{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/67257","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/67257/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/67257/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/67257/events","html_url":"https://github.com/kubernetes/kubernetes/pull/67257","id":349558080,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA3NjQ1Njg2","number":67257,"title":"dynamic audit configuration","user":{"login":"pbarker","id":5533189,"node_id":"MDQ6VXNlcjU1MzMxODk=","avatar_url":"https://avatars3.githubusercontent.com/u/5533189?v=4","gravatar_id":"","url":"https://api.github.com/users/pbarker","html_url":"https://github.com/pbarker","followers_url":"https://api.github.com/users/pbarker/followers","following_url":"https://api.github.com/users/pbarker/following{/other_user}","gists_url":"https://api.github.com/users/pbarker/gists{/gist_id}","starred_url":"https://api.github.com/users/pbarker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbarker/subscriptions","organizations_url":"https://api.github.com/users/pbarker/orgs","repos_url":"https://api.github.com/users/pbarker/repos","events_url":"https://api.github.com/users/pbarker/events{/privacy}","received_events_url":"https://api.github.com/users/pbarker/received_events","type":"User","site_admin":false},"labels":[{"id":136601536,"node_id":"MDU6TGFiZWwxMzY2MDE1MzY=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/apiserver","name":"area/apiserver","color":"0052cc","default":false},{"id":116719829,"node_id":"MDU6TGFiZWwxMTY3MTk4Mjk=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/kubelet","name":"area/kubelet","color":"0052cc","default":false},{"id":477397086,"node_id":"MDU6TGFiZWw0NzczOTcwODY=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":261005360,"node_id":"MDU6TGFiZWwyNjEwMDUzNjA=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/api-change","name":"kind/api-change","color":"e11d21","default":false},{"id":267761362,"node_id":"MDU6TGFiZWwyNjc3NjEzNjI=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/feature","name":"kind/feature","color":"c7def8","default":false},{"id":114528223,"node_id":"MDU6TGFiZWwxMTQ1MjgyMjM=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/priority/important-soon","name":"priority/important-soon","color":"eb6420","default":false},{"id":200149833,"node_id":"MDU6TGFiZWwyMDAxNDk4MzM=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note","name":"release-note","color":"c2e0c6","default":false},{"id":173493835,"node_id":"MDU6TGFiZWwxNzM0OTM4MzU=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/api-machinery","name":"sig/api-machinery","color":"d2b48c","default":false},{"id":636152047,"node_id":"MDU6TGFiZWw2MzYxNTIwNDc=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/architecture","name":"sig/architecture","color":"d2b48c","default":false},{"id":357119284,"node_id":"MDU6TGFiZWwzNTcxMTkyODQ=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/auth","name":"sig/auth","color":"d2b48c","default":false},{"id":450823910,"node_id":"MDU6TGFiZWw0NTA4MjM5MTA=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/cli","name":"sig/cli","color":"d2b48c","default":false},{"id":958178286,"node_id":"MDU6TGFiZWw5NTgxNzgyODY=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/cloud-provider","name":"sig/cloud-provider","color":"d2b48c","default":false},{"id":173493665,"node_id":"MDU6TGFiZWwxNzM0OTM2NjU=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/node","name":"sig/node","color":"d2b48c","default":false},{"id":125550211,"node_id":"MDU6TGFiZWwxMjU1NTAyMTE=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/scheduling","name":"sig/scheduling","color":"d2b48c","default":false},{"id":483069764,"node_id":"MDU6TGFiZWw0ODMwNjk3NjQ=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/testing","name":"sig/testing","color":"d2b48c","default":false},{"id":253451093,"node_id":"MDU6TGFiZWwyNTM0NTEwOTM=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/XXL","name":"size/XXL","color":"ee0000","default":false}],"state":"open","locked":false,"assignee":{"login":"tallclair","id":29742491,"node_id":"MDQ6VXNlcjI5NzQyNDkx","avatar_url":"https://avatars1.githubusercontent.com/u/29742491?v=4","gravatar_id":"","url":"https://api.github.com/users/tallclair","html_url":"https://github.com/tallclair","followers_url":"https://api.github.com/users/tallclair/followers","following_url":"https://api.github.com/users/tallclair/following{/other_user}","gists_url":"https://api.github.com/users/tallclair/gists{/gist_id}","starred_url":"https://api.github.com/users/tallclair/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tallclair/subscriptions","organizations_url":"https://api.github.com/users/tallclair/orgs","repos_url":"https://api.github.com/users/tallclair/repos","events_url":"https://api.github.com/users/tallclair/events{/privacy}","received_events_url":"https://api.github.com/users/tallclair/received_events","type":"User","site_admin":false},"assignees":[{"login":"tallclair","id":29742491,"node_id":"MDQ6VXNlcjI5NzQyNDkx","avatar_url":"https://avatars1.githubusercontent.com/u/29742491?v=4","gravatar_id":"","url":"https://api.github.com/users/tallclair","html_url":"https://github.com/tallclair","followers_url":"https://api.github.com/users/tallclair/followers","following_url":"https://api.github.com/users/tallclair/following{/other_user}","gists_url":"https://api.github.com/users/tallclair/gists{/gist_id}","starred_url":"https://api.github.com/users/tallclair/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tallclair/subscriptions","organizations_url":"https://api.github.com/users/tallclair/orgs","repos_url":"https://api.github.com/users/tallclair/repos","events_url":"https://api.github.com/users/tallclair/events{/privacy}","received_events_url":"https://api.github.com/users/tallclair/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/40","html_url":"https://github.com/kubernetes/kubernetes/milestone/40","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/40/labels","id":2913713,"node_id":"MDk6TWlsZXN0b25lMjkxMzcxMw==","number":40,"title":"v1.13","description":"","creator":{"login":"thockin","id":5595220,"node_id":"MDQ6VXNlcjU1OTUyMjA=","avatar_url":"https://avatars0.githubusercontent.com/u/5595220?v=4","gravatar_id":"","url":"https://api.github.com/users/thockin","html_url":"https://github.com/thockin","followers_url":"https://api.github.com/users/thockin/followers","following_url":"https://api.github.com/users/thockin/following{/other_user}","gists_url":"https://api.github.com/users/thockin/gists{/gist_id}","starred_url":"https://api.github.com/users/thockin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thockin/subscriptions","organizations_url":"https://api.github.com/users/thockin/orgs","repos_url":"https://api.github.com/users/thockin/repos","events_url":"https://api.github.com/users/thockin/events{/privacy}","received_events_url":"https://api.github.com/users/thockin/received_events","type":"User","site_admin":false},"open_issues":49,"closed_issues":23,"state":"open","created_at":"2017-11-15T06:32:59Z","updated_at":"2018-10-13T03:42:00Z","due_on":null,"closed_at":null},"comments":13,"created_at":"2018-08-10T15:23:34Z","updated_at":"2018-10-14T23:17:56Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/67257","html_url":"https://github.com/kubernetes/kubernetes/pull/67257","diff_url":"https://github.com/kubernetes/kubernetes/pull/67257.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/67257.patch"},"body":"**What this PR does / why we need it**:\r\nImplements [dynamic audit configuration](https://github.com/kubernetes/community/blob/master/keps/sig-auth/0014-dynamic-audit-configuration.md)\r\n\r\n**Which issue(s) this PR fixes** :\r\nFor https://github.com/kubernetes/features/issues/600\r\n\r\n**Special notes for your reviewer**:\r\n\r\nThe api changes have been separated into https://github.com/kubernetes/kubernetes/pull/67547 and that must be merged first.\r\n\r\nIn order to make the review process easier, the api changes have been separated into their own commit.\r\n\r\nIn general this code aims to stay out of the way of the current advanced auditing pipeline as it progresses to GA, in doing so there is some temporary code duplication.\r\n\r\nThe webhook portion of the code follows the current [admission package](https://github.com/kubernetes/kubernetes/tree/master/staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/config). That package could not be used directly, so it was largely replicated with some changes to make it generic and placed in `k8s.io/apiserver/pkg/util/webhook`. This provides a common mechanism for outgoing webhooks from the apiserver. This PR does not refactor the admission webhooks to use this nor does it imply they should, that will be left to the maintainers of that package.\r\n\r\nThis PR has performance implication when the feature is enabled. This was discussed in the [KEP](https://github.com/kubernetes/community/blob/master/keps/sig-auth/0014-dynamic-audit-configuration.md) and will be benchmarked and evaluated before moving to beta.\r\n\r\nNotable changes to current audit pipeline:\r\n* Currently, if an event is not logged there is not audit ID returned in the HTTP header. This is not possible with dynamic configuration, so an ID will always be returned\r\n* The [ApplyTo](https://github.com/kubernetes/kubernetes/pull/67257/files#diff-515f037b063ce70c486bf4316e2f0789R281) method for runtime configuration object now takes auth resolver and informer factory.\r\n\r\nDeviations from the [KEP](https://github.com/kubernetes/community/blob/master/keps/sig-auth/0014-dynamic-audit-configuration.md):\r\n* We had discussed making the policy enforcement inline to avoid deep nesting of the plugins, this was attempted but the result was messy. Went forward with the nested version\r\n\r\n**Release note**:\r\n```release-note\r\nAdd dynamic audit configuration\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/429671866","html_url":"https://github.com/kubernetes/kubernetes/pull/67257#issuecomment-429671866","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/67257","id":429671866,"node_id":"MDEyOklzc3VlQ29tbWVudDQyOTY3MTg2Ng==","user":{"login":"k8s-ci-robot","id":20407524,"node_id":"MDQ6VXNlcjIwNDA3NTI0","avatar_url":"https://avatars0.githubusercontent.com/u/20407524?v=4","gravatar_id":"","url":"https://api.github.com/users/k8s-ci-robot","html_url":"https://github.com/k8s-ci-robot","followers_url":"https://api.github.com/users/k8s-ci-robot/followers","following_url":"https://api.github.com/users/k8s-ci-robot/following{/other_user}","gists_url":"https://api.github.com/users/k8s-ci-robot/gists{/gist_id}","starred_url":"https://api.github.com/users/k8s-ci-robot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/k8s-ci-robot/subscriptions","organizations_url":"https://api.github.com/users/k8s-ci-robot/orgs","repos_url":"https://api.github.com/users/k8s-ci-robot/repos","events_url":"https://api.github.com/users/k8s-ci-robot/events{/privacy}","received_events_url":"https://api.github.com/users/k8s-ci-robot/received_events","type":"User","site_admin":false},"created_at":"2018-10-14T23:17:56Z","updated_at":"2018-10-14T23:17:56Z","author_association":"CONTRIBUTOR","body":"@pbarker: The following tests **failed**, say `/retest` to rerun them all:\n\nTest name | Commit | Details | Rerun command\n--- | --- | --- | ---\npull-kubernetes-local-e2e-containerized | b793c3b348d5def662c562324d2a34964abcb5a5 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/67257/pull-kubernetes-local-e2e-containerized/2388/) | `/test pull-kubernetes-local-e2e-containerized`\npull-kubernetes-cross | aa0ed8505b5ae370431f993f17af40e614a27225 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/67257/pull-kubernetes-cross/9093/) | `/test pull-kubernetes-cross`\npull-kubernetes-verify | aa0ed8505b5ae370431f993f17af40e614a27225 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/67257/pull-kubernetes-verify/109651/) | `/test pull-kubernetes-verify`\npull-kubernetes-bazel-test | b7bb6e03e4eef838940711acff5b61216cf87675 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/67257/pull-kubernetes-bazel-test/63482/) | `/test pull-kubernetes-bazel-test`\npull-kubernetes-integration | b7bb6e03e4eef838940711acff5b61216cf87675 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/67257/pull-kubernetes-integration/31024/) | `/test pull-kubernetes-integration`\n\n[Full PR test history](https://k8s-gubernator.appspot.com/pr/67257). [Your PR dashboard](https://k8s-gubernator.appspot.com/pr/pbarker). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes/kubernetes/issues?q=is:issue+is:open) when you hit one in your PR.\n\n<details>\n\nInstructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).\n</details>\n<!-- test report -->"}}
{"actor":{"display_login":"k8s-ci-robot"}}