{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/3318","labels_url":"https://api.github.com/repos/openshift/origin/issues/3318/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/3318/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/3318/events","html_url":"https://github.com/openshift/origin/issues/3318","id":89375536,"number":3318,"title":"Can't use secrets in templates for pods also in templates","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/openshift/origin/labels/area/security","name":"area/security","color":"006b75"},{"url":"https://api.github.com/repos/openshift/origin/labels/area/usability","name":"area/usability","color":"006b75"},{"url":"https://api.github.com/repos/openshift/origin/labels/dependency/kubernetes","name":"dependency/kubernetes","color":"c7def8"},{"url":"https://api.github.com/repos/openshift/origin/labels/kind/enhancement","name":"kind/enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/openshift/origin/labels/priority/P2","name":"priority/P2","color":"fbca04"}],"state":"open","locked":false,"assignee":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-06-18T19:22:41Z","updated_at":"2015-07-01T23:35:31Z","closed_at":null,"body":"In order to mount a secret, the service account for a pod must have the secret in its list of mountable secrets.  If my secret is in my template and I don't want to create a new service account in that template, my pods will be rejected until my service account is updated.\r\n\r\nWe should have an option for creating a super-SA that can mount any secret in the namespace.  Two obvious implementations:\r\n 1. flag obeyed by the admission controller that allow any secrets.\r\n 1. flag obeyed by a controller that adds all secrets to the list of mountable secrets for the service account.\r\n\r\nI think the dealbreak for option 2 is that if the modification of the service account  doesn't happen before the pod in the template is created, the pod will be rejected by admission.  Pretty sure that means it's option 1 only."},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/117851560","html_url":"https://github.com/openshift/origin/issues/3318#issuecomment-117851560","issue_url":"https://api.github.com/repos/openshift/origin/issues/3318","id":117851560,"user":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"created_at":"2015-07-01T23:35:31Z","updated_at":"2015-07-01T23:35:31Z","body":"This is pissing me off and is now p1.  I'd like this in before we cut 3.0.1"}}