{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/features/issues/209","repository_url":"https://api.github.com/repos/kubernetes/features","labels_url":"https://api.github.com/repos/kubernetes/features/issues/209/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/features/issues/209/comments","events_url":"https://api.github.com/repos/kubernetes/features/issues/209/events","html_url":"https://github.com/kubernetes/features/issues/209","id":215066300,"number":209,"title":"Kubernetes should be able to easily integrate external policy control ","user":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars3.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/kubernetes/features/milestones/3","html_url":"https://github.com/kubernetes/features/milestone/3","labels_url":"https://api.github.com/repos/kubernetes/features/milestones/3/labels","id":1892029,"number":3,"title":"next-milestone","description":"","creator":{"login":"idvoretskyi","id":118459,"avatar_url":"https://avatars1.githubusercontent.com/u/118459?v=3","gravatar_id":"","url":"https://api.github.com/users/idvoretskyi","html_url":"https://github.com/idvoretskyi","followers_url":"https://api.github.com/users/idvoretskyi/followers","following_url":"https://api.github.com/users/idvoretskyi/following{/other_user}","gists_url":"https://api.github.com/users/idvoretskyi/gists{/gist_id}","starred_url":"https://api.github.com/users/idvoretskyi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/idvoretskyi/subscriptions","organizations_url":"https://api.github.com/users/idvoretskyi/orgs","repos_url":"https://api.github.com/users/idvoretskyi/repos","events_url":"https://api.github.com/users/idvoretskyi/events{/privacy}","received_events_url":"https://api.github.com/users/idvoretskyi/received_events","type":"User","site_admin":false},"open_issues":59,"closed_issues":4,"state":"open","created_at":"2016-07-19T13:43:19Z","updated_at":"2017-03-20T12:59:27Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2017-03-17T17:09:05Z","updated_at":"2017-03-20T20:44:35Z","closed_at":null,"body":"# Description\r\n\r\nAs a Kubernetes administrator or integrator, I should be able to add policy and security integrations that can control the admission of content to the cluster, so that I can add my own administrative policy to the cluster.  As a Kubernetes developer looking to build new features out of the core repository, I need a way to easily integrate into the pod lifecycle in a decoupled and decentralized way.\r\n\r\nIn Kubernetes this mechanism is known as \"admission\" and we are planning to add a way of having Kubernetes make calls out to remote servers to perform those checks.  We are also looking to add an additional concept to objects called an \"initializer\", which gives system agents an opportunity to react to objects (like pods) being created before other clients can see them - this would make very common integrations like setting defaults on pods easy to build and run on the cluster.  Finally we want to enable a way to dynamically alter the configuration of a running system to add or remove these integrations.\r\n\r\nPart of sig-api-machinery.\r\n\r\n# Progress Tracker\r\n\r\n\r\n- [ ] Alpha\r\n    - [ ] Write and maintain draft quality doc\r\n      - [ ] During development keep a doc up-to-date about the desired experience of the feature and how someone can try the feature in its current state. Think of it as the README of your new feature and a skeleton for the docs to be written before the Kubernetes release. Paste link to Google Doc: **DOC-LINK**\r\n    - [ ] Design Approval\r\n      - [ ] Design Proposal.  https://github.com/kubernetes/community/pull/132\r\n      - [ ] Decide which repo this feature's code will be checked into. Not everything needs to land in the core kubernetes repo. **kubernetes/kubernetes**\r\n      - [ ] Initial API review (if API).  Maybe same PR as design doc. **PR-NUMBER**\r\n        -  Any code that changes an API (`/pkg/apis/...`)\r\n        -  **cc `@kubernetes/api`**\r\n      - [ ] Identify shepherd (your SIG lead and/or kubernetes-pm@googlegroups.com will be able to help you). **My Shepherd is:** _replace.me@replaceme.com_ (and/or GH Handle)\r\n        -  A shepherd is an individual who will help acquaint you with the process of getting your feature into the repo, identify reviewers and provide feedback on the feature. They are _not_ (necessarily) the code reviewer of the feature, or tech lead for the area.\r\n        -  The shepherd is _not_ responsible for showing up to Kubernetes-PM meetings and/or communicating if the feature is on-track to make the release goals. That is still your responsibility.\r\n      - [ ] Identify secondary/backup contact point. **My Secondary Contact Point is:** _replace.me@replaceme.com_ (and/or GH Handle)\r\n    - [ ] Write (code + tests + docs) then get them merged.  **ALL-PR-NUMBERS**\r\n      - [ ] **Code needs to be disabled by default.**   Verified by code OWNERS\r\n      - [ ] Minimal testing\r\n      - [ ] Minimal docs\r\n        - cc `@kubernetes/docs` on docs PR\r\n        - **cc `@kubernetes/feature-reviewers` on this issue** to get approval before checking this off\r\n        - New apis: *Glossary Section Item* in the docs repo: kubernetes/kubernetes.github.io\r\n      - [ ] Update release notes\r\n- [ ] Beta\r\n  - [ ] Testing is sufficient for beta\r\n  - [ ] User docs with tutorials\r\n        - *Updated walkthrough / tutorial* in the docs repo: kubernetes/kubernetes.github.io\r\n        - cc `@kubernetes/docs` on docs PR\r\n        - **cc `@kubernetes/feature-reviewers` on this issue** to get approval before checking this off\r\n  - [ ] Thorough API review\r\n    - **cc `@kubernetes/api`**\r\n- [ ] Stable\r\n  - [ ] docs/proposals/foo.md moved to docs/design/foo.md \r\n        - **cc `@kubernetes/feature-reviewers` on this issue** to get approval before checking this off\r\n  - [ ] Soak, load testing \t\t\t\r\n  - [ ] detailed user docs and examples\r\n    - **cc `@kubernetes/docs`**\r\n    - **cc `@kubernetes/feature-reviewers` on this issue** to get approval before checking this off\r\n\r\n*FEATURE_STATUS is used for feature tracking and to be updated by `@kubernetes/feature-reviewers`.*\r\n**FEATURE_STATUS: IN_DEVELOPMENT**\r\n\r\nMore advice:\r\n\r\nDesign\r\n   - Once you get LGTM from a *`@kubernetes/feature-reviewers`* member, you can check this checkbox, and the reviewer will apply the \"design-complete\" label.\r\n \r\nCoding\r\n  - Use as many PRs as you need.  Write tests in the same or different PRs, as is convenient for you.\r\n  - As each PR is merged, add a comment to this issue referencing the PRs.  Code goes in the http://github.com/kubernetes/kubernetes repository,\r\n        and sometimes http://github.com/kubernetes/contrib, or other repos.\r\n  - When you are done with the code, apply the \"code-complete\" label.\r\n  - When the feature has user docs, please add a comment mentioning `@kubernetes/feature-reviewers` and they will\r\n        check that the code matches the proposed feature and design, and that everything is done, and that there is adequate\r\n        testing.  They won't do detailed code review: that already happened when your PRs were reviewed.\r\n        When that is done, you can check this box and the reviewer will apply the \"code-complete\" label.\r\n\r\nDocs\r\n  - [ ] Write user docs and get them merged in.\r\n  - User docs go into http://github.com/kubernetes/kubernetes.github.io.\r\n  - When the feature has user docs, please add a comment mentioning `@kubernetes/docs`.\r\n  - When you get LGTM, you can check this checkbox, and the reviewer will apply the \"docs-complete\" label.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/features/issues/comments/287891874","html_url":"https://github.com/kubernetes/features/issues/209#issuecomment-287891874","issue_url":"https://api.github.com/repos/kubernetes/features/issues/209","id":287891874,"user":{"login":"jbeda","id":37310,"avatar_url":"https://avatars1.githubusercontent.com/u/37310?v=3","gravatar_id":"","url":"https://api.github.com/users/jbeda","html_url":"https://github.com/jbeda","followers_url":"https://api.github.com/users/jbeda/followers","following_url":"https://api.github.com/users/jbeda/following{/other_user}","gists_url":"https://api.github.com/users/jbeda/gists{/gist_id}","starred_url":"https://api.github.com/users/jbeda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbeda/subscriptions","organizations_url":"https://api.github.com/users/jbeda/orgs","repos_url":"https://api.github.com/users/jbeda/repos","events_url":"https://api.github.com/users/jbeda/events{/privacy}","received_events_url":"https://api.github.com/users/jbeda/received_events","type":"User","site_admin":false},"created_at":"2017-03-20T20:44:35Z","updated_at":"2017-03-20T20:44:35Z","body":"The plan to use webhooks for this (and many more contexts) is great.  But the identity permissions model leaves us in a situation where users have to create and manage a whole mess of certificates.  I don't have an immediate answer here but it is worth putting some thought in to as we do this more and more."}}
{"actor":{"display_login":"jbeda"}}