{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/4782","labels_url":"https://api.github.com/repos/openshift/origin/issues/4782/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/4782/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/4782/events","html_url":"https://github.com/openshift/origin/issues/4782","id":108136125,"number":4782,"title":"users can't predict whether an SCC will satisfy their DC","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/openshift/origin/labels/component/master","name":"component/master","color":"0052cc"},{"url":"https://api.github.com/repos/openshift/origin/labels/priority/P2","name":"priority/P2","color":"fbca04"}],"state":"closed","locked":false,"assignee":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"milestone":null,"comments":7,"created_at":"2015-09-24T14:00:09Z","updated_at":"2015-11-10T19:52:10Z","closed_at":"2015-11-10T19:52:10Z","body":"The chain from DC to SCC is maze of twisty passages.\r\n\r\n1. User creates deployment config\r\n2. deployment controller creates rc\r\n4. rc manager creates pod\r\n\r\nIn order to know if his DC is going to work, the user must be able to determine if the podspec in the DC will result in a pod that the SCC admission plugin will admit.  That requires knowledge of the SCCs available to the podspec's SA.  Right now, that information is unavailable.\r\n\r\nWe need to allow editors (and maybe viewers) enough power to figure out which SA they should use for a particular DC/RC/Pod.  That means exposing a way for them to see which SCCs a given SA has and which SCCs they have available.  Off the top of my head, this could be done with:\r\n\r\n1. an AccessReview style check\r\n2. with subresources on SAs and users (less desireable I think)\r\n3. get/list on SCCs (we probably don't want this, since it exposes the list of subjects, giving attack targets)\r\n\r\n@pweil- @smarterclayton @liggitt "},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/155547163","html_url":"https://github.com/openshift/origin/issues/4782#issuecomment-155547163","issue_url":"https://api.github.com/repos/openshift/origin/issues/4782","id":155547163,"user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"created_at":"2015-11-10T19:52:10Z","updated_at":"2015-11-10T19:52:10Z","body":"Closing for trello: https://trello.com/c/YqfYqKdS/545-policy-related-endpoints-need-work"}}