{"action":"created","issue":{"url":"https://api.github.com/repos/30x/project-management/issues/119","repository_url":"https://api.github.com/repos/30x/project-management","labels_url":"https://api.github.com/repos/30x/project-management/issues/119/labels{/name}","comments_url":"https://api.github.com/repos/30x/project-management/issues/119/comments","events_url":"https://api.github.com/repos/30x/project-management/issues/119/events","html_url":"https://github.com/30x/project-management/issues/119","id":167734443,"number":119,"title":"Namespace watcher for network isolation","user":{"login":"whitlockjc","id":98899,"avatar_url":"https://avatars.githubusercontent.com/u/98899?v=3","gravatar_id":"","url":"https://api.github.com/users/whitlockjc","html_url":"https://github.com/whitlockjc","followers_url":"https://api.github.com/users/whitlockjc/followers","following_url":"https://api.github.com/users/whitlockjc/following{/other_user}","gists_url":"https://api.github.com/users/whitlockjc/gists{/gist_id}","starred_url":"https://api.github.com/users/whitlockjc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whitlockjc/subscriptions","organizations_url":"https://api.github.com/users/whitlockjc/orgs","repos_url":"https://api.github.com/users/whitlockjc/repos","events_url":"https://api.github.com/users/whitlockjc/events{/privacy}","received_events_url":"https://api.github.com/users/whitlockjc/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/30x/project-management/labels/ready","name":"ready","color":"ededed"}],"state":"open","locked":false,"assignee":{"login":"noahdietz","id":6644735,"avatar_url":"https://avatars.githubusercontent.com/u/6644735?v=3","gravatar_id":"","url":"https://api.github.com/users/noahdietz","html_url":"https://github.com/noahdietz","followers_url":"https://api.github.com/users/noahdietz/followers","following_url":"https://api.github.com/users/noahdietz/following{/other_user}","gists_url":"https://api.github.com/users/noahdietz/gists{/gist_id}","starred_url":"https://api.github.com/users/noahdietz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/noahdietz/subscriptions","organizations_url":"https://api.github.com/users/noahdietz/orgs","repos_url":"https://api.github.com/users/noahdietz/repos","events_url":"https://api.github.com/users/noahdietz/events{/privacy}","received_events_url":"https://api.github.com/users/noahdietz/received_events","type":"User","site_admin":false},"assignees":[{"login":"noahdietz","id":6644735,"avatar_url":"https://avatars.githubusercontent.com/u/6644735?v=3","gravatar_id":"","url":"https://api.github.com/users/noahdietz","html_url":"https://github.com/noahdietz","followers_url":"https://api.github.com/users/noahdietz/followers","following_url":"https://api.github.com/users/noahdietz/following{/other_user}","gists_url":"https://api.github.com/users/noahdietz/gists{/gist_id}","starred_url":"https://api.github.com/users/noahdietz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/noahdietz/subscriptions","organizations_url":"https://api.github.com/users/noahdietz/orgs","repos_url":"https://api.github.com/users/noahdietz/repos","events_url":"https://api.github.com/users/noahdietz/events{/privacy}","received_events_url":"https://api.github.com/users/noahdietz/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/30x/project-management/milestones/2","html_url":"https://github.com/30x/project-management/milestones/beta","labels_url":"https://api.github.com/repos/30x/project-management/milestones/2/labels","id":1866118,"number":2,"title":"beta","description":"Issues related to the beta release.","creator":{"login":"whitlockjc","id":98899,"avatar_url":"https://avatars.githubusercontent.com/u/98899?v=3","gravatar_id":"","url":"https://api.github.com/users/whitlockjc","html_url":"https://github.com/whitlockjc","followers_url":"https://api.github.com/users/whitlockjc/followers","following_url":"https://api.github.com/users/whitlockjc/following{/other_user}","gists_url":"https://api.github.com/users/whitlockjc/gists{/gist_id}","starred_url":"https://api.github.com/users/whitlockjc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whitlockjc/subscriptions","organizations_url":"https://api.github.com/users/whitlockjc/orgs","repos_url":"https://api.github.com/users/whitlockjc/repos","events_url":"https://api.github.com/users/whitlockjc/events{/privacy}","received_events_url":"https://api.github.com/users/whitlockjc/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":6,"state":"open","created_at":"2016-07-05T21:20:01Z","updated_at":"2016-07-26T23:19:08Z","due_on":"2016-07-31T06:00:00Z","closed_at":null},"comments":1,"created_at":"2016-07-26T23:18:17Z","updated_at":"2016-07-26T23:20:52Z","closed_at":null,"body":"We need a namespace watcher for Kubernetes that will watch for namespace `Added` and `Modified` events and perform the following actions:\n\n1. Make sure the `name` label is set to the name of the namespace _(This is used during network isolation)_\n2. Make sure network isolation is enabled/configured _(when necessary)_ by setting the `net.beta.kubernetes.io/network-policy` annotation to be the following JSON document: `{\"ingress\": {\"isolation\": \"DefaultDeny\"}`\n3. For namespaces where network isolation is desired, make sure the proper `NetworkPolicy` objects are created:\n    1. Disallow Pod<->Pod communication for Pods outside this namespace\n    2. Allow Pod<->Pod communication for Pods within this namespace\n    3. Allow Pod<->Pod communication for Pods in the `apigee` namespace _(this should probably be a list of namespaces)_ to Pods in this namespace _(We could even make this so that only the necessary pods, like the `k8s-router` Pods, can do this)_"},"comment":{"url":"https://api.github.com/repos/30x/project-management/issues/comments/235435812","html_url":"https://github.com/30x/project-management/issues/119#issuecomment-235435812","issue_url":"https://api.github.com/repos/30x/project-management/issues/119","id":235435812,"user":{"login":"whitlockjc","id":98899,"avatar_url":"https://avatars.githubusercontent.com/u/98899?v=3","gravatar_id":"","url":"https://api.github.com/users/whitlockjc","html_url":"https://github.com/whitlockjc","followers_url":"https://api.github.com/users/whitlockjc/followers","following_url":"https://api.github.com/users/whitlockjc/following{/other_user}","gists_url":"https://api.github.com/users/whitlockjc/gists{/gist_id}","starred_url":"https://api.github.com/users/whitlockjc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whitlockjc/subscriptions","organizations_url":"https://api.github.com/users/whitlockjc/orgs","repos_url":"https://api.github.com/users/whitlockjc/repos","events_url":"https://api.github.com/users/whitlockjc/events{/privacy}","received_events_url":"https://api.github.com/users/whitlockjc/received_events","type":"User","site_admin":false},"created_at":"2016-07-26T23:20:52Z","updated_at":"2016-07-26T23:20:52Z","body":"In all seriousness, we should probably watch `NetworkPolicy` events as well to make sure that whenever a `NetworkPolicy` we _own_ is altered/deleted that we restore/recreate it."}}
{"actor":{"display_login":"whitlockjc"}}