{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/origin/pulls/comments/31873187","id":31873187,"diff_hunk":"@@ -213,6 +213,100 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {\n \t\t},\n \t\t{\n \t\t\tObjectMeta: kapi.ObjectMeta{\n+\t\t\t\tName: BuildControllerRoleName,\n+\t\t\t},\n+\t\t\tRules: []authorizationapi.PolicyRule{\n+\t\t\t\t// BuildControllerFactory.buildLW\n+\t\t\t\t// BuildControllerFactory.buildDeleteLW\n+\t\t\t\t{\n+\t\t\t\t\tVerbs:     util.NewStringSet(\"get\", \"list\", \"watch\"),\n+\t\t\t\t\tResources: util.NewStringSet(\"builds\"),\n+\t\t\t\t},\n+\t\t\t\t// BuildController.BuildUpdater (OSClientBuildClient)\n+\t\t\t\t{\n+\t\t\t\t\tVerbs:     util.NewStringSet(\"update\"),\n+\t\t\t\t\tResources: util.NewStringSet(\"builds\"),\n+\t\t\t\t},\n+\t\t\t\t// BuildController.ImageStreamClient (ControllerClient)\n+\t\t\t\t{\n+\t\t\t\t\tVerbs:     util.NewStringSet(\"get\"),\n+\t\t\t\t\tResources: util.NewStringSet(\"imagestreams\"),\n+\t\t\t\t},\n+\t\t\t\t// BuildController.PodManager (ControllerClient)\n+\t\t\t\t// BuildDeleteController.PodManager (ControllerClient)\n+\t\t\t\t// BuildControllerFactory.buildDeleteLW\n+\t\t\t\t{\n+\t\t\t\t\tVerbs:     util.NewStringSet(\"get\", \"list\", \"create\", \"delete\"),\n+\t\t\t\t\tResources: util.NewStringSet(\"pods\"),\n+\t\t\t\t},\n+\t\t\t\t// BuildController.Recorder (EventBroadcaster)\n+\t\t\t\t{\n+\t\t\t\t\tVerbs:     util.NewStringSet(\"create\", \"update\"),\n+\t\t\t\t\tResources: util.NewStringSet(\"events\"),\n+\t\t\t\t},\n+\t\t\t},\n+\t\t},\n+\t\t{\n+\t\t\tObjectMeta: kapi.ObjectMeta{\n+\t\t\t\tName: DeploymentControllerRoleName,\n+\t\t\t},\n+\t\t\tRules: []authorizationapi.PolicyRule{\n+\t\t\t\t// DeploymentControllerFactory.deploymentLW\n+\t\t\t\t{\n+\t\t\t\t\tVerbs:     util.NewStringSet(\"list\", \"watch\"),\n+\t\t\t\t\tResources: util.NewStringSet(\"replicationcontrollers\"),\n+\t\t\t\t},\n+\t\t\t\t// DeploymentControllerFactory.deploymentClient\n+\t\t\t\t{\n+\t\t\t\t\tVerbs:     util.NewStringSet(\"get\", \"update\"),\n+\t\t\t\t\tResources: util.NewStringSet(\"replicationcontrollers\"),\n+\t\t\t\t},\n+\t\t\t\t// DeploymentController.podClient\n+\t\t\t\t{\n+\t\t\t\t\tVerbs:     util.NewStringSet(\"get\", \"create\", \"delete\", \"update\"),\n+\t\t\t\t\tResources: util.NewStringSet(\"pods\"),\n+\t\t\t\t},\n+\t\t\t\t// DeploymentController.recorder (EventBroadcaster)\n+\t\t\t\t{\n+\t\t\t\t\tVerbs:     util.NewStringSet(\"create\", \"update\"),\n+\t\t\t\t\tResources: util.NewStringSet(\"events\"),\n+\t\t\t\t},\n+\t\t\t},\n+\t\t},\n+\t\t{\n+\t\t\tObjectMeta: kapi.ObjectMeta{\n+\t\t\t\tName: ReplicationControllerRoleName,","path":"pkg/cmd/server/bootstrappolicy/policy.go","position":66,"original_position":66,"commit_id":"b16025b1f769f0c0bc6072eedb988ee5bcc62a0b","original_commit_id":"b16025b1f769f0c0bc6072eedb988ee5bcc62a0b","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"body":"@ironcladlou can you also double-check these as permissions for the ReplicationController","created_at":"2015-06-07T02:20:28Z","updated_at":"2015-06-07T02:20:28Z","html_url":"https://github.com/openshift/origin/pull/2777#discussion_r31873187","pull_request_url":"https://api.github.com/repos/openshift/origin/pulls/2777","_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments/31873187"},"html":{"href":"https://github.com/openshift/origin/pull/2777#discussion_r31873187"},"pull_request":{"href":"https://api.github.com/repos/openshift/origin/pulls/2777"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/2777","id":36900019,"html_url":"https://github.com/openshift/origin/pull/2777","diff_url":"https://github.com/openshift/origin/pull/2777.diff","patch_url":"https://github.com/openshift/origin/pull/2777.patch","issue_url":"https://api.github.com/repos/openshift/origin/issues/2777","number":2777,"state":"open","locked":false,"title":"Run pod-creating controllers under infra-namespace service accounts","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"body":"- [x] Add config option for infra namespace\r\n- [x] Ensure namespace exists on startup\r\n- [x] Ensure replicationController, buildController, deploymentController service accounts exist\r\n- [x] Define roles for ^\r\n- [x] Ensure service accounts are mapped to roles at startup\r\n- [x] Build clients using service account credentials when starting controllers\r\n- [ ] Open issue for doc to add infra namespace config\r\n- [ ] Open issue for install to add infra namespace config to templates\r\n\r\nResolves #2774","created_at":"2015-06-04T03:44:43Z","updated_at":"2015-06-07T02:20:28Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9cdde4456ef05f26d9c58180c0391acc57f89352","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openshift/origin/pulls/2777/commits","review_comments_url":"https://api.github.com/repos/openshift/origin/pulls/2777/comments","review_comment_url":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/origin/issues/2777/comments","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/b16025b1f769f0c0bc6072eedb988ee5bcc62a0b","head":{"label":"liggitt:build_pod_user","ref":"build_pod_user","sha":"b16025b1f769f0c0bc6072eedb988ee5bcc62a0b","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"repo":{"id":23198153,"name":"origin","full_name":"liggitt/origin","owner":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/liggitt/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":true,"url":"https://api.github.com/repos/liggitt/origin","forks_url":"https://api.github.com/repos/liggitt/origin/forks","keys_url":"https://api.github.com/repos/liggitt/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/liggitt/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/liggitt/origin/teams","hooks_url":"https://api.github.com/repos/liggitt/origin/hooks","issue_events_url":"https://api.github.com/repos/liggitt/origin/issues/events{/number}","events_url":"https://api.github.com/repos/liggitt/origin/events","assignees_url":"https://api.github.com/repos/liggitt/origin/assignees{/user}","branches_url":"https://api.github.com/repos/liggitt/origin/branches{/branch}","tags_url":"https://api.github.com/repos/liggitt/origin/tags","blobs_url":"https://api.github.com/repos/liggitt/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/liggitt/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/liggitt/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/liggitt/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/liggitt/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/liggitt/origin/languages","stargazers_url":"https://api.github.com/repos/liggitt/origin/stargazers","contributors_url":"https://api.github.com/repos/liggitt/origin/contributors","subscribers_url":"https://api.github.com/repos/liggitt/origin/subscribers","subscription_url":"https://api.github.com/repos/liggitt/origin/subscription","commits_url":"https://api.github.com/repos/liggitt/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/liggitt/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/liggitt/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/liggitt/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/liggitt/origin/contents/{+path}","compare_url":"https://api.github.com/repos/liggitt/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/liggitt/origin/merges","archive_url":"https://api.github.com/repos/liggitt/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/liggitt/origin/downloads","issues_url":"https://api.github.com/repos/liggitt/origin/issues{/number}","pulls_url":"https://api.github.com/repos/liggitt/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/liggitt/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/liggitt/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/liggitt/origin/labels{/name}","releases_url":"https://api.github.com/repos/liggitt/origin/releases{/id}","created_at":"2014-08-21T18:23:05Z","updated_at":"2015-05-08T13:01:51Z","pushed_at":"2015-06-07T02:06:11Z","git_url":"git://github.com/liggitt/origin.git","ssh_url":"git@github.com:liggitt/origin.git","clone_url":"https://github.com/liggitt/origin.git","svn_url":"https://github.com/liggitt/origin","homepage":"https://openshift.github.io","size":125386,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"91604bd013892fae328d26578b621580b5b7cf60","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":22442668,"name":"origin","full_name":"openshift/origin","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":false,"url":"https://api.github.com/repos/openshift/origin","forks_url":"https://api.github.com/repos/openshift/origin/forks","keys_url":"https://api.github.com/repos/openshift/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/origin/teams","hooks_url":"https://api.github.com/repos/openshift/origin/hooks","issue_events_url":"https://api.github.com/repos/openshift/origin/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/origin/events","assignees_url":"https://api.github.com/repos/openshift/origin/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/origin/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/origin/tags","blobs_url":"https://api.github.com/repos/openshift/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/origin/languages","stargazers_url":"https://api.github.com/repos/openshift/origin/stargazers","contributors_url":"https://api.github.com/repos/openshift/origin/contributors","subscribers_url":"https://api.github.com/repos/openshift/origin/subscribers","subscription_url":"https://api.github.com/repos/openshift/origin/subscription","commits_url":"https://api.github.com/repos/openshift/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/origin/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/origin/merges","archive_url":"https://api.github.com/repos/openshift/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/origin/downloads","issues_url":"https://api.github.com/repos/openshift/origin/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/origin/labels{/name}","releases_url":"https://api.github.com/repos/openshift/origin/releases{/id}","created_at":"2014-07-30T20:04:05Z","updated_at":"2015-06-06T19:50:38Z","pushed_at":"2015-06-07T02:06:12Z","git_url":"git://github.com/openshift/origin.git","ssh_url":"git@github.com:openshift/origin.git","clone_url":"https://github.com/openshift/origin.git","svn_url":"https://github.com/openshift/origin","homepage":"http://www.openshift.org","size":191826,"stargazers_count":465,"watchers_count":465,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":232,"mirror_url":null,"open_issues_count":289,"forks":232,"open_issues":289,"watchers":465,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/2777"},"html":{"href":"https://github.com/openshift/origin/pull/2777"},"issue":{"href":"https://api.github.com/repos/openshift/origin/issues/2777"},"comments":{"href":"https://api.github.com/repos/openshift/origin/issues/2777/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/origin/pulls/2777/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/origin/pulls/2777/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/origin/statuses/b16025b1f769f0c0bc6072eedb988ee5bcc62a0b"}}}}