{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22873","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22873/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22873/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22873/events","html_url":"https://github.com/kubernetes/kubernetes/issues/22873","id":140285654,"number":22873,"title":"Help with defining the right ABAC authorization policies","user":{"login":"huang195","id":8008677,"avatar_url":"https://avatars.githubusercontent.com/u/8008677?v=3","gravatar_id":"","url":"https://api.github.com/users/huang195","html_url":"https://github.com/huang195","followers_url":"https://api.github.com/users/huang195/followers","following_url":"https://api.github.com/users/huang195/following{/other_user}","gists_url":"https://api.github.com/users/huang195/gists{/gist_id}","starred_url":"https://api.github.com/users/huang195/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/huang195/subscriptions","organizations_url":"https://api.github.com/users/huang195/orgs","repos_url":"https://api.github.com/users/huang195/repos","events_url":"https://api.github.com/users/huang195/events{/privacy}","received_events_url":"https://api.github.com/users/huang195/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-03-11T20:36:53Z","updated_at":"2016-03-13T01:44:36Z","closed_at":null,"body":"I'm in the process of creating ABAC authorization policies for our Kubernetes cluster and ran into several issues:\r\n\r\n1. Is there a cookie cutter example of what a \"normal user\" and an \"admin user\"'s policy should look like?\r\n\r\n2. We expect our users to use `kubectl` to interact with our k8s cluster, is the following policy safe to use?\r\n\r\n```\r\n{\"apiVersion\": \"abac.authorization.kubernetes.io/v1beta1\", \"kind\": \"Policy\", \"spec\": {\"user\":\"*\",         \"nonResourcePath\": \"*\", \"readonly\": true}}\r\n```\r\n\r\n3. If I add a new user to the cluster with the corresponding changes to the ABAC authorization policy file, do I always need to restart API server? If so, is there a better way to handle this as we don't want to always having to restart things.\r\n\r\nThanks!"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/195848890","html_url":"https://github.com/kubernetes/kubernetes/issues/22873#issuecomment-195848890","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22873","id":195848890,"user":{"login":"huang195","id":8008677,"avatar_url":"https://avatars.githubusercontent.com/u/8008677?v=3","gravatar_id":"","url":"https://api.github.com/users/huang195","html_url":"https://github.com/huang195","followers_url":"https://api.github.com/users/huang195/followers","following_url":"https://api.github.com/users/huang195/following{/other_user}","gists_url":"https://api.github.com/users/huang195/gists{/gist_id}","starred_url":"https://api.github.com/users/huang195/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/huang195/subscriptions","organizations_url":"https://api.github.com/users/huang195/orgs","repos_url":"https://api.github.com/users/huang195/repos","events_url":"https://api.github.com/users/huang195/events{/privacy}","received_events_url":"https://api.github.com/users/huang195/received_events","type":"User","site_admin":false},"created_at":"2016-03-13T01:44:36Z","updated_at":"2016-03-13T01:44:36Z","body":"@mkulke thanks for those pointers. I will take a look and see it's actually implemented to give me more confidence that I'm creating an authorization policy without holes."}}