{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/62216","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/62216/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/62216/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/62216/events","html_url":"https://github.com/kubernetes/kubernetes/pull/62216","id":312127563,"node_id":"MDExOlB1bGxSZXF1ZXN0MTgwMDYwMjEz","number":62216,"title":"NonRootGroup API Changes and Implementation","user":{"login":"krmayankk","id":16662068,"node_id":"MDQ6VXNlcjE2NjYyMDY4","avatar_url":"https://avatars0.githubusercontent.com/u/16662068?v=4","gravatar_id":"","url":"https://api.github.com/users/krmayankk","html_url":"https://github.com/krmayankk","followers_url":"https://api.github.com/users/krmayankk/followers","following_url":"https://api.github.com/users/krmayankk/following{/other_user}","gists_url":"https://api.github.com/users/krmayankk/gists{/gist_id}","starred_url":"https://api.github.com/users/krmayankk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/krmayankk/subscriptions","organizations_url":"https://api.github.com/users/krmayankk/orgs","repos_url":"https://api.github.com/users/krmayankk/repos","events_url":"https://api.github.com/users/krmayankk/events{/privacy}","received_events_url":"https://api.github.com/users/krmayankk/received_events","type":"User","site_admin":false},"labels":[{"id":477397086,"node_id":"MDU6TGFiZWw0NzczOTcwODY=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":261005360,"node_id":"MDU6TGFiZWwyNjEwMDUzNjA=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/api-change","name":"kind/api-change","color":"c7def8","default":false},{"id":200149833,"node_id":"MDU6TGFiZWwyMDAxNDk4MzM=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note","name":"release-note","color":"c2e0c6","default":false},{"id":357119284,"node_id":"MDU6TGFiZWwzNTcxMTkyODQ=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/auth","name":"sig/auth","color":"d2b48c","default":false},{"id":173493665,"node_id":"MDU6TGFiZWwxNzM0OTM2NjU=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/node","name":"sig/node","color":"d2b48c","default":false},{"id":253451093,"node_id":"MDU6TGFiZWwyNTM0NTEwOTM=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/XXL","name":"size/XXL","color":"ee0000","default":false}],"state":"open","locked":false,"assignee":{"login":"liggitt","id":980082,"node_id":"MDQ6VXNlcjk4MDA4Mg==","avatar_url":"https://avatars0.githubusercontent.com/u/980082?v=4","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"assignees":[{"login":"pmorie","id":366488,"node_id":"MDQ6VXNlcjM2NjQ4OA==","avatar_url":"https://avatars2.githubusercontent.com/u/366488?v=4","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},{"login":"liggitt","id":980082,"node_id":"MDQ6VXNlcjk4MDA4Mg==","avatar_url":"https://avatars0.githubusercontent.com/u/980082?v=4","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},{"login":"tallclair","id":29742491,"node_id":"MDQ6VXNlcjI5NzQyNDkx","avatar_url":"https://avatars1.githubusercontent.com/u/29742491?v=4","gravatar_id":"","url":"https://api.github.com/users/tallclair","html_url":"https://github.com/tallclair","followers_url":"https://api.github.com/users/tallclair/followers","following_url":"https://api.github.com/users/tallclair/following{/other_user}","gists_url":"https://api.github.com/users/tallclair/gists{/gist_id}","starred_url":"https://api.github.com/users/tallclair/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tallclair/subscriptions","organizations_url":"https://api.github.com/users/tallclair/orgs","repos_url":"https://api.github.com/users/tallclair/repos","events_url":"https://api.github.com/users/tallclair/events{/privacy}","received_events_url":"https://api.github.com/users/tallclair/received_events","type":"User","site_admin":false}],"milestone":null,"comments":33,"created_at":"2018-04-06T21:38:34Z","updated_at":"2018-08-01T21:41:45Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/62216","html_url":"https://github.com/kubernetes/kubernetes/pull/62216","diff_url":"https://github.com/kubernetes/kubernetes/pull/62216.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/62216.patch"},"body":"**What this PR does / why we need it**:\r\nImplements NonRootGroup in SecurityContext at Pod and Container level as proposed in  kubernetes/community#756. Continuing on the work started in https://github.com/kubernetes/kubernetes/pull/52077\r\n\r\nFixes # https://github.com/kubernetes/features/issues/213\r\n\r\n```release-note\r\n    Implement RunAsNonRootGroup at Pod and Container level in SecurityContext\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/409733618","html_url":"https://github.com/kubernetes/kubernetes/pull/62216#issuecomment-409733618","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/62216","id":409733618,"node_id":"MDEyOklzc3VlQ29tbWVudDQwOTczMzYxOA==","user":{"login":"krmayankk","id":16662068,"node_id":"MDQ6VXNlcjE2NjYyMDY4","avatar_url":"https://avatars0.githubusercontent.com/u/16662068?v=4","gravatar_id":"","url":"https://api.github.com/users/krmayankk","html_url":"https://github.com/krmayankk","followers_url":"https://api.github.com/users/krmayankk/followers","following_url":"https://api.github.com/users/krmayankk/following{/other_user}","gists_url":"https://api.github.com/users/krmayankk/gists{/gist_id}","starred_url":"https://api.github.com/users/krmayankk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/krmayankk/subscriptions","organizations_url":"https://api.github.com/users/krmayankk/orgs","repos_url":"https://api.github.com/users/krmayankk/repos","events_url":"https://api.github.com/users/krmayankk/events{/privacy}","received_events_url":"https://api.github.com/users/krmayankk/received_events","type":"User","site_admin":false},"created_at":"2018-08-01T21:41:45Z","updated_at":"2018-08-01T21:41:45Z","author_association":"CONTRIBUTOR","body":">>Yes and no. From a policy perspective, I agree with this. It would catch basically all cases of an uninformed user trying to do something dangerous by accident. \r\n\r\nThis is not just catching an uninformed user trying to do something by accident. Its also catching a malicious user which is sneaking root GID through the docker image by using the USER command. That is the part I feel is giving users better security. My understanding is that this check cannot be done at PSP level. @tallclair  @jessfraz  what do you both think ?  Are we ready to forego that just because we cannot determine /etc/groups gid ? \r\n\r\n>>Of course, no 1 feature will give you complete security, but it's important for it to make a concrete promise so that it can be composed with other security features.\r\n\r\nDoes that mean that every-time a new vulnerability comes out, or we implement a new security feature, if we cannot make a concrete promise we never release the fix for it ? Or is the better solution document what promises we make and what we cannot and let the user decide what he wants ?\r\n\r\n>> On the other hand, from the perspective of hardening against a determined attacker, I disagree. You end up with something that gives a false sense of security, which can be more dangerous than no security.\r\n \r\nHow is covering two out of three cases more dangerous than not covering any case ?\r\n\r\nPS: i agree with runAsNonRootGroup covering both primary and supplementary gid. I guess we will have t o bite the bullet and fix the documentation and  code for  PSP. i will open issues as we close this thread on that.\r\n\r\n\r\n"}}
{"actor":{"display_login":"krmayankk"}}