{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31529","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31529/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31529/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31529/events","html_url":"https://github.com/kubernetes/kubernetes/pull/31529","id":173483781,"number":31529,"title":"add GenericAPIServer posthooks for initialization","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note-label-needed","name":"release-note-label-needed","color":"db5a64"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/L","name":"size/L","color":"ee9900"}],"state":"open","locked":false,"assignee":{"login":"nikhiljindal","id":10199099,"avatar_url":"https://avatars.githubusercontent.com/u/10199099?v=3","gravatar_id":"","url":"https://api.github.com/users/nikhiljindal","html_url":"https://github.com/nikhiljindal","followers_url":"https://api.github.com/users/nikhiljindal/followers","following_url":"https://api.github.com/users/nikhiljindal/following{/other_user}","gists_url":"https://api.github.com/users/nikhiljindal/gists{/gist_id}","starred_url":"https://api.github.com/users/nikhiljindal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikhiljindal/subscriptions","organizations_url":"https://api.github.com/users/nikhiljindal/orgs","repos_url":"https://api.github.com/users/nikhiljindal/repos","events_url":"https://api.github.com/users/nikhiljindal/events{/privacy}","received_events_url":"https://api.github.com/users/nikhiljindal/received_events","type":"User","site_admin":false},"assignees":[{"login":"nikhiljindal","id":10199099,"avatar_url":"https://avatars.githubusercontent.com/u/10199099?v=3","gravatar_id":"","url":"https://api.github.com/users/nikhiljindal","html_url":"https://github.com/nikhiljindal","followers_url":"https://api.github.com/users/nikhiljindal/followers","following_url":"https://api.github.com/users/nikhiljindal/following{/other_user}","gists_url":"https://api.github.com/users/nikhiljindal/gists{/gist_id}","starred_url":"https://api.github.com/users/nikhiljindal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikhiljindal/subscriptions","organizations_url":"https://api.github.com/users/nikhiljindal/orgs","repos_url":"https://api.github.com/users/nikhiljindal/repos","events_url":"https://api.github.com/users/nikhiljindal/events{/privacy}","received_events_url":"https://api.github.com/users/nikhiljindal/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/23","html_url":"https://github.com/kubernetes/kubernetes/milestones/v1.5","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/23/labels","id":1945978,"number":23,"title":"v1.5","description":"","creator":{"login":"lavalamp","id":647318,"avatar_url":"https://avatars.githubusercontent.com/u/647318?v=3","gravatar_id":"","url":"https://api.github.com/users/lavalamp","html_url":"https://github.com/lavalamp","followers_url":"https://api.github.com/users/lavalamp/followers","following_url":"https://api.github.com/users/lavalamp/following{/other_user}","gists_url":"https://api.github.com/users/lavalamp/gists{/gist_id}","starred_url":"https://api.github.com/users/lavalamp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lavalamp/subscriptions","organizations_url":"https://api.github.com/users/lavalamp/orgs","repos_url":"https://api.github.com/users/lavalamp/repos","events_url":"https://api.github.com/users/lavalamp/events{/privacy}","received_events_url":"https://api.github.com/users/lavalamp/received_events","type":"User","site_admin":false},"open_issues":186,"closed_issues":44,"state":"open","created_at":"2016-08-16T21:47:28Z","updated_at":"2016-09-15T21:39:59Z","due_on":"2016-12-09T00:00:00Z","closed_at":null},"comments":21,"created_at":"2016-08-26T15:45:26Z","updated_at":"2016-09-15T21:58:15Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/31529","html_url":"https://github.com/kubernetes/kubernetes/pull/31529","diff_url":"https://github.com/kubernetes/kubernetes/pull/31529.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/31529.patch"},"body":"Adds the concept of a `PostStartHook` to the `GenericAPIServer` to allow post-server start hooks.  This gives a standard location to perform post-start bootstrapping tasks.  The common case usage we have downstream are security related bootstrapping tasks that are performed on the \"empty etcd\" initialization cases.  The RBAC authorizer is a good example of this in kube.  It needs a location to create default policies to start a server which is capable of being accessed.\r\n\r\nKube is also likely to hit this for things like PSP and breaking the monolithic controller user into separate, scoped service accounts.\r\n\r\n@kubernetes/sig-api-machinery for the `GenericAPIServer` bits\r\n@kubernetes/sig-auth for the particular clusterrole bootstrapping. I've only done one to start, but I suspect we'll start making more and probably introduce a binding so that the RBAC super-user doesn't remain a special case forever.\n\n<!-- Reviewable:start -->\n---\nThis change is [<img src=\"https://reviewable.kubernetes.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.kubernetes.io/reviews/kubernetes/kubernetes/31529)\n<!-- Reviewable:end -->\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/247467212","html_url":"https://github.com/kubernetes/kubernetes/pull/31529#issuecomment-247467212","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31529","id":247467212,"user":{"login":"lavalamp","id":647318,"avatar_url":"https://avatars.githubusercontent.com/u/647318?v=3","gravatar_id":"","url":"https://api.github.com/users/lavalamp","html_url":"https://github.com/lavalamp","followers_url":"https://api.github.com/users/lavalamp/followers","following_url":"https://api.github.com/users/lavalamp/following{/other_user}","gists_url":"https://api.github.com/users/lavalamp/gists{/gist_id}","starred_url":"https://api.github.com/users/lavalamp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lavalamp/subscriptions","organizations_url":"https://api.github.com/users/lavalamp/orgs","repos_url":"https://api.github.com/users/lavalamp/repos","events_url":"https://api.github.com/users/lavalamp/events{/privacy}","received_events_url":"https://api.github.com/users/lavalamp/received_events","type":"User","site_admin":false},"created_at":"2016-09-15T21:58:14Z","updated_at":"2016-09-15T21:58:14Z","body":"I guess I'm saying our controllers don't go through any load balancers.\nOrdinarily the service controller would set the endpoints to not ready, but\nthat's not happening here.\n\nOn Thu, Sep 15, 2016 at 2:08 PM, David Eads <notifications@github.com>\nwrote:\n\n> I was going to report unready until the post hooks completed. That would\n> let people who care (services/load balancers as a for instance) decide\n> whether to include it. It doesn't affect liveness. I think that covers the\n> majority of cases.\n>\n> I know about 429s, but I don't think I object.\n>\n> —\n> You are receiving this because you were mentioned.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/kubernetes/kubernetes/pull/31529#issuecomment-247456031>,\n> or mute the thread\n> <https://github.com/notifications/unsubscribe-auth/AAnglp8Xg-uCqVJQogpVrJziZCBHwxK5ks5qqbPIgaJpZM4JuNUJ>\n> .\n>\n"}}
{"actor":{"display_login":"lavalamp"}}