{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/origin/pulls/comments/29183155","id":29183155,"diff_hunk":"@@ -0,0 +1,97 @@\n+package admission\n+\n+import (\n+\t\"fmt\"\n+\t\"io\"\n+\n+\t\"github.com/GoogleCloudPlatform/kubernetes/pkg/admission\"\n+\tkapi \"github.com/GoogleCloudPlatform/kubernetes/pkg/api\"\n+\tapierrors \"github.com/GoogleCloudPlatform/kubernetes/pkg/api/errors\"\n+\t\"github.com/GoogleCloudPlatform/kubernetes/pkg/api/meta\"\n+\t\"github.com/GoogleCloudPlatform/kubernetes/pkg/client\"\n+\t\"github.com/GoogleCloudPlatform/kubernetes/pkg/labels\"\n+\n+\tnodecache \"github.com/openshift/origin/pkg/node/cache\"\n+\tprojectcache \"github.com/openshift/origin/pkg/project/cache\"\n+)\n+\n+func init() {\n+\tadmission.RegisterPlugin(\"OriginPodNodeEnvironment\", func(client client.Interface, config io.Reader) (admission.Interface, error) {\n+\t\treturn NewPodNodeEnvironment()\n+\t})\n+}\n+\n+// podNodeEnvironment is an implementation of admission.Interface.\n+type podNodeEnvironment struct {\n+}\n+\n+// Admit enforces that pod and its project node label selectors matches at least a node in the cluster.\n+func (p *podNodeEnvironment) Admit(a admission.Attributes) (err error) {\n+\t// ignore deletes\n+\tif a.GetOperation() == \"DELETE\" {\n+\t\treturn nil\n+\t}\n+\n+\tresource := a.GetResource()\n+\tif resource != \"pods\" {\n+\t\treturn nil\n+\t}\n+\n+\tobj := a.GetObject()\n+\tname := \"Unknown\"\n+\tif obj != nil {\n+\t\tname, _ = meta.NewAccessor().Name(obj)\n+\t}\n+\tpod := obj.(*kapi.Pod)\n+\n+\tvar podNodeSelector labels.Selector\n+\tif len(pod.Spec.NodeSelector) == 0 {\n+\t\tpodNodeSelector = labels.Everything()\n+\t} else {\n+\t\tpodNodeSelector = labels.SelectorFromSet(pod.Spec.NodeSelector)\n+\t}\n+\n+\tprojects, err := projectcache.GetProjectCache()\n+\tif err != nil {\n+\t\treturn err\n+\t}\n+\tnamespace, err := projects.GetNamespaceObject(a.GetNamespace())\n+\tif err != nil {\n+\t\treturn apierrors.NewForbidden(resource, name, err)\n+\t}\n+\tprojectNodeSelector, err := projects.GetNodeSelectorObject(namespace)\n+\tif err != nil {\n+\t\treturn apierrors.NewForbidden(resource, name, err)\n+\t}\n+\n+\tnc, err := nodecache.GetNodeCache()\n+\tif err != nil {\n+\t\treturn err\n+\t}\n+\tnodes, err := nc.NodeLister.List()\n+\tif err != nil {\n+\t\treturn apierrors.NewForbidden(resource, name, fmt.Errorf(\"Unable to list nodes in the cluster, error: %v\", err))\n+\t}\n+\n+\tprojectMatched := false\n+\tfor _, node := range nodes.Items {\n+\t\tnodeLabelSet := labels.Set(node.Labels)\n+\t\tpodSelectorMatches := podNodeSelector.Matches(nodeLabelSet)\n+\t\tprojectSelectorMatches := projectNodeSelector.Matches(nodeLabelSet)\n+\t\tif podSelectorMatches && projectSelectorMatches {\n+\t\t\treturn nil\n+\t\t}\n+\t\tif projectSelectorMatches {\n+\t\t\tprojectMatched = true\n+\t\t}\n+\t}\n+\tif !projectMatched {\n+\t\treturn apierrors.NewForbidden(resource, name, fmt.Errorf(\"Pod's project node selector didn't match any nodes in the cluster.\"))\n+\t} else {\n+\t\treturn apierrors.NewForbidden(resource, name, fmt.Errorf(\"Pod node selector didn't match any nodes in the cluster.\"))","path":"pkg/pod/admission/nodeenv/admission.go","position":91,"original_position":91,"commit_id":"91d0206a608ea4525b09853cf19c20706d7247be","original_commit_id":"91d0206a608ea4525b09853cf19c20706d7247be","user":{"login":"derekwaynecarr","id":6233452,"avatar_url":"https://avatars.githubusercontent.com/u/6233452?v=3","gravatar_id":"","url":"https://api.github.com/users/derekwaynecarr","html_url":"https://github.com/derekwaynecarr","followers_url":"https://api.github.com/users/derekwaynecarr/followers","following_url":"https://api.github.com/users/derekwaynecarr/following{/other_user}","gists_url":"https://api.github.com/users/derekwaynecarr/gists{/gist_id}","starred_url":"https://api.github.com/users/derekwaynecarr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/derekwaynecarr/subscriptions","organizations_url":"https://api.github.com/users/derekwaynecarr/orgs","repos_url":"https://api.github.com/users/derekwaynecarr/repos","events_url":"https://api.github.com/users/derekwaynecarr/events{/privacy}","received_events_url":"https://api.github.com/users/derekwaynecarr/received_events","type":"User","site_admin":false},"body":"I don't get why you would reject the pod creation request.\r\n\r\nI think we should accept the pod creation request, but the scheduler should error when it attempts to find a placement for the pod.  The error should be made known to the user via an event on the pod like all other pod scheduling events.\r\n\r\nThis seems to introduce a lot of overhead on every pod creation operation, when we should be looking to do this level of validation at pod placement.\r\n\r\nCan you explain why we feel the need to reject the pod outright rather than just not schedule?","created_at":"2015-04-27T19:44:58Z","updated_at":"2015-04-27T19:44:58Z","html_url":"https://github.com/openshift/origin/pull/1918#discussion_r29183155","pull_request_url":"https://api.github.com/repos/openshift/origin/pulls/1918","_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments/29183155"},"html":{"href":"https://github.com/openshift/origin/pull/1918#discussion_r29183155"},"pull_request":{"href":"https://api.github.com/repos/openshift/origin/pulls/1918"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/1918","id":34093179,"html_url":"https://github.com/openshift/origin/pull/1918","diff_url":"https://github.com/openshift/origin/pull/1918.diff","patch_url":"https://github.com/openshift/origin/pull/1918.patch","issue_url":"https://api.github.com/repos/openshift/origin/issues/1918","number":1918,"state":"open","locked":false,"title":"Added support for project node selector","user":{"login":"pravisankar","id":1258630,"avatar_url":"https://avatars.githubusercontent.com/u/1258630?v=3","gravatar_id":"","url":"https://api.github.com/users/pravisankar","html_url":"https://github.com/pravisankar","followers_url":"https://api.github.com/users/pravisankar/followers","following_url":"https://api.github.com/users/pravisankar/following{/other_user}","gists_url":"https://api.github.com/users/pravisankar/gists{/gist_id}","starred_url":"https://api.github.com/users/pravisankar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pravisankar/subscriptions","organizations_url":"https://api.github.com/users/pravisankar/orgs","repos_url":"https://api.github.com/users/pravisankar/repos","events_url":"https://api.github.com/users/pravisankar/events{/privacy}","received_events_url":"https://api.github.com/users/pravisankar/received_events","type":"User","site_admin":false},"body":"Project node selector will constrain all pods within a project\r\nto a pool of nodes that satisfies given label selector.\r\n\r\n - Cluster admin can optionally specify global default project node selector.\r\n   Either pass '--project-node-selector=<selector>' flag as command line argument or\r\n   'projectNodeSelector: <selector>' entry in the master config.\r\n - User can optionally specify node selector for the project.\r\n   Pass node selector as annotation to the project.\r\n   Example:\r\n\t{\r\n\t  kind: 'Project',\r\n          Annotations: map[string]string{\r\n            'nodeSelector': <label-selector>\r\n          }\r\n          ...\r\n\t}\r\n - Any project with no node selector will use global node selector if present.\r\n - Pod create/update op is blocked if pod's node label selector and\r\n   pod's project node selector doesn't match at least a node in the cluster.","created_at":"2015-04-24T23:00:13Z","updated_at":"2015-04-27T19:44:58Z","closed_at":null,"merged_at":null,"merge_commit_sha":"857cd03e2d6b8109a03ad271ceab1374976e5f4a","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openshift/origin/pulls/1918/commits","review_comments_url":"https://api.github.com/repos/openshift/origin/pulls/1918/comments","review_comment_url":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/origin/issues/1918/comments","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/91d0206a608ea4525b09853cf19c20706d7247be","head":{"label":"pravisankar:project-nodeenv","ref":"project-nodeenv","sha":"91d0206a608ea4525b09853cf19c20706d7247be","user":{"login":"pravisankar","id":1258630,"avatar_url":"https://avatars.githubusercontent.com/u/1258630?v=3","gravatar_id":"","url":"https://api.github.com/users/pravisankar","html_url":"https://github.com/pravisankar","followers_url":"https://api.github.com/users/pravisankar/followers","following_url":"https://api.github.com/users/pravisankar/following{/other_user}","gists_url":"https://api.github.com/users/pravisankar/gists{/gist_id}","starred_url":"https://api.github.com/users/pravisankar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pravisankar/subscriptions","organizations_url":"https://api.github.com/users/pravisankar/orgs","repos_url":"https://api.github.com/users/pravisankar/repos","events_url":"https://api.github.com/users/pravisankar/events{/privacy}","received_events_url":"https://api.github.com/users/pravisankar/received_events","type":"User","site_admin":false},"repo":{"id":26983891,"name":"origin","full_name":"pravisankar/origin","owner":{"login":"pravisankar","id":1258630,"avatar_url":"https://avatars.githubusercontent.com/u/1258630?v=3","gravatar_id":"","url":"https://api.github.com/users/pravisankar","html_url":"https://github.com/pravisankar","followers_url":"https://api.github.com/users/pravisankar/followers","following_url":"https://api.github.com/users/pravisankar/following{/other_user}","gists_url":"https://api.github.com/users/pravisankar/gists{/gist_id}","starred_url":"https://api.github.com/users/pravisankar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pravisankar/subscriptions","organizations_url":"https://api.github.com/users/pravisankar/orgs","repos_url":"https://api.github.com/users/pravisankar/repos","events_url":"https://api.github.com/users/pravisankar/events{/privacy}","received_events_url":"https://api.github.com/users/pravisankar/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/pravisankar/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":true,"url":"https://api.github.com/repos/pravisankar/origin","forks_url":"https://api.github.com/repos/pravisankar/origin/forks","keys_url":"https://api.github.com/repos/pravisankar/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pravisankar/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pravisankar/origin/teams","hooks_url":"https://api.github.com/repos/pravisankar/origin/hooks","issue_events_url":"https://api.github.com/repos/pravisankar/origin/issues/events{/number}","events_url":"https://api.github.com/repos/pravisankar/origin/events","assignees_url":"https://api.github.com/repos/pravisankar/origin/assignees{/user}","branches_url":"https://api.github.com/repos/pravisankar/origin/branches{/branch}","tags_url":"https://api.github.com/repos/pravisankar/origin/tags","blobs_url":"https://api.github.com/repos/pravisankar/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pravisankar/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pravisankar/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/pravisankar/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pravisankar/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/pravisankar/origin/languages","stargazers_url":"https://api.github.com/repos/pravisankar/origin/stargazers","contributors_url":"https://api.github.com/repos/pravisankar/origin/contributors","subscribers_url":"https://api.github.com/repos/pravisankar/origin/subscribers","subscription_url":"https://api.github.com/repos/pravisankar/origin/subscription","commits_url":"https://api.github.com/repos/pravisankar/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/pravisankar/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/pravisankar/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/pravisankar/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/pravisankar/origin/contents/{+path}","compare_url":"https://api.github.com/repos/pravisankar/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pravisankar/origin/merges","archive_url":"https://api.github.com/repos/pravisankar/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pravisankar/origin/downloads","issues_url":"https://api.github.com/repos/pravisankar/origin/issues{/number}","pulls_url":"https://api.github.com/repos/pravisankar/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/pravisankar/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/pravisankar/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pravisankar/origin/labels{/name}","releases_url":"https://api.github.com/repos/pravisankar/origin/releases{/id}","created_at":"2014-11-22T00:39:33Z","updated_at":"2015-04-24T22:45:07Z","pushed_at":"2015-04-27T06:38:33Z","git_url":"git://github.com/pravisankar/origin.git","ssh_url":"git@github.com:pravisankar/origin.git","clone_url":"https://github.com/pravisankar/origin.git","svn_url":"https://github.com/pravisankar/origin","homepage":"https://openshift.github.io","size":95956,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"e58626973ffe9c466cffd1bb0a0e303b96e5ba54","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":22442668,"name":"origin","full_name":"openshift/origin","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":false,"url":"https://api.github.com/repos/openshift/origin","forks_url":"https://api.github.com/repos/openshift/origin/forks","keys_url":"https://api.github.com/repos/openshift/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/origin/teams","hooks_url":"https://api.github.com/repos/openshift/origin/hooks","issue_events_url":"https://api.github.com/repos/openshift/origin/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/origin/events","assignees_url":"https://api.github.com/repos/openshift/origin/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/origin/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/origin/tags","blobs_url":"https://api.github.com/repos/openshift/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/origin/languages","stargazers_url":"https://api.github.com/repos/openshift/origin/stargazers","contributors_url":"https://api.github.com/repos/openshift/origin/contributors","subscribers_url":"https://api.github.com/repos/openshift/origin/subscribers","subscription_url":"https://api.github.com/repos/openshift/origin/subscription","commits_url":"https://api.github.com/repos/openshift/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/origin/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/origin/merges","archive_url":"https://api.github.com/repos/openshift/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/origin/downloads","issues_url":"https://api.github.com/repos/openshift/origin/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/origin/labels{/name}","releases_url":"https://api.github.com/repos/openshift/origin/releases{/id}","created_at":"2014-07-30T20:04:05Z","updated_at":"2015-04-27T19:23:00Z","pushed_at":"2015-04-27T19:44:23Z","git_url":"git://github.com/openshift/origin.git","ssh_url":"git@github.com:openshift/origin.git","clone_url":"https://github.com/openshift/origin.git","svn_url":"https://github.com/openshift/origin","homepage":"http://www.openshift.org","size":155444,"stargazers_count":389,"watchers_count":389,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":194,"mirror_url":null,"open_issues_count":236,"forks":194,"open_issues":236,"watchers":389,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/1918"},"html":{"href":"https://github.com/openshift/origin/pull/1918"},"issue":{"href":"https://api.github.com/repos/openshift/origin/issues/1918"},"comments":{"href":"https://api.github.com/repos/openshift/origin/issues/1918/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/origin/pulls/1918/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/origin/pulls/1918/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/origin/statuses/91d0206a608ea4525b09853cf19c20706d7247be"}}}}