{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/3047","labels_url":"https://api.github.com/repos/openshift/origin/issues/3047/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/3047/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/3047/events","html_url":"https://github.com/openshift/origin/pull/3047","id":86981989,"number":3047,"title":"auto-manage system roles on startup","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-06-10T14:03:52Z","updated_at":"2015-06-10T21:15:02Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/3047","html_url":"https://github.com/openshift/origin/pull/3047","diff_url":"https://github.com/openshift/origin/pull/3047.diff","patch_url":"https://github.com/openshift/origin/pull/3047.patch"},"body":"Remove system:* roles and rolebindings from policy.json.  One master start, the system:* roles are diffed into the existing system:* roles and created/updated as appropriate.  system:* rolebindings are checked for equivalence and covers and mutated appropriately.\r\n\r\nThis obviates the need for system:* role permissions to be updated manually since we own those roles\r\n\r\n@liggitt ptal\r\n@smarterclayton approval?  This would eliminate manual steps like @liggitt had to describe in his note."},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/110916596","html_url":"https://github.com/openshift/origin/pull/3047#issuecomment-110916596","issue_url":"https://api.github.com/repos/openshift/origin/issues/3047","id":110916596,"user":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"created_at":"2015-06-10T21:15:02Z","updated_at":"2015-06-10T21:15:02Z","body":"Post 3.0.  We need to have a longer discussion about whether we own system: or not.\r\n\r\n> On Jun 10, 2015, at 10:03 AM, David Eads <notifications@github.com> wrote:\r\n> \r\n> Remove system:* roles and rolebindings from policy.json. One master start, the system:* roles are diffed into the existing system:* roles and created/updated as appropriate. system:* rolebindings are checked for equivalence and covers and mutated appropriately.\r\n> \r\n> This obviates the need for system:* role permissions to be updated manually since we own those roles\r\n> \r\n> @liggitt ptal\r\n> @smarterclayton approval? This would eliminate manual steps like @liggitt had to describe in his note.\r\n> \r\n> You can view, comment on, or merge this pull request online at:\r\n> \r\n>   https://github.com/openshift/origin/pull/3047\r\n> \r\n> Commit Summary\r\n> \r\n> auto-manage system roles on startup\r\n> File Changes\r\n> \r\n> M pkg/authorization/registry/clusterrole/registry.go (16)\r\n> M pkg/authorization/registry/clusterrolebinding/registry.go (60)\r\n> M pkg/cmd/server/bootstrappolicy/policy.go (423)\r\n> A pkg/cmd/server/bootstrappolicy/system_policy.go (461)\r\n> A pkg/cmd/server/bootstrappolicy/system_policy_test.go (72)\r\n> M pkg/cmd/server/origin/master.go (72)\r\n> Patch Links:\r\n> \r\n> https://github.com/openshift/origin/pull/3047.patch\r\n> https://github.com/openshift/origin/pull/3047.diff\r\n> —\r\n> Reply to this email directly or view it on GitHub.\r\n> \r\n"}}