{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/40628377","id":40628377,"diff_hunk":"@@ -0,0 +1,280 @@\n+## Abstract\n+\n+A proposal for enabling containers in a pod to share volumes using a pod level SELinux context.\n+\n+## Motivation\n+\n+Many users have a requirement to run pods on systems that have SELinux enabled.  Volume plugin\n+authors should not have to explicitly account for SELinux except for volume types that require\n+special handling of the SELinux context during setup.\n+\n+Currently, each container in a pod has an SELinux context.  This is not an ideal factoring for\n+sharing resources using SELinux.  \n+\n+We propose a pod-level SELinux context and a mechanism to support SELinux labeling of volumes in a\n+generic way.\n+\n+Goals of this design:\n+\n+1.  Describe the problems with a container SELinux context\n+2.  Articulate a design for generic SELinux support for volumes using a pod level SELinux context\n+    which is backward compatible with the v1.0.0 API\n+\n+## Constraints and Assumptions\n+\n+1.  We will not support securing containers within a pod from one another\n+2.  Volume plugins should not have to handle setting SELinux context on volumes\n+3.  We will not deal with shared storage \n+\n+## Current State Overview\n+\n+### Docker\n+\n+Docker uses a base SELinux context and calculates a unique MCS label per container.  The SELinux\n+context of a container can be overriden with the `SecurityOpt` api that allows setting the different\n+parts of the SELinux context individually.\n+\n+Docker has functionality to relabel bind-mounts with a usable SElinux and supports two different\n+use-cases:\n+\n+1.  The `:Z` bind-mount flag, which tells Docker to relabel a bind-mount with the container's\n+    SELinux context\n+2.  The `:z` bind-mount flag, which tells Docker to relabel a bind-mount with the container's\n+    SElinux context, but remove the MCS labels, making the volume shareable beween containers\n+\n+We should avoid using the `:z` flag, because it relaxes the SELinux context so that any container\n+(from an SELinux standpoint) can use the volume.\n+\n+### Rocket\n+\n+Rocket currently reads the base SELinux context to use from `/etc/selinux/*/contexts/lxc_contexts`\n+and allocates a unique MCS label per pod.\n+\n+### Kubernetes\n+\n+\n+There is a [proposed change](https://github.com/GoogleCloudPlatform/kubernetes/pull/9844) to the\n+EmptyDir plugin that adds SELinux relabeling capabilities to that plugin, which is also carried as a\n+patch in [OpenShift](https://github.com/openshift/origin).  It is preferable to solve the problem\n+in general of handling SELinux in kubernetes to merging this PR.\n+\n+A new `PodSecurityContext` type has been added that carries information about security attributes\n+that apply to the entire pod and that apply to all containers in a pod.  See:\n+\n+1.  [Skeletal implementation](https://github.com/kubernetes/kubernetes/pull/13939)\n+1.  [Proposal for inlining container security fields](https://github.com/kubernetes/kubernetes/pull/12823)\n+\n+## Use Cases\n+\n+1.  As a cluster operator, I want to support securing pods from one another using SELinux when\n+    SELinux integration is enabled in the cluster\n+2.  As a user, I want volumes sharing to work correctly amongst containers in pods \n+\n+#### SELinux context: pod- or container- level?\n+\n+Currently, SELinux context is specifiable only at the container level.  This is an inconvenient\n+factoring for sharing volumes and other SELinux-secured resources between containers because there\n+is no way in SELinux to share resources between processes with different MCS labels except to\n+remove MCS labels from the shared resource.  This is a big security risk: _any container_ in the\n+system can work with a resource which has the same SELinux context as it and no MCS labels.  Since\n+we are also not interested in isolating containers in a pod from one another, the SELinux context\n+should be shared by all containers in a pod to facilitate isolation from the containers in other\n+pods and sharing resources amongst all the containers of a pod.\n+\n+#### Volumes\n+\n+Kubernetes volumes can be divided into two broad categories:\n+\n+1.  Unshared storage:\n+    1.  Volumes created by the kubelet on the host directory: empty directory, git repo, secret,\n+        downward api; all volumes in this category delegate to `EmptyDir` for their underlying\n+        storage\n+    2.  Volumes based on network block devices: AWS EBS, iSCSI, RBD, etc\n+2.  Shared storage: NFS, Glusterfs, Cephfs, etc\n+\n+For unshared storage, SELinux handling for most volumes can be generalized into running a `chcon` operation on the volume directory after running the volume plugin's `Setup` function.  For these\n+volumes, the Kubelet can perform the `chcon` operation and keep SELinux concerns out of the volume\n+plugin code.  Some volume plugins may need to use the SELinux context during a mount operation in\n+certain cases.  To account for this, our design must have a way for volume plugins to state that\n+a particular volume should or should not receive generic label management. \n+\n+For shared storage, the picture is murkier.  Labels for existing shared storage will be managed\n+outside Kubernetes and administrators will have to set the SELinux context of pods correctly.\n+The problem of solving SELinux context management for new shared storage is outside the scope for\n+this proposal.\n+\n+## Analysis\n+\n+The system needs to be able to:\n+\n+1.  Model correctly which volumes require SELinux label management\n+1.  Determine the correct ownership and SELinux context of each volume in a pod if required\n+1.  Relabel volumes with the correct SELinux context when required\n+\n+### Modeling whether a volume requires label management\n+\n+#### Unshared storage: volumes derived from `EmptyDir`\n+\n+Empty dir and volumes derived from it are the opposite of hostPath.  Since they are created by the\n+system, Kubernetes must always ensure that the ownership and SELinux context (when relevant) are\n+set correctly for the volume to be usable.\n+\n+#### Unshared storage: network block devices\n+\n+Volume plugins based on network block devices such as AWS EBS and RBS can be treated the same way\n+as local volumes.  Since inodes are written to these block devices in the same way as local devices,\n+SELinux context can be managed on the client side by the Kubelet.\n+\n+#### Shared storage: hostPath\n+\n+The `hostPath` volume should only be used by 'trusted' users, and the permissions of paths exposed\n+into containers via hostPath volumes should always be managed by the cluster operator.  If the\n+Kubelet managed the SELinux label for `hostPath` volumes, a user who could create a `hostPath`\n+volume could affect changes in the state of arbitrary paths within the host's filesystem.  This\n+would be a severe security risk, so we will consider hostPath a corner case that the kubelet should\n+never perform ownership management for.\n+\n+#### Shared storage: network\n+\n+Whether the ownership or SELinux label of a volume for a distributed file system should be managed\n+by Kubernetes depends on the cluster operator's policy and the volume type.  Additionally, not all\n+distributed file systems support `chown`, `chmod`, and `chcon` operations uniformly.  Our API should\n+make it simple to express whether a particular volume should have these concerns managed by\n+Kubernetes.  For simplicity's sake, we will assume that if a volume requires ownership management,\n+that it also requires relabeling and vice-versa.\n+\n+#### API requirements\n+\n+From the above, we know that label management must be applied:\n+\n+1.  To some volume types always\n+2.  To some volume types never\n+3.  To some volume types *sometimes*\n+\n+If the SELinux cluster capability is enabled, volumes should be relabeled with the correct SELinux\n+context.  Docker has this capability today; it is desireable for other container runtime\n+implementations to provide similar functionality.\n+\n+Relabeling should be an optional aspect of a volume plugin to accomodate:\n+\n+1.  volume types for which generalized relabeling support is not sufficient\n+2.  testing for each volume plugin individually\n+\n+## Proposed Design\n+\n+Our design should minimize code for handling SELinux labelling required in the Kubelet and volume\n+plugins.\n+\n+### Deferral: MCS label allocation\n+\n+Our short-term goal is to facilitate volume sharing and isolation with SELinux and expose the\n+primitives for higher level composition; making these automatic is a longer-term goal.  Allocating\n+groups and MCS labels are fairly complex problems in their own right, and so our proposal will not\n+encompass either of these topics.  There are several problems that the solution for allocation\n+depends on:\n+\n+1.  Users and groups in Kubernetes\n+2.  General auth policy in Kubernetes\n+3.  [security policy](https://github.com/GoogleCloudPlatform/kubernetes/pull/7893)\n+\n+### API changes\n+\n+The [inline container security attributes PR (12823)](https://github.com/kubernetes/kubernetes/pull/12823)\n+adds a `pod.Spec.SecurityContext.SELinuxOptions` field.  The change to the API in this proposal is\n+the addition of the semantics to this field:\n+\n+* When the `pod.Spec.SecurityContext.SELinuxOptions` field is set, volumes that support ownership\n+management in the Kubelet have their SELinuxContext set from this field.\n+\n+```go\n+package api\n+\n+type PodSecurityContext struct {\n+    // SELinuxOptions captures the SELinux context for all containers in a Pod.  If a container's\n+    // SecurityContext.SELinuxOptions field is set, that setting has precedent for that container.\n+    //\n+    // This field will be used to set the SELinux of volumes that support SELinux label management\n+    // by the kubelet.\n+    SELinuxOptions *SELinuxOptions `json:\"seLinuxOptions,omitempty\"`\n+}\n+```\n+\n+The V1 API is extended with the same semantics:\n+\n+```go\n+package v1\n+\n+type PodSecurityContext struct {\n+    // SELinuxOptions captures the SELinux context for all containers in a Pod.  If a container's\n+    // SecurityContext.SELinuxOptions field is set, that setting has precedent for that container.\n+    //\n+    // This field will be used to set the SELinux of volumes that support SELinux label management\n+    // by the kubelet.\n+    SELinuxOptions *SELinuxOptions `json:\"seLinuxOptions,omitempty\"`\n+}\n+```\n+\n+#### API backward compatibility\n+\n+Old pods that do not have the `pod.Spec.SecurityContext.SELinuxOptions` field set will not receive\n+SELinux label management for their volumes.  This is acceptable since old clients won't know about\n+this field and won't have any expectation of their volumes being managed this way.\n+\n+The existing backward compatibility semantics for SELinux do not change at all with this proposal.\n+\n+### Kubelet changes\n+\n+The Kubelet should be modified to perform SELinux label management when required for a volume.  The\n+criteria to activate the kubelet SELinux label management for volumes are:\n+\n+1.  SELinux integration is enabled in the cluster\n+2.  SELinux is enabled on the node\n+3.  The `pod.Spec.SecurityContext.SELinuxOptions` field is set\n+4.  The volume plugin supports SELinux label management\n+\n+The `volume.Builder` interface should have a new method added that indicates whether the plugin\n+supports SELinux label management:\n+\n+```go\n+package volume\n+\n+type Builder interface {\n+    // other methods omitted\n+    SupportsSELinuxLabelManagement() bool\n+}\n+```\n+\n+Individual volume plugins are responsible for correctly reporting whether they support label","path":"docs/proposals/selinux.md","position":280,"original_position":247,"commit_id":"dd2a3bfcd35f3bf060cafad6d651c2b31a4ad0f5","original_commit_id":"b2e967e94a6a9558d87cf084d1981044ecc64427","user":{"login":"pmorie","id":366488,"avatar_url":"https://avatars.githubusercontent.com/u/366488?v=3","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},"body":"@thockin Could it be better named, perhaps?  `RequestsKubeletChcon`, `RequestKubeletLabelManagement`, `DesiresInHeartOfHeartsSELinuxLabelManagementFromKubelet`?","created_at":"2015-09-29T02:18:38Z","updated_at":"2015-09-29T02:18:38Z","html_url":"https://github.com/kubernetes/kubernetes/pull/14192#discussion_r40628377","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/14192","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/40628377"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/14192#discussion_r40628377"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/14192"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/14192","id":45439739,"html_url":"https://github.com/kubernetes/kubernetes/pull/14192","diff_url":"https://github.com/kubernetes/kubernetes/pull/14192.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/14192.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/14192","number":14192,"state":"open","locked":false,"title":"WIP: pod level SELinux context and volumes","user":{"login":"pmorie","id":366488,"avatar_url":"https://avatars.githubusercontent.com/u/366488?v=3","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},"body":"Splitting from #12944; this proposal covers just SELinux and generic label management for volumes.\r\n\r\nNext step is discussion of API backward compatibility issues.\r\n\r\n@pweil- @swagiaal @smarterclayton @childsb @wattsteve\n\n<!-- Reviewable:start -->\n[<img src=\"https://reviewable.io/review_button.png\" height=40 alt=\"Review on Reviewable\"/>](https://reviewable.io/reviews/kubernetes/kubernetes/14192)\n<!-- Reviewable:end -->\n","created_at":"2015-09-18T18:50:32Z","updated_at":"2015-09-29T02:18:38Z","closed_at":null,"merged_at":null,"merge_commit_sha":"18d6da89bc363744ba5b616783585ad06236415b","assignee":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/14192/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/14192/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/14192/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/dd2a3bfcd35f3bf060cafad6d651c2b31a4ad0f5","head":{"label":"pmorie:generic-selinux","ref":"generic-selinux","sha":"dd2a3bfcd35f3bf060cafad6d651c2b31a4ad0f5","user":{"login":"pmorie","id":366488,"avatar_url":"https://avatars.githubusercontent.com/u/366488?v=3","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},"repo":{"id":21654452,"name":"kubernetes","full_name":"pmorie/kubernetes","owner":{"login":"pmorie","id":366488,"avatar_url":"https://avatars.githubusercontent.com/u/366488?v=3","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/pmorie/kubernetes","description":"Container Cluster Manager","fork":true,"url":"https://api.github.com/repos/pmorie/kubernetes","forks_url":"https://api.github.com/repos/pmorie/kubernetes/forks","keys_url":"https://api.github.com/repos/pmorie/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pmorie/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pmorie/kubernetes/teams","hooks_url":"https://api.github.com/repos/pmorie/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/pmorie/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/pmorie/kubernetes/events","assignees_url":"https://api.github.com/repos/pmorie/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/pmorie/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/pmorie/kubernetes/tags","blobs_url":"https://api.github.com/repos/pmorie/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pmorie/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pmorie/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/pmorie/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pmorie/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/pmorie/kubernetes/languages","stargazers_url":"https://api.github.com/repos/pmorie/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/pmorie/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/pmorie/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/pmorie/kubernetes/subscription","commits_url":"https://api.github.com/repos/pmorie/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/pmorie/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/pmorie/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/pmorie/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/pmorie/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/pmorie/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pmorie/kubernetes/merges","archive_url":"https://api.github.com/repos/pmorie/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pmorie/kubernetes/downloads","issues_url":"https://api.github.com/repos/pmorie/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/pmorie/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/pmorie/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/pmorie/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pmorie/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/pmorie/kubernetes/releases{/id}","created_at":"2014-07-09T14:06:25Z","updated_at":"2015-08-13T02:02:33Z","pushed_at":"2015-09-29T01:51:37Z","git_url":"git://github.com/pmorie/kubernetes.git","ssh_url":"git@github.com:pmorie/kubernetes.git","clone_url":"https://github.com/pmorie/kubernetes.git","svn_url":"https://github.com/pmorie/kubernetes","homepage":null,"size":112488,"stargazers_count":1,"watchers_count":1,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":3,"forks":0,"open_issues":3,"watchers":1,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"d49ca164ef27e8cb2661feb126f7de948c853b10","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Container Cluster Manager from Google","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","created_at":"2014-06-06T22:56:04Z","updated_at":"2015-09-28T22:29:51Z","pushed_at":"2015-09-29T02:08:56Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":434483,"stargazers_count":10479,"watchers_count":10479,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":2611,"mirror_url":null,"open_issues_count":1954,"forks":2611,"open_issues":1954,"watchers":10479,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/14192"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/14192"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/14192"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/14192/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/14192/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/14192/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/dd2a3bfcd35f3bf060cafad6d651c2b31a4ad0f5"}}}}