{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/origin/pulls/comments/55072644","id":55072644,"diff_hunk":"@@ -0,0 +1,175 @@\n+package podnodeconstraints\n+\n+import (\n+\t\"fmt\"\n+\t\"io\"\n+\t\"reflect\"\n+\n+\tadmission \"k8s.io/kubernetes/pkg/admission\"\n+\tkapi \"k8s.io/kubernetes/pkg/api\"\n+\tkapierrors \"k8s.io/kubernetes/pkg/api/errors\"\n+\t\"k8s.io/kubernetes/pkg/apis/extensions\"\n+\tclientset \"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset\"\n+\t\"k8s.io/kubernetes/pkg/util/sets\"\n+\n+\tauthorizationapi \"github.com/openshift/origin/pkg/authorization/api\"\n+\t\"github.com/openshift/origin/pkg/client\"\n+\toadmission \"github.com/openshift/origin/pkg/cmd/server/admission\"\n+\tconfiglatest \"github.com/openshift/origin/pkg/cmd/server/api/latest\"\n+\tdeployapi \"github.com/openshift/origin/pkg/deploy/api\"\n+\t\"github.com/openshift/origin/pkg/scheduler/admission/podnodeconstraints/api\"\n+)\n+\n+func init() {\n+\tadmission.RegisterPlugin(\"PodNodeConstraints\", func(c clientset.Interface, config io.Reader) (admission.Interface, error) {\n+\t\tpluginConfig, err := readConfig(config)\n+\t\tif err != nil {\n+\t\t\treturn nil, err\n+\t\t}\n+\t\treturn NewPodNodeConstraints(pluginConfig), nil\n+\t})\n+}\n+\n+// NewPodNodeConstraints creates a new admission plugin to prevent objects that contain pod templates\n+// from containing node bindings by name or selector based on role permissions.\n+func NewPodNodeConstraints(config *api.PodNodeConstraintsConfig) admission.Interface {\n+\treturn &podNodeConstraints{\n+\t\tconfig:  config,\n+\t\tHandler: admission.NewHandler(admission.Create, admission.Update),\n+\t}\n+}\n+\n+type podNodeConstraints struct {\n+\t*admission.Handler\n+\tclient client.Interface\n+\tconfig *api.PodNodeConstraintsConfig\n+}\n+\n+var _ = oadmission.WantsOpenshiftClient(&podNodeConstraints{})\n+var _ = oadmission.Validator(&podNodeConstraints{})\n+\n+func readConfig(reader io.Reader) (*api.PodNodeConstraintsConfig, error) {\n+\tif reader == nil || reflect.ValueOf(reader).IsNil() {\n+\t\treturn &api.PodNodeConstraintsConfig{}, nil\n+\t}\n+\n+\tobj, err := configlatest.ReadYAML(reader)\n+\tif err != nil {\n+\t\treturn nil, err\n+\t}\n+\tif obj == nil {\n+\t\treturn nil, nil\n+\t}\n+\tconfig, ok := obj.(*api.PodNodeConstraintsConfig)\n+\tif !ok {\n+\t\treturn nil, fmt.Errorf(\"unexpected config object: %#v\", obj)\n+\t}\n+\t// No validation needed since config is just list of strings\n+\treturn config, nil\n+}\n+\n+func (o *podNodeConstraints) Admit(attr admission.Attributes) error {\n+\tswitch {\n+\tcase o.config == nil,\n+\t\tattr.GetSubresource() != \"\":\n+\t\treturn nil\n+\t}\n+\tswitch attr.GetResource() {\n+\t// We only want CREATE for pods\n+\tcase kapi.Resource(\"pods\"):\n+\t\tif attr.GetOperation() == admission.Update {\n+\t\t\treturn nil\n+\t\t}\n+\t// But we want CREATE & UPDATE for every other resource\n+\tcase kapi.Resource(\"replicationcontrollers\"),\n+\t\textensions.Resource(\"deployments\"),\n+\t\textensions.Resource(\"replicasets\"),\n+\t\textensions.Resource(\"jobs\"),\n+\t\tdeployapi.Resource(\"deploymentconfigs\"):\n+\t\t// These are the only types we care about\n+\tdefault:\n+\t\treturn nil\n+\t}\n+\tps, err := o.getPodSpec(attr)\n+\tif err == nil {\n+\t\treturn o.admitPodSpec(attr, ps)\n+\t}\n+\treturn err\n+}\n+\n+// extract the PodSpec from the pod templates for each object we care about\n+func (o *podNodeConstraints) getPodSpec(attr admission.Attributes) (kapi.PodSpec, error) {\n+\tswitch r := attr.GetObject().(type) {\n+\tcase *kapi.Pod:\n+\t\treturn r.Spec, nil\n+\tcase *kapi.ReplicationController:\n+\t\treturn r.Spec.Template.Spec, nil\n+\tcase *extensions.Deployment:\n+\t\treturn r.Spec.Template.Spec, nil\n+\tcase *extensions.ReplicaSet:\n+\t\treturn r.Spec.Template.Spec, nil\n+\tcase *extensions.Job:\n+\t\treturn r.Spec.Template.Spec, nil\n+\tcase *deployapi.DeploymentConfig:\n+\t\treturn r.Spec.Template.Spec, nil\n+\t}\n+\treturn kapi.PodSpec{}, kapierrors.NewInternalError(fmt.Errorf(\"No PodSpec available for supplied admission attribute\"))\n+}\n+\n+// validate PodSpec if NodeName or NodeSelector are specified\n+func (o *podNodeConstraints) admitPodSpec(attr admission.Attributes, ps kapi.PodSpec) error {\n+\tlbls := []string{}\n+\t// nodeSelector blacklist filter\n+\tif len(ps.NodeSelector) > 0 {\n+\t\tfor nslbl := range ps.NodeSelector {\n+\t\t\tfor _, bllbl := range o.config.NodeSelectorLabelBlacklist {\n+\t\t\t\tif bllbl == nslbl {\n+\t\t\t\t\tlbls = append(lbls, bllbl)\n+\t\t\t\t}\n+\t\t\t}\n+\t\t}\n+\t}\n+\t// nodeName constraint\n+\tif len(ps.NodeName) > 0 || len(lbls) > 0 {\n+\t\tallow, err := o.checkPodsBindAccess(attr)\n+\t\tif err != nil {\n+\t\t\treturn err\n+\t\t}\n+\t\tif allow != nil && !allow.Allowed {\n+\t\t\tswitch {\n+\t\t\tcase len(ps.NodeName) > 0 && len(lbls) == 0:\n+\t\t\t\treturn admission.NewForbidden(attr, fmt.Errorf(\"node selection by nodeName is prohibited by policy for your role\"))\n+\t\t\tcase len(ps.NodeName) == 0 && len(lbls) > 0:\n+\t\t\t\treturn admission.NewForbidden(attr, fmt.Errorf(\"node selection by label(s) %v is prohibited by policy for your role\", lbls))\n+\t\t\tcase len(ps.NodeName) > 0 && len(lbls) > 0:\n+\t\t\t\treturn admission.NewForbidden(attr, fmt.Errorf(\"node selection by nodeName and label(s) %v is prohibited by policy for your role\", lbls))\n+\t\t\t}\n+\t\t}\n+\t}\n+\treturn nil\n+}\n+\n+func (o *podNodeConstraints) SetOpenshiftClient(c client.Interface) {\n+\to.client = c\n+}\n+\n+func (o *podNodeConstraints) Validate() error {\n+\tif o.client == nil {\n+\t\treturn fmt.Errorf(\"PodNodeConstraints needs an Openshift client\")\n+\t}\n+\treturn nil\n+}\n+\n+// build LocalSubjectAccessReview struct to validate role via checkAccess\n+func (o *podNodeConstraints) checkPodsBindAccess(attr admission.Attributes) (*authorizationapi.SubjectAccessReviewResponse, error) {","path":"pkg/scheduler/admission/podnodeconstraints/admission.go","position":164,"original_position":164,"commit_id":"290aec7e27951ad3c9c693b69e61e3a4efa9c817","original_commit_id":"290aec7e27951ad3c9c693b69e61e3a4efa9c817","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"body":"> @deads2k Would you be ok with passing the origin authorizer to build the Kube master? (Otherwise I don't see how we could pass one to the plugin when initialized by Kube)\r\n\r\nYes, though you may end up writing a wrapper for our Authorizer interface to conform to a kube interface in order to keep dependencies sane.  Alternatively, we could collapse to a single admission chain, which also seems reasonable to me.\r\n\r\nDo you have a preference?","created_at":"2016-03-04T18:57:42Z","updated_at":"2016-03-04T18:57:42Z","html_url":"https://github.com/openshift/origin/pull/6979#discussion_r55072644","pull_request_url":"https://api.github.com/repos/openshift/origin/pulls/6979","_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments/55072644"},"html":{"href":"https://github.com/openshift/origin/pull/6979#discussion_r55072644"},"pull_request":{"href":"https://api.github.com/repos/openshift/origin/pulls/6979"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/6979","id":58049134,"html_url":"https://github.com/openshift/origin/pull/6979","diff_url":"https://github.com/openshift/origin/pull/6979.diff","patch_url":"https://github.com/openshift/origin/pull/6979.patch","issue_url":"https://api.github.com/repos/openshift/origin/issues/6979","number":6979,"state":"open","locked":false,"title":"[WIP] Add constraints for nodeName and nodeSelector","user":{"login":"dobbymoodge","id":1537044,"avatar_url":"https://avatars.githubusercontent.com/u/1537044?v=3","gravatar_id":"","url":"https://api.github.com/users/dobbymoodge","html_url":"https://github.com/dobbymoodge","followers_url":"https://api.github.com/users/dobbymoodge/followers","following_url":"https://api.github.com/users/dobbymoodge/following{/other_user}","gists_url":"https://api.github.com/users/dobbymoodge/gists{/gist_id}","starred_url":"https://api.github.com/users/dobbymoodge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dobbymoodge/subscriptions","organizations_url":"https://api.github.com/users/dobbymoodge/orgs","repos_url":"https://api.github.com/users/dobbymoodge/repos","events_url":"https://api.github.com/users/dobbymoodge/events{/privacy}","received_events_url":"https://api.github.com/users/dobbymoodge/received_events","type":"User","site_admin":false},"body":"This adds an admission controller that provides booleans to allow or prohibit the use of `nodeName` and `nodeSelector` fields in pod requests\r\n","created_at":"2016-02-02T21:00:09Z","updated_at":"2016-03-04T18:57:42Z","closed_at":null,"merged_at":null,"merge_commit_sha":"ee39daecc18a77c8f36215a39704216837d969fe","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openshift/origin/pulls/6979/commits","review_comments_url":"https://api.github.com/repos/openshift/origin/pulls/6979/comments","review_comment_url":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/origin/issues/6979/comments","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/290aec7e27951ad3c9c693b69e61e3a4efa9c817","head":{"label":"dobbymoodge:nodeName_admsnctl","ref":"nodeName_admsnctl","sha":"290aec7e27951ad3c9c693b69e61e3a4efa9c817","user":{"login":"dobbymoodge","id":1537044,"avatar_url":"https://avatars.githubusercontent.com/u/1537044?v=3","gravatar_id":"","url":"https://api.github.com/users/dobbymoodge","html_url":"https://github.com/dobbymoodge","followers_url":"https://api.github.com/users/dobbymoodge/followers","following_url":"https://api.github.com/users/dobbymoodge/following{/other_user}","gists_url":"https://api.github.com/users/dobbymoodge/gists{/gist_id}","starred_url":"https://api.github.com/users/dobbymoodge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dobbymoodge/subscriptions","organizations_url":"https://api.github.com/users/dobbymoodge/orgs","repos_url":"https://api.github.com/users/dobbymoodge/repos","events_url":"https://api.github.com/users/dobbymoodge/events{/privacy}","received_events_url":"https://api.github.com/users/dobbymoodge/received_events","type":"User","site_admin":false},"repo":{"id":28879731,"name":"origin","full_name":"dobbymoodge/origin","owner":{"login":"dobbymoodge","id":1537044,"avatar_url":"https://avatars.githubusercontent.com/u/1537044?v=3","gravatar_id":"","url":"https://api.github.com/users/dobbymoodge","html_url":"https://github.com/dobbymoodge","followers_url":"https://api.github.com/users/dobbymoodge/followers","following_url":"https://api.github.com/users/dobbymoodge/following{/other_user}","gists_url":"https://api.github.com/users/dobbymoodge/gists{/gist_id}","starred_url":"https://api.github.com/users/dobbymoodge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dobbymoodge/subscriptions","organizations_url":"https://api.github.com/users/dobbymoodge/orgs","repos_url":"https://api.github.com/users/dobbymoodge/repos","events_url":"https://api.github.com/users/dobbymoodge/events{/privacy}","received_events_url":"https://api.github.com/users/dobbymoodge/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/dobbymoodge/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":true,"url":"https://api.github.com/repos/dobbymoodge/origin","forks_url":"https://api.github.com/repos/dobbymoodge/origin/forks","keys_url":"https://api.github.com/repos/dobbymoodge/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dobbymoodge/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dobbymoodge/origin/teams","hooks_url":"https://api.github.com/repos/dobbymoodge/origin/hooks","issue_events_url":"https://api.github.com/repos/dobbymoodge/origin/issues/events{/number}","events_url":"https://api.github.com/repos/dobbymoodge/origin/events","assignees_url":"https://api.github.com/repos/dobbymoodge/origin/assignees{/user}","branches_url":"https://api.github.com/repos/dobbymoodge/origin/branches{/branch}","tags_url":"https://api.github.com/repos/dobbymoodge/origin/tags","blobs_url":"https://api.github.com/repos/dobbymoodge/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dobbymoodge/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dobbymoodge/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/dobbymoodge/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dobbymoodge/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/dobbymoodge/origin/languages","stargazers_url":"https://api.github.com/repos/dobbymoodge/origin/stargazers","contributors_url":"https://api.github.com/repos/dobbymoodge/origin/contributors","subscribers_url":"https://api.github.com/repos/dobbymoodge/origin/subscribers","subscription_url":"https://api.github.com/repos/dobbymoodge/origin/subscription","commits_url":"https://api.github.com/repos/dobbymoodge/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/dobbymoodge/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/dobbymoodge/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/dobbymoodge/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/dobbymoodge/origin/contents/{+path}","compare_url":"https://api.github.com/repos/dobbymoodge/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dobbymoodge/origin/merges","archive_url":"https://api.github.com/repos/dobbymoodge/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dobbymoodge/origin/downloads","issues_url":"https://api.github.com/repos/dobbymoodge/origin/issues{/number}","pulls_url":"https://api.github.com/repos/dobbymoodge/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/dobbymoodge/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/dobbymoodge/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dobbymoodge/origin/labels{/name}","releases_url":"https://api.github.com/repos/dobbymoodge/origin/releases{/id}","deployments_url":"https://api.github.com/repos/dobbymoodge/origin/deployments","created_at":"2015-01-06T19:31:27Z","updated_at":"2016-01-11T20:38:16Z","pushed_at":"2016-03-03T16:32:07Z","git_url":"git://github.com/dobbymoodge/origin.git","ssh_url":"git@github.com:dobbymoodge/origin.git","clone_url":"https://github.com/dobbymoodge/origin.git","svn_url":"https://github.com/dobbymoodge/origin","homepage":"https://openshift.github.io","size":224485,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"a98744590f599510905d1635fa54dac6dbe20adf","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":22442668,"name":"origin","full_name":"openshift/origin","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":false,"url":"https://api.github.com/repos/openshift/origin","forks_url":"https://api.github.com/repos/openshift/origin/forks","keys_url":"https://api.github.com/repos/openshift/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/origin/teams","hooks_url":"https://api.github.com/repos/openshift/origin/hooks","issue_events_url":"https://api.github.com/repos/openshift/origin/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/origin/events","assignees_url":"https://api.github.com/repos/openshift/origin/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/origin/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/origin/tags","blobs_url":"https://api.github.com/repos/openshift/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/origin/languages","stargazers_url":"https://api.github.com/repos/openshift/origin/stargazers","contributors_url":"https://api.github.com/repos/openshift/origin/contributors","subscribers_url":"https://api.github.com/repos/openshift/origin/subscribers","subscription_url":"https://api.github.com/repos/openshift/origin/subscription","commits_url":"https://api.github.com/repos/openshift/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/origin/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/origin/merges","archive_url":"https://api.github.com/repos/openshift/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/origin/downloads","issues_url":"https://api.github.com/repos/openshift/origin/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/origin/labels{/name}","releases_url":"https://api.github.com/repos/openshift/origin/releases{/id}","deployments_url":"https://api.github.com/repos/openshift/origin/deployments","created_at":"2014-07-30T20:04:05Z","updated_at":"2016-03-04T08:43:05Z","pushed_at":"2016-03-04T18:54:38Z","git_url":"git://github.com/openshift/origin.git","ssh_url":"git@github.com:openshift/origin.git","clone_url":"https://github.com/openshift/origin.git","svn_url":"https://github.com/openshift/origin","homepage":"http://www.openshift.org","size":287674,"stargazers_count":1091,"watchers_count":1091,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":669,"mirror_url":null,"open_issues_count":901,"forks":669,"open_issues":901,"watchers":1091,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/6979"},"html":{"href":"https://github.com/openshift/origin/pull/6979"},"issue":{"href":"https://api.github.com/repos/openshift/origin/issues/6979"},"comments":{"href":"https://api.github.com/repos/openshift/origin/issues/6979/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/origin/pulls/6979/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/origin/pulls/6979/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/origin/statuses/290aec7e27951ad3c9c693b69e61e3a4efa9c817"}}}}