{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16250","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16250/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16250/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16250/events","html_url":"https://github.com/kubernetes/kubernetes/pull/16250","id":113280669,"number":16250,"title":"[WIP]Add uidenforcer admission controller","user":{"login":"yuvipanda","id":30430,"avatar_url":"https://avatars.githubusercontent.com/u/30430?v=3","gravatar_id":"","url":"https://api.github.com/users/yuvipanda","html_url":"https://github.com/yuvipanda","followers_url":"https://api.github.com/users/yuvipanda/followers","following_url":"https://api.github.com/users/yuvipanda/following{/other_user}","gists_url":"https://api.github.com/users/yuvipanda/gists{/gist_id}","starred_url":"https://api.github.com/users/yuvipanda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yuvipanda/subscriptions","organizations_url":"https://api.github.com/users/yuvipanda/orgs","repos_url":"https://api.github.com/users/yuvipanda/repos","events_url":"https://api.github.com/users/yuvipanda/events{/privacy}","received_events_url":"https://api.github.com/users/yuvipanda/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/L","name":"size/L","color":"ee9900"}],"state":"open","locked":false,"assignee":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"milestone":null,"comments":24,"created_at":"2015-10-26T03:53:04Z","updated_at":"2015-11-10T20:16:43Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/16250","html_url":"https://github.com/kubernetes/kubernetes/pull/16250","diff_url":"https://github.com/kubernetes/kubernetes/pull/16250.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/16250.patch"},"body":"- Enforces that all containers belonging to a particular user\r\n  in all pods run with the system uid (RunAsUser) of that user\r\n- Requires that uid be an integer specified for all users\r\n\r\nThis is me building and testing this out to be useful for Wikimedia Labs' use case, where we have:\r\n\r\n1. 1 to 1 correspondence for LDAP users and k8s users\r\n2. A different system (OpenGridEngine) that is already in use and runs user processes with their uids\r\n3. NFS that needs to be accessible to both GridEngine based processes and kubernetes containers/pods\r\n\r\nI'm still testing this out. Wondering how useful this would be upstream?\r\n\r\nAlso, I think there should be easier ways of deploying an admission controller that does not require\r\nit to be 'compiled' in."},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/155553224","html_url":"https://github.com/kubernetes/kubernetes/pull/16250#issuecomment-155553224","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16250","id":155553224,"user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"created_at":"2015-11-10T20:16:43Z","updated_at":"2015-11-10T20:16:43Z","body":"Outcome of discussion at Kubecon:\r\n\r\n1. @yuvipanda to put an annotation on the namespace like \"wikimedia-tool-user-uid=1234\" when he creates it. \r\n1. then he modifies this PR so that it just looks at the namespace of a pod, then looks up the namespace, gets the annotation, parses it, and then sets the RunAsUid of all incoming pods.  Pods created by the cluster admin in the kube-system namespace would have some other annotation allowing them to do whatever they want.\r\n1. he carries this patch for a few months and hopefully we get Security Policy #7893 merged into 1.3\r\n1. @erictune to make sure that we fix https://github.com/kubernetes/kubernetes/pull/13667 or the equivalent ASAP."}}