{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/23502","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/23502/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/23502/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/23502/events","html_url":"https://github.com/kubernetes/kubernetes/pull/23502","id":143598528,"number":23502,"title":"etcd-based abac authorizor plugin","user":{"login":"huang195","id":8008677,"avatar_url":"https://avatars.githubusercontent.com/u/8008677?v=3","gravatar_id":"","url":"https://api.github.com/users/huang195","html_url":"https://github.com/huang195","followers_url":"https://api.github.com/users/huang195/followers","following_url":"https://api.github.com/users/huang195/following{/other_user}","gists_url":"https://api.github.com/users/huang195/gists{/gist_id}","starred_url":"https://api.github.com/users/huang195/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/huang195/subscriptions","organizations_url":"https://api.github.com/users/huang195/orgs","repos_url":"https://api.github.com/users/huang195/repos","events_url":"https://api.github.com/users/huang195/events{/privacy}","received_events_url":"https://api.github.com/users/huang195/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note-label-needed","name":"release-note-label-needed","color":"db5a64"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/L","name":"size/L","color":"ee9900"}],"state":"open","locked":false,"assignee":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"milestone":null,"comments":10,"created_at":"2016-03-25T21:08:24Z","updated_at":"2016-04-22T17:24:34Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/23502","html_url":"https://github.com/kubernetes/kubernetes/pull/23502","diff_url":"https://github.com/kubernetes/kubernetes/pull/23502.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/23502.patch"},"body":"Refers to #22988, #23095, #23346 \r\n@liggitt I ended up implementing an ABAC authorizor plugin that can i) load a policy file from etcd backend and ii) detect policy changes and then reload. I think it solves the problems we encountered earlier while not overloading the built-in ABAC authorizor. rsync/atomic.Value is used per earlier suggestion."},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/213519735","html_url":"https://github.com/kubernetes/kubernetes/pull/23502#issuecomment-213519735","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/23502","id":213519735,"user":{"login":"k8s-bot","id":12551979,"avatar_url":"https://avatars.githubusercontent.com/u/12551979?v=3","gravatar_id":"","url":"https://api.github.com/users/k8s-bot","html_url":"https://github.com/k8s-bot","followers_url":"https://api.github.com/users/k8s-bot/followers","following_url":"https://api.github.com/users/k8s-bot/following{/other_user}","gists_url":"https://api.github.com/users/k8s-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/k8s-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/k8s-bot/subscriptions","organizations_url":"https://api.github.com/users/k8s-bot/orgs","repos_url":"https://api.github.com/users/k8s-bot/repos","events_url":"https://api.github.com/users/k8s-bot/events{/privacy}","received_events_url":"https://api.github.com/users/k8s-bot/received_events","type":"User","site_admin":false},"created_at":"2016-04-22T17:24:34Z","updated_at":"2016-04-22T17:24:34Z","body":"Can one of the admins verify that this patch is reasonable to test? If so, please reply \"ok to test\".\n(Note: \"add to whitelist\" is no longer supported. Please update configurations in `hack/jenkins/job-configs/kubernetes-jenkins-pull/` instead.)\n\nThis message may repeat a few times in short succession due to https://github.com/jenkinsci/ghprb-plugin/issues/292. Sorry.\n\nOtherwise, if this message is too spammy, please complain to ixdy."}}