{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/origin/pulls/comments/91010221","pull_request_review_id":11521388,"id":91010221,"diff_hunk":"@@ -476,3 +476,92 @@ type ClusterRoleList struct {\n \t// Items is a list of ClusterRoles\n \tItems []ClusterRole `json:\"items\" protobuf:\"bytes,2,rep,name=items\"`\n }\n+\n+// RoleBindingRestriction is an object that can be matched against a subject\n+// (user, group, or service account) to determine whether rolebindings on that\n+// subject are allowed in the namespace to which the RoleBindingRestriction\n+// belongs.  If any one of those RoleBindingRestriction objects matches\n+// a subject, rolebindings on that subject in the namespace are allowed.\n+type RoleBindingRestriction struct {\n+\tunversioned.TypeMeta `json:\",inline\"`\n+\n+\t// Standard object's metadata.\n+\tkapi.ObjectMeta `json:\"metadata\" protobuf:\"bytes,1,opt,name=metadata\"`\n+\n+\t// Spec defines the matcher.\n+\tSpec RoleBindingRestrictionSpec `json:\"spec\" protobuf:\"bytes,2,opt,name=spec\"`\n+}\n+\n+// RoleBindingRestrictionSpec defines a rolebinding restriction.  Exactly one\n+// field must be non-nil.\n+type RoleBindingRestrictionSpec struct {\n+\t// UserRestriction matches against user subjects.\n+\tUserRestriction *UserRestriction `json:\"userrestriction\" protobuf:\"bytes,1,opt,name=userrestriction\"`\n+\n+\t// GroupRestriction matches against group subjects.\n+\tGroupRestriction *GroupRestriction `json:\"grouprestriction\" protobuf:\"bytes,2,opt,name=grouprestriction\"`\n+\n+\t// ServiceAccountRestriction matches against service-account subjects.\n+\tServiceAccountRestriction *ServiceAccountRestriction `json:\"serviceaccountrestriction\" protobuf:\"bytes,3,opt,name=serviceaccountrestriction\"`\n+}\n+\n+// RoleBindingRestrictionList is a collection of RoleBindingRestriction objects.\n+type RoleBindingRestrictionList struct {\n+\tunversioned.TypeMeta `json:\",inline\"`\n+\n+\t// Standard object's metadata.\n+\tunversioned.ListMeta `json:\"metadata,omitempty\" protobuf:\"bytes,1,opt,name=metadata\"`\n+\n+\t// Items is a list of RoleBindingRestriction objects.\n+\tItems []RoleBindingRestriction `json:\"items\" protobuf:\"bytes,2,rep,name=items\"`\n+}\n+\n+// UserRestriction matches a user either by a string match on the user name,\n+// a string match on the name of a group to which the user belongs, or a label\n+// selector applied to the user labels.\n+type UserRestriction struct {\n+\t// Users specifies a list of literal user names.\n+\tUsers []string `json:\"users\" protobuf:\"bytes,1,rep,name=users\"`\n+\n+\t// Groups specifies a list of literal group names.\n+\tGroups []string `json:\"groups\" protobuf:\"bytes,2,rep,name=groups\"`\n+\n+\t// Selectors specifies a list of label selectors over user labels.\n+\tSelectors []*unversioned.LabelSelector `json:\"labels\" protobuf:\"bytes,3,rep,name=labels\"`\n+}\n+\n+// GroupRestriction matches a group either by a string match on the group name\n+// or a label selector applied to group labels.\n+type GroupRestriction struct {\n+\t// Groups is a list of groups used to match against an individual user's\n+\t// groups. If the user is a member of one of the whitelisted groups, the user\n+\t// is allowed to be bound to a role.\n+\tGroups []string `json:\"groups\" protobuf:\"bytes,1,rep,name=groups\"`\n+\n+\t// Selectors specifies a list of label selectors over group labels.\n+\tSelectors []*unversioned.LabelSelector `json:\"labels\" protobuf:\"bytes,2,rep,name=labels\"`\n+}\n+\n+// ServiceAccountRestriction matches a service account by a string match on\n+// either the service-account name or the name of the service account's\n+// namespace.\n+type ServiceAccountRestriction struct {\n+\t// ServiceAccounts specifies a list of literal service-account names.\n+\tServiceAccounts []*ServiceAccountReference `json:\"serviceaccounts\" protobuf:\"bytes,1,rep,name=serviceaccounts\"`","path":"pkg/authorization/api/v1/types.go","position":75,"original_position":75,"commit_id":"af9afd6d9155a6fe63499d2bdcc14f169ad0b94b","original_commit_id":"34b1c9f010fe7e89db0d406c78aa530ff5d020ef","user":{"login":"Miciah","id":2042465,"avatar_url":"https://avatars.githubusercontent.com/u/2042465?v=3","gravatar_id":"","url":"https://api.github.com/users/Miciah","html_url":"https://github.com/Miciah","followers_url":"https://api.github.com/users/Miciah/followers","following_url":"https://api.github.com/users/Miciah/following{/other_user}","gists_url":"https://api.github.com/users/Miciah/gists{/gist_id}","starred_url":"https://api.github.com/users/Miciah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Miciah/subscriptions","organizations_url":"https://api.github.com/users/Miciah/orgs","repos_url":"https://api.github.com/users/Miciah/repos","events_url":"https://api.github.com/users/Miciah/events{/privacy}","received_events_url":"https://api.github.com/users/Miciah/received_events","type":"User","site_admin":false},"body":"I'm not sure, but I was probably following the example of the `Selectors []*unversioned.LabelSelector` fields in `UserRestriction` and `GroupRestriction`, so I will change this if there is no good reason to use pointers for those fields.","created_at":"2016-12-06T04:28:24Z","updated_at":"2016-12-06T04:28:24Z","html_url":"https://github.com/openshift/origin/pull/11743#discussion_r91010221","pull_request_url":"https://api.github.com/repos/openshift/origin/pulls/11743","_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments/91010221"},"html":{"href":"https://github.com/openshift/origin/pull/11743#discussion_r91010221"},"pull_request":{"href":"https://api.github.com/repos/openshift/origin/pulls/11743"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/11743","id":92071596,"html_url":"https://github.com/openshift/origin/pull/11743","diff_url":"https://github.com/openshift/origin/pull/11743.diff","patch_url":"https://github.com/openshift/origin/pull/11743.patch","issue_url":"https://api.github.com/repos/openshift/origin/issues/11743","number":11743,"state":"open","locked":false,"title":"Introduce RestrictUsersAdmission plugin for collaboration","user":{"login":"Miciah","id":2042465,"avatar_url":"https://avatars.githubusercontent.com/u/2042465?v=3","gravatar_id":"","url":"https://api.github.com/users/Miciah","html_url":"https://github.com/Miciah","followers_url":"https://api.github.com/users/Miciah/followers","following_url":"https://api.github.com/users/Miciah/following{/other_user}","gists_url":"https://api.github.com/users/Miciah/gists{/gist_id}","starred_url":"https://api.github.com/users/Miciah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Miciah/subscriptions","organizations_url":"https://api.github.com/users/Miciah/orgs","repos_url":"https://api.github.com/users/Miciah/repos","events_url":"https://api.github.com/users/Miciah/events{/privacy}","received_events_url":"https://api.github.com/users/Miciah/received_events","type":"User","site_admin":false},"body":"Add the `RestrictUsersAdmission` admission plugin for collaboration.\r\n\r\n---\r\n\r\nopenshift-bot, please [test]!","created_at":"2016-11-02T22:58:49Z","updated_at":"2016-12-06T04:28:24Z","closed_at":null,"merged_at":null,"merge_commit_sha":"fdfbdf4f4e04031f9b5da2641e3134fb02d4fdab","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/openshift/origin/pulls/11743/commits","review_comments_url":"https://api.github.com/repos/openshift/origin/pulls/11743/comments","review_comment_url":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/origin/issues/11743/comments","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/af9afd6d9155a6fe63499d2bdcc14f169ad0b94b","head":{"label":"Miciah:RestrictUsersAdmission","ref":"RestrictUsersAdmission","sha":"af9afd6d9155a6fe63499d2bdcc14f169ad0b94b","user":{"login":"Miciah","id":2042465,"avatar_url":"https://avatars.githubusercontent.com/u/2042465?v=3","gravatar_id":"","url":"https://api.github.com/users/Miciah","html_url":"https://github.com/Miciah","followers_url":"https://api.github.com/users/Miciah/followers","following_url":"https://api.github.com/users/Miciah/following{/other_user}","gists_url":"https://api.github.com/users/Miciah/gists{/gist_id}","starred_url":"https://api.github.com/users/Miciah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Miciah/subscriptions","organizations_url":"https://api.github.com/users/Miciah/orgs","repos_url":"https://api.github.com/users/Miciah/repos","events_url":"https://api.github.com/users/Miciah/events{/privacy}","received_events_url":"https://api.github.com/users/Miciah/received_events","type":"User","site_admin":false},"repo":{"id":31791406,"name":"origin","full_name":"Miciah/origin","owner":{"login":"Miciah","id":2042465,"avatar_url":"https://avatars.githubusercontent.com/u/2042465?v=3","gravatar_id":"","url":"https://api.github.com/users/Miciah","html_url":"https://github.com/Miciah","followers_url":"https://api.github.com/users/Miciah/followers","following_url":"https://api.github.com/users/Miciah/following{/other_user}","gists_url":"https://api.github.com/users/Miciah/gists{/gist_id}","starred_url":"https://api.github.com/users/Miciah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Miciah/subscriptions","organizations_url":"https://api.github.com/users/Miciah/orgs","repos_url":"https://api.github.com/users/Miciah/repos","events_url":"https://api.github.com/users/Miciah/events{/privacy}","received_events_url":"https://api.github.com/users/Miciah/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/Miciah/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":true,"url":"https://api.github.com/repos/Miciah/origin","forks_url":"https://api.github.com/repos/Miciah/origin/forks","keys_url":"https://api.github.com/repos/Miciah/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Miciah/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Miciah/origin/teams","hooks_url":"https://api.github.com/repos/Miciah/origin/hooks","issue_events_url":"https://api.github.com/repos/Miciah/origin/issues/events{/number}","events_url":"https://api.github.com/repos/Miciah/origin/events","assignees_url":"https://api.github.com/repos/Miciah/origin/assignees{/user}","branches_url":"https://api.github.com/repos/Miciah/origin/branches{/branch}","tags_url":"https://api.github.com/repos/Miciah/origin/tags","blobs_url":"https://api.github.com/repos/Miciah/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Miciah/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Miciah/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/Miciah/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Miciah/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/Miciah/origin/languages","stargazers_url":"https://api.github.com/repos/Miciah/origin/stargazers","contributors_url":"https://api.github.com/repos/Miciah/origin/contributors","subscribers_url":"https://api.github.com/repos/Miciah/origin/subscribers","subscription_url":"https://api.github.com/repos/Miciah/origin/subscription","commits_url":"https://api.github.com/repos/Miciah/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/Miciah/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/Miciah/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/Miciah/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/Miciah/origin/contents/{+path}","compare_url":"https://api.github.com/repos/Miciah/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Miciah/origin/merges","archive_url":"https://api.github.com/repos/Miciah/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Miciah/origin/downloads","issues_url":"https://api.github.com/repos/Miciah/origin/issues{/number}","pulls_url":"https://api.github.com/repos/Miciah/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/Miciah/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/Miciah/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Miciah/origin/labels{/name}","releases_url":"https://api.github.com/repos/Miciah/origin/releases{/id}","deployments_url":"https://api.github.com/repos/Miciah/origin/deployments","created_at":"2015-03-06T22:14:05Z","updated_at":"2015-03-06T22:14:07Z","pushed_at":"2016-12-05T21:24:26Z","git_url":"git://github.com/Miciah/origin.git","ssh_url":"git@github.com:Miciah/origin.git","clone_url":"https://github.com/Miciah/origin.git","svn_url":"https://github.com/Miciah/origin","homepage":"http://www.openshift.org","size":369018,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"ec0d94cc87ff6bbba3ec8b8653f616971839f561","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":22442668,"name":"origin","full_name":"openshift/origin","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/origin","description":"Enterprise Kubernetes for Developers","fork":false,"url":"https://api.github.com/repos/openshift/origin","forks_url":"https://api.github.com/repos/openshift/origin/forks","keys_url":"https://api.github.com/repos/openshift/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/origin/teams","hooks_url":"https://api.github.com/repos/openshift/origin/hooks","issue_events_url":"https://api.github.com/repos/openshift/origin/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/origin/events","assignees_url":"https://api.github.com/repos/openshift/origin/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/origin/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/origin/tags","blobs_url":"https://api.github.com/repos/openshift/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/origin/languages","stargazers_url":"https://api.github.com/repos/openshift/origin/stargazers","contributors_url":"https://api.github.com/repos/openshift/origin/contributors","subscribers_url":"https://api.github.com/repos/openshift/origin/subscribers","subscription_url":"https://api.github.com/repos/openshift/origin/subscription","commits_url":"https://api.github.com/repos/openshift/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/origin/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/origin/merges","archive_url":"https://api.github.com/repos/openshift/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/origin/downloads","issues_url":"https://api.github.com/repos/openshift/origin/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/origin/labels{/name}","releases_url":"https://api.github.com/repos/openshift/origin/releases{/id}","deployments_url":"https://api.github.com/repos/openshift/origin/deployments","created_at":"2014-07-30T20:04:05Z","updated_at":"2016-12-05T18:14:37Z","pushed_at":"2016-12-06T03:15:45Z","git_url":"git://github.com/openshift/origin.git","ssh_url":"git@github.com:openshift/origin.git","clone_url":"https://github.com/openshift/origin.git","svn_url":"https://github.com/openshift/origin","homepage":"http://www.openshift.org","size":667545,"stargazers_count":2108,"watchers_count":2108,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1393,"mirror_url":null,"open_issues_count":1154,"forks":1393,"open_issues":1154,"watchers":2108,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/11743"},"html":{"href":"https://github.com/openshift/origin/pull/11743"},"issue":{"href":"https://api.github.com/repos/openshift/origin/issues/11743"},"comments":{"href":"https://api.github.com/repos/openshift/origin/issues/11743/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/origin/pulls/11743/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/origin/pulls/11743/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/origin/statuses/af9afd6d9155a6fe63499d2bdcc14f169ad0b94b"}}}}
{"actor":{"display_login":"Miciah"}}