{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/61788758","id":61788758,"diff_hunk":"@@ -0,0 +1,321 @@\n+<!-- BEGIN MUNGE: UNVERSIONED_WARNING -->\n+\n+<!-- BEGIN STRIP_FOR_RELEASE -->\n+\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+<img src=\"http://kubernetes.io/img/warning.png\" alt=\"WARNING\"\n+     width=\"25\" height=\"25\">\n+\n+<h2>PLEASE NOTE: This document applies to the HEAD of the source tree</h2>\n+\n+If you are using a released version of Kubernetes, you should\n+refer to the docs that go with that version.\n+\n+Documentation for other releases can be found at\n+[releases.k8s.io](http://releases.k8s.io).\n+</strong>\n+--\n+\n+<!-- END STRIP_FOR_RELEASE -->\n+\n+<!-- END MUNGE: UNVERSIONED_WARNING -->\n+\n+# NetworkPolicy\n+\n+## Abstract\n+\n+A proposal for implementing a new resource - NetworkPolicy - which\n+will enable definition of ingress policies for selections of pods.\n+\n+The design for this proposal has been created by, and discussed\n+extensively within the Kubernetes networking SIG.  It has been implemented\n+and tested using Kubernetes API extensions by various networking solutions already.\n+\n+In this design, users can create various NetworkPolicy objects which select groups of pods and\n+define how those pods should be allowed to communicate with each other.  The\n+implementation of that policy at the network layer is left up to the\n+chosen networking solution.\n+\n+> Note that this proposal does not yet include egress / cidr-based policy, which is still actively undergoing discussion in the SIG. These are expected to augment this proposal in a backwards compatible way.\n+\n+## Implementation\n+\n+The implmentation in Kubernetes consists of:\n+- A v1beta1 NetworkPolicy API object\n+- A structure on the `Namespace` object to control policy, to be developed as an annotation for now.\n+\n+### Namespace changes\n+\n+The following objects will be defined on a Namespace Spec.\n+>NOTE: In v1beta1 these objects will be implemented as an annotation.\n+\n+```go\n+type IngressIsolationPolicy string\n+\n+const (\n+\t// Deny all ingress traffic to pods in this namespace.\n+\tDefaultDeny IngressIsolationPolicy = \"DefaultDeny\"\n+) \n+\n+// Standard NamespaceSpec object, modified to include a new\n+// NamespaceNetworkPolicy field.\n+type NamespaceSpec struct {\n+\t// This is a pointer so that it can be left undefined.\n+\tNetworkPolicy *NamespaceNetworkPolicy `json:\"networkPolicy,omitempty\"`\n+}\n+\n+type NamespaceNetworkPolicy struct {\n+\t// Ingress configuration for this namespace.  This config is \n+\t// applied to all pods within this namespace. For now, only \n+\t// ingress is supported.  This field is optional - if not \n+\t// defined, then the cluster default for ingress is applied.\n+\tIngress *NamespaceIngressPolicy `json:\"ingress,omitempty\"`\n+}\n+\n+// Configuration for ingress to pods within this namespace.\n+// For now, this only supports specifying an isolation policy.\n+type NamespaceIngressPolicy struct {\n+\t// The isolation policy to apply to pods in this namespace.\n+\t// Currently this field only supports \"DefaultDeny\", but could \n+\t// be extended to support other policies in the future.  When set to DefaultDeny,\n+\t// pods in this namespace are denied ingress traffic.  When not defined,\n+\t// the cluster default ingress policy is applied (currently allow all). \n+\tIsolation *IngressIsolationPolicy `json:\"isolation,omitempty\"` \n+}\n+```\n+\n+```yaml\n+kind: Namespace\n+apiVersion: v1\n+spec:\n+  networkPolicy:\n+    ingress:\n+      isolation: DefaultDeny\n+```\n+\n+The above structures will be represented in v1beta1 as a json encoded annotation like so:\n+\n+```yaml\n+kind: Namespace\n+apiVersion: v1\n+metadata:\n+  annotations:\n+    net.beta.kubernetes.io/network-policy: \"{\\\"ingress\\\": {\\\"isolation\\\": \\\"DefaultDeny\\\"}\" \n+```\n+\n+### NetworkPolicy Go Definition\n+\n+Once a Namespace is isolated, a mechanism to selectively allow traffic into the namespace and between pods within\n+the namespace is required.  That is accomplished through ingress rules on `NetworkPolicy`\n+objects (of which there can be multiple in a single namespace).  Pods selected by\n+one or more NetworkPolicy objects should allow any incoming connections that match any\n+ingress rule on those NetworkPolicy objects, per the network plugin’s capabilities.\n+\n+If ingress `isolation` is not specified on a namespace, then all traffic is allowed to pods in that namespace.\n+\n+NetworkPolicy objects and the above namespace isolation both act on _connections_ rather than packets.  That is to say that if traffic from pod A to pod B is allowed by the configured\n+policy, then the return packets for that connection from B -> A are also allowed, even if policy is in place that would prevent \n+B from initiating a connection to A.  If new network policy is applied that would block an existing connection between two endpoints, the enforcer of policy \n+should terminate and block the existing connection as soon as can be expected by the implementation.\n+\n+We propose adding a new `/apis/networking` API group for the NetworkPolicy object.\n+\n+```go\n+type NetworkPolicy struct {\n+  TypeMeta\n+  ObjectMeta\n+\n+  // Specification of the desired behavior for this NetworkPolicy.\n+  Spec NetworkPolicySpec \n+}\n+\n+type NetworkPolicySpec struct {\n+  // Selects the pods to which this NetworkPolicy object applies.  The array of NetworkPolicyIngressRules below \n+  // is applied to any pods selected by this field. Multiple NetworkPolicy objects can select the \n+  // same set of pods.  In this case, the NetworkPolicyRules for each are combined additively.\n+  // This field is NOT optional and follows standard unversioned.LabelSelector semantics.  \n+  // An empty PodSelector matches all pods in this namespace.\n+  PodSelector unversioned.LabelSelector `json:\"podSelector\"`\n+\n+  // List of ingress rules to be applied to the selected pods.\n+  // Traffic is allowed to a pod if Namespace.NetworkPolicy.Ingress.Isolation is undefined, \n+  // OR if the traffic source is the pod's local kubelet (for health checks), \n+  // OR if Namespace.NetworkPolicy.Ingress.Isolation=DefaultDeny and the traffic matches at least \n+  // one NetworkPolicyIngressRule across all of the NetworkPolicy \n+  // objects whose podSelector matches the pod.  \n+  // If this field is nil, this NetworkPolicy allows all traffic.\n+  // If this field is non-nil but contains no rules, this NetworkPolicy allows no traffic.\n+  // If this field is non-nil and contains at least one rule, this NetworkPolicy allows any traffic\n+  // which matches at least one of the NetworkPolicyIngressRules in this list.\n+  Ingress []NetworkPolicyIngressRule `json:\"ingress,omitempty\"`\n+}\n+\n+// This NetworkPolicyIngressRule matches traffic if and only if the traffic matches both Ports AND From. \n+type NetworkPolicyIngressRule struct {\n+  // List of ports which should be made accessible on the pods selected by PodSelector.  \n+  // Each item in this list is combined using a logical OR.  \n+  // If this field is nil, this NetworkPolicyIngressRule matches all ports (traffic not restricted by Port). \n+  // If this field is non-nil but contains no items, this NetworkPolicyIngressRule matches no ports (no traffic matches).\n+  // If this field is non-nil and contains at least one item, then this NetworkPolicyIngressRule allows traffic \n+  // only if the traffic matches at least one NetworkPolicyPort in the Ports list. \n+  Ports []NetworkPolicyPort `json:\"ports,omitempty\"`\n+\n+  // List of sources which should be able to access the pods selected by PodSelector.\n+  // Items in this list are combined using a logical OR operation.\n+  // If this field nil, this NetworkPolicyIngressRule matches all sources (traffic not restricted by source).\n+  // If this field is non-nil but contains no items, this NetworkPolicyIngressRule matches no sources (no traffic matches). \n+  // If this field is non-nil and contains at least on item, this NetworkPolicyIngressRule allows traffic only if the \n+  // traffic matches at least one NetworkPolicyPeer in the From list. \n+  From []NetworkPolicyPeer `json:\"from,omitempty\"`\n+}\n+\n+type NetworkPolicyPort struct {\n+  // The protocol (TCP or UDP) which traffic must match.\n+  // If not defined, this field defaults to TCP. \n+  Protocol api.Protocol `json:\"protocol\"`\n+\n+  // If specified, the port on the given protocol.  This can \n+  // either be a numerical or named port.  If this field is nil,\n+  // this NetworkPolicyPort matches all port names and numbers.\n+  // If non-nil, only traffic on the specified protocol AND port\n+  // will be matched by this NetworkPolicyPort.\n+  Port *intstr.IntOrString `json:\"port,omitempty\"`\n+}\n+\n+type NetworkPolicyPeer struct {\n+  // If 'Namespaces' is defined, 'Pods' must not be.\n+  // This is a label selector which selects Pods in this namespace.\n+  // This NetworkPolicyPeer matches any pods selected by this selector.\n+  // This field follows standard unversioned.LabelSelector semantics.\n+  // If nil, this selector selects no pods.\n+  // If non-nil but empty, this selector selects all pods in this namespace.\n+  Pods *unversioned.LabelSelector `json:\"pods,omitempty\"`\n+\n+  // If 'Pods' is defined, 'Namespaces' must not be.\n+  // Selects Kubernetes Namespaces.  This NetworkPolicyPeer matches \n+  // all pods in all namespaces selected by this label selector. \n+  // This field follows standard unversioned.LabelSelector semantics.\n+  // If nil, this selector selects no namespaces.\n+  // If non-nil but empty, this selector selects all namespaces.\n+  Namespaces *unversioned.LabelSelector `json:\"namespaces,omitempty\"`\n+}\n+```\n+\n+### Behavior\n+\n+The following pseudo-code attempts to define when traffic is allowed to a given pod when using this API.\n+\n+```python\n+def is_traffic_allowed(traffic, pod):\n+  \"\"\"\n+  Returns True if traffic is allowed to this pod, False otherwise.\n+  \"\"\"\n+  if not namespace.networkPolicy.ingress.isolation:\n+    # If ingress isolation is disabled on the Namespace, all traffic is allowed.\n+    return True \n+  elif traffic.source == pod.node.kubelet:\n+    # Traffic is from kubelet health checks.\n+    return True\n+  else:\n+    # If namespace ingress isolation is enabled, only allow traffic \n+    # that matches a network policy which selects this pod.\n+    for network_policy in network_policies(pod.namespace):\n+      if not network_policy.podSelector.selects(pod):","path":"docs/proposals/network-policy.md","position":230,"original_position":230,"commit_id":"50ffec15971078f36d175a3eef88ef1f9c14dd2e","original_commit_id":"50ffec15971078f36d175a3eef88ef1f9c14dd2e","user":{"login":"MikeSpreitzer","id":14296719,"avatar_url":"https://avatars.githubusercontent.com/u/14296719?v=3","gravatar_id":"","url":"https://api.github.com/users/MikeSpreitzer","html_url":"https://github.com/MikeSpreitzer","followers_url":"https://api.github.com/users/MikeSpreitzer/followers","following_url":"https://api.github.com/users/MikeSpreitzer/following{/other_user}","gists_url":"https://api.github.com/users/MikeSpreitzer/gists{/gist_id}","starred_url":"https://api.github.com/users/MikeSpreitzer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MikeSpreitzer/subscriptions","organizations_url":"https://api.github.com/users/MikeSpreitzer/orgs","repos_url":"https://api.github.com/users/MikeSpreitzer/repos","events_url":"https://api.github.com/users/MikeSpreitzer/events{/privacy}","received_events_url":"https://api.github.com/users/MikeSpreitzer/received_events","type":"User","site_admin":false},"body":"Need to go through the `Spec` field, and adjust capitalization.","created_at":"2016-05-02T19:21:55Z","updated_at":"2016-05-02T19:21:55Z","html_url":"https://github.com/kubernetes/kubernetes/pull/24154#discussion_r61788758","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/61788758"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/24154#discussion_r61788758"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154","id":66218087,"html_url":"https://github.com/kubernetes/kubernetes/pull/24154","diff_url":"https://github.com/kubernetes/kubernetes/pull/24154.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/24154.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/24154","number":24154,"state":"open","locked":false,"title":"Network policy proposal","user":{"login":"caseydavenport","id":1944093,"avatar_url":"https://avatars.githubusercontent.com/u/1944093?v=3","gravatar_id":"","url":"https://api.github.com/users/caseydavenport","html_url":"https://github.com/caseydavenport","followers_url":"https://api.github.com/users/caseydavenport/followers","following_url":"https://api.github.com/users/caseydavenport/following{/other_user}","gists_url":"https://api.github.com/users/caseydavenport/gists{/gist_id}","starred_url":"https://api.github.com/users/caseydavenport/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caseydavenport/subscriptions","organizations_url":"https://api.github.com/users/caseydavenport/orgs","repos_url":"https://api.github.com/users/caseydavenport/repos","events_url":"https://api.github.com/users/caseydavenport/events{/privacy}","received_events_url":"https://api.github.com/users/caseydavenport/received_events","type":"User","site_admin":false},"body":"This proposal attempts to add a v1beta API for network policy to Kubernetes, as discussed and designed within the networking SIG.","created_at":"2016-04-12T19:58:45Z","updated_at":"2016-05-02T19:21:55Z","closed_at":null,"merged_at":null,"merge_commit_sha":"cea4ec8a2d1aca4795162eaf5871f3df0775fe1f","assignee":{"login":"thockin","id":5595220,"avatar_url":"https://avatars.githubusercontent.com/u/5595220?v=3","gravatar_id":"","url":"https://api.github.com/users/thockin","html_url":"https://github.com/thockin","followers_url":"https://api.github.com/users/thockin/followers","following_url":"https://api.github.com/users/thockin/following{/other_user}","gists_url":"https://api.github.com/users/thockin/gists{/gist_id}","starred_url":"https://api.github.com/users/thockin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thockin/subscriptions","organizations_url":"https://api.github.com/users/thockin/orgs","repos_url":"https://api.github.com/users/thockin/repos","events_url":"https://api.github.com/users/thockin/events{/privacy}","received_events_url":"https://api.github.com/users/thockin/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/24154/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/50ffec15971078f36d175a3eef88ef1f9c14dd2e","head":{"label":"caseydavenport:network-policy-proposal","ref":"network-policy-proposal","sha":"50ffec15971078f36d175a3eef88ef1f9c14dd2e","user":{"login":"caseydavenport","id":1944093,"avatar_url":"https://avatars.githubusercontent.com/u/1944093?v=3","gravatar_id":"","url":"https://api.github.com/users/caseydavenport","html_url":"https://github.com/caseydavenport","followers_url":"https://api.github.com/users/caseydavenport/followers","following_url":"https://api.github.com/users/caseydavenport/following{/other_user}","gists_url":"https://api.github.com/users/caseydavenport/gists{/gist_id}","starred_url":"https://api.github.com/users/caseydavenport/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caseydavenport/subscriptions","organizations_url":"https://api.github.com/users/caseydavenport/orgs","repos_url":"https://api.github.com/users/caseydavenport/repos","events_url":"https://api.github.com/users/caseydavenport/events{/privacy}","received_events_url":"https://api.github.com/users/caseydavenport/received_events","type":"User","site_admin":false},"repo":{"id":38320636,"name":"kubernetes","full_name":"caseydavenport/kubernetes","owner":{"login":"caseydavenport","id":1944093,"avatar_url":"https://avatars.githubusercontent.com/u/1944093?v=3","gravatar_id":"","url":"https://api.github.com/users/caseydavenport","html_url":"https://github.com/caseydavenport","followers_url":"https://api.github.com/users/caseydavenport/followers","following_url":"https://api.github.com/users/caseydavenport/following{/other_user}","gists_url":"https://api.github.com/users/caseydavenport/gists{/gist_id}","starred_url":"https://api.github.com/users/caseydavenport/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caseydavenport/subscriptions","organizations_url":"https://api.github.com/users/caseydavenport/orgs","repos_url":"https://api.github.com/users/caseydavenport/repos","events_url":"https://api.github.com/users/caseydavenport/events{/privacy}","received_events_url":"https://api.github.com/users/caseydavenport/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/caseydavenport/kubernetes","description":"Container Cluster Manager from Google","fork":true,"url":"https://api.github.com/repos/caseydavenport/kubernetes","forks_url":"https://api.github.com/repos/caseydavenport/kubernetes/forks","keys_url":"https://api.github.com/repos/caseydavenport/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/caseydavenport/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/caseydavenport/kubernetes/teams","hooks_url":"https://api.github.com/repos/caseydavenport/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/caseydavenport/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/caseydavenport/kubernetes/events","assignees_url":"https://api.github.com/repos/caseydavenport/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/caseydavenport/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/caseydavenport/kubernetes/tags","blobs_url":"https://api.github.com/repos/caseydavenport/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/caseydavenport/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/caseydavenport/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/caseydavenport/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/caseydavenport/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/caseydavenport/kubernetes/languages","stargazers_url":"https://api.github.com/repos/caseydavenport/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/caseydavenport/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/caseydavenport/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/caseydavenport/kubernetes/subscription","commits_url":"https://api.github.com/repos/caseydavenport/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/caseydavenport/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/caseydavenport/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/caseydavenport/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/caseydavenport/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/caseydavenport/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/caseydavenport/kubernetes/merges","archive_url":"https://api.github.com/repos/caseydavenport/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/caseydavenport/kubernetes/downloads","issues_url":"https://api.github.com/repos/caseydavenport/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/caseydavenport/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/caseydavenport/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/caseydavenport/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/caseydavenport/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/caseydavenport/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/caseydavenport/kubernetes/deployments","created_at":"2015-06-30T16:35:10Z","updated_at":"2016-01-12T22:34:55Z","pushed_at":"2016-05-02T16:44:13Z","git_url":"git://github.com/caseydavenport/kubernetes.git","ssh_url":"git@github.com:caseydavenport/kubernetes.git","clone_url":"https://github.com/caseydavenport/kubernetes.git","svn_url":"https://github.com/caseydavenport/kubernetes","homepage":"http://kubernetes.io","size":187846,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"f500194d92ab0f8d64836f0b38a6eeefc2c612ee","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Container Cluster Manager from Google","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/kubernetes/deployments","created_at":"2014-06-06T22:56:04Z","updated_at":"2016-05-02T18:20:08Z","pushed_at":"2016-05-02T19:10:17Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":389457,"stargazers_count":14173,"watchers_count":14173,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":4230,"mirror_url":null,"open_issues_count":3537,"forks":4230,"open_issues":3537,"watchers":14173,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/24154"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/24154"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/24154/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/24154/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/50ffec15971078f36d175a3eef88ef1f9c14dd2e"}}}}