{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/community/pulls/comments/115096538","pull_request_review_id":36619386,"id":115096538,"diff_hunk":"@@ -0,0 +1,169 @@\n+# Scoped Kubelet API Access\n+\n+Author: Jordan Liggitt (jliggitt@redhat.com)\n+\n+## Overview\n+\n+Kubelets are primarily responsible for:\n+* creating and updating status of their Node API object\n+* running and updating status of Pod API objects bound to their node\n+* creating/deleting \"mirror pod\" API objects for statically-defined pods running on their node\n+\n+To run a pod, a kubelet must have read access to the following objects referenced by the pod spec:\n+* Secrets\n+* ConfigMaps\n+* PersistentVolumeClaims (and any bound PersistentVolume or referenced StorageClass object)\n+\n+As of 1.6, kubelets have read/write access to all Node and Pod objects, and \n+read access to all Secret, ConfigMap, PersistentVolumeClaim, and PersistentVolume objects.\n+This means that compromising a node gives access to credentials that allow modifying other nodes,\n+pods belonging to other nodes, and accessing confidential data unrelated to the node's pods.\n+\n+This document proposes limiting a kubelet's API access using a new node authorizer and admission plugin:\n+* Node authorizer\n+  * Authorizes requests from nodes using a fixed policy identical to the default RBAC `system:node` cluster role\n+  * Further restricts secret and configmap access to only allow reading objects referenced by pods bound to the node making the request\n+* Node admission\n+  * Limits nodes to only be able to mutate their own Node API object\n+  * Limits nodes to only be able to mutate pods bound to themselves\n+  * Limits nodes to only be able to create mirror pods","path":"contributors/design-proposals/kubelet-authorizer.md","position":29,"original_position":29,"commit_id":"97e839bed3ab9cd1174578e070c18246a5a11e17","original_commit_id":"97e839bed3ab9cd1174578e070c18246a5a11e17","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars3.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"body":"the previous point implies that, but will make that explicit ","created_at":"2017-05-05T22:10:14Z","updated_at":"2017-05-05T22:10:14Z","html_url":"https://github.com/kubernetes/community/pull/585#discussion_r115096538","pull_request_url":"https://api.github.com/repos/kubernetes/community/pulls/585","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/community/pulls/comments/115096538"},"html":{"href":"https://github.com/kubernetes/community/pull/585#discussion_r115096538"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/community/pulls/585"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/community/pulls/585","id":117807338,"html_url":"https://github.com/kubernetes/community/pull/585","diff_url":"https://github.com/kubernetes/community/pull/585.diff","patch_url":"https://github.com/kubernetes/community/pull/585.patch","issue_url":"https://api.github.com/repos/kubernetes/community/issues/585","number":585,"state":"open","locked":false,"title":"Scoped Kubelet API Access","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars3.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"body":"Proposal to subdivide kubelet API access to read secrets/configmaps, and to mutate node and pod resources","created_at":"2017-04-26T20:53:25Z","updated_at":"2017-05-05T22:10:14Z","closed_at":null,"merged_at":null,"merge_commit_sha":"b8342dfa241d9346ad2f2c4dc4e02e686952a9dc","assignee":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars3.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"assignees":[{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars3.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},{"login":"ericchiang","id":2342749,"avatar_url":"https://avatars2.githubusercontent.com/u/2342749?v=3","gravatar_id":"","url":"https://api.github.com/users/ericchiang","html_url":"https://github.com/ericchiang","followers_url":"https://api.github.com/users/ericchiang/followers","following_url":"https://api.github.com/users/ericchiang/following{/other_user}","gists_url":"https://api.github.com/users/ericchiang/gists{/gist_id}","starred_url":"https://api.github.com/users/ericchiang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericchiang/subscriptions","organizations_url":"https://api.github.com/users/ericchiang/orgs","repos_url":"https://api.github.com/users/ericchiang/repos","events_url":"https://api.github.com/users/ericchiang/events{/privacy}","received_events_url":"https://api.github.com/users/ericchiang/received_events","type":"User","site_admin":false},{"login":"timstclair","id":3272040,"avatar_url":"https://avatars2.githubusercontent.com/u/3272040?v=3","gravatar_id":"","url":"https://api.github.com/users/timstclair","html_url":"https://github.com/timstclair","followers_url":"https://api.github.com/users/timstclair/followers","following_url":"https://api.github.com/users/timstclair/following{/other_user}","gists_url":"https://api.github.com/users/timstclair/gists{/gist_id}","starred_url":"https://api.github.com/users/timstclair/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timstclair/subscriptions","organizations_url":"https://api.github.com/users/timstclair/orgs","repos_url":"https://api.github.com/users/timstclair/repos","events_url":"https://api.github.com/users/timstclair/events{/privacy}","received_events_url":"https://api.github.com/users/timstclair/received_events","type":"User","site_admin":false},{"login":"deads2k","id":8225098,"avatar_url":"https://avatars3.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false}],"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes/community/pulls/585/commits","review_comments_url":"https://api.github.com/repos/kubernetes/community/pulls/585/comments","review_comment_url":"https://api.github.com/repos/kubernetes/community/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/community/issues/585/comments","statuses_url":"https://api.github.com/repos/kubernetes/community/statuses/97e839bed3ab9cd1174578e070c18246a5a11e17","head":{"label":"liggitt:kubelet-authorizer","ref":"kubelet-authorizer","sha":"97e839bed3ab9cd1174578e070c18246a5a11e17","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars3.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"repo":{"id":85588859,"name":"community","full_name":"liggitt/community","owner":{"login":"liggitt","id":980082,"avatar_url":"https://avatars3.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/liggitt/community","description":"Kubernetes community content","fork":true,"url":"https://api.github.com/repos/liggitt/community","forks_url":"https://api.github.com/repos/liggitt/community/forks","keys_url":"https://api.github.com/repos/liggitt/community/keys{/key_id}","collaborators_url":"https://api.github.com/repos/liggitt/community/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/liggitt/community/teams","hooks_url":"https://api.github.com/repos/liggitt/community/hooks","issue_events_url":"https://api.github.com/repos/liggitt/community/issues/events{/number}","events_url":"https://api.github.com/repos/liggitt/community/events","assignees_url":"https://api.github.com/repos/liggitt/community/assignees{/user}","branches_url":"https://api.github.com/repos/liggitt/community/branches{/branch}","tags_url":"https://api.github.com/repos/liggitt/community/tags","blobs_url":"https://api.github.com/repos/liggitt/community/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/liggitt/community/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/liggitt/community/git/refs{/sha}","trees_url":"https://api.github.com/repos/liggitt/community/git/trees{/sha}","statuses_url":"https://api.github.com/repos/liggitt/community/statuses/{sha}","languages_url":"https://api.github.com/repos/liggitt/community/languages","stargazers_url":"https://api.github.com/repos/liggitt/community/stargazers","contributors_url":"https://api.github.com/repos/liggitt/community/contributors","subscribers_url":"https://api.github.com/repos/liggitt/community/subscribers","subscription_url":"https://api.github.com/repos/liggitt/community/subscription","commits_url":"https://api.github.com/repos/liggitt/community/commits{/sha}","git_commits_url":"https://api.github.com/repos/liggitt/community/git/commits{/sha}","comments_url":"https://api.github.com/repos/liggitt/community/comments{/number}","issue_comment_url":"https://api.github.com/repos/liggitt/community/issues/comments{/number}","contents_url":"https://api.github.com/repos/liggitt/community/contents/{+path}","compare_url":"https://api.github.com/repos/liggitt/community/compare/{base}...{head}","merges_url":"https://api.github.com/repos/liggitt/community/merges","archive_url":"https://api.github.com/repos/liggitt/community/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/liggitt/community/downloads","issues_url":"https://api.github.com/repos/liggitt/community/issues{/number}","pulls_url":"https://api.github.com/repos/liggitt/community/pulls{/number}","milestones_url":"https://api.github.com/repos/liggitt/community/milestones{/number}","notifications_url":"https://api.github.com/repos/liggitt/community/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/liggitt/community/labels{/name}","releases_url":"https://api.github.com/repos/liggitt/community/releases{/id}","deployments_url":"https://api.github.com/repos/liggitt/community/deployments","created_at":"2017-03-20T14:46:54Z","updated_at":"2017-03-20T14:46:57Z","pushed_at":"2017-05-04T18:35:11Z","git_url":"git://github.com/liggitt/community.git","ssh_url":"git@github.com:liggitt/community.git","clone_url":"https://github.com/liggitt/community.git","svn_url":"https://github.com/liggitt/community","homepage":"","size":7763,"stargazers_count":0,"watchers_count":0,"language":"Makefile","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"95481717b6f96149d35d639bcb328bfddbc7af2a","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars1.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":57939112,"name":"community","full_name":"kubernetes/community","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars1.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/community","description":"Kubernetes community content","fork":false,"url":"https://api.github.com/repos/kubernetes/community","forks_url":"https://api.github.com/repos/kubernetes/community/forks","keys_url":"https://api.github.com/repos/kubernetes/community/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/community/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/community/teams","hooks_url":"https://api.github.com/repos/kubernetes/community/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/community/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/community/events","assignees_url":"https://api.github.com/repos/kubernetes/community/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/community/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/community/tags","blobs_url":"https://api.github.com/repos/kubernetes/community/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/community/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/community/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/community/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/community/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/community/languages","stargazers_url":"https://api.github.com/repos/kubernetes/community/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/community/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/community/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/community/subscription","commits_url":"https://api.github.com/repos/kubernetes/community/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/community/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/community/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/community/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/community/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/community/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/community/merges","archive_url":"https://api.github.com/repos/kubernetes/community/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/community/downloads","issues_url":"https://api.github.com/repos/kubernetes/community/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/community/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/community/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/community/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/community/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/community/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/community/deployments","created_at":"2016-05-03T03:36:05Z","updated_at":"2017-05-05T18:08:14Z","pushed_at":"2017-05-05T21:15:21Z","git_url":"git://github.com/kubernetes/community.git","ssh_url":"git@github.com:kubernetes/community.git","clone_url":"https://github.com/kubernetes/community.git","svn_url":"https://github.com/kubernetes/community","homepage":"","size":8223,"stargazers_count":389,"watchers_count":389,"language":"Makefile","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":368,"mirror_url":null,"open_issues_count":130,"forks":368,"open_issues":130,"watchers":389,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/community/pulls/585"},"html":{"href":"https://github.com/kubernetes/community/pull/585"},"issue":{"href":"https://api.github.com/repos/kubernetes/community/issues/585"},"comments":{"href":"https://api.github.com/repos/kubernetes/community/issues/585/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/community/pulls/585/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/community/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/community/pulls/585/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/community/statuses/97e839bed3ab9cd1174578e070c18246a5a11e17"}}}}
{"actor":{"display_login":"liggitt"}}