{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13939","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13939/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13939/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13939/events","html_url":"https://github.com/kubernetes/kubernetes/pull/13939","id":106436263,"number":13939,"title":"Add PodSecurityContext and backward compatibility tests","user":{"login":"pmorie","id":366488,"avatar_url":"https://avatars.githubusercontent.com/u/366488?v=3","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/XL","name":"size/XL","color":"ee5500"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/api","name":"team/api","color":"d2b48c"}],"state":"open","locked":false,"assignee":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"milestone":null,"comments":8,"created_at":"2015-09-14T21:58:19Z","updated_at":"2015-09-15T20:27:53Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/13939","html_url":"https://github.com/kubernetes/kubernetes/pull/13939","diff_url":"https://github.com/kubernetes/kubernetes/pull/13939.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/13939.patch"},"body":"Splitting from #12823 after discussion with @bgrant0607 and @smarterclayton.  This PR contains a subset of the proposed changes from #12823 that are fully backward compatible.\r\n\r\n@thockin @liggitt @pweil- "},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/140527647","html_url":"https://github.com/kubernetes/kubernetes/pull/13939#issuecomment-140527647","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13939","id":140527647,"user":{"login":"bgrant0607","id":7725777,"avatar_url":"https://avatars.githubusercontent.com/u/7725777?v=3","gravatar_id":"","url":"https://api.github.com/users/bgrant0607","html_url":"https://github.com/bgrant0607","followers_url":"https://api.github.com/users/bgrant0607/followers","following_url":"https://api.github.com/users/bgrant0607/following{/other_user}","gists_url":"https://api.github.com/users/bgrant0607/gists{/gist_id}","starred_url":"https://api.github.com/users/bgrant0607/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgrant0607/subscriptions","organizations_url":"https://api.github.com/users/bgrant0607/orgs","repos_url":"https://api.github.com/users/bgrant0607/repos","events_url":"https://api.github.com/users/bgrant0607/events{/privacy}","received_events_url":"https://api.github.com/users/bgrant0607/received_events","type":"User","site_admin":false},"created_at":"2015-09-15T20:27:53Z","updated_at":"2015-09-15T20:27:53Z","body":"My take from #12944, #12823, and other conversations is that the critical use case we're trying to address is volumes. \r\n\r\nThe first thing needed is supplemental groups, AIUI, which doesn't have compatibility problems. Why don't we start there? I don't understand why we care about HostNetwork, HostPID, and HostIPC.\r\n\r\nThe next thing needed is SELinux settings for the volume. Adding this to the PodSecurityContext might be cleanest, but has the problem of overlapping with container-level SecurityContext. One way to get around that would be to add it to volumes instead. Would it need to be on all volumes, or just local ones (e.g., emptyDir), or volumeMount, or ...?"}}