{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36721","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36721/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36721/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36721/events","html_url":"https://github.com/kubernetes/kubernetes/pull/36721","id":189004482,"number":36721,"title":"Add initializer support to admission and uninitialized filtering to rest storage","user":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars3.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"labels":[{"id":414883982,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/approved","name":"approved","color":"0ffa16","default":false},{"id":176978828,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf","default":false},{"id":477397086,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":240247879,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/needs-rebase","name":"needs-rebase","color":"BDBDBD","default":false},{"id":349530192,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note-label-needed","name":"release-note-label-needed","color":"db5a64","default":false},{"id":173493835,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/api-machinery","name":"sig/api-machinery","color":"d2b48c","default":false},{"id":253451093,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/XXL","name":"size/XXL","color":"ee0000","default":false}],"state":"open","locked":false,"assignee":{"login":"lavalamp","id":647318,"avatar_url":"https://avatars3.githubusercontent.com/u/647318?v=3","gravatar_id":"","url":"https://api.github.com/users/lavalamp","html_url":"https://github.com/lavalamp","followers_url":"https://api.github.com/users/lavalamp/followers","following_url":"https://api.github.com/users/lavalamp/following{/other_user}","gists_url":"https://api.github.com/users/lavalamp/gists{/gist_id}","starred_url":"https://api.github.com/users/lavalamp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lavalamp/subscriptions","organizations_url":"https://api.github.com/users/lavalamp/orgs","repos_url":"https://api.github.com/users/lavalamp/repos","events_url":"https://api.github.com/users/lavalamp/events{/privacy}","received_events_url":"https://api.github.com/users/lavalamp/received_events","type":"User","site_admin":false},"assignees":[{"login":"lavalamp","id":647318,"avatar_url":"https://avatars3.githubusercontent.com/u/647318?v=3","gravatar_id":"","url":"https://api.github.com/users/lavalamp","html_url":"https://github.com/lavalamp","followers_url":"https://api.github.com/users/lavalamp/followers","following_url":"https://api.github.com/users/lavalamp/following{/other_user}","gists_url":"https://api.github.com/users/lavalamp/gists{/gist_id}","starred_url":"https://api.github.com/users/lavalamp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lavalamp/subscriptions","organizations_url":"https://api.github.com/users/lavalamp/orgs","repos_url":"https://api.github.com/users/lavalamp/repos","events_url":"https://api.github.com/users/lavalamp/events{/privacy}","received_events_url":"https://api.github.com/users/lavalamp/received_events","type":"User","site_admin":false},{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars3.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},{"login":"derekwaynecarr","id":6233452,"avatar_url":"https://avatars0.githubusercontent.com/u/6233452?v=3","gravatar_id":"","url":"https://api.github.com/users/derekwaynecarr","html_url":"https://github.com/derekwaynecarr","followers_url":"https://api.github.com/users/derekwaynecarr/followers","following_url":"https://api.github.com/users/derekwaynecarr/following{/other_user}","gists_url":"https://api.github.com/users/derekwaynecarr/gists{/gist_id}","starred_url":"https://api.github.com/users/derekwaynecarr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/derekwaynecarr/subscriptions","organizations_url":"https://api.github.com/users/derekwaynecarr/orgs","repos_url":"https://api.github.com/users/derekwaynecarr/repos","events_url":"https://api.github.com/users/derekwaynecarr/events{/privacy}","received_events_url":"https://api.github.com/users/derekwaynecarr/received_events","type":"User","site_admin":false},{"login":"csbell","id":23373339,"avatar_url":"https://avatars2.githubusercontent.com/u/23373339?v=3","gravatar_id":"","url":"https://api.github.com/users/csbell","html_url":"https://github.com/csbell","followers_url":"https://api.github.com/users/csbell/followers","following_url":"https://api.github.com/users/csbell/following{/other_user}","gists_url":"https://api.github.com/users/csbell/gists{/gist_id}","starred_url":"https://api.github.com/users/csbell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csbell/subscriptions","organizations_url":"https://api.github.com/users/csbell/orgs","repos_url":"https://api.github.com/users/csbell/repos","events_url":"https://api.github.com/users/csbell/events{/privacy}","received_events_url":"https://api.github.com/users/csbell/received_events","type":"User","site_admin":false}],"milestone":null,"comments":22,"created_at":"2016-11-13T23:45:35Z","updated_at":"2017-05-30T23:49:43Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/36721","html_url":"https://github.com/kubernetes/kubernetes/pull/36721","diff_url":"https://github.com/kubernetes/kubernetes/pull/36721.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/36721.patch"},"body":"Working prototype to identify issues in adding initializers to the API. Initializers are the opposite of finalizers - they allow API clients to react to object creation and populate fields prior to other clients seeing them.\r\n\r\nHigh level description:\r\n\r\n1. Add `metadata.initializers` field to all objects\r\n2. By default, filter objects with > 0 initializers from LIST and WATCH to preserve legacy client behavior (known as partially-initialized objects)\r\n3. Add an admission controller that populates .initializer values per type, and denies mutation of initializers except by certain privilege levels (you must have the `initialize` verb on a resource)\r\n4. Allow partially-initialized objects to be viewed via LIST and WATCH for initializer types\r\n5. When creating objects, the object is \"held\" by the server until the initializers list is empty\r\n6. Allow some creators to bypass initialization (set initializers to `[]`), or to have the result returned immediately when the object is created.\r\n\r\nThe code here should be backwards compatible for all clients because they do not see partially initialized objects unless they GET the resource directly. The watch cache makes checking for partially initialized objects cheap. Some reflectors may need to change to ask for partially-initialized objects.\r\n\r\nFurther investigation:\r\n\r\n1. Relaxation of certain validation rules on partially-initialized objects\r\n2. Field level authorization for specific initializers (those that can set resources vs those who can set clusterIP)\r\n3. An example initializer\r\n4. Content-type negotiation of ability to view uninitialized content\r\n5. Gaps in watch behavior for partially-initialized resources\r\n6. Discussion of where quota should go\r\n7. Ordering of initializers\r\n8. The need for a separate endpoint.\r\n9. How to set initialization failure status and have that be reported back to the creater (via metadata.initializationStatus and delete?)\r\n\r\nI think this approach is technically feasible and is an improvement over the current webhook admission controllers, and is a better future extension path for admission than some of the alternatives we were exploring (it reduces admission to just an API client problem, and is backwards compatible).\r\n\r\n<!-- Reviewable:start -->\r\n---\r\nThis change is [<img src=\"https://reviewable.kubernetes.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.kubernetes.io/reviews/kubernetes/kubernetes/36721)\r\n<!-- Reviewable:end -->\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/305040918","html_url":"https://github.com/kubernetes/kubernetes/pull/36721#issuecomment-305040918","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36721","id":305040918,"user":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars3.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"created_at":"2017-05-30T23:49:43Z","updated_at":"2017-05-30T23:49:43Z","body":"I just don't like fail open :)\n\nMost of the initializers I care about are not the kind that should\nfail open.  Can we articulate the requirement for fail open in terms\nof a concrete initializer where fail open is better?\n"}}
{"actor":{"display_login":"smarterclayton"}}