{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/90354736","pull_request_review_id":10871735,"id":90354736,"diff_hunk":"@@ -0,0 +1,221 @@\n+# Linux Capabilities in Container Runtime Interface\n+\n+The following proposal summarizes the current state and problems for runtimes to implement Linux Capabilities.\n+\n+## Problems\n+\n+Today's [Linux Capabilities Interface](https://github.com/kubernetes/kubernetes/blob/v1.5.0-alpha.0/pkg/kubelet/api/v1alpha1/runtime/api.proto#L350-L355) in CRI is derived from the Docker runtime implementation, which also maps to the [k8s API](https://github.com/kubernetes/kubernetes/blob/v1.5.0-alpha.0/pkg/api/v1/types.go#L1164-L1170).\n+\n+If users want to launch a container with ad-hoc capabilities, they will go through the following steps:\n+\n+- Get a list of capabilities he would require\n+- Look up Docker's docs about the [default capability list](https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities).\n+- Calculate the `Add` and `Drop` capability set based on his requirements and the default capabilities list.\n+- Specify the `Add` and `Drop` set for the containers in a k8s pod spec.\n+- Launch the pod/container.\n+\n+There are several issues here:\n+\n+- The default capability set heavily depends on Docker's implementation; Kubernetes has no control over that.\n+When Docker changes the default capability set across versions, the effective set of default capabilities can change suddenly.\n+- To implement the same semantics as today's Docker runtime, other runtimes (e.g. rkt) are required to depend on the implicit Docker default capability set as well. If Docker changes the default capability set, then consistency is not guaranteed.\n+- From a security point of view, an explicit capability set which does not rely on undefined defaults is preferable for auditing purposes.\n+\n+## Solution\n+\n+The proposed solution will:\n+\n+- Keep the Kubernetes API backwards compatible.\n+- Add a new `RequestedSet` field to the `PodSpec.SecurityContext.Capabilities` struct, to allow users to request a specific set of capabilities.\n+- Add a new `DefaultCapabilities` field to the `PodSecurityPolicySpec` struct, to allow administrators to define a default set of capabilities.\n+- Define a default capability whitelist inside the following Kubernetes components:\n+  1. the *API server*: Capability defaults are being applied to `PodSpec.SecurityContext.Capabilities.RequestedSet` either through the `PodSecurityPolicySpec` or, if admission control is disabled, using a default capability whitelist.\n+  2. the *Kubelet*: If the kubelet receives a `PodSpec.SecurityContext.Capabilities.RequestedSet` that does not specify any capabilities, the kubelet applies capability defaults to retain backwards compatibility. This could occur for example when a kubelet is newer than the API server.\n+- Make CRI expose the whitelist based capability interface, remove the existing `add_capabilities`, and `drop_capabilities` fields, and put the burden on the runtime to implement that.\n+- Make the final requested capability set **visible** through the container spec, for example:\n+\n+```shell\n+$ kubectl get pod -o yaml\n+apiVersion: v1\n+items:\n+- apiVersion: v1\n+  kind: Pod\n+  metadata:\n+  ...\n+  spec:\n+    containers:\n+    - command:\n+      - sleep\n+      - \"1000\"\n+      image: busybox\n+      imagePullPolicy: Always\n+      name: my-busybox\n+      securityContext:\n+        capabilities:\n+          requestedSet:\n+          - SETPCAP, MKNOD, AUDIT_WRITE, ...\n+          add:\n+          - NET_ADMIN\n+          drop:\n+          - MKNOD\n+      ...\n+  status:\n+    containerStatuses:\n+    - image: busybox\n+      name: my-busybox\n+      state:\n+        running:\n+          startedAt: 2016-09-27T22:33:38Z\n+    ...\n+```\n+\n+## Struct changes\n+\n+The `PodSecurityPolicySpec` in `pkg/apis/extensions/types.go` gains a new `DefaultCapabilities` field. \n+The existing fields `DefaultAddCapabilities`, and `RequiredDropCapabilities` will be marked as deprecated.\n+\n+```\n+type PodSecurityPolicySpec struct {\n+...\n+        // DefaultAddCapabilities is the default set of capabilities that will be added to the container\n+        // unless the pod spec specifically drops the capability or the pod spec uses a requested-set.\n+        // You may not list a capability in both DefaultAddCapabilities and RequiredDropCapabilities.\n+        // Note: this field is deprecated in favor of the DefaultCapabilities field.\n+        DefaultAddCapabilities []api.Capability `json:\"defaultAddCapabilities,omitempty\"`\n+\n+        // RequiredDropCapabilities are the capabilities that will be dropped from the container. These\n+        // are required to be dropped and cannot be added or present in the requested-set.\n+        RequiredDropCapabilities []api.Capability `json:\"requiredDropCapabilities,omitempty\"`\n+\n+        // AllowedCapabilities is a list of capabilities that can be requested to add to the container.\n+        // Capabilities in this field may be added at the pod author's discretion via the add\n+        // or requested-set in the pod spec.\n+        // You must not list a capability in both AllowedCapabilities and RequiredDropCapabilities.\n+        AllowedCapabilities []api.Capability `json:\"allowedCapabilities,omitempty\"`\n+\n+        // DefaultCapabilities is a set of default capabilities that will be used for pods\n+        // that do not have a requested-set specified in their pod spec.\n+        // The pod spec's add/drop capabilities are applied to this set.\n+        // In addition to the capabilities listed here, the pod author can add additional capabilities\n+        // specified in the AllowedCapabilities field.\n+        DefaultCapabilities []api.Capability `json:\"defaultCapabilities,omitempty\"`\n+...\n+}\n+```\n+\n+The `Capabilities` struct in `pkg/api/types.go`, and `pkg/api/v1/types.go` gets a new `RequestedSet` field:\n+\n+```\n+// Capabilities represent POSIX capabilities that can be added or removed to a running container to/from a default set.\n+type Capabilities struct {\n+        // Capabilities added to the default capabilities\n+        Add []Capability `json:\"add,omitempty\"`\n+        // Capabilities removed from the default capabilities\n+        Drop []Capability `json:\"drop,omitempty\"`\n+        // Requested set of capabilities\n+        RequestedSet []Capability `json:\"requestedSet,omitempty\"`\n+}\n+```\n+\n+The `Capability` struct in `pkg/kubelet/api/v1alpha1/runtime/api.proto` replaces the existing `add_capabilities` and `drop_capabilities` fields with a new `requested_capabilities` field:\n+\n+```\n+message Capability {\n+    // List of capabilities to retain.\n+    repeated string requested_capabilities = 1;\n+}\n+```\n+\n+## Use Cases\n+\n+### User specifies `requestedSet` only in the pod spec:\n+\n+The simplest use case is when a user only sets the `requestedSet` field in a new pod spec:\n+\n+```\n+  spec:\n+    containers:\n+      securityContext:\n+        capabilities:\n+          requestedSet:\n+          - MKNOD, NET_ADMIN, SETPCAP, AUDIT_WRITE, ...\n+```\n+\n+The resolved requested set equals `requestedSet`.","path":"docs/proposals/container-runtime-interface/capabilities.md","position":144,"original_position":144,"commit_id":"fc61c40a4280389fc2b00bfc605ee5e3f7d35d64","original_commit_id":"fc61c40a4280389fc2b00bfc605ee5e3f7d35d64","user":{"login":"timstclair","id":3272040,"avatar_url":"https://avatars.githubusercontent.com/u/3272040?v=3","gravatar_id":"","url":"https://api.github.com/users/timstclair","html_url":"https://github.com/timstclair","followers_url":"https://api.github.com/users/timstclair/followers","following_url":"https://api.github.com/users/timstclair/following{/other_user}","gists_url":"https://api.github.com/users/timstclair/gists{/gist_id}","starred_url":"https://api.github.com/users/timstclair/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timstclair/subscriptions","organizations_url":"https://api.github.com/users/timstclair/orgs","repos_url":"https://api.github.com/users/timstclair/repos","events_url":"https://api.github.com/users/timstclair/events{/privacy}","received_events_url":"https://api.github.com/users/timstclair/received_events","type":"User","site_admin":false},"body":"Add a note about how this interacts with `DefaultAddCapabilities` and `RequiredDropCapabilities` on the PSP. I assume `DefaultAddCapabilities` is ignored, but if there's overlap with `RequiredDropCapabilities` would that trigger a validation error or silently drop the capability?","created_at":"2016-11-30T23:40:52Z","updated_at":"2016-11-30T23:53:43Z","html_url":"https://github.com/kubernetes/kubernetes/pull/35910#discussion_r90354736","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/35910","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/90354736"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/35910#discussion_r90354736"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/35910"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/35910","id":91643448,"html_url":"https://github.com/kubernetes/kubernetes/pull/35910","diff_url":"https://github.com/kubernetes/kubernetes/pull/35910.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/35910.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/35910","number":35910,"state":"open","locked":false,"title":"Proposal: Change capability interface in CRI.","user":{"login":"s-urbaniak","id":375856,"avatar_url":"https://avatars.githubusercontent.com/u/375856?v=3","gravatar_id":"","url":"https://api.github.com/users/s-urbaniak","html_url":"https://github.com/s-urbaniak","followers_url":"https://api.github.com/users/s-urbaniak/followers","following_url":"https://api.github.com/users/s-urbaniak/following{/other_user}","gists_url":"https://api.github.com/users/s-urbaniak/gists{/gist_id}","starred_url":"https://api.github.com/users/s-urbaniak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/s-urbaniak/subscriptions","organizations_url":"https://api.github.com/users/s-urbaniak/orgs","repos_url":"https://api.github.com/users/s-urbaniak/repos","events_url":"https://api.github.com/users/s-urbaniak/events{/privacy}","received_events_url":"https://api.github.com/users/s-urbaniak/received_events","type":"User","site_admin":false},"body":"This PR supersedes https://github.com/kubernetes/kubernetes/pull/33614, and addresses its review comments.\n\n<!-- Reviewable:start -->\n\n---\nThis change is [<img src=\"https://reviewable.kubernetes.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.kubernetes.io/reviews/kubernetes/kubernetes/35910)\n<!-- Reviewable:end -->\n","created_at":"2016-10-31T16:36:15Z","updated_at":"2016-11-30T23:53:43Z","closed_at":null,"merged_at":null,"merge_commit_sha":"aab967c89af3b57a7069796e4d6bf7df234f41d6","assignee":{"login":"dchen1107","id":7740897,"avatar_url":"https://avatars.githubusercontent.com/u/7740897?v=3","gravatar_id":"","url":"https://api.github.com/users/dchen1107","html_url":"https://github.com/dchen1107","followers_url":"https://api.github.com/users/dchen1107/followers","following_url":"https://api.github.com/users/dchen1107/following{/other_user}","gists_url":"https://api.github.com/users/dchen1107/gists{/gist_id}","starred_url":"https://api.github.com/users/dchen1107/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dchen1107/subscriptions","organizations_url":"https://api.github.com/users/dchen1107/orgs","repos_url":"https://api.github.com/users/dchen1107/repos","events_url":"https://api.github.com/users/dchen1107/events{/privacy}","received_events_url":"https://api.github.com/users/dchen1107/received_events","type":"User","site_admin":false},"assignees":[{"login":"dchen1107","id":7740897,"avatar_url":"https://avatars.githubusercontent.com/u/7740897?v=3","gravatar_id":"","url":"https://api.github.com/users/dchen1107","html_url":"https://github.com/dchen1107","followers_url":"https://api.github.com/users/dchen1107/followers","following_url":"https://api.github.com/users/dchen1107/following{/other_user}","gists_url":"https://api.github.com/users/dchen1107/gists{/gist_id}","starred_url":"https://api.github.com/users/dchen1107/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dchen1107/subscriptions","organizations_url":"https://api.github.com/users/dchen1107/orgs","repos_url":"https://api.github.com/users/dchen1107/repos","events_url":"https://api.github.com/users/dchen1107/events{/privacy}","received_events_url":"https://api.github.com/users/dchen1107/received_events","type":"User","site_admin":false}],"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/35910/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/35910/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/35910/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/fc61c40a4280389fc2b00bfc605ee5e3f7d35d64","head":{"label":"s-urbaniak:cri_caps","ref":"cri_caps","sha":"fc61c40a4280389fc2b00bfc605ee5e3f7d35d64","user":{"login":"s-urbaniak","id":375856,"avatar_url":"https://avatars.githubusercontent.com/u/375856?v=3","gravatar_id":"","url":"https://api.github.com/users/s-urbaniak","html_url":"https://github.com/s-urbaniak","followers_url":"https://api.github.com/users/s-urbaniak/followers","following_url":"https://api.github.com/users/s-urbaniak/following{/other_user}","gists_url":"https://api.github.com/users/s-urbaniak/gists{/gist_id}","starred_url":"https://api.github.com/users/s-urbaniak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/s-urbaniak/subscriptions","organizations_url":"https://api.github.com/users/s-urbaniak/orgs","repos_url":"https://api.github.com/users/s-urbaniak/repos","events_url":"https://api.github.com/users/s-urbaniak/events{/privacy}","received_events_url":"https://api.github.com/users/s-urbaniak/received_events","type":"User","site_admin":false},"repo":{"id":72454057,"name":"kubernetes","full_name":"s-urbaniak/kubernetes","owner":{"login":"s-urbaniak","id":375856,"avatar_url":"https://avatars.githubusercontent.com/u/375856?v=3","gravatar_id":"","url":"https://api.github.com/users/s-urbaniak","html_url":"https://github.com/s-urbaniak","followers_url":"https://api.github.com/users/s-urbaniak/followers","following_url":"https://api.github.com/users/s-urbaniak/following{/other_user}","gists_url":"https://api.github.com/users/s-urbaniak/gists{/gist_id}","starred_url":"https://api.github.com/users/s-urbaniak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/s-urbaniak/subscriptions","organizations_url":"https://api.github.com/users/s-urbaniak/orgs","repos_url":"https://api.github.com/users/s-urbaniak/repos","events_url":"https://api.github.com/users/s-urbaniak/events{/privacy}","received_events_url":"https://api.github.com/users/s-urbaniak/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/s-urbaniak/kubernetes","description":"Production-Grade Container Scheduling and Management","fork":true,"url":"https://api.github.com/repos/s-urbaniak/kubernetes","forks_url":"https://api.github.com/repos/s-urbaniak/kubernetes/forks","keys_url":"https://api.github.com/repos/s-urbaniak/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/s-urbaniak/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/s-urbaniak/kubernetes/teams","hooks_url":"https://api.github.com/repos/s-urbaniak/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/s-urbaniak/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/s-urbaniak/kubernetes/events","assignees_url":"https://api.github.com/repos/s-urbaniak/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/s-urbaniak/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/s-urbaniak/kubernetes/tags","blobs_url":"https://api.github.com/repos/s-urbaniak/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/s-urbaniak/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/s-urbaniak/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/s-urbaniak/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/s-urbaniak/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/s-urbaniak/kubernetes/languages","stargazers_url":"https://api.github.com/repos/s-urbaniak/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/s-urbaniak/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/s-urbaniak/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/s-urbaniak/kubernetes/subscription","commits_url":"https://api.github.com/repos/s-urbaniak/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/s-urbaniak/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/s-urbaniak/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/s-urbaniak/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/s-urbaniak/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/s-urbaniak/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/s-urbaniak/kubernetes/merges","archive_url":"https://api.github.com/repos/s-urbaniak/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/s-urbaniak/kubernetes/downloads","issues_url":"https://api.github.com/repos/s-urbaniak/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/s-urbaniak/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/s-urbaniak/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/s-urbaniak/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/s-urbaniak/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/s-urbaniak/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/s-urbaniak/kubernetes/deployments","created_at":"2016-10-31T16:12:10Z","updated_at":"2016-10-31T16:12:49Z","pushed_at":"2016-11-15T10:51:49Z","git_url":"git://github.com/s-urbaniak/kubernetes.git","ssh_url":"git@github.com:s-urbaniak/kubernetes.git","clone_url":"https://github.com/s-urbaniak/kubernetes.git","svn_url":"https://github.com/s-urbaniak/kubernetes","homepage":"http://kubernetes.io","size":351584,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"05d067d6bb626c622f0ceb5b16687c288d0d6c39","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Production-Grade Container Scheduling and Management","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/kubernetes/deployments","created_at":"2014-06-06T22:56:04Z","updated_at":"2016-11-30T23:45:07Z","pushed_at":"2016-11-30T23:51:37Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":643417,"stargazers_count":18810,"watchers_count":18810,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":6236,"mirror_url":null,"open_issues_count":5393,"forks":6236,"open_issues":5393,"watchers":18810,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/35910"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/35910"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/35910"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/35910/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/35910/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/35910/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/fc61c40a4280389fc2b00bfc605ee5e3f7d35d64"}}}}
{"actor":{"display_login":"timstclair"}}