{"action":"created","comment":{"url":"https://api.github.com/repos/ocf/puppet/pulls/comments/243155627","pull_request_review_id":186848012,"id":243155627,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDI0MzE1NTYyNw==","diff_hunk":"@@ -0,0 +1,45 @@\n+class ocf_kubernetes::worker::secrets {\n+  # The way we manage secrets in Kubernetes is that we put them in the Puppet\n+  # private share under \"docker\", which is made available to the Kubernetes\n+  # workers via a special file share, \"private-docker\".\n+  #\n+  # We then mount individual directories (e.g. for the RT service, we might\n+  # mount /opt/share/docker/secrets/rt into the container).\n+  #\n+  # Since inside the container, our processes typically run as \"nobody\" (or\n+  # another unprivileged user), these secrets need to be world-readable.\n+  # That's fine inside Docker, but outside Docker, we don't want random users\n+  # on the host to be able to access them. So we make one directory,\n+  # `/opt/share/docker`, which has strict permissions, and then put the secrets\n+  # in `/opt/share/docker/secrets` underneath it.\n+  #\n+  # The extra directory is theoretically unnecessary, but in practice Puppet\n+  # makes it hard to set \"0700\" on a directory, while recursively setting\n+  # 0644/0755 on children. Oh well.\n+  #\n+  # Only some Kubernetes workers have this class. Some (e.g. desktops) don't,\n+  # and so won't run jobs that require secrets.\n+  file {\n+    '/opt/share/docker':\n+      ensure => directory,\n+      mode   => '0700';\n+\n+    '/opt/share/docker/secrets':","path":"modules/ocf_kubernetes/manifests/worker/secrets.pp","position":27,"original_position":27,"commit_id":"32d987bfa94138a2a330a03cb92f44ecd788cc79","original_commit_id":"32d987bfa94138a2a330a03cb92f44ecd788cc79","user":{"login":"abizer","id":1916822,"node_id":"MDQ6VXNlcjE5MTY4MjI=","avatar_url":"https://avatars1.githubusercontent.com/u/1916822?v=4","gravatar_id":"","url":"https://api.github.com/users/abizer","html_url":"https://github.com/abizer","followers_url":"https://api.github.com/users/abizer/followers","following_url":"https://api.github.com/users/abizer/following{/other_user}","gists_url":"https://api.github.com/users/abizer/gists{/gist_id}","starred_url":"https://api.github.com/users/abizer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abizer/subscriptions","organizations_url":"https://api.github.com/users/abizer/orgs","repos_url":"https://api.github.com/users/abizer/repos","events_url":"https://api.github.com/users/abizer/events{/privacy}","received_events_url":"https://api.github.com/users/abizer/received_events","type":"User","site_admin":false},"body":"it would be nice if we could rename this directory to something more semantically meaningful, like `/opt/share/kubernetes/secrets/` or something like that.","created_at":"2018-12-20T04:50:26Z","updated_at":"2018-12-20T04:50:49Z","html_url":"https://github.com/ocf/puppet/pull/446#discussion_r243155627","pull_request_url":"https://api.github.com/repos/ocf/puppet/pulls/446","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/ocf/puppet/pulls/comments/243155627"},"html":{"href":"https://github.com/ocf/puppet/pull/446#discussion_r243155627"},"pull_request":{"href":"https://api.github.com/repos/ocf/puppet/pulls/446"}}},"pull_request":{"url":"https://api.github.com/repos/ocf/puppet/pulls/446","id":239690174,"node_id":"MDExOlB1bGxSZXF1ZXN0MjM5NjkwMTc0","html_url":"https://github.com/ocf/puppet/pull/446","diff_url":"https://github.com/ocf/puppet/pull/446.diff","patch_url":"https://github.com/ocf/puppet/pull/446.patch","issue_url":"https://api.github.com/repos/ocf/puppet/issues/446","number":446,"state":"open","locked":false,"title":"Mount secrets on kubernetes workers","user":{"login":"dkess","id":749522,"node_id":"MDQ6VXNlcjc0OTUyMg==","avatar_url":"https://avatars1.githubusercontent.com/u/749522?v=4","gravatar_id":"","url":"https://api.github.com/users/dkess","html_url":"https://github.com/dkess","followers_url":"https://api.github.com/users/dkess/followers","following_url":"https://api.github.com/users/dkess/following{/other_user}","gists_url":"https://api.github.com/users/dkess/gists{/gist_id}","starred_url":"https://api.github.com/users/dkess/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dkess/subscriptions","organizations_url":"https://api.github.com/users/dkess/orgs","repos_url":"https://api.github.com/users/dkess/repos","events_url":"https://api.github.com/users/dkess/events{/privacy}","received_events_url":"https://api.github.com/users/dkess/received_events","type":"User","site_admin":false},"body":"This basically copies the Marathon secrets file into Kubernetes.\r\n\r\nOne departure from how this is handled in Marathon: in Marathon, we labeled certain slaves as \"holding secrets\" because some we didn't want some slaves (desktops) to mount them. I'm not including that here, since I don't expect us to use the desktops as Kubernetes workers. If we do end up deciding to do that, we can make a separate PR for labeling workers.","created_at":"2018-12-19T02:06:35Z","updated_at":"2018-12-20T04:50:49Z","closed_at":null,"merged_at":null,"merge_commit_sha":"0d9d8c839c6073c0aaff76c4c4fe7749d76e9670","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/ocf/puppet/pulls/446/commits","review_comments_url":"https://api.github.com/repos/ocf/puppet/pulls/446/comments","review_comment_url":"https://api.github.com/repos/ocf/puppet/pulls/comments{/number}","comments_url":"https://api.github.com/repos/ocf/puppet/issues/446/comments","statuses_url":"https://api.github.com/repos/ocf/puppet/statuses/32d987bfa94138a2a330a03cb92f44ecd788cc79","head":{"label":"ocf:kubernetes","ref":"kubernetes","sha":"32d987bfa94138a2a330a03cb92f44ecd788cc79","user":{"login":"ocf","id":1504667,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE1MDQ2Njc=","avatar_url":"https://avatars2.githubusercontent.com/u/1504667?v=4","gravatar_id":"","url":"https://api.github.com/users/ocf","html_url":"https://github.com/ocf","followers_url":"https://api.github.com/users/ocf/followers","following_url":"https://api.github.com/users/ocf/following{/other_user}","gists_url":"https://api.github.com/users/ocf/gists{/gist_id}","starred_url":"https://api.github.com/users/ocf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ocf/subscriptions","organizations_url":"https://api.github.com/users/ocf/orgs","repos_url":"https://api.github.com/users/ocf/repos","events_url":"https://api.github.com/users/ocf/events{/privacy}","received_events_url":"https://api.github.com/users/ocf/received_events","type":"Organization","site_admin":false},"repo":{"id":7022222,"node_id":"MDEwOlJlcG9zaXRvcnk3MDIyMjIy","name":"puppet","full_name":"ocf/puppet","private":false,"owner":{"login":"ocf","id":1504667,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE1MDQ2Njc=","avatar_url":"https://avatars2.githubusercontent.com/u/1504667?v=4","gravatar_id":"","url":"https://api.github.com/users/ocf","html_url":"https://github.com/ocf","followers_url":"https://api.github.com/users/ocf/followers","following_url":"https://api.github.com/users/ocf/following{/other_user}","gists_url":"https://api.github.com/users/ocf/gists{/gist_id}","starred_url":"https://api.github.com/users/ocf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ocf/subscriptions","organizations_url":"https://api.github.com/users/ocf/orgs","repos_url":"https://api.github.com/users/ocf/repos","events_url":"https://api.github.com/users/ocf/events{/privacy}","received_events_url":"https://api.github.com/users/ocf/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/ocf/puppet","description":"Puppet config for OCF servers and lab machines","fork":false,"url":"https://api.github.com/repos/ocf/puppet","forks_url":"https://api.github.com/repos/ocf/puppet/forks","keys_url":"https://api.github.com/repos/ocf/puppet/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ocf/puppet/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ocf/puppet/teams","hooks_url":"https://api.github.com/repos/ocf/puppet/hooks","issue_events_url":"https://api.github.com/repos/ocf/puppet/issues/events{/number}","events_url":"https://api.github.com/repos/ocf/puppet/events","assignees_url":"https://api.github.com/repos/ocf/puppet/assignees{/user}","branches_url":"https://api.github.com/repos/ocf/puppet/branches{/branch}","tags_url":"https://api.github.com/repos/ocf/puppet/tags","blobs_url":"https://api.github.com/repos/ocf/puppet/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ocf/puppet/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ocf/puppet/git/refs{/sha}","trees_url":"https://api.github.com/repos/ocf/puppet/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ocf/puppet/statuses/{sha}","languages_url":"https://api.github.com/repos/ocf/puppet/languages","stargazers_url":"https://api.github.com/repos/ocf/puppet/stargazers","contributors_url":"https://api.github.com/repos/ocf/puppet/contributors","subscribers_url":"https://api.github.com/repos/ocf/puppet/subscribers","subscription_url":"https://api.github.com/repos/ocf/puppet/subscription","commits_url":"https://api.github.com/repos/ocf/puppet/commits{/sha}","git_commits_url":"https://api.github.com/repos/ocf/puppet/git/commits{/sha}","comments_url":"https://api.github.com/repos/ocf/puppet/comments{/number}","issue_comment_url":"https://api.github.com/repos/ocf/puppet/issues/comments{/number}","contents_url":"https://api.github.com/repos/ocf/puppet/contents/{+path}","compare_url":"https://api.github.com/repos/ocf/puppet/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ocf/puppet/merges","archive_url":"https://api.github.com/repos/ocf/puppet/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ocf/puppet/downloads","issues_url":"https://api.github.com/repos/ocf/puppet/issues{/number}","pulls_url":"https://api.github.com/repos/ocf/puppet/pulls{/number}","milestones_url":"https://api.github.com/repos/ocf/puppet/milestones{/number}","notifications_url":"https://api.github.com/repos/ocf/puppet/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ocf/puppet/labels{/name}","releases_url":"https://api.github.com/repos/ocf/puppet/releases{/id}","deployments_url":"https://api.github.com/repos/ocf/puppet/deployments","created_at":"2012-12-05T18:16:15Z","updated_at":"2018-12-18T05:20:37Z","pushed_at":"2018-12-19T21:32:34Z","git_url":"git://github.com/ocf/puppet.git","ssh_url":"git@github.com:ocf/puppet.git","clone_url":"https://github.com/ocf/puppet.git","svn_url":"https://github.com/ocf/puppet","homepage":"https://www.ocf.berkeley.edu/","size":5459,"stargazers_count":16,"watchers_count":16,"language":"Puppet","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":40,"mirror_url":null,"archived":false,"open_issues_count":26,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":40,"open_issues":26,"watchers":16,"default_branch":"master"}},"base":{"label":"ocf:master","ref":"master","sha":"7e2b1ca46473b68716fd46c1b7d97e4f44e92c3b","user":{"login":"ocf","id":1504667,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE1MDQ2Njc=","avatar_url":"https://avatars2.githubusercontent.com/u/1504667?v=4","gravatar_id":"","url":"https://api.github.com/users/ocf","html_url":"https://github.com/ocf","followers_url":"https://api.github.com/users/ocf/followers","following_url":"https://api.github.com/users/ocf/following{/other_user}","gists_url":"https://api.github.com/users/ocf/gists{/gist_id}","starred_url":"https://api.github.com/users/ocf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ocf/subscriptions","organizations_url":"https://api.github.com/users/ocf/orgs","repos_url":"https://api.github.com/users/ocf/repos","events_url":"https://api.github.com/users/ocf/events{/privacy}","received_events_url":"https://api.github.com/users/ocf/received_events","type":"Organization","site_admin":false},"repo":{"id":7022222,"node_id":"MDEwOlJlcG9zaXRvcnk3MDIyMjIy","name":"puppet","full_name":"ocf/puppet","private":false,"owner":{"login":"ocf","id":1504667,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE1MDQ2Njc=","avatar_url":"https://avatars2.githubusercontent.com/u/1504667?v=4","gravatar_id":"","url":"https://api.github.com/users/ocf","html_url":"https://github.com/ocf","followers_url":"https://api.github.com/users/ocf/followers","following_url":"https://api.github.com/users/ocf/following{/other_user}","gists_url":"https://api.github.com/users/ocf/gists{/gist_id}","starred_url":"https://api.github.com/users/ocf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ocf/subscriptions","organizations_url":"https://api.github.com/users/ocf/orgs","repos_url":"https://api.github.com/users/ocf/repos","events_url":"https://api.github.com/users/ocf/events{/privacy}","received_events_url":"https://api.github.com/users/ocf/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/ocf/puppet","description":"Puppet config for OCF servers and lab machines","fork":false,"url":"https://api.github.com/repos/ocf/puppet","forks_url":"https://api.github.com/repos/ocf/puppet/forks","keys_url":"https://api.github.com/repos/ocf/puppet/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ocf/puppet/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ocf/puppet/teams","hooks_url":"https://api.github.com/repos/ocf/puppet/hooks","issue_events_url":"https://api.github.com/repos/ocf/puppet/issues/events{/number}","events_url":"https://api.github.com/repos/ocf/puppet/events","assignees_url":"https://api.github.com/repos/ocf/puppet/assignees{/user}","branches_url":"https://api.github.com/repos/ocf/puppet/branches{/branch}","tags_url":"https://api.github.com/repos/ocf/puppet/tags","blobs_url":"https://api.github.com/repos/ocf/puppet/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ocf/puppet/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ocf/puppet/git/refs{/sha}","trees_url":"https://api.github.com/repos/ocf/puppet/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ocf/puppet/statuses/{sha}","languages_url":"https://api.github.com/repos/ocf/puppet/languages","stargazers_url":"https://api.github.com/repos/ocf/puppet/stargazers","contributors_url":"https://api.github.com/repos/ocf/puppet/contributors","subscribers_url":"https://api.github.com/repos/ocf/puppet/subscribers","subscription_url":"https://api.github.com/repos/ocf/puppet/subscription","commits_url":"https://api.github.com/repos/ocf/puppet/commits{/sha}","git_commits_url":"https://api.github.com/repos/ocf/puppet/git/commits{/sha}","comments_url":"https://api.github.com/repos/ocf/puppet/comments{/number}","issue_comment_url":"https://api.github.com/repos/ocf/puppet/issues/comments{/number}","contents_url":"https://api.github.com/repos/ocf/puppet/contents/{+path}","compare_url":"https://api.github.com/repos/ocf/puppet/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ocf/puppet/merges","archive_url":"https://api.github.com/repos/ocf/puppet/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ocf/puppet/downloads","issues_url":"https://api.github.com/repos/ocf/puppet/issues{/number}","pulls_url":"https://api.github.com/repos/ocf/puppet/pulls{/number}","milestones_url":"https://api.github.com/repos/ocf/puppet/milestones{/number}","notifications_url":"https://api.github.com/repos/ocf/puppet/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ocf/puppet/labels{/name}","releases_url":"https://api.github.com/repos/ocf/puppet/releases{/id}","deployments_url":"https://api.github.com/repos/ocf/puppet/deployments","created_at":"2012-12-05T18:16:15Z","updated_at":"2018-12-18T05:20:37Z","pushed_at":"2018-12-19T21:32:34Z","git_url":"git://github.com/ocf/puppet.git","ssh_url":"git@github.com:ocf/puppet.git","clone_url":"https://github.com/ocf/puppet.git","svn_url":"https://github.com/ocf/puppet","homepage":"https://www.ocf.berkeley.edu/","size":5459,"stargazers_count":16,"watchers_count":16,"language":"Puppet","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":40,"mirror_url":null,"archived":false,"open_issues_count":26,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":40,"open_issues":26,"watchers":16,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/ocf/puppet/pulls/446"},"html":{"href":"https://github.com/ocf/puppet/pull/446"},"issue":{"href":"https://api.github.com/repos/ocf/puppet/issues/446"},"comments":{"href":"https://api.github.com/repos/ocf/puppet/issues/446/comments"},"review_comments":{"href":"https://api.github.com/repos/ocf/puppet/pulls/446/comments"},"review_comment":{"href":"https://api.github.com/repos/ocf/puppet/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/ocf/puppet/pulls/446/commits"},"statuses":{"href":"https://api.github.com/repos/ocf/puppet/statuses/32d987bfa94138a2a330a03cb92f44ecd788cc79"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"abizer"}}