{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31292","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31292/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31292/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31292/events","html_url":"https://github.com/kubernetes/kubernetes/issues/31292","id":172794239,"number":31292,"title":"need an API for a user to know which actions they can perform","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"labels":[{"id":357119284,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/auth","name":"area/auth","color":"00cc00","default":false},{"id":138247961,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/component/kubectl","name":"component/kubectl","color":"0052cc","default":false},{"id":243794510,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/api","name":"team/api","color":"d2b48c","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/23","html_url":"https://github.com/kubernetes/kubernetes/milestones/v1.5","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/23/labels","id":1945978,"number":23,"title":"v1.5","description":"","creator":{"login":"lavalamp","id":647318,"avatar_url":"https://avatars.githubusercontent.com/u/647318?v=3","gravatar_id":"","url":"https://api.github.com/users/lavalamp","html_url":"https://github.com/lavalamp","followers_url":"https://api.github.com/users/lavalamp/followers","following_url":"https://api.github.com/users/lavalamp/following{/other_user}","gists_url":"https://api.github.com/users/lavalamp/gists{/gist_id}","starred_url":"https://api.github.com/users/lavalamp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lavalamp/subscriptions","organizations_url":"https://api.github.com/users/lavalamp/orgs","repos_url":"https://api.github.com/users/lavalamp/repos","events_url":"https://api.github.com/users/lavalamp/events{/privacy}","received_events_url":"https://api.github.com/users/lavalamp/received_events","type":"User","site_admin":false},"open_issues":274,"closed_issues":609,"state":"open","created_at":"2016-08-16T21:47:28Z","updated_at":"2016-11-15T16:15:57Z","due_on":"2016-12-09T00:00:00Z","closed_at":null},"comments":1,"created_at":"2016-08-23T20:09:50Z","updated_at":"2016-11-15T16:15:53Z","closed_at":null,"body":"It's important for users to be able to determine which actions they are allowed to perform.  We have a general API for inspecting a particular action called `SelfSubjectAccessReview.v1beta1.authorization.k8s.io`.  It is not tied to a particular authorizer because API actions have a defined set of parameter by the `authorizer.Authorize` interface.\n\nWe need a similar API for users to be able to determine which actions they're allowed to perform without checking an exhaustive list themselves.  OpenShift models this with a `SubjectRulesReview` endpoint which returns back a list of essentially `rbac.PolicyRules`, but Kube should not tie the endpoint directly to a particular authorizer.  I think we can manage this by creating an optional interface implemented by an authorizer which could provide the information.\n\nIf we made an `AllowedActions() authorizer.Attributes` interface which an authorizer could implement to provide a list of `authorizer.Attributes`, we could create a generic endpoint in the `authorization.k8s.io` group which would be authorizer agnostic.\n\n@kubernetes/sig-auth comments?\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/260686615","html_url":"https://github.com/kubernetes/kubernetes/issues/31292#issuecomment-260686615","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31292","id":260686615,"user":{"login":"dims","id":23304,"avatar_url":"https://avatars.githubusercontent.com/u/23304?v=3","gravatar_id":"","url":"https://api.github.com/users/dims","html_url":"https://github.com/dims","followers_url":"https://api.github.com/users/dims/followers","following_url":"https://api.github.com/users/dims/following{/other_user}","gists_url":"https://api.github.com/users/dims/gists{/gist_id}","starred_url":"https://api.github.com/users/dims/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dims/subscriptions","organizations_url":"https://api.github.com/users/dims/orgs","repos_url":"https://api.github.com/users/dims/repos","events_url":"https://api.github.com/users/dims/events{/privacy}","received_events_url":"https://api.github.com/users/dims/received_events","type":"User","site_admin":false},"created_at":"2016-11-15T16:15:53Z","updated_at":"2016-11-15T16:15:53Z","body":"@deads2k switching this to 1.6 as it's too late for 1.5. ok?"}}
{"actor":{"display_login":"dims"}}