{"action":"closed","issue":{"url":"https://api.github.com/repos/open-policy-agent/opa/issues/1130","repository_url":"https://api.github.com/repos/open-policy-agent/opa","labels_url":"https://api.github.com/repos/open-policy-agent/opa/issues/1130/labels{/name}","comments_url":"https://api.github.com/repos/open-policy-agent/opa/issues/1130/comments","events_url":"https://api.github.com/repos/open-policy-agent/opa/issues/1130/events","html_url":"https://github.com/open-policy-agent/opa/issues/1130","id":395111189,"node_id":"MDU6SXNzdWUzOTUxMTExODk=","number":1130,"title":"kubernetes subject access review","user":{"login":"kfox1111","id":1513154,"node_id":"MDQ6VXNlcjE1MTMxNTQ=","avatar_url":"https://avatars0.githubusercontent.com/u/1513154?v=4","gravatar_id":"","url":"https://api.github.com/users/kfox1111","html_url":"https://github.com/kfox1111","followers_url":"https://api.github.com/users/kfox1111/followers","following_url":"https://api.github.com/users/kfox1111/following{/other_user}","gists_url":"https://api.github.com/users/kfox1111/gists{/gist_id}","starred_url":"https://api.github.com/users/kfox1111/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kfox1111/subscriptions","organizations_url":"https://api.github.com/users/kfox1111/orgs","repos_url":"https://api.github.com/users/kfox1111/repos","events_url":"https://api.github.com/users/kfox1111/events{/privacy}","received_events_url":"https://api.github.com/users/kfox1111/received_events","type":"User","site_admin":false},"labels":[{"id":304682004,"node_id":"MDU6TGFiZWwzMDQ2ODIwMDQ=","url":"https://api.github.com/repos/open-policy-agent/opa/labels/question","name":"question","color":"cc317c","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2019-01-01T20:52:05Z","updated_at":"2019-01-03T17:24:27Z","closed_at":"2019-01-03T17:24:26Z","author_association":"NONE","body":"I have various users with different permissions granted via rbac. For example, cluster admins can do things regular users can't. I would like to write custom permissions that I bind to users. Currently only username and groups are available in the review. I don't have access to changing/updating the usernames/groups, In talking with the Kubernetes sig-auth team, they recommend doing a subject access review to check if a user has a permission to do something. So I need the ability to do subject access reviews from rego to enforce/disable particular checks. Can this currently be done somehow, or should we add the feature?"}}
{"actor":{"display_login":"tsandall"}}