{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/121197402","pull_request_review_id":43233432,"id":121197402,"diff_hunk":"@@ -113,11 +113,12 @@ func TestCreatePodSecurityContextNonmutating(t *testing.T) {\n \n func TestCreateContainerSecurityContextNonmutating(t *testing.T) {\n \t// Create a pod with a security context that needs filling in\n+\tuntrue := false\n \tcreatePod := func() *api.Pod {\n \t\treturn &api.Pod{\n \t\t\tSpec: api.PodSpec{\n \t\t\t\tContainers: []api.Container{{\n-\t\t\t\t\tSecurityContext: &api.SecurityContext{},\n+\t\t\t\t\tSecurityContext: &api.SecurityContext{RunAsNonRoot: &untrue},","path":"pkg/security/podsecuritypolicy/provider_test.go","position":null,"original_position":10,"commit_id":"158f17b9bb3cc1d2ba1378fc56db017e8326f865","original_commit_id":"e2b2a34117be5fa79a79ba5c502665d47bfec3db","user":{"login":"Q-Lee","id":13410337,"avatar_url":"https://avatars3.githubusercontent.com/u/13410337?v=3","gravatar_id":"","url":"https://api.github.com/users/Q-Lee","html_url":"https://github.com/Q-Lee","followers_url":"https://api.github.com/users/Q-Lee/followers","following_url":"https://api.github.com/users/Q-Lee/following{/other_user}","gists_url":"https://api.github.com/users/Q-Lee/gists{/gist_id}","starred_url":"https://api.github.com/users/Q-Lee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Q-Lee/subscriptions","organizations_url":"https://api.github.com/users/Q-Lee/orgs","repos_url":"https://api.github.com/users/Q-Lee/repos","events_url":"https://api.github.com/users/Q-Lee/events{/privacy}","received_events_url":"https://api.github.com/users/Q-Lee/received_events","type":"User","site_admin":false},"body":"Done","created_at":"2017-06-09T18:47:29Z","updated_at":"2017-06-09T18:47:29Z","html_url":"https://github.com/kubernetes/kubernetes/pull/47073#discussion_r121197402","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47073","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/121197402"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/47073#discussion_r121197402"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47073"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47073","id":124270000,"html_url":"https://github.com/kubernetes/kubernetes/pull/47073","diff_url":"https://github.com/kubernetes/kubernetes/pull/47073.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/47073.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/47073","number":47073,"state":"open","locked":false,"title":"PodSecurityPolicy should respect and validate user-supplied RunAsNonR…","user":{"login":"Q-Lee","id":13410337,"avatar_url":"https://avatars3.githubusercontent.com/u/13410337?v=3","gravatar_id":"","url":"https://api.github.com/users/Q-Lee","html_url":"https://github.com/Q-Lee","followers_url":"https://api.github.com/users/Q-Lee/followers","following_url":"https://api.github.com/users/Q-Lee/following{/other_user}","gists_url":"https://api.github.com/users/Q-Lee/gists{/gist_id}","starred_url":"https://api.github.com/users/Q-Lee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Q-Lee/subscriptions","organizations_url":"https://api.github.com/users/Q-Lee/orgs","repos_url":"https://api.github.com/users/Q-Lee/repos","events_url":"https://api.github.com/users/Q-Lee/events{/privacy}","received_events_url":"https://api.github.com/users/Q-Lee/received_events","type":"User","site_admin":false},"body":"**What this PR does / why we need it**: PodSecurityPolicies overwrite and then fail to validate the RunAsNonRoot field in the container security context.\r\n\r\n**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47071\r\n\r\n**Special notes for your reviewer**: gce/gke don't use this in 1.6. You'll need to speak up if you think this is important enough to patch. It should almost certainly go into 1.7.\r\n\r\n**Release note**:\r\n<!--  Steps to write your release note:\r\n1. Use the release-note-* labels to set the release note state (if you have access)\r\n2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`.\r\n-->\r\n\r\n```release-note\r\nPodSecurityPolicy now recognizes pods that specify `runAsNonRoot: false` in their security context and does not overwrite the specified value\r\n```\r\n","created_at":"2017-06-06T19:31:25Z","updated_at":"2017-06-09T18:47:29Z","closed_at":null,"merged_at":null,"merge_commit_sha":"8384dfc7b9b5520e2ddd8b8546250523d01126e3","assignee":{"login":"liggitt","id":980082,"avatar_url":"https://avatars3.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"assignees":[{"login":"liggitt","id":980082,"avatar_url":"https://avatars3.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false}],"requested_reviewers":[],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/36","html_url":"https://github.com/kubernetes/kubernetes/milestone/36","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/36/labels","id":2545392,"number":36,"title":"v1.8","description":"Kubernetes 1.8 release milestone, date is TBD.","creator":{"login":"timothysc","id":169553,"avatar_url":"https://avatars3.githubusercontent.com/u/169553?v=3","gravatar_id":"","url":"https://api.github.com/users/timothysc","html_url":"https://github.com/timothysc","followers_url":"https://api.github.com/users/timothysc/followers","following_url":"https://api.github.com/users/timothysc/following{/other_user}","gists_url":"https://api.github.com/users/timothysc/gists{/gist_id}","starred_url":"https://api.github.com/users/timothysc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timothysc/subscriptions","organizations_url":"https://api.github.com/users/timothysc/orgs","repos_url":"https://api.github.com/users/timothysc/repos","events_url":"https://api.github.com/users/timothysc/events{/privacy}","received_events_url":"https://api.github.com/users/timothysc/received_events","type":"User","site_admin":false},"open_issues":96,"closed_issues":2,"state":"open","created_at":"2017-05-26T17:18:43Z","updated_at":"2017-06-09T18:47:05Z","due_on":null,"closed_at":null},"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47073/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47073/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/47073/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/158f17b9bb3cc1d2ba1378fc56db017e8326f865","head":{"label":"Q-Lee:psp-run-as-non-root","ref":"psp-run-as-non-root","sha":"158f17b9bb3cc1d2ba1378fc56db017e8326f865","user":{"login":"Q-Lee","id":13410337,"avatar_url":"https://avatars3.githubusercontent.com/u/13410337?v=3","gravatar_id":"","url":"https://api.github.com/users/Q-Lee","html_url":"https://github.com/Q-Lee","followers_url":"https://api.github.com/users/Q-Lee/followers","following_url":"https://api.github.com/users/Q-Lee/following{/other_user}","gists_url":"https://api.github.com/users/Q-Lee/gists{/gist_id}","starred_url":"https://api.github.com/users/Q-Lee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Q-Lee/subscriptions","organizations_url":"https://api.github.com/users/Q-Lee/orgs","repos_url":"https://api.github.com/users/Q-Lee/repos","events_url":"https://api.github.com/users/Q-Lee/events{/privacy}","received_events_url":"https://api.github.com/users/Q-Lee/received_events","type":"User","site_admin":false},"repo":{"id":51333025,"name":"kubernetes","full_name":"Q-Lee/kubernetes","owner":{"login":"Q-Lee","id":13410337,"avatar_url":"https://avatars3.githubusercontent.com/u/13410337?v=3","gravatar_id":"","url":"https://api.github.com/users/Q-Lee","html_url":"https://github.com/Q-Lee","followers_url":"https://api.github.com/users/Q-Lee/followers","following_url":"https://api.github.com/users/Q-Lee/following{/other_user}","gists_url":"https://api.github.com/users/Q-Lee/gists{/gist_id}","starred_url":"https://api.github.com/users/Q-Lee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Q-Lee/subscriptions","organizations_url":"https://api.github.com/users/Q-Lee/orgs","repos_url":"https://api.github.com/users/Q-Lee/repos","events_url":"https://api.github.com/users/Q-Lee/events{/privacy}","received_events_url":"https://api.github.com/users/Q-Lee/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/Q-Lee/kubernetes","description":"Container Cluster Manager from Google","fork":true,"url":"https://api.github.com/repos/Q-Lee/kubernetes","forks_url":"https://api.github.com/repos/Q-Lee/kubernetes/forks","keys_url":"https://api.github.com/repos/Q-Lee/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Q-Lee/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Q-Lee/kubernetes/teams","hooks_url":"https://api.github.com/repos/Q-Lee/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/Q-Lee/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/Q-Lee/kubernetes/events","assignees_url":"https://api.github.com/repos/Q-Lee/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/Q-Lee/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/Q-Lee/kubernetes/tags","blobs_url":"https://api.github.com/repos/Q-Lee/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Q-Lee/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Q-Lee/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/Q-Lee/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Q-Lee/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/Q-Lee/kubernetes/languages","stargazers_url":"https://api.github.com/repos/Q-Lee/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/Q-Lee/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/Q-Lee/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/Q-Lee/kubernetes/subscription","commits_url":"https://api.github.com/repos/Q-Lee/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/Q-Lee/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/Q-Lee/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/Q-Lee/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/Q-Lee/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/Q-Lee/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Q-Lee/kubernetes/merges","archive_url":"https://api.github.com/repos/Q-Lee/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Q-Lee/kubernetes/downloads","issues_url":"https://api.github.com/repos/Q-Lee/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/Q-Lee/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/Q-Lee/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/Q-Lee/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Q-Lee/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/Q-Lee/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/Q-Lee/kubernetes/deployments","created_at":"2016-02-08T22:49:53Z","updated_at":"2016-02-08T22:50:05Z","pushed_at":"2017-06-09T18:47:13Z","git_url":"git://github.com/Q-Lee/kubernetes.git","ssh_url":"git@github.com:Q-Lee/kubernetes.git","clone_url":"https://github.com/Q-Lee/kubernetes.git","svn_url":"https://github.com/Q-Lee/kubernetes","homepage":"http://kubernetes.io","size":431205,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"25aed0a63181ab43222ba24b2f090fd1952d8db6","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars1.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars1.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Production-Grade Container Scheduling and Management","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/kubernetes/deployments","created_at":"2014-06-06T22:56:04Z","updated_at":"2017-06-09T18:22:50Z","pushed_at":"2017-06-09T18:47:17Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":663167,"stargazers_count":23867,"watchers_count":23867,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":8459,"mirror_url":null,"open_issues_count":5182,"forks":8459,"open_issues":5182,"watchers":23867,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47073"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/47073"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/47073"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/47073/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47073/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47073/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/158f17b9bb3cc1d2ba1378fc56db017e8326f865"}}}}
{"actor":{"display_login":"Q-Lee"}}