{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/26057","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/26057/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/26057/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/26057/events","html_url":"https://github.com/kubernetes/kubernetes/pull/26057","id":156238887,"number":26057,"title":"Add sysctl proposal","user":{"login":"sttts","id":730123,"avatar_url":"https://avatars.githubusercontent.com/u/730123?v=3","gravatar_id":"","url":"https://api.github.com/users/sttts","html_url":"https://github.com/sttts","followers_url":"https://api.github.com/users/sttts/followers","following_url":"https://api.github.com/users/sttts/following{/other_user}","gists_url":"https://api.github.com/users/sttts/gists{/gist_id}","starred_url":"https://api.github.com/users/sttts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sttts/subscriptions","organizations_url":"https://api.github.com/users/sttts/orgs","repos_url":"https://api.github.com/users/sttts/repos","events_url":"https://api.github.com/users/sttts/events{/privacy}","received_events_url":"https://api.github.com/users/sttts/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/api","name":"area/api","color":"e1ed21"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/security","name":"area/security","color":"d4c5f9"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20human-approved","name":"cla: human-approved","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/api-change","name":"kind/api-change","color":"c7def8"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/design","name":"kind/design","color":"c7def8"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/enhancement","name":"kind/enhancement","color":"c7def8"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note-none","name":"release-note-none","color":"c2e0c6"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/retest-not-required","name":"retest-not-required","color":"eb6420"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/retest-not-required-docs-only","name":"retest-not-required-docs-only","color":"fbca04"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/XL","name":"size/XL","color":"ee5500"}],"state":"open","locked":false,"assignee":{"login":"vishh","id":7063592,"avatar_url":"https://avatars.githubusercontent.com/u/7063592?v=3","gravatar_id":"","url":"https://api.github.com/users/vishh","html_url":"https://github.com/vishh","followers_url":"https://api.github.com/users/vishh/followers","following_url":"https://api.github.com/users/vishh/following{/other_user}","gists_url":"https://api.github.com/users/vishh/gists{/gist_id}","starred_url":"https://api.github.com/users/vishh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vishh/subscriptions","organizations_url":"https://api.github.com/users/vishh/orgs","repos_url":"https://api.github.com/users/vishh/repos","events_url":"https://api.github.com/users/vishh/events{/privacy}","received_events_url":"https://api.github.com/users/vishh/received_events","type":"User","site_admin":false},"assignees":[{"login":"vishh","id":7063592,"avatar_url":"https://avatars.githubusercontent.com/u/7063592?v=3","gravatar_id":"","url":"https://api.github.com/users/vishh","html_url":"https://github.com/vishh","followers_url":"https://api.github.com/users/vishh/followers","following_url":"https://api.github.com/users/vishh/following{/other_user}","gists_url":"https://api.github.com/users/vishh/gists{/gist_id}","starred_url":"https://api.github.com/users/vishh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vishh/subscriptions","organizations_url":"https://api.github.com/users/vishh/orgs","repos_url":"https://api.github.com/users/vishh/repos","events_url":"https://api.github.com/users/vishh/events{/privacy}","received_events_url":"https://api.github.com/users/vishh/received_events","type":"User","site_admin":false},{"login":"dchen1107","id":7740897,"avatar_url":"https://avatars.githubusercontent.com/u/7740897?v=3","gravatar_id":"","url":"https://api.github.com/users/dchen1107","html_url":"https://github.com/dchen1107","followers_url":"https://api.github.com/users/dchen1107/followers","following_url":"https://api.github.com/users/dchen1107/following{/other_user}","gists_url":"https://api.github.com/users/dchen1107/gists{/gist_id}","starred_url":"https://api.github.com/users/dchen1107/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dchen1107/subscriptions","organizations_url":"https://api.github.com/users/dchen1107/orgs","repos_url":"https://api.github.com/users/dchen1107/repos","events_url":"https://api.github.com/users/dchen1107/events{/privacy}","received_events_url":"https://api.github.com/users/dchen1107/received_events","type":"User","site_admin":false},{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/22","html_url":"https://github.com/kubernetes/kubernetes/milestones/v1.4","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/22/labels","id":1777384,"number":22,"title":"v1.4","description":"https://github.com/kubernetes/features/blob/master/release-1.4/Release-1.4.md","creator":{"login":"bgrant0607","id":7725777,"avatar_url":"https://avatars.githubusercontent.com/u/7725777?v=3","gravatar_id":"","url":"https://api.github.com/users/bgrant0607","html_url":"https://github.com/bgrant0607","followers_url":"https://api.github.com/users/bgrant0607/followers","following_url":"https://api.github.com/users/bgrant0607/following{/other_user}","gists_url":"https://api.github.com/users/bgrant0607/gists{/gist_id}","starred_url":"https://api.github.com/users/bgrant0607/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgrant0607/subscriptions","organizations_url":"https://api.github.com/users/bgrant0607/orgs","repos_url":"https://api.github.com/users/bgrant0607/repos","events_url":"https://api.github.com/users/bgrant0607/events{/privacy}","received_events_url":"https://api.github.com/users/bgrant0607/received_events","type":"User","site_admin":false},"open_issues":122,"closed_issues":752,"state":"open","created_at":"2016-05-19T18:50:19Z","updated_at":"2016-09-07T13:37:08Z","due_on":"2016-09-20T00:00:00Z","closed_at":null},"comments":77,"created_at":"2016-05-23T09:38:03Z","updated_at":"2016-09-07T13:44:38Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/26057","html_url":"https://github.com/kubernetes/kubernetes/pull/26057","diff_url":"https://github.com/kubernetes/kubernetes/pull/26057.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/26057.patch"},"body":"Solves https://github.com/kubernetes/kubernetes/issues/5095. Feature: https://github.com/kubernetes/features/issues/34.\r\nAuthors: @hodovska, @ingvagabund, @sttts\r\n\r\nTODO / Open Questions:\r\n- [x] investigate pod vs. containers sysctl namespaces (IPC+net are shared among containers of a pod)\r\n- [x] investigate error behaviour if disallowed sysctls are passed to Docker\r\n- [x] get rkt feedback /cc @s-urbaniak\r\n- [x] investigate implications of `PodSecurityContext`. Is there any policy part involved to control who can change the security context and how?\r\n- [x] check whether this proposal is in-line with the plan for `PodSecurityContext`: compare [proposal](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/security-context-constraints.md) and [open issues of the implementation](https://github.com/kubernetes/kubernetes/issues/23217) /cc @pweil- \r\n- [x] @vishh's comments concerning scheduler support for shared memory\r\n- [x] @vishh's suggestion to use mem cgroup limits instead of `kernel.*` ipc sysctls\r\n- [x] conclusion from bad kmem coverage in kernel >= 4.5\r\n- [x] describe node-level whitelist\r\n- [x] add isolation level (node, pod, container) to the analysis summary\r\n- [x] split whitelist concept into greylist+whitelist\r\n- [x] describe taint/tolerations for sysctls\r\n\r\n<!-- Reviewable:start -->\r\n---\r\nThis change is [<img src=\"https://reviewable.kubernetes.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.kubernetes.io/reviews/kubernetes/kubernetes/26057)\r\n<!-- Reviewable:end -->\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/245284683","html_url":"https://github.com/kubernetes/kubernetes/pull/26057#issuecomment-245284683","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/26057","id":245284683,"user":{"login":"sttts","id":730123,"avatar_url":"https://avatars.githubusercontent.com/u/730123?v=3","gravatar_id":"","url":"https://api.github.com/users/sttts","html_url":"https://github.com/sttts","followers_url":"https://api.github.com/users/sttts/followers","following_url":"https://api.github.com/users/sttts/following{/other_user}","gists_url":"https://api.github.com/users/sttts/gists{/gist_id}","starred_url":"https://api.github.com/users/sttts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sttts/subscriptions","organizations_url":"https://api.github.com/users/sttts/orgs","repos_url":"https://api.github.com/users/sttts/repos","events_url":"https://api.github.com/users/sttts/events{/privacy}","received_events_url":"https://api.github.com/users/sttts/received_events","type":"User","site_admin":false},"created_at":"2016-09-07T13:44:38Z","updated_at":"2016-09-07T13:44:38Z","body":"For reference, the kernel level changes for kmem accounting of `kernel.msg*`  is tracked here: https://bugzilla.redhat.com/show_bug.cgi?id=1364926"}}
{"actor":{"display_login":"sttts"}}