{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31458","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31458/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31458/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31458/events","html_url":"https://github.com/kubernetes/kubernetes/issues/31458","id":173293944,"number":31458,"title":"CRI client-side implementation (aka kuberuntime) in kubelet","user":{"login":"yujuhong","id":10524058,"avatar_url":"https://avatars.githubusercontent.com/u/10524058?v=3","gravatar_id":"","url":"https://api.github.com/users/yujuhong","html_url":"https://github.com/yujuhong","followers_url":"https://api.github.com/users/yujuhong/followers","following_url":"https://api.github.com/users/yujuhong/following{/other_user}","gists_url":"https://api.github.com/users/yujuhong/gists{/gist_id}","starred_url":"https://api.github.com/users/yujuhong/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yujuhong/subscriptions","organizations_url":"https://api.github.com/users/yujuhong/orgs","repos_url":"https://api.github.com/users/yujuhong/repos","events_url":"https://api.github.com/users/yujuhong/events{/privacy}","received_events_url":"https://api.github.com/users/yujuhong/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/kubelet-api","name":"area/kubelet-api","color":"fbca04"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/component/kubelet","name":"component/kubelet","color":"0052cc"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/node","name":"team/node","color":"d2b48c"}],"state":"open","locked":false,"assignee":{"login":"feiskyer","id":676637,"avatar_url":"https://avatars.githubusercontent.com/u/676637?v=3","gravatar_id":"","url":"https://api.github.com/users/feiskyer","html_url":"https://github.com/feiskyer","followers_url":"https://api.github.com/users/feiskyer/followers","following_url":"https://api.github.com/users/feiskyer/following{/other_user}","gists_url":"https://api.github.com/users/feiskyer/gists{/gist_id}","starred_url":"https://api.github.com/users/feiskyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/feiskyer/subscriptions","organizations_url":"https://api.github.com/users/feiskyer/orgs","repos_url":"https://api.github.com/users/feiskyer/repos","events_url":"https://api.github.com/users/feiskyer/events{/privacy}","received_events_url":"https://api.github.com/users/feiskyer/received_events","type":"User","site_admin":false},"assignees":[{"login":"feiskyer","id":676637,"avatar_url":"https://avatars.githubusercontent.com/u/676637?v=3","gravatar_id":"","url":"https://api.github.com/users/feiskyer","html_url":"https://github.com/feiskyer","followers_url":"https://api.github.com/users/feiskyer/followers","following_url":"https://api.github.com/users/feiskyer/following{/other_user}","gists_url":"https://api.github.com/users/feiskyer/gists{/gist_id}","starred_url":"https://api.github.com/users/feiskyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/feiskyer/subscriptions","organizations_url":"https://api.github.com/users/feiskyer/orgs","repos_url":"https://api.github.com/users/feiskyer/repos","events_url":"https://api.github.com/users/feiskyer/events{/privacy}","received_events_url":"https://api.github.com/users/feiskyer/received_events","type":"User","site_admin":false},{"login":"yujuhong","id":10524058,"avatar_url":"https://avatars.githubusercontent.com/u/10524058?v=3","gravatar_id":"","url":"https://api.github.com/users/yujuhong","html_url":"https://github.com/yujuhong","followers_url":"https://api.github.com/users/yujuhong/followers","following_url":"https://api.github.com/users/yujuhong/following{/other_user}","gists_url":"https://api.github.com/users/yujuhong/gists{/gist_id}","starred_url":"https://api.github.com/users/yujuhong/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yujuhong/subscriptions","organizations_url":"https://api.github.com/users/yujuhong/orgs","repos_url":"https://api.github.com/users/yujuhong/repos","events_url":"https://api.github.com/users/yujuhong/events{/privacy}","received_events_url":"https://api.github.com/users/yujuhong/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/23","html_url":"https://github.com/kubernetes/kubernetes/milestones/v1.5","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/23/labels","id":1945978,"number":23,"title":"v1.5","description":"","creator":{"login":"lavalamp","id":647318,"avatar_url":"https://avatars.githubusercontent.com/u/647318?v=3","gravatar_id":"","url":"https://api.github.com/users/lavalamp","html_url":"https://github.com/lavalamp","followers_url":"https://api.github.com/users/lavalamp/followers","following_url":"https://api.github.com/users/lavalamp/following{/other_user}","gists_url":"https://api.github.com/users/lavalamp/gists{/gist_id}","starred_url":"https://api.github.com/users/lavalamp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lavalamp/subscriptions","organizations_url":"https://api.github.com/users/lavalamp/orgs","repos_url":"https://api.github.com/users/lavalamp/repos","events_url":"https://api.github.com/users/lavalamp/events{/privacy}","received_events_url":"https://api.github.com/users/lavalamp/received_events","type":"User","site_admin":false},"open_issues":208,"closed_issues":153,"state":"open","created_at":"2016-08-16T21:47:28Z","updated_at":"2016-10-13T21:53:27Z","due_on":"2016-12-09T00:00:00Z","closed_at":null},"comments":2,"created_at":"2016-08-25T19:53:28Z","updated_at":"2016-10-13T22:12:34Z","closed_at":null,"body":"Meta issue: #28789\r\n\r\nCreating this issue to track the progress of kuberuntime.\r\n\r\n- [ ] Support pod/container security context features (e.g., RunAsUser). \r\n\r\n\r\nRelevant PRs so far: #29884, #30121, #31322, #30267, #31320, #31395, #29811, #31326, #30753, #29811, #30212\r\nOther relevant issues: #30463\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/253654130","html_url":"https://github.com/kubernetes/kubernetes/issues/31458#issuecomment-253654130","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31458","id":253654130,"user":{"login":"yujuhong","id":10524058,"avatar_url":"https://avatars.githubusercontent.com/u/10524058?v=3","gravatar_id":"","url":"https://api.github.com/users/yujuhong","html_url":"https://github.com/yujuhong","followers_url":"https://api.github.com/users/yujuhong/followers","following_url":"https://api.github.com/users/yujuhong/following{/other_user}","gists_url":"https://api.github.com/users/yujuhong/gists{/gist_id}","starred_url":"https://api.github.com/users/yujuhong/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yujuhong/subscriptions","organizations_url":"https://api.github.com/users/yujuhong/orgs","repos_url":"https://api.github.com/users/yujuhong/repos","events_url":"https://api.github.com/users/yujuhong/events{/privacy}","received_events_url":"https://api.github.com/users/yujuhong/received_events","type":"User","site_admin":false},"created_at":"2016-10-13T22:12:34Z","updated_at":"2016-10-13T22:12:34Z","body":"I just discovered that we don't support various security context features. For example, `RunAsUser` is never examined and applied to the container configs in kuberuntime.\r\nI looked at the docker package and noticed that `DockerManager` calls methods in [`pkg/securitycontext`](https://github.com/kubernetes/kubernetes/blob/8fd414537b5143ab039cb910590237cabf4af783/pkg/securitycontext/types.go) directly to modify the docker configs. Obviously, this won't work for CRI. We'll need to change the package or implement similar functions in `kuberuntime`. The SecurityContext e2e tests are \"feature\" tests that don't run in regular e2e suites, and that's why we can't rely on e2e tests to catch the missing features.\r\n\r\n/cc @pmorie @timstclair @feiskyer @euank @yifan-gu @Random-Liu \r\n"}}
{"actor":{"display_login":"yujuhong"}}