{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/45021171","id":45021171,"diff_hunk":"@@ -0,0 +1,219 @@\n+# Proposal: Solving the Confused Deputy Problem with Acting-As\n+\n+## Proposal\n+\n+**Ongoing Problem**: we have had confused deputy bugs in RC-manager, job-manager, and HPA-manager.\n+It is an insidious problem in general.  We need to attenuate the authority of controller-manager.\n+\n+**Core Kubernetes Principle**: controllers from the core project, like replication controller, are\n+not special -- they are on a level playing field with user-implemented components.  (Only apiservers\n+are special, and they should do as little work as practical.)\n+\n+**Observation**:  Instead of POSTing an RC and letting the RC-manager watch it for me, I could write a\n+go program that watches my pods, and makes new ones for me, emulating an RC.  Currently the auth\n+flow for those two cases is totally different.  But it should not be very different, (see above\n+Principle).  \n+\n+This diagram shows how it works today when a user creates an RC, and then the RC-manager\n+creates a pod.\n+\n+<img src=\"https://www.lucidchart.com/publicSegments/view/14d7b49f-469c-4bc4-8bf7-f13581ee0220/image.png\"\n+alt=\"UML Sequence Diagram for Current Replication Controller\">\n+<!-- Original document: https://www.lucidchart.com/documents/edit/34454705-cff6-4b42-a95f-24d69a36184c\n+     contact etune@google.com to request access -->\n+\n+This diagram shows how it woud work today if a user created a program that was itself a Kubernetes\n+client, and acted as an RC, but for a fixed template, number of replicas, etc.\n+\n+<img src=\"https://www.lucidchart.com/publicSegments/view/a719bd66-191f-478f-8c42-bc033d19ef25/image.png\"\n+alt=\"UML Sequence Diagram for User-written Replication Controller\">\n+<!-- Original document: https://www.lucidchart.com/documents/edit/92c9f481-a104-4283-8c8d-6bec71a1d9d7\n+     contact etune@google.com to request access -->\n+\n+This diagram shows a proposal for how I think RC-manager should work.  It uses a new header (or\n+maybe query parameter?) which tells the apiserver that the RC-manager wants to Act-As\n+a different user. It is much closer to the \"user-written replication manager\" case.\n+\n+<img src=\"https://www.lucidchart.com/publicSegments/view/c59b1964-2345-4910-8580-d4c636f28fa3/image.png\"\n+alt=\"UML Sequence Diagram for Proposed RC-manager\">\n+<!-- Original document: https://www.lucidchart.com/documents/edit/7c8cdcde-9803-4211-8cf1-a05c6da3fbc6\n+     contact etune@google.com to request access -->\n+\n+Things to note in the new flow:\n+\n+- controller-manager is using authorized port instead of the localhost port to talk to \n+   kube-apiserver\n+- controller-manager sets a header to say it wants to lower its root-like powers in order\n+  to act as less powerful user (which solves the confused deputy).\n+\n+\n+## Argument for proposal\n+\n+This change would protect us from the confused-deputy problem.  This is important because:\n+\n+1. we have already had confused deputy bugs in many of our controllers.  there will be others.\n+1. this is a common class of bugs in systems such as this.\n+1. we might trust ourselves to keep controllers in the main repo free from these bugs;\n+   but we will not have time to closely review contributed code for these bugs.\n+1. out authorization rules will get more complex over time, so deputies will have\n+   to have new, more complex checks in them.  Bug fixing contrib code will be hard,\n+   since authorization is compiled into the controller.\n+1. Writing a controller in a language other than go difficult because you\n+   will not be able to reuse on-controller-auth code.\n+\n+## Work items\n+\n+The specific changes needed for this new flow are:\n+\n+- change controller manager to use the secure port rather than 127.0.0.1 on the\n+  master This does require users to change their flags, but we can support the\n+  old way for several release cycles.\n+- change apiserver to recognize an \"Acting-As\" header in requests, and to check whether the\n+  originally authenticated user is able to act as that user.\n+- Record both originally authenticated user and acting-as user in the apiserver logs for\n+  auditability. (Bonus).\n+- change controller-manager to set \"Acting-As\" header in requests.  It will be hardcoded to use\n+  the default service account of that namespace when making a request.  ","path":"docs/proposals/acting-as.md","position":76,"original_position":76,"commit_id":"9c2c4a2847b8e7d32334cd3b748f22b00b3a4561","original_commit_id":"6085b0c59b2a99f01ed97a0076997ff509026b43","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"body":"I'm not sold on the benefit of making a system-wide controller lower its abilities for each namespace it operates in. I would rather just correctly scope it to the permissions it needs (create pods, etc) across namespaces. Artificially lowering and raising permission levels makes it harder to reason about who the controller is acting as at any given point (and could even introduce escalation bugs where the programmer was trusting authz, and got confused about who the controller was... confused deputy deputy?)","created_at":"2015-11-17T04:24:55Z","updated_at":"2015-11-17T04:24:55Z","html_url":"https://github.com/kubernetes/kubernetes/pull/16933#discussion_r45021171","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/16933","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/45021171"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/16933#discussion_r45021171"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/16933"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/16933","id":49991769,"html_url":"https://github.com/kubernetes/kubernetes/pull/16933","diff_url":"https://github.com/kubernetes/kubernetes/pull/16933.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/16933.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16933","number":16933,"state":"open","locked":false,"title":"Added proposal for \"acting-as\".","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"body":"","created_at":"2015-11-06T19:05:01Z","updated_at":"2015-11-17T04:24:55Z","closed_at":null,"merged_at":null,"merge_commit_sha":"2067ed19358a08aee587310f9bfc2f7678fc9792","assignee":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/16933/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/16933/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16933/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/9c2c4a2847b8e7d32334cd3b748f22b00b3a4561","head":{"label":"erictune:auth-design-updates","ref":"auth-design-updates","sha":"9c2c4a2847b8e7d32334cd3b748f22b00b3a4561","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"repo":{"id":21629362,"name":"kubernetes","full_name":"erictune/kubernetes","owner":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/erictune/kubernetes","description":"Container Cluster Manager","fork":true,"url":"https://api.github.com/repos/erictune/kubernetes","forks_url":"https://api.github.com/repos/erictune/kubernetes/forks","keys_url":"https://api.github.com/repos/erictune/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/erictune/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/erictune/kubernetes/teams","hooks_url":"https://api.github.com/repos/erictune/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/erictune/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/erictune/kubernetes/events","assignees_url":"https://api.github.com/repos/erictune/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/erictune/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/erictune/kubernetes/tags","blobs_url":"https://api.github.com/repos/erictune/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/erictune/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/erictune/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/erictune/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/erictune/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/erictune/kubernetes/languages","stargazers_url":"https://api.github.com/repos/erictune/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/erictune/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/erictune/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/erictune/kubernetes/subscription","commits_url":"https://api.github.com/repos/erictune/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/erictune/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/erictune/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/erictune/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/erictune/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/erictune/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/erictune/kubernetes/merges","archive_url":"https://api.github.com/repos/erictune/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/erictune/kubernetes/downloads","issues_url":"https://api.github.com/repos/erictune/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/erictune/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/erictune/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/erictune/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/erictune/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/erictune/kubernetes/releases{/id}","created_at":"2014-07-08T21:00:59Z","updated_at":"2015-05-01T23:13:23Z","pushed_at":"2015-11-17T00:53:35Z","git_url":"git://github.com/erictune/kubernetes.git","ssh_url":"git@github.com:erictune/kubernetes.git","clone_url":"https://github.com/erictune/kubernetes.git","svn_url":"https://github.com/erictune/kubernetes","homepage":null,"size":131126,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"e88593d788947db4d5bb1c8333b1b0f418e826a3","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Container Cluster Manager from Google","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","created_at":"2014-06-06T22:56:04Z","updated_at":"2015-11-17T00:57:13Z","pushed_at":"2015-11-17T04:07:29Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":285576,"stargazers_count":11296,"watchers_count":11296,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":2977,"mirror_url":null,"open_issues_count":2328,"forks":2977,"open_issues":2328,"watchers":11296,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/16933"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/16933"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/16933"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/16933/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/16933/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/16933/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/9c2c4a2847b8e7d32334cd3b748f22b00b3a4561"}}}}