{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/79458491","id":79458491,"diff_hunk":"@@ -84,10 +93,44 @@ func (p RBACRESTStorageProvider) v1alpha1Storage(apiResourceConfigSource generic\n \tif apiResourceConfigSource.ResourceEnabled(version.WithResource(\"clusterroles\")) {\n \t\tclusterRolesStorage := clusterroleetcd.NewREST(restOptionsGetter(rbac.Resource(\"clusterroles\")))\n \t\tstorage[\"clusterroles\"] = clusterrolepolicybased.NewStorage(clusterRolesStorage, newRuleValidator(), p.AuthorizerRBACSuperUser)\n+\n+\t\tp.postStartHook = newPostStartHook(clusterRolesStorage)\n \t}\n \tif apiResourceConfigSource.ResourceEnabled(version.WithResource(\"clusterrolebindings\")) {\n \t\tclusterRoleBindingsStorage := clusterrolebindingetcd.NewREST(restOptionsGetter(rbac.Resource(\"clusterrolebindings\")))\n \t\tstorage[\"clusterrolebindings\"] = clusterrolebindingpolicybased.NewStorage(clusterRoleBindingsStorage, newRuleValidator(), p.AuthorizerRBACSuperUser)\n \t}\n \treturn storage\n }\n+\n+func (p *RBACRESTStorageProvider) PostStartHook() (string, genericapiserver.PostStartHookFunc, error) {\n+\treturn \"rbac/bootstrap-roles\", p.postStartHook, nil","path":"pkg/master/storage_rbac.go","position":59,"original_position":59,"commit_id":"ed61455601f51507eff88421d4950a898e2309b7","original_commit_id":"ed61455601f51507eff88421d4950a898e2309b7","user":{"login":"sttts","id":730123,"avatar_url":"https://avatars.githubusercontent.com/u/730123?v=3","gravatar_id":"","url":"https://api.github.com/users/sttts","html_url":"https://github.com/sttts","followers_url":"https://api.github.com/users/sttts/followers","following_url":"https://api.github.com/users/sttts/following{/other_user}","gists_url":"https://api.github.com/users/sttts/gists{/gist_id}","starred_url":"https://api.github.com/users/sttts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sttts/subscriptions","organizations_url":"https://api.github.com/users/sttts/orgs","repos_url":"https://api.github.com/users/sttts/repos","events_url":"https://api.github.com/users/sttts/events{/privacy}","received_events_url":"https://api.github.com/users/sttts/received_events","type":"User","site_admin":false},"body":"is it really necessary to store the hook func?","created_at":"2016-09-19T18:33:33Z","updated_at":"2016-09-19T18:33:33Z","html_url":"https://github.com/kubernetes/kubernetes/pull/31529#discussion_r79458491","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/31529","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/79458491"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/31529#discussion_r79458491"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/31529"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/31529","id":82910146,"html_url":"https://github.com/kubernetes/kubernetes/pull/31529","diff_url":"https://github.com/kubernetes/kubernetes/pull/31529.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/31529.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31529","number":31529,"state":"open","locked":false,"title":"add GenericAPIServer posthooks for initialization","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"body":"Adds the concept of a `PostStartHook` to the `GenericAPIServer` to allow post-server start hooks.  This gives a standard location to perform post-start bootstrapping tasks.  The common case usage we have downstream are security related bootstrapping tasks that are performed on the \"empty etcd\" initialization cases.  The RBAC authorizer is a good example of this in kube.  It needs a location to create default policies to start a server which is capable of being accessed.\r\n\r\nKube is also likely to hit this for things like PSP and breaking the monolithic controller user into separate, scoped service accounts.\r\n\r\n@kubernetes/sig-api-machinery for the `GenericAPIServer` bits\r\n@kubernetes/sig-auth for the particular clusterrole bootstrapping. I've only done one to start, but I suspect we'll start making more and probably introduce a binding so that the RBAC super-user doesn't remain a special case forever.\n\n<!-- Reviewable:start -->\n---\nThis change is [<img src=\"https://reviewable.kubernetes.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.kubernetes.io/reviews/kubernetes/kubernetes/31529)\n<!-- Reviewable:end -->\n","created_at":"2016-08-26T15:45:26Z","updated_at":"2016-09-19T18:33:33Z","closed_at":null,"merged_at":null,"merge_commit_sha":"1863f235a74a1d57c044f6900260dcc0e18e5d92","assignee":{"login":"nikhiljindal","id":10199099,"avatar_url":"https://avatars.githubusercontent.com/u/10199099?v=3","gravatar_id":"","url":"https://api.github.com/users/nikhiljindal","html_url":"https://github.com/nikhiljindal","followers_url":"https://api.github.com/users/nikhiljindal/followers","following_url":"https://api.github.com/users/nikhiljindal/following{/other_user}","gists_url":"https://api.github.com/users/nikhiljindal/gists{/gist_id}","starred_url":"https://api.github.com/users/nikhiljindal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikhiljindal/subscriptions","organizations_url":"https://api.github.com/users/nikhiljindal/orgs","repos_url":"https://api.github.com/users/nikhiljindal/repos","events_url":"https://api.github.com/users/nikhiljindal/events{/privacy}","received_events_url":"https://api.github.com/users/nikhiljindal/received_events","type":"User","site_admin":false},"assignees":[{"login":"nikhiljindal","id":10199099,"avatar_url":"https://avatars.githubusercontent.com/u/10199099?v=3","gravatar_id":"","url":"https://api.github.com/users/nikhiljindal","html_url":"https://github.com/nikhiljindal","followers_url":"https://api.github.com/users/nikhiljindal/followers","following_url":"https://api.github.com/users/nikhiljindal/following{/other_user}","gists_url":"https://api.github.com/users/nikhiljindal/gists{/gist_id}","starred_url":"https://api.github.com/users/nikhiljindal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikhiljindal/subscriptions","organizations_url":"https://api.github.com/users/nikhiljindal/orgs","repos_url":"https://api.github.com/users/nikhiljindal/repos","events_url":"https://api.github.com/users/nikhiljindal/events{/privacy}","received_events_url":"https://api.github.com/users/nikhiljindal/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/23","html_url":"https://github.com/kubernetes/kubernetes/milestones/v1.5","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/23/labels","id":1945978,"number":23,"title":"v1.5","description":"","creator":{"login":"lavalamp","id":647318,"avatar_url":"https://avatars.githubusercontent.com/u/647318?v=3","gravatar_id":"","url":"https://api.github.com/users/lavalamp","html_url":"https://github.com/lavalamp","followers_url":"https://api.github.com/users/lavalamp/followers","following_url":"https://api.github.com/users/lavalamp/following{/other_user}","gists_url":"https://api.github.com/users/lavalamp/gists{/gist_id}","starred_url":"https://api.github.com/users/lavalamp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lavalamp/subscriptions","organizations_url":"https://api.github.com/users/lavalamp/orgs","repos_url":"https://api.github.com/users/lavalamp/repos","events_url":"https://api.github.com/users/lavalamp/events{/privacy}","received_events_url":"https://api.github.com/users/lavalamp/received_events","type":"User","site_admin":false},"open_issues":202,"closed_issues":51,"state":"open","created_at":"2016-08-16T21:47:28Z","updated_at":"2016-09-19T15:11:08Z","due_on":"2016-12-09T00:00:00Z","closed_at":null},"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/31529/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/31529/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31529/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/ed61455601f51507eff88421d4950a898e2309b7","head":{"label":"deads2k:rbac-05-bootstrapping","ref":"rbac-05-bootstrapping","sha":"ed61455601f51507eff88421d4950a898e2309b7","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"repo":{"id":24939417,"name":"kubernetes","full_name":"deads2k/kubernetes","owner":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/deads2k/kubernetes","description":"Container Cluster Manager","fork":true,"url":"https://api.github.com/repos/deads2k/kubernetes","forks_url":"https://api.github.com/repos/deads2k/kubernetes/forks","keys_url":"https://api.github.com/repos/deads2k/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/deads2k/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/deads2k/kubernetes/teams","hooks_url":"https://api.github.com/repos/deads2k/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/deads2k/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/deads2k/kubernetes/events","assignees_url":"https://api.github.com/repos/deads2k/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/deads2k/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/deads2k/kubernetes/tags","blobs_url":"https://api.github.com/repos/deads2k/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/deads2k/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/deads2k/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/deads2k/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/deads2k/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/deads2k/kubernetes/languages","stargazers_url":"https://api.github.com/repos/deads2k/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/deads2k/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/deads2k/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/deads2k/kubernetes/subscription","commits_url":"https://api.github.com/repos/deads2k/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/deads2k/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/deads2k/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/deads2k/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/deads2k/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/deads2k/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/deads2k/kubernetes/merges","archive_url":"https://api.github.com/repos/deads2k/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/deads2k/kubernetes/downloads","issues_url":"https://api.github.com/repos/deads2k/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/deads2k/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/deads2k/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/deads2k/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/deads2k/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/deads2k/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/deads2k/kubernetes/deployments","created_at":"2014-10-08T12:24:01Z","updated_at":"2016-01-11T16:12:51Z","pushed_at":"2016-09-19T15:21:18Z","git_url":"git://github.com/deads2k/kubernetes.git","ssh_url":"git@github.com:deads2k/kubernetes.git","clone_url":"https://github.com/deads2k/kubernetes.git","svn_url":"https://github.com/deads2k/kubernetes","homepage":null,"size":314394,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"87b40782c9c1cc82ba42f75de4cf23126297e0a3","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Production-Grade Container Scheduling and Management","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/kubernetes/deployments","created_at":"2014-06-06T22:56:04Z","updated_at":"2016-09-19T17:33:18Z","pushed_at":"2016-09-19T18:32:12Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":565494,"stargazers_count":16916,"watchers_count":16916,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":5456,"mirror_url":null,"open_issues_count":4524,"forks":5456,"open_issues":4524,"watchers":16916,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/31529"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/31529"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/31529"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/31529/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/31529/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/31529/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/ed61455601f51507eff88421d4950a898e2309b7"}}}}
{"actor":{"display_login":"sttts"}}