{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/6659","repository_url":"https://api.github.com/repos/openshift/origin","labels_url":"https://api.github.com/repos/openshift/origin/issues/6659/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/6659/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/6659/events","html_url":"https://github.com/openshift/origin/pull/6659","id":126692895,"number":6659,"title":"Add SCC support for blocking pods from using EmptyDir volumes.","user":{"login":"dgoodwin","id":51265,"avatar_url":"https://avatars.githubusercontent.com/u/51265?v=3","gravatar_id":"","url":"https://api.github.com/users/dgoodwin","html_url":"https://github.com/dgoodwin","followers_url":"https://api.github.com/users/dgoodwin/followers","following_url":"https://api.github.com/users/dgoodwin/following{/other_user}","gists_url":"https://api.github.com/users/dgoodwin/gists{/gist_id}","starred_url":"https://api.github.com/users/dgoodwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dgoodwin/subscriptions","organizations_url":"https://api.github.com/users/dgoodwin/orgs","repos_url":"https://api.github.com/users/dgoodwin/repos","events_url":"https://api.github.com/users/dgoodwin/events{/privacy}","received_events_url":"https://api.github.com/users/dgoodwin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/openshift/origin/labels/area/compatibility","name":"area/compatibility","color":"006b75"}],"state":"open","locked":false,"assignee":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"milestone":null,"comments":35,"created_at":"2016-01-14T16:36:59Z","updated_at":"2016-02-10T20:16:25Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/6659","html_url":"https://github.com/openshift/origin/pull/6659","diff_url":"https://github.com/openshift/origin/pull/6659.diff","patch_url":"https://github.com/openshift/origin/pull/6659.patch"},"body":"Builds off the example of AllowHostDirVolumePlugin. Change is being implemented to satisfy some online/multi-tenant use cases, and roughly matches a planned feature for pod security policy: https://github.com/pweil-/kubernetes/blob/security-policy/docs/proposals/security-context-constraints.md\r\n\r\nThere is however an outstanding problem I could use some guidance on, today use of empty dir volumes is implicitly allowed, but this SCC parameter is a boolean to allow it, which will zero to false effectively breaking every SCC out in the wild. I am unsure how best to roll this out.\r\n\r\nIdeas:\r\n\r\n(1) reconcile-sccs command\r\n\r\n(2) Inverting it to DenyEmptyDirVolumePlugin. There's nothing else in the SCC that would match this 'deny' convention, so it feels inconsistent, but it might be more technically correct for what it actually needs to do.\r\n\r\n(3) Alternatively could we make it a string so we can have a legitimate third state? Empty string = unset, \"true\" and \"false\"? \r\n\r\nWe don't really need a third state so in some ways I'd kind of lean towards (2) as being the best option, but please let me know what you think or if there are other ideas."},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/182562183","html_url":"https://github.com/openshift/origin/pull/6659#issuecomment-182562183","issue_url":"https://api.github.com/repos/openshift/origin/issues/6659","id":182562183,"user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"created_at":"2016-02-10T20:16:25Z","updated_at":"2016-02-10T20:16:25Z","body":"@pweil- I blocked this on the rebase last time.  If its still good, he'd probably like a merge before the next one goes in :)"}}