{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16148","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16148/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16148/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16148/events","html_url":"https://github.com/kubernetes/kubernetes/pull/16148","id":112962178,"number":16148,"title":"Add non-resource-request support to ABAC, fix kubectl for namespaced users","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note","name":"release-note","color":"db5a64"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/XXL","name":"size/XXL","color":"ee0000"}],"state":"open","locked":false,"assignee":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"milestone":null,"comments":36,"created_at":"2015-10-23T06:32:48Z","updated_at":"2015-11-26T14:47:07Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/16148","html_url":"https://github.com/kubernetes/kubernetes/pull/16148","diff_url":"https://github.com/kubernetes/kubernetes/pull/16148.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/16148.patch"},"body":"Rebased and built on https://github.com/kubernetes/kubernetes/issues/13667\r\n\r\n- authorizer.Attributes\r\n  - Added attribute indicating whether the request was for a resource (`IsResourceRequest`)\r\n  - Added attribute containing the request path (can be used in combination with `IsResourceRequest` to authorize non-resource requests to paths like `/swaggerapi`, or `/apis` or `/healthz`, etc)\r\n- ABAC policy\r\n  - Added support for matching on API groups attribute\r\n  - Added support for matching non-resource requests (fixes #13097)\r\n  - Added line number and context to load errors\r\n  - Ignore empty and comment lines\r\n  - Converted to versioned resources (similar to scheduler policy objects) (fixes #15117)\r\n  - In \"abac.authorization.kubernetes.io/v1\", explicitly require `\"user\":\"*\",\"namespace\":\"*\",\"resource\":\"*\",\"resourceGroup\":\"*\"` to match all (deny by default, rather than grant by default)\r\n  - Defined a \"abac.authorization.kubernetes.io/v0\" version for ABAC policy rule objects with conversions to \"abac.authorization.kubernetes.io/v1\" preserving current behavior (preserved all ABAC tests as well)"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/159930956","html_url":"https://github.com/kubernetes/kubernetes/pull/16148#issuecomment-159930956","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16148","id":159930956,"user":{"login":"k8s-bot","id":12551979,"avatar_url":"https://avatars.githubusercontent.com/u/12551979?v=3","gravatar_id":"","url":"https://api.github.com/users/k8s-bot","html_url":"https://github.com/k8s-bot","followers_url":"https://api.github.com/users/k8s-bot/followers","following_url":"https://api.github.com/users/k8s-bot/following{/other_user}","gists_url":"https://api.github.com/users/k8s-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/k8s-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/k8s-bot/subscriptions","organizations_url":"https://api.github.com/users/k8s-bot/orgs","repos_url":"https://api.github.com/users/k8s-bot/repos","events_url":"https://api.github.com/users/k8s-bot/events{/privacy}","received_events_url":"https://api.github.com/users/k8s-bot/received_events","type":"User","site_admin":false},"created_at":"2015-11-26T14:47:06Z","updated_at":"2015-11-26T14:47:06Z","body":"GCE e2e test build/test **passed** for commit 91b18f882c83a10328cde052e0f6544025a3deee.\n* [Build Log](https://storage.cloud.google.com/kubernetes-jenkins/pr-logs/91b18f882c83a10328cde052e0f6544025a3deee/kubernetes-pull-build-test-e2e-gce/18090/build-log.txt)\n* [Test Artifacts](https://console.developers.google.com/storage/browser/kubernetes-jenkins/pr-logs/91b18f882c83a10328cde052e0f6544025a3deee/kubernetes-pull-build-test-e2e-gce/18090/artifacts/)\n* [Internal Jenkins Results](http://goto.google.com/prkubekins/job/kubernetes-pull-build-test-e2e-gce//18090)\n"}}