{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/12209","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/12209/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/12209/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/12209/events","html_url":"https://github.com/kubernetes/kubernetes/pull/12209","id":99016157,"number":12209,"title":"Proposal: enhance pluggable policy","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/L","name":"size/L","color":"ee9900"}],"state":"open","locked":false,"assignee":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/16","html_url":"https://github.com/kubernetes/kubernetes/milestones/v1.2-candidate","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/16/labels","id":1278500,"number":16,"title":"v1.2-candidate","description":"Things to consider for next minor release.","creator":{"login":"bgrant0607","id":7725777,"avatar_url":"https://avatars.githubusercontent.com/u/7725777?v=3","gravatar_id":"","url":"https://api.github.com/users/bgrant0607","html_url":"https://github.com/bgrant0607","followers_url":"https://api.github.com/users/bgrant0607/followers","following_url":"https://api.github.com/users/bgrant0607/following{/other_user}","gists_url":"https://api.github.com/users/bgrant0607/gists{/gist_id}","starred_url":"https://api.github.com/users/bgrant0607/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgrant0607/subscriptions","organizations_url":"https://api.github.com/users/bgrant0607/orgs","repos_url":"https://api.github.com/users/bgrant0607/repos","events_url":"https://api.github.com/users/bgrant0607/events{/privacy}","received_events_url":"https://api.github.com/users/bgrant0607/received_events","type":"User","site_admin":false},"open_issues":188,"closed_issues":25,"state":"open","created_at":"2015-08-29T03:54:34Z","updated_at":"2015-11-20T11:03:45Z","due_on":null,"closed_at":null},"comments":22,"created_at":"2015-08-04T17:14:13Z","updated_at":"2015-11-20T14:34:35Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/12209","html_url":"https://github.com/kubernetes/kubernetes/pull/12209","diff_url":"https://github.com/kubernetes/kubernetes/pull/12209.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/12209.patch"},"body":"This describes modifications to the current authorization APIs to make policy more powerful and easier to extend.  This document aligns with OpenShift authorization.\r\n\r\n@erictune ptal\r\n\r\n@liggitt @smarterclayton @derekwaynecarr fyi"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/158417035","html_url":"https://github.com/kubernetes/kubernetes/pull/12209#issuecomment-158417035","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/12209","id":158417035,"user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"created_at":"2015-11-20T14:34:35Z","updated_at":"2015-11-20T14:34:35Z","body":"> Does Subject Access Review just do the kind of authorization that you can do against openshift policy objects (e.g. Role, Policy, and RoleBinding) or does it also check against admission controllers that might reject based on specific content of pods?\r\n\r\nIt only does the authorization check, the `.Authorize` call.  It doesn't check any admission controllers or the like."}}