token for each kubelet and a separate policy for each.\r\n"},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/68580704","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/2483#issuecomment-68580704","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2483","id":68580704,"user":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"created_at":"2015-01-03T02:50:18Z","updated_at":"2015-01-03T02:50:18Z","body":"The plan at the moment is to introduce #846, then with v1beta3 make another step.  We need to reach closure on the issues I mentioned above, and Eric had some of those elements as a WIP"}}