{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/20347","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/20347/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/20347/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/20347/events","html_url":"https://github.com/kubernetes/kubernetes/pull/20347","id":129895349,"number":20347,"title":"[WIP] plugin/pkg/auth: add gRPC implementation of authorizer.Authorizer plugin","user":{"login":"ericchiang","id":2342749,"avatar_url":"https://avatars.githubusercontent.com/u/2342749?v=3","gravatar_id":"","url":"https://api.github.com/users/ericchiang","html_url":"https://github.com/ericchiang","followers_url":"https://api.github.com/users/ericchiang/followers","following_url":"https://api.github.com/users/ericchiang/following{/other_user}","gists_url":"https://api.github.com/users/ericchiang/gists{/gist_id}","starred_url":"https://api.github.com/users/ericchiang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericchiang/subscriptions","organizations_url":"https://api.github.com/users/ericchiang/orgs","repos_url":"https://api.github.com/users/ericchiang/repos","events_url":"https://api.github.com/users/ericchiang/events{/privacy}","received_events_url":"https://api.github.com/users/ericchiang/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20no","name":"cla: no","color":"e11d21"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/needs-rebase","name":"needs-rebase","color":"BDBDBD"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/XS","name":"size/XS","color":"009900"}],"state":"open","locked":false,"assignee":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"milestone":null,"comments":19,"created_at":"2016-01-29T22:05:31Z","updated_at":"2016-02-02T01:01:57Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/20347","html_url":"https://github.com/kubernetes/kubernetes/pull/20347","diff_url":"https://github.com/kubernetes/kubernetes/pull/20347.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/20347.patch"},"body":"Following up on the proposal in #19828 this is an implementation of the authorizer.Authorizer plugin which calls out to a remote gRPC service to drive authorization. The details are in that issues, but in summary we (CoreOS) would like a way to build services that drive authentication separate from k8s.\r\n\r\nDue to the current vendored state of the protobuf and grpc packages, I've had to cherry pick updates from #19931 to generate code that would compile. That PR is not passing tests, but I'd still like feedback on this PR and will update the commits when #19931 is resolved.\r\n\r\ncc @philips @sym3tri @bobbyrullo\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/178288333","html_url":"https://github.com/kubernetes/kubernetes/pull/20347#issuecomment-178288333","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/20347","id":178288333,"user":{"login":"ericchiang","id":2342749,"avatar_url":"https://avatars.githubusercontent.com/u/2342749?v=3","gravatar_id":"","url":"https://api.github.com/users/ericchiang","html_url":"https://github.com/ericchiang","followers_url":"https://api.github.com/users/ericchiang/followers","following_url":"https://api.github.com/users/ericchiang/following{/other_user}","gists_url":"https://api.github.com/users/ericchiang/gists{/gist_id}","starred_url":"https://api.github.com/users/ericchiang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericchiang/subscriptions","organizations_url":"https://api.github.com/users/ericchiang/orgs","repos_url":"https://api.github.com/users/ericchiang/repos","events_url":"https://api.github.com/users/ericchiang/events{/privacy}","received_events_url":"https://api.github.com/users/ericchiang/received_events","type":"User","site_admin":false},"created_at":"2016-02-02T01:01:57Z","updated_at":"2016-02-02T01:01:57Z","body":"> My first thought is that we don't use gRPC anywhere else, and it seems arbitrary to start using it here.\r\n\r\nI've used gRPC because we prefer it to REST, but the overall goal is to provide a webhook like mechanism for authz. If it would fit into the existing project better, REST would be fine.\r\n\r\n> Baking in an RPC is a big support/compatibility commitment. We don't currently have any outgoing RPCs or webhooks, although we've definitely talked about webhooks, and specifically about auth webhooks. So thanks in advance for bearing with us if we spend a lot of time here ~~arguing~~ discussing.\r\n\r\nSince the existing API already has a lot of good language around API stability / compatibility would it be more reasonable to rethink this as an API addition of a REST webhook? That would allow us to add swagger definitions for documentation (rather than pointing others to a .proto file) and piggyback off of established rules for API groups and deprecation."}}