{"action":"created","issue":{"url":"https://api.github.com/repos/30x/project-management/issues/152","repository_url":"https://api.github.com/repos/30x/project-management","labels_url":"https://api.github.com/repos/30x/project-management/issues/152/labels{/name}","comments_url":"https://api.github.com/repos/30x/project-management/issues/152/comments","events_url":"https://api.github.com/repos/30x/project-management/issues/152/events","html_url":"https://github.com/30x/project-management/issues/152","id":175377911,"number":152,"title":"Research/Mark necessary pods as privileged","user":{"login":"whitlockjc","id":98899,"avatar_url":"https://avatars.githubusercontent.com/u/98899?v=3","gravatar_id":"","url":"https://api.github.com/users/whitlockjc","html_url":"https://github.com/whitlockjc","followers_url":"https://api.github.com/users/whitlockjc/followers","following_url":"https://api.github.com/users/whitlockjc/following{/other_user}","gists_url":"https://api.github.com/users/whitlockjc/gists{/gist_id}","starred_url":"https://api.github.com/users/whitlockjc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whitlockjc/subscriptions","organizations_url":"https://api.github.com/users/whitlockjc/orgs","repos_url":"https://api.github.com/users/whitlockjc/repos","events_url":"https://api.github.com/users/whitlockjc/events{/privacy}","received_events_url":"https://api.github.com/users/whitlockjc/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/30x/project-management/labels/ready","name":"ready","color":"ededed"}],"state":"open","locked":false,"assignee":{"login":"whitlockjc","id":98899,"avatar_url":"https://avatars.githubusercontent.com/u/98899?v=3","gravatar_id":"","url":"https://api.github.com/users/whitlockjc","html_url":"https://github.com/whitlockjc","followers_url":"https://api.github.com/users/whitlockjc/followers","following_url":"https://api.github.com/users/whitlockjc/following{/other_user}","gists_url":"https://api.github.com/users/whitlockjc/gists{/gist_id}","starred_url":"https://api.github.com/users/whitlockjc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whitlockjc/subscriptions","organizations_url":"https://api.github.com/users/whitlockjc/orgs","repos_url":"https://api.github.com/users/whitlockjc/repos","events_url":"https://api.github.com/users/whitlockjc/events{/privacy}","received_events_url":"https://api.github.com/users/whitlockjc/received_events","type":"User","site_admin":false},"assignees":[{"login":"whitlockjc","id":98899,"avatar_url":"https://avatars.githubusercontent.com/u/98899?v=3","gravatar_id":"","url":"https://api.github.com/users/whitlockjc","html_url":"https://github.com/whitlockjc","followers_url":"https://api.github.com/users/whitlockjc/followers","following_url":"https://api.github.com/users/whitlockjc/following{/other_user}","gists_url":"https://api.github.com/users/whitlockjc/gists{/gist_id}","starred_url":"https://api.github.com/users/whitlockjc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whitlockjc/subscriptions","organizations_url":"https://api.github.com/users/whitlockjc/orgs","repos_url":"https://api.github.com/users/whitlockjc/repos","events_url":"https://api.github.com/users/whitlockjc/events{/privacy}","received_events_url":"https://api.github.com/users/whitlockjc/received_events","type":"User","site_admin":false},{"login":"madhurranjan","id":596447,"avatar_url":"https://avatars.githubusercontent.com/u/596447?v=3","gravatar_id":"","url":"https://api.github.com/users/madhurranjan","html_url":"https://github.com/madhurranjan","followers_url":"https://api.github.com/users/madhurranjan/followers","following_url":"https://api.github.com/users/madhurranjan/following{/other_user}","gists_url":"https://api.github.com/users/madhurranjan/gists{/gist_id}","starred_url":"https://api.github.com/users/madhurranjan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/madhurranjan/subscriptions","organizations_url":"https://api.github.com/users/madhurranjan/orgs","repos_url":"https://api.github.com/users/madhurranjan/repos","events_url":"https://api.github.com/users/madhurranjan/events{/privacy}","received_events_url":"https://api.github.com/users/madhurranjan/received_events","type":"User","site_admin":false},{"login":"mpnally","id":2752746,"avatar_url":"https://avatars.githubusercontent.com/u/2752746?v=3","gravatar_id":"","url":"https://api.github.com/users/mpnally","html_url":"https://github.com/mpnally","followers_url":"https://api.github.com/users/mpnally/followers","following_url":"https://api.github.com/users/mpnally/following{/other_user}","gists_url":"https://api.github.com/users/mpnally/gists{/gist_id}","starred_url":"https://api.github.com/users/mpnally/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpnally/subscriptions","organizations_url":"https://api.github.com/users/mpnally/orgs","repos_url":"https://api.github.com/users/mpnally/repos","events_url":"https://api.github.com/users/mpnally/events{/privacy}","received_events_url":"https://api.github.com/users/mpnally/received_events","type":"User","site_admin":false},{"login":"jbowen93","id":5825193,"avatar_url":"https://avatars.githubusercontent.com/u/5825193?v=3","gravatar_id":"","url":"https://api.github.com/users/jbowen93","html_url":"https://github.com/jbowen93","followers_url":"https://api.github.com/users/jbowen93/followers","following_url":"https://api.github.com/users/jbowen93/following{/other_user}","gists_url":"https://api.github.com/users/jbowen93/gists{/gist_id}","starred_url":"https://api.github.com/users/jbowen93/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbowen93/subscriptions","organizations_url":"https://api.github.com/users/jbowen93/orgs","repos_url":"https://api.github.com/users/jbowen93/repos","events_url":"https://api.github.com/users/jbowen93/events{/privacy}","received_events_url":"https://api.github.com/users/jbowen93/received_events","type":"User","site_admin":false},{"login":"jlin21","id":5839718,"avatar_url":"https://avatars.githubusercontent.com/u/5839718?v=3","gravatar_id":"","url":"https://api.github.com/users/jlin21","html_url":"https://github.com/jlin21","followers_url":"https://api.github.com/users/jlin21/followers","following_url":"https://api.github.com/users/jlin21/following{/other_user}","gists_url":"https://api.github.com/users/jlin21/gists{/gist_id}","starred_url":"https://api.github.com/users/jlin21/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jlin21/subscriptions","organizations_url":"https://api.github.com/users/jlin21/orgs","repos_url":"https://api.github.com/users/jlin21/repos","events_url":"https://api.github.com/users/jlin21/events{/privacy}","received_events_url":"https://api.github.com/users/jlin21/received_events","type":"User","site_admin":false},{"login":"noahdietz","id":6644735,"avatar_url":"https://avatars.githubusercontent.com/u/6644735?v=3","gravatar_id":"","url":"https://api.github.com/users/noahdietz","html_url":"https://github.com/noahdietz","followers_url":"https://api.github.com/users/noahdietz/followers","following_url":"https://api.github.com/users/noahdietz/following{/other_user}","gists_url":"https://api.github.com/users/noahdietz/gists{/gist_id}","starred_url":"https://api.github.com/users/noahdietz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/noahdietz/subscriptions","organizations_url":"https://api.github.com/users/noahdietz/orgs","repos_url":"https://api.github.com/users/noahdietz/repos","events_url":"https://api.github.com/users/noahdietz/events{/privacy}","received_events_url":"https://api.github.com/users/noahdietz/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/30x/project-management/milestones/5","html_url":"https://github.com/30x/project-management/milestones/Beta-3","labels_url":"https://api.github.com/repos/30x/project-management/milestones/5/labels","id":2022362,"number":5,"title":"Beta-3","description":"","creator":{"login":"whitlockjc","id":98899,"avatar_url":"https://avatars.githubusercontent.com/u/98899?v=3","gravatar_id":"","url":"https://api.github.com/users/whitlockjc","html_url":"https://github.com/whitlockjc","followers_url":"https://api.github.com/users/whitlockjc/followers","following_url":"https://api.github.com/users/whitlockjc/following{/other_user}","gists_url":"https://api.github.com/users/whitlockjc/gists{/gist_id}","starred_url":"https://api.github.com/users/whitlockjc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whitlockjc/subscriptions","organizations_url":"https://api.github.com/users/whitlockjc/orgs","repos_url":"https://api.github.com/users/whitlockjc/repos","events_url":"https://api.github.com/users/whitlockjc/events{/privacy}","received_events_url":"https://api.github.com/users/whitlockjc/received_events","type":"User","site_admin":false},"open_issues":13,"closed_issues":3,"state":"open","created_at":"2016-09-22T15:40:06Z","updated_at":"2016-09-30T18:01:15Z","due_on":"2016-10-08T00:00:00Z","closed_at":null},"comments":2,"created_at":"2016-09-06T23:40:11Z","updated_at":"2016-10-03T19:58:33Z","closed_at":null,"body":"We are currently using the [DenyEscalatingExec](http://kubernetes.io/docs/admin/admission-controllers/#denyescalatingexec) admission controller to disallow someone using `exec` or `run` to run a privileged container.  The purpose of this is security.  For example, `kiln` uses the Docker socket directly and should be locked down.  But there are also other situations where this could be useful, like Pods that are given access to communicate with Pods outside its own namespace, like the routers."},"comment":{"url":"https://api.github.com/repos/30x/project-management/issues/comments/251209561","html_url":"https://github.com/30x/project-management/issues/152#issuecomment-251209561","issue_url":"https://api.github.com/repos/30x/project-management/issues/152","id":251209561,"user":{"login":"whitlockjc","id":98899,"avatar_url":"https://avatars.githubusercontent.com/u/98899?v=3","gravatar_id":"","url":"https://api.github.com/users/whitlockjc","html_url":"https://github.com/whitlockjc","followers_url":"https://api.github.com/users/whitlockjc/followers","following_url":"https://api.github.com/users/whitlockjc/following{/other_user}","gists_url":"https://api.github.com/users/whitlockjc/gists{/gist_id}","starred_url":"https://api.github.com/users/whitlockjc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whitlockjc/subscriptions","organizations_url":"https://api.github.com/users/whitlockjc/orgs","repos_url":"https://api.github.com/users/whitlockjc/repos","events_url":"https://api.github.com/users/whitlockjc/events{/privacy}","received_events_url":"https://api.github.com/users/whitlockjc/received_events","type":"User","site_admin":false},"created_at":"2016-10-03T19:58:33Z","updated_at":"2016-10-03T19:58:33Z","body":"Applying this to `k8s-router` would make debugging nginx harder but I can understand why we'd do it since our network policies would allow traffic from there to be blindly accepted into any namespace.  If that is our reasoning, we should probably do it for any container in any whitelisted namespace.\r\n\r\nBut we do need to think about this a little more because it would have a huge impact on debugging."}}
{"actor":{"display_login":"whitlockjc"}}