{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13667","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13667/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13667/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13667/events","html_url":"https://github.com/kubernetes/kubernetes/pull/13667","id":105377435,"number":13667,"title":"Fix kubectl for namespaced users","user":{"login":"mkulke","id":273280,"avatar_url":"https://avatars.githubusercontent.com/u/273280?v=3","gravatar_id":"","url":"https://api.github.com/users/mkulke","html_url":"https://github.com/mkulke","followers_url":"https://api.github.com/users/mkulke/followers","following_url":"https://api.github.com/users/mkulke/following{/other_user}","gists_url":"https://api.github.com/users/mkulke/gists{/gist_id}","starred_url":"https://api.github.com/users/mkulke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mkulke/subscriptions","organizations_url":"https://api.github.com/users/mkulke/orgs","repos_url":"https://api.github.com/users/mkulke/repos","events_url":"https://api.github.com/users/mkulke/events{/privacy}","received_events_url":"https://api.github.com/users/mkulke/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/L","name":"size/L","color":"ee9900"}],"state":"open","locked":false,"assignee":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"milestone":null,"comments":45,"created_at":"2015-09-08T13:11:19Z","updated_at":"2015-09-15T21:29:44Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/13667","html_url":"https://github.com/kubernetes/kubernetes/pull/13667","diff_url":"https://github.com/kubernetes/kubernetes/pull/13667.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/13667.patch"},"body":"This is an attempt at fixing #13097. Currently users locked in a namespace by the ABAC authorization module cannot use kubectl at all, since kubectl does a version negotiation using /api which is not covered by the ABAC ontologies. So I ended up creating a MetaResource type, representing \"/api\" and \"/healthz\" currently. When a user has set \"kubectl: true\" as a property in the authorization policy file, calls to \"/api\" by that user will be allowed."},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/140552636","html_url":"https://github.com/kubernetes/kubernetes/pull/13667#issuecomment-140552636","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13667","id":140552636,"user":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"created_at":"2015-09-15T21:29:44Z","updated_at":"2015-09-15T21:29:44Z","body":"@liggitt is out this week, @deads2k if you have a few minutes to look at tests I would appreciate it."}}