{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/63731787","id":63731787,"diff_hunk":"@@ -0,0 +1,335 @@\n+<!-- BEGIN MUNGE: UNVERSIONED_WARNING -->\n+\n+<!-- BEGIN STRIP_FOR_RELEASE -->\n+\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+\n+<h2>PLEASE NOTE: This document applies to the HEAD of the source tree</h2>\n+\n+If you are using a released version of Kubernetes, you should\n+refer to the docs that go with that version.\n+\n+Documentation for other releases can be found at\n+[releases.k8s.io](http://releases.k8s.io).\n+</strong>\n+--\n+\n+<!-- END STRIP_FOR_RELEASE -->\n+\n+<!-- END MUNGE: UNVERSIONED_WARNING -->\n+\n+# NetworkPolicy\n+\n+## Abstract\n+\n+A proposal for implementing a new resource - NetworkPolicy - which\n+will enable definition of ingress policies for selections of pods.\n+\n+The design for this proposal has been created by, and discussed\n+extensively within the Kubernetes networking SIG.  It has been implemented\n+and tested using Kubernetes API extensions by various networking solutions already.\n+\n+In this design, users can create various NetworkPolicy objects which select groups of pods and\n+define how those pods should be allowed to communicate with each other.  The\n+implementation of that policy at the network layer is left up to the\n+chosen networking solution.\n+\n+> Note that this proposal does not yet include egress / cidr-based policy, which is still actively undergoing discussion in the SIG. These are expected to augment this proposal in a backwards compatible way.\n+\n+## Implementation\n+\n+The implmentation in Kubernetes consists of:\n+- A v1beta1 NetworkPolicy API object\n+- A structure on the `Namespace` object to control policy, to be developed as an annotation for now.\n+\n+### Namespace changes\n+\n+The following objects will be defined on a Namespace Spec.\n+>NOTE: In v1beta1 the Namespace changes will be implemented as an annotation.\n+\n+```go\n+type IngressIsolationPolicy string\n+\n+const (\n+\t// Deny all ingress traffic to pods in this namespace. Ingress means \n+\t// any incoming traffic to pods, whether that be from other pods within this namespace\n+\t// or any source outside of this namespace.\n+\tDefaultDeny IngressIsolationPolicy = \"DefaultDeny\"\n+) \n+\n+// Standard NamespaceSpec object, modified to include a new\n+// NamespaceNetworkPolicy field.\n+type NamespaceSpec struct {\n+\t// This is a pointer so that it can be left undefined.\n+\tNetworkPolicy *NamespaceNetworkPolicy `json:\"networkPolicy,omitempty\"`\n+}\n+\n+type NamespaceNetworkPolicy struct {\n+\t// Ingress configuration for this namespace.  This config is \n+\t// applied to all pods within this namespace. For now, only \n+\t// ingress is supported.  This field is optional - if not \n+\t// defined, then the cluster default for ingress is applied.\n+\tIngress *NamespaceIngressPolicy `json:\"ingress,omitempty\"`\n+}\n+\n+// Configuration for ingress to pods within this namespace.\n+// For now, this only supports specifying an isolation policy.\n+type NamespaceIngressPolicy struct {\n+\t// The isolation policy to apply to pods in this namespace.\n+\t// Currently this field only supports \"DefaultDeny\", but could \n+\t// be extended to support other policies in the future.  When set to DefaultDeny,\n+\t// pods in this namespace are denied ingress traffic by default.  When not defined,\n+\t// the cluster default ingress isolation policy is applied (currently allow all). \n+\tIsolation *IngressIsolationPolicy `json:\"isolation,omitempty\"` \n+}\n+```\n+\n+```yaml\n+kind: Namespace\n+apiVersion: v1\n+spec:\n+  networkPolicy:\n+    ingress:\n+      isolation: DefaultDeny\n+```\n+\n+The above structures will be represented in v1beta1 as a json encoded annotation like so:\n+\n+```yaml\n+kind: Namespace\n+apiVersion: v1\n+metadata:\n+  annotations:\n+    net.beta.kubernetes.io/network-policy: |\n+      {\n+        \"ingress\": {\n+          \"isolation\": \"DefaultDeny\"\n+        }\n+      }\n+```\n+\n+### NetworkPolicy Go Definition\n+\n+For a namespace with ingress isolation, connections to pods in that namespace (from any source) are prevented.  \n+The user needs a way to explicitly declare which connections are allowed into pods of that namespace.\n+\n+This is accomplished through ingress rules on `NetworkPolicy`\n+objects (of which there can be multiple in a single namespace).  Pods selected by\n+one or more NetworkPolicy objects should allow any incoming connections that match any\n+ingress rule on those NetworkPolicy objects, per the network plugin’s capabilities.\n+\n+NetworkPolicy objects and the above namespace isolation both act on _connections_ rather than individual packets.  That is to say that if traffic from pod A to pod B is allowed by the configured\n+policy, then the return packets for that connection from B -> A are also allowed, even if policy is in place that would prevent\n+B from initiating a connection to A.  NetworkPolicy objects act on a broad definition of _connection_ which includes both TCP and UDP streams.   If new network policy is applied that would block an existing connection between two endpoints, the enforcer of policy\n+should terminate and block the existing connection as soon as can be expected by the implementation.\n+\n+We propose adding the new NetworkPolicy object to the `extensions/v1beta1` API group for now.\n+\n+The SIG also considered the following while developing the proposed NetworkPolicy object:\n+- A per-pod policy field.  We discounted this in favor of the loose coupling that labels provide, similar to Services.\n+- Per-Service policy.  We chose not to attach network policy to services to avoid semantic overloading of a single object, and conflating the existing semantics of load-balancing and service discovery with those of network policy.\n+\n+```go\n+type NetworkPolicy struct {\n+\tTypeMeta\n+\tObjectMeta\n+\t\n+\t// Specification of the desired behavior for this NetworkPolicy.\n+\tSpec NetworkPolicySpec \n+}\n+\n+type NetworkPolicySpec struct {\n+\t// Selects the pods to which this NetworkPolicy object applies.  The array of ingress rules \n+\t// is applied to any pods selected by this field. Multiple network policies can select the \n+\t// same set of pods.  In this case, the ingress rules for each are combined additively.\n+\t// This field is NOT optional and follows standard unversioned.LabelSelector semantics.  \n+\t// An empty podSelector matches all pods in this namespace.\n+\tPodSelector unversioned.LabelSelector `json:\"podSelector\"`\n+\t\n+\t// List of ingress rules to be applied to the selected pods.\n+\t// Traffic is allowed to a pod if namespace.networkPolicy.ingress.isolation is undefined and cluster policy allows it, \n+\t// OR if the traffic source is the pod's local node, \n+\t// OR if the traffic matches at least one ingress rule across all of the NetworkPolicy \n+\t// objects whose podSelector matches the pod.  \n+\t// If this field is empty then this NetworkPolicy does not affect ingress isolation.\n+\t// If this field is present and contains at least one rule, this policy allows any traffic\n+\t// which matches at least one of the ingress rules in this list.\n+\tIngress []NetworkPolicyIngressRule `json:\"ingress,omitempty\"`\n+}\n+\n+// This NetworkPolicyIngressRule matches traffic if and only if the traffic matches both ports AND from. \n+type NetworkPolicyIngressRule struct {\n+\t// List of ports which should be made accessible on the pods selected for this rule. \n+\t// Each item in this list is combined using a logical OR.  \n+\t// If this field is not provided, this rule matches all ports (traffic not restricted by port). \n+\t// If this field is empty, this rule matches no ports (no traffic matches).\n+\t// If this field is present and contains at least one item, then this rule allows traffic \n+\t// only if the traffic matches at least one port in the ports list. \n+\tPorts *[]NetworkPolicyPort `json:\"ports,omitempty\"`\n+\t\n+\t// List of sources which should be able to access the pods selected for this rule.\n+\t// Items in this list are combined using a logical OR operation.\n+\t// If this field is not provided, this rule matches all sources (traffic not restricted by source).\n+\t// If this field is empty, this rule matches no sources (no traffic matches). \n+\t// If this field is present and contains at least on item, this rule allows traffic only if the \n+\t// traffic matches at least one item in the from list. \n+\tFrom *[]NetworkPolicyPeer `json:\"from,omitempty\"`\n+}\n+\n+type NetworkPolicyPort struct {\n+\t// Optional.  The protocol (TCP or UDP) which traffic must match.\n+\t// If not specified, this field defaults to TCP. \n+\tProtocol *api.Protocol `json:\"protocol,omitempty\"`\n+\t\n+\t// If specified, the port on the given protocol.  This can \n+\t// either be a numerical or named port.  If this field is not provided,\n+\t// this matches all port names and numbers.\n+\t// If present, only traffic on the specified protocol AND port\n+\t// will be matched.\n+\tPort *intstr.IntOrString `json:\"port,omitempty\"`\n+}\n+\n+type NetworkPolicyPeer struct {\n+\t// Exactly one of the following must be specified.\n+\n+\t// This is a label selector which selects Pods in this namespace.\n+\t// This field follows standard unversioned.LabelSelector semantics.\n+\t// If not provided, this selector selects no pods.\n+\t// If present but empty, this selector selects all pods in this namespace.\n+\tPodSelector *unversioned.LabelSelector `json:\"podSelector,omitempty\"`\n+\t\n+\t// Selects Namespaces using cluster scoped-labels.  This \n+\t// matches all pods in all namespaces selected by this label selector. \n+\t// This field follows standard unversioned.LabelSelector semantics.\n+\t// If omited, this selector selects no namespaces.\n+\t// If present but empty, this selector selects all namespaces.\n+\tNamespaceSelector *unversioned.LabelSelector `json:\"namespaceSelector,omitempty\"`\n+}\n+```\n+\n+### Behavior\n+\n+The following pseudo-code attempts to define when traffic is allowed to a given pod when using this API.\n+\n+```python\n+def is_traffic_allowed(traffic, pod):\n+  \"\"\"\n+  Returns True if traffic is allowed to this pod, False otherwise.\n+  \"\"\"\n+  if not pod.Namespace.Spec.NetworkPolicy.Ingress.Isolation:\n+    # If ingress isolation is disabled on the Namespace, all traffic is allowed.\n+    return True \n+  elif traffic.source == pod.node.kubelet:\n+    # Traffic is from kubelet health checks.\n+    return True\n+  else:\n+    # If namespace ingress isolation is enabled, only allow traffic \n+    # that matches a network policy which selects this pod.\n+    for network_policy in network_policies(pod.Namespace):\n+      if not network_policy.Spec.PodSelector.selects(pod):\n+        # This policy doesn't select this pod. Try the next one. \n+        continue\n+\n+      # This policy selects this pod.  Check each ingress rule \n+      # defined on this policy to see if it allows the traffic.\n+      # If at least one does, then the traffic is allowed.\n+      for ingress_rule in network_policy.Ingress or []:\n+        if ingress_rule.matches(traffic): \n+          return True \n+\n+  # Ingress isolation is DefaultDeny and no policies match the given pod and traffic.\n+  # Use the cluster default behavior.\n+  return clusterDefault(traffic, pod) ","path":"docs/proposals/network-policy.md","position":null,"original_position":251,"commit_id":"7495ebb233492aac6c7ac3c5446fc730586feef5","original_commit_id":"4b0750a952e4a47500933496371294eac3d834ba","user":{"login":"MikeSpreitzer","id":14296719,"avatar_url":"https://avatars.githubusercontent.com/u/14296719?v=3","gravatar_id":"","url":"https://api.github.com/users/MikeSpreitzer","html_url":"https://github.com/MikeSpreitzer","followers_url":"https://api.github.com/users/MikeSpreitzer/followers","following_url":"https://api.github.com/users/MikeSpreitzer/following{/other_user}","gists_url":"https://api.github.com/users/MikeSpreitzer/gists{/gist_id}","starred_url":"https://api.github.com/users/MikeSpreitzer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MikeSpreitzer/subscriptions","organizations_url":"https://api.github.com/users/MikeSpreitzer/orgs","repos_url":"https://api.github.com/users/MikeSpreitzer/repos","events_url":"https://api.github.com/users/MikeSpreitzer/events{/privacy}","received_events_url":"https://api.github.com/users/MikeSpreitzer/received_events","type":"User","site_admin":false},"body":"No, the cluster default is what applies when namespace.networkPolicy.ingress.isolation is undefined; otherwise traffic is refused if it is neither for probing (health checking or lifecycle) or allowed by a NetworkPolicy.\r\nIf this is not clear yet, just consider this: where does this code ever return \"False\"?","created_at":"2016-05-18T15:59:43Z","updated_at":"2016-05-18T15:59:43Z","html_url":"https://github.com/kubernetes/kubernetes/pull/24154#discussion_r63731787","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/63731787"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/24154#discussion_r63731787"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154","id":66218087,"html_url":"https://github.com/kubernetes/kubernetes/pull/24154","diff_url":"https://github.com/kubernetes/kubernetes/pull/24154.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/24154.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/24154","number":24154,"state":"open","locked":false,"title":"Network policy proposal","user":{"login":"caseydavenport","id":1944093,"avatar_url":"https://avatars.githubusercontent.com/u/1944093?v=3","gravatar_id":"","url":"https://api.github.com/users/caseydavenport","html_url":"https://github.com/caseydavenport","followers_url":"https://api.github.com/users/caseydavenport/followers","following_url":"https://api.github.com/users/caseydavenport/following{/other_user}","gists_url":"https://api.github.com/users/caseydavenport/gists{/gist_id}","starred_url":"https://api.github.com/users/caseydavenport/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caseydavenport/subscriptions","organizations_url":"https://api.github.com/users/caseydavenport/orgs","repos_url":"https://api.github.com/users/caseydavenport/repos","events_url":"https://api.github.com/users/caseydavenport/events{/privacy}","received_events_url":"https://api.github.com/users/caseydavenport/received_events","type":"User","site_admin":false},"body":"This proposal attempts to add a v1beta API for network policy to Kubernetes, as discussed and designed within the networking SIG.\n\n<!-- Reviewable:start -->\n---\nThis change is [<img src=\"http://reviewable.k8s.io/review_button.svg\" height=\"35\" align=\"absmiddle\" alt=\"Reviewable\"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/24154)\n<!-- Reviewable:end -->\n","created_at":"2016-04-12T19:58:45Z","updated_at":"2016-05-18T15:59:43Z","closed_at":null,"merged_at":null,"merge_commit_sha":"2fff056508210ff41469bfae03258ef2347b35f6","assignee":{"login":"thockin","id":5595220,"avatar_url":"https://avatars.githubusercontent.com/u/5595220?v=3","gravatar_id":"","url":"https://api.github.com/users/thockin","html_url":"https://github.com/thockin","followers_url":"https://api.github.com/users/thockin/followers","following_url":"https://api.github.com/users/thockin/following{/other_user}","gists_url":"https://api.github.com/users/thockin/gists{/gist_id}","starred_url":"https://api.github.com/users/thockin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thockin/subscriptions","organizations_url":"https://api.github.com/users/thockin/orgs","repos_url":"https://api.github.com/users/thockin/repos","events_url":"https://api.github.com/users/thockin/events{/privacy}","received_events_url":"https://api.github.com/users/thockin/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/18","html_url":"https://github.com/kubernetes/kubernetes/milestones/v1.3","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/18/labels","id":1638460,"number":18,"title":"v1.3","description":"https://github.com/kubernetes/kubernetes/wiki/Release-1.3","creator":{"login":"bgrant0607","id":7725777,"avatar_url":"https://avatars.githubusercontent.com/u/7725777?v=3","gravatar_id":"","url":"https://api.github.com/users/bgrant0607","html_url":"https://github.com/bgrant0607","followers_url":"https://api.github.com/users/bgrant0607/followers","following_url":"https://api.github.com/users/bgrant0607/following{/other_user}","gists_url":"https://api.github.com/users/bgrant0607/gists{/gist_id}","starred_url":"https://api.github.com/users/bgrant0607/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgrant0607/subscriptions","organizations_url":"https://api.github.com/users/bgrant0607/orgs","repos_url":"https://api.github.com/users/bgrant0607/repos","events_url":"https://api.github.com/users/bgrant0607/events{/privacy}","received_events_url":"https://api.github.com/users/bgrant0607/received_events","type":"User","site_admin":false},"open_issues":210,"closed_issues":102,"state":"open","created_at":"2016-03-11T07:40:20Z","updated_at":"2016-05-18T15:54:46Z","due_on":"2016-06-24T07:00:00Z","closed_at":null},"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/24154/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/7495ebb233492aac6c7ac3c5446fc730586feef5","head":{"label":"caseydavenport:network-policy-proposal","ref":"network-policy-proposal","sha":"7495ebb233492aac6c7ac3c5446fc730586feef5","user":{"login":"caseydavenport","id":1944093,"avatar_url":"https://avatars.githubusercontent.com/u/1944093?v=3","gravatar_id":"","url":"https://api.github.com/users/caseydavenport","html_url":"https://github.com/caseydavenport","followers_url":"https://api.github.com/users/caseydavenport/followers","following_url":"https://api.github.com/users/caseydavenport/following{/other_user}","gists_url":"https://api.github.com/users/caseydavenport/gists{/gist_id}","starred_url":"https://api.github.com/users/caseydavenport/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caseydavenport/subscriptions","organizations_url":"https://api.github.com/users/caseydavenport/orgs","repos_url":"https://api.github.com/users/caseydavenport/repos","events_url":"https://api.github.com/users/caseydavenport/events{/privacy}","received_events_url":"https://api.github.com/users/caseydavenport/received_events","type":"User","site_admin":false},"repo":{"id":38320636,"name":"kubernetes","full_name":"caseydavenport/kubernetes","owner":{"login":"caseydavenport","id":1944093,"avatar_url":"https://avatars.githubusercontent.com/u/1944093?v=3","gravatar_id":"","url":"https://api.github.com/users/caseydavenport","html_url":"https://github.com/caseydavenport","followers_url":"https://api.github.com/users/caseydavenport/followers","following_url":"https://api.github.com/users/caseydavenport/following{/other_user}","gists_url":"https://api.github.com/users/caseydavenport/gists{/gist_id}","starred_url":"https://api.github.com/users/caseydavenport/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caseydavenport/subscriptions","organizations_url":"https://api.github.com/users/caseydavenport/orgs","repos_url":"https://api.github.com/users/caseydavenport/repos","events_url":"https://api.github.com/users/caseydavenport/events{/privacy}","received_events_url":"https://api.github.com/users/caseydavenport/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/caseydavenport/kubernetes","description":"Container Cluster Manager from Google","fork":true,"url":"https://api.github.com/repos/caseydavenport/kubernetes","forks_url":"https://api.github.com/repos/caseydavenport/kubernetes/forks","keys_url":"https://api.github.com/repos/caseydavenport/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/caseydavenport/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/caseydavenport/kubernetes/teams","hooks_url":"https://api.github.com/repos/caseydavenport/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/caseydavenport/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/caseydavenport/kubernetes/events","assignees_url":"https://api.github.com/repos/caseydavenport/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/caseydavenport/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/caseydavenport/kubernetes/tags","blobs_url":"https://api.github.com/repos/caseydavenport/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/caseydavenport/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/caseydavenport/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/caseydavenport/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/caseydavenport/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/caseydavenport/kubernetes/languages","stargazers_url":"https://api.github.com/repos/caseydavenport/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/caseydavenport/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/caseydavenport/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/caseydavenport/kubernetes/subscription","commits_url":"https://api.github.com/repos/caseydavenport/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/caseydavenport/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/caseydavenport/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/caseydavenport/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/caseydavenport/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/caseydavenport/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/caseydavenport/kubernetes/merges","archive_url":"https://api.github.com/repos/caseydavenport/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/caseydavenport/kubernetes/downloads","issues_url":"https://api.github.com/repos/caseydavenport/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/caseydavenport/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/caseydavenport/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/caseydavenport/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/caseydavenport/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/caseydavenport/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/caseydavenport/kubernetes/deployments","created_at":"2015-06-30T16:35:10Z","updated_at":"2016-01-12T22:34:55Z","pushed_at":"2016-05-18T15:59:26Z","git_url":"git://github.com/caseydavenport/kubernetes.git","ssh_url":"git@github.com:caseydavenport/kubernetes.git","clone_url":"https://github.com/caseydavenport/kubernetes.git","svn_url":"https://github.com/caseydavenport/kubernetes","homepage":"http://kubernetes.io","size":225075,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":3,"forks":0,"open_issues":3,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"952e8302fb4562b74a5ed17e099c620b8fb363e9","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Container Cluster Manager from Google","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/kubernetes/deployments","created_at":"2014-06-06T22:56:04Z","updated_at":"2016-05-18T15:18:09Z","pushed_at":"2016-05-18T15:59:28Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":451330,"stargazers_count":14434,"watchers_count":14434,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":4368,"mirror_url":null,"open_issues_count":3559,"forks":4368,"open_issues":3559,"watchers":14434,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/24154"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/24154"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/24154/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/7495ebb233492aac6c7ac3c5446fc730586feef5"}}}}