{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/43544","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/43544/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/43544/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/43544/events","html_url":"https://github.com/kubernetes/kubernetes/pull/43544","id":216217558,"number":43544,"title":"Default to enabling legacy ABAC policy in non-test kube-up.sh environments","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars3.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"labels":[{"id":414883982,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/approved","name":"approved","color":"0ffa16","default":false},{"id":477397086,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":335674843,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/do-not-merge","name":"do-not-merge","color":"e11d21","default":false},{"id":200149833,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note","name":"release-note","color":"c2e0c6","default":false},{"id":253450895,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/S","name":"size/S","color":"77bb00","default":false}],"state":"open","locked":false,"assignee":{"login":"krousey","id":157083,"avatar_url":"https://avatars1.githubusercontent.com/u/157083?v=3","gravatar_id":"","url":"https://api.github.com/users/krousey","html_url":"https://github.com/krousey","followers_url":"https://api.github.com/users/krousey/followers","following_url":"https://api.github.com/users/krousey/following{/other_user}","gists_url":"https://api.github.com/users/krousey/gists{/gist_id}","starred_url":"https://api.github.com/users/krousey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/krousey/subscriptions","organizations_url":"https://api.github.com/users/krousey/orgs","repos_url":"https://api.github.com/users/krousey/repos","events_url":"https://api.github.com/users/krousey/events{/privacy}","received_events_url":"https://api.github.com/users/krousey/received_events","type":"User","site_admin":false},"assignees":[{"login":"krousey","id":157083,"avatar_url":"https://avatars1.githubusercontent.com/u/157083?v=3","gravatar_id":"","url":"https://api.github.com/users/krousey","html_url":"https://github.com/krousey","followers_url":"https://api.github.com/users/krousey/followers","following_url":"https://api.github.com/users/krousey/following{/other_user}","gists_url":"https://api.github.com/users/krousey/gists{/gist_id}","starred_url":"https://api.github.com/users/krousey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/krousey/subscriptions","organizations_url":"https://api.github.com/users/krousey/orgs","repos_url":"https://api.github.com/users/krousey/repos","events_url":"https://api.github.com/users/krousey/events{/privacy}","received_events_url":"https://api.github.com/users/krousey/received_events","type":"User","site_admin":false},{"login":"mikedanese","id":1787169,"avatar_url":"https://avatars0.githubusercontent.com/u/1787169?v=3","gravatar_id":"","url":"https://api.github.com/users/mikedanese","html_url":"https://github.com/mikedanese","followers_url":"https://api.github.com/users/mikedanese/followers","following_url":"https://api.github.com/users/mikedanese/following{/other_user}","gists_url":"https://api.github.com/users/mikedanese/gists{/gist_id}","starred_url":"https://api.github.com/users/mikedanese/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikedanese/subscriptions","organizations_url":"https://api.github.com/users/mikedanese/orgs","repos_url":"https://api.github.com/users/mikedanese/repos","events_url":"https://api.github.com/users/mikedanese/events{/privacy}","received_events_url":"https://api.github.com/users/mikedanese/received_events","type":"User","site_admin":false},{"login":"cjcullen","id":7154008,"avatar_url":"https://avatars1.githubusercontent.com/u/7154008?v=3","gravatar_id":"","url":"https://api.github.com/users/cjcullen","html_url":"https://github.com/cjcullen","followers_url":"https://api.github.com/users/cjcullen/followers","following_url":"https://api.github.com/users/cjcullen/following{/other_user}","gists_url":"https://api.github.com/users/cjcullen/gists{/gist_id}","starred_url":"https://api.github.com/users/cjcullen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cjcullen/subscriptions","organizations_url":"https://api.github.com/users/cjcullen/orgs","repos_url":"https://api.github.com/users/cjcullen/repos","events_url":"https://api.github.com/users/cjcullen/events{/privacy}","received_events_url":"https://api.github.com/users/cjcullen/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2017-03-22T21:43:44Z","updated_at":"2017-03-22T21:56:36Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/43544","html_url":"https://github.com/kubernetes/kubernetes/pull/43544","diff_url":"https://github.com/kubernetes/kubernetes/pull/43544.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/43544.patch"},"body":"Fixes https://github.com/kubernetes/kubernetes/issues/43541\r\n\r\nIn 1.5, we unconditionally stomped the abac policy file if KUBE_USER was set, and unconditionally used ABAC mode pointing to that file.\r\n\r\nIn 1.6, unless the user opts out (via `ENABLE_LEGACY_ABAC=false`), we want the same legacy policy included as a fallback to RBAC.\r\n\r\nThis defaults to enabling ABAC in default deployments, and disabling it in test deployments (so our tests run with tightened permissions).\r\n\r\nQuestions:\r\n- [ ] do upgrade tests use config-test.sh? (@krousey?)\r\n- [ ] do regular CI jobs use config-test.sh?\r\n- [ ] does GKE need to make similar adjustments here? (@cjcullen?)\r\n- [ ] do we need to generate the ABAC file in gce/container-linux as well?"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/288552451","html_url":"https://github.com/kubernetes/kubernetes/pull/43544#issuecomment-288552451","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/43544","id":288552451,"user":{"login":"fejta","id":940341,"avatar_url":"https://avatars1.githubusercontent.com/u/940341?v=3","gravatar_id":"","url":"https://api.github.com/users/fejta","html_url":"https://github.com/fejta","followers_url":"https://api.github.com/users/fejta/followers","following_url":"https://api.github.com/users/fejta/following{/other_user}","gists_url":"https://api.github.com/users/fejta/gists{/gist_id}","starred_url":"https://api.github.com/users/fejta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fejta/subscriptions","organizations_url":"https://api.github.com/users/fejta/orgs","repos_url":"https://api.github.com/users/fejta/repos","events_url":"https://api.github.com/users/fejta/events{/privacy}","received_events_url":"https://api.github.com/users/fejta/received_events","type":"User","site_admin":false},"created_at":"2017-03-22T21:56:36Z","updated_at":"2017-03-22T21:56:36Z","body":"I am not super familiar with what config-test is and why/whether anything needs to use it.\r\n\r\nIt appears as though `kubetest --up` calls this though:\r\n\r\nhttps://github.com/kubernetes/test-infra/blob/master/kubetest/bash.go#L26\r\nhttps://github.com/kubernetes/kubernetes/blob/master/hack/e2e-internal/e2e-up.sh#L24"}}
{"actor":{"display_login":"fejta"}}