{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/170409045","pull_request_review_id":99099993,"id":170409045,"diff_hunk":"@@ -125,6 +130,12 @@ func (c *nodePlugin) Admit(a admission.Attributes) error {\n \t\t\treturn admission.NewForbidden(a, fmt.Errorf(\"may only update PVC status\"))\n \t\t}\n \n+\tcase svcacctResource:\n+\t\tif c.features.Enabled(features.TokenRequest) {\n+\t\t\treturn c.admitServiceAccount(nodeName, a)\n+\t\t}\n+\t\tfallthrough","path":"plugin/pkg/admission/noderestriction/admission.go","position":null,"original_position":47,"commit_id":"a879abcd0b475b3c1bd325f4e7ba770a73333e68","original_commit_id":"a496d51f836686c61a04aca24f01bc4a4e0d25f4","user":{"login":"mikedanese","id":1787169,"avatar_url":"https://avatars3.githubusercontent.com/u/1787169?v=4","gravatar_id":"","url":"https://api.github.com/users/mikedanese","html_url":"https://github.com/mikedanese","followers_url":"https://api.github.com/users/mikedanese/followers","following_url":"https://api.github.com/users/mikedanese/following{/other_user}","gists_url":"https://api.github.com/users/mikedanese/gists{/gist_id}","starred_url":"https://api.github.com/users/mikedanese/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikedanese/subscriptions","organizations_url":"https://api.github.com/users/mikedanese/orgs","repos_url":"https://api.github.com/users/mikedanese/repos","events_url":"https://api.github.com/users/mikedanese/events{/privacy}","received_events_url":"https://api.github.com/users/mikedanese/received_events","type":"User","site_admin":false},"body":"done.","created_at":"2018-02-24T03:10:47Z","updated_at":"2018-02-24T03:10:48Z","html_url":"https://github.com/kubernetes/kubernetes/pull/55019#discussion_r170409045","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/55019","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/170409045"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/55019#discussion_r170409045"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/55019"}},"in_reply_to_id":170407325},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/55019","id":150367120,"html_url":"https://github.com/kubernetes/kubernetes/pull/55019","diff_url":"https://github.com/kubernetes/kubernetes/pull/55019.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/55019.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/55019","number":55019,"state":"open","locked":false,"title":"auth: allow nodes to create tokens for svcaccts of pods","user":{"login":"mikedanese","id":1787169,"avatar_url":"https://avatars3.githubusercontent.com/u/1787169?v=4","gravatar_id":"","url":"https://api.github.com/users/mikedanese","html_url":"https://github.com/mikedanese","followers_url":"https://api.github.com/users/mikedanese/followers","following_url":"https://api.github.com/users/mikedanese/following{/other_user}","gists_url":"https://api.github.com/users/mikedanese/gists{/gist_id}","starred_url":"https://api.github.com/users/mikedanese/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikedanese/subscriptions","organizations_url":"https://api.github.com/users/mikedanese/orgs","repos_url":"https://api.github.com/users/mikedanese/repos","events_url":"https://api.github.com/users/mikedanese/events{/privacy}","received_events_url":"https://api.github.com/users/mikedanese/received_events","type":"User","site_admin":false},"body":"ref https://github.com/kubernetes/kubernetes/issues/58790\r\n\r\nrunning on them. nodes essentially have the power to do this today\r\nbut not explicitly. this allows agents using the node identity to\r\ntake actions on behalf of local pods.\r\n\r\n@kubernetes/sig-auth-pr-reviews @smarterclayton \r\n\r\n```release-note\r\nThe node authorizer now allows nodes to request service account tokens for the service accounts of pods running on them.\r\n```","created_at":"2017-11-02T18:16:15Z","updated_at":"2018-02-24T03:10:48Z","closed_at":null,"merged_at":null,"merge_commit_sha":"18745c62ff5ecece0ed3d4b3daee5b3fe8b417d8","assignee":{"login":"liggitt","id":980082,"avatar_url":"https://avatars0.githubusercontent.com/u/980082?v=4","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"assignees":[{"login":"liggitt","id":980082,"avatar_url":"https://avatars0.githubusercontent.com/u/980082?v=4","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},{"login":"ericchiang","id":2342749,"avatar_url":"https://avatars1.githubusercontent.com/u/2342749?v=4","gravatar_id":"","url":"https://api.github.com/users/ericchiang","html_url":"https://github.com/ericchiang","followers_url":"https://api.github.com/users/ericchiang/followers","following_url":"https://api.github.com/users/ericchiang/following{/other_user}","gists_url":"https://api.github.com/users/ericchiang/gists{/gist_id}","starred_url":"https://api.github.com/users/ericchiang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericchiang/subscriptions","organizations_url":"https://api.github.com/users/ericchiang/orgs","repos_url":"https://api.github.com/users/ericchiang/repos","events_url":"https://api.github.com/users/ericchiang/events{/privacy}","received_events_url":"https://api.github.com/users/ericchiang/received_events","type":"User","site_admin":false},{"login":"tallclair","id":29742491,"avatar_url":"https://avatars1.githubusercontent.com/u/29742491?v=4","gravatar_id":"","url":"https://api.github.com/users/tallclair","html_url":"https://github.com/tallclair","followers_url":"https://api.github.com/users/tallclair/followers","following_url":"https://api.github.com/users/tallclair/following{/other_user}","gists_url":"https://api.github.com/users/tallclair/gists{/gist_id}","starred_url":"https://api.github.com/users/tallclair/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tallclair/subscriptions","organizations_url":"https://api.github.com/users/tallclair/orgs","repos_url":"https://api.github.com/users/tallclair/repos","events_url":"https://api.github.com/users/tallclair/events{/privacy}","received_events_url":"https://api.github.com/users/tallclair/received_events","type":"User","site_admin":false}],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":477397086,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":200149833,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note","name":"release-note","color":"c2e0c6","default":false},{"id":357119284,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/auth","name":"sig/auth","color":"d2b48c","default":false},{"id":253450978,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/L","name":"size/L","color":"ee9900","default":false}],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/37","html_url":"https://github.com/kubernetes/kubernetes/milestone/37","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/37/labels","id":2659046,"number":37,"title":"v1.10","description":null,"creator":{"login":"mtaufen","id":903617,"avatar_url":"https://avatars1.githubusercontent.com/u/903617?v=4","gravatar_id":"","url":"https://api.github.com/users/mtaufen","html_url":"https://github.com/mtaufen","followers_url":"https://api.github.com/users/mtaufen/followers","following_url":"https://api.github.com/users/mtaufen/following{/other_user}","gists_url":"https://api.github.com/users/mtaufen/gists{/gist_id}","starred_url":"https://api.github.com/users/mtaufen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtaufen/subscriptions","organizations_url":"https://api.github.com/users/mtaufen/orgs","repos_url":"https://api.github.com/users/mtaufen/repos","events_url":"https://api.github.com/users/mtaufen/events{/privacy}","received_events_url":"https://api.github.com/users/mtaufen/received_events","type":"User","site_admin":false},"open_issues":86,"closed_issues":168,"state":"open","created_at":"2017-07-24T18:50:54Z","updated_at":"2018-02-24T02:59:28Z","due_on":null,"closed_at":null},"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/55019/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/55019/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/55019/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/a879abcd0b475b3c1bd325f4e7ba770a73333e68","head":{"label":"mikedanese:svcacct","ref":"svcacct","sha":"a879abcd0b475b3c1bd325f4e7ba770a73333e68","user":{"login":"mikedanese","id":1787169,"avatar_url":"https://avatars3.githubusercontent.com/u/1787169?v=4","gravatar_id":"","url":"https://api.github.com/users/mikedanese","html_url":"https://github.com/mikedanese","followers_url":"https://api.github.com/users/mikedanese/followers","following_url":"https://api.github.com/users/mikedanese/following{/other_user}","gists_url":"https://api.github.com/users/mikedanese/gists{/gist_id}","starred_url":"https://api.github.com/users/mikedanese/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikedanese/subscriptions","organizations_url":"https://api.github.com/users/mikedanese/orgs","repos_url":"https://api.github.com/users/mikedanese/repos","events_url":"https://api.github.com/users/mikedanese/events{/privacy}","received_events_url":"https://api.github.com/users/mikedanese/received_events","type":"User","site_admin":false},"repo":{"id":26203986,"name":"kubernetes","full_name":"mikedanese/kubernetes","owner":{"login":"mikedanese","id":1787169,"avatar_url":"https://avatars3.githubusercontent.com/u/1787169?v=4","gravatar_id":"","url":"https://api.github.com/users/mikedanese","html_url":"https://github.com/mikedanese","followers_url":"https://api.github.com/users/mikedanese/followers","following_url":"https://api.github.com/users/mikedanese/following{/other_user}","gists_url":"https://api.github.com/users/mikedanese/gists{/gist_id}","starred_url":"https://api.github.com/users/mikedanese/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikedanese/subscriptions","organizations_url":"https://api.github.com/users/mikedanese/orgs","repos_url":"https://api.github.com/users/mikedanese/repos","events_url":"https://api.github.com/users/mikedanese/events{/privacy}","received_events_url":"https://api.github.com/users/mikedanese/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mikedanese/kubernetes","description":"Container Cluster Manager","fork":true,"url":"https://api.github.com/repos/mikedanese/kubernetes","forks_url":"https://api.github.com/repos/mikedanese/kubernetes/forks","keys_url":"https://api.github.com/repos/mikedanese/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mikedanese/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mikedanese/kubernetes/teams","hooks_url":"https://api.github.com/repos/mikedanese/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/mikedanese/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/mikedanese/kubernetes/events","assignees_url":"https://api.github.com/repos/mikedanese/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/mikedanese/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/mikedanese/kubernetes/tags","blobs_url":"https://api.github.com/repos/mikedanese/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mikedanese/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mikedanese/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/mikedanese/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mikedanese/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/mikedanese/kubernetes/languages","stargazers_url":"https://api.github.com/repos/mikedanese/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/mikedanese/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/mikedanese/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/mikedanese/kubernetes/subscription","commits_url":"https://api.github.com/repos/mikedanese/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/mikedanese/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/mikedanese/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/mikedanese/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/mikedanese/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/mikedanese/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mikedanese/kubernetes/merges","archive_url":"https://api.github.com/repos/mikedanese/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mikedanese/kubernetes/downloads","issues_url":"https://api.github.com/repos/mikedanese/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/mikedanese/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/mikedanese/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/mikedanese/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mikedanese/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/mikedanese/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/mikedanese/kubernetes/deployments","created_at":"2014-11-05T05:02:25Z","updated_at":"2016-01-14T21:47:33Z","pushed_at":"2018-02-24T02:58:03Z","git_url":"git://github.com/mikedanese/kubernetes.git","ssh_url":"git@github.com:mikedanese/kubernetes.git","clone_url":"https://github.com/mikedanese/kubernetes.git","svn_url":"https://github.com/mikedanese/kubernetes","homepage":null,"size":532919,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"6a7656b69364337749133f97d7dcb78f63f36b60","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars2.githubusercontent.com/u/13629408?v=4","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars2.githubusercontent.com/u/13629408?v=4","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Production-Grade Container Scheduling and Management","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/kubernetes/deployments","created_at":"2014-06-06T22:56:04Z","updated_at":"2018-02-24T02:59:44Z","pushed_at":"2018-02-24T03:01:50Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":757612,"stargazers_count":32843,"watchers_count":32843,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":11578,"mirror_url":null,"archived":false,"open_issues_count":4494,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":11578,"open_issues":4494,"watchers":32843,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/55019"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/55019"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/55019"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/55019/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/55019/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/55019/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/a879abcd0b475b3c1bd325f4e7ba770a73333e68"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"mikedanese"}}