{"action":"created","issue":{"url":"https://api.github.com/repos/Azure/aad-pod-identity/issues/115","repository_url":"https://api.github.com/repos/Azure/aad-pod-identity","labels_url":"https://api.github.com/repos/Azure/aad-pod-identity/issues/115/labels{/name}","comments_url":"https://api.github.com/repos/Azure/aad-pod-identity/issues/115/comments","events_url":"https://api.github.com/repos/Azure/aad-pod-identity/issues/115/events","html_url":"https://github.com/Azure/aad-pod-identity/issues/115","id":379887301,"node_id":"MDU6SXNzdWUzNzk4ODczMDE=","number":115,"title":"Proposed Behavior Change: Identity/Namespaces/Assignment","user":{"login":"khenidak","id":10683203,"node_id":"MDQ6VXNlcjEwNjgzMjAz","avatar_url":"https://avatars2.githubusercontent.com/u/10683203?v=4","gravatar_id":"","url":"https://api.github.com/users/khenidak","html_url":"https://github.com/khenidak","followers_url":"https://api.github.com/users/khenidak/followers","following_url":"https://api.github.com/users/khenidak/following{/other_user}","gists_url":"https://api.github.com/users/khenidak/gists{/gist_id}","starred_url":"https://api.github.com/users/khenidak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/khenidak/subscriptions","organizations_url":"https://api.github.com/users/khenidak/orgs","repos_url":"https://api.github.com/users/khenidak/repos","events_url":"https://api.github.com/users/khenidak/events{/privacy}","received_events_url":"https://api.github.com/users/khenidak/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-11-12T17:49:59Z","updated_at":"2018-11-12T18:10:44Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Ref: #106 #45 and other\r\n\r\nToday Identities hardcoded to default namespace. and pods are matched using selector irrespective of `pod.namespace`. The is causing the following:\r\n1. Users would like to compartmentalize application resources at the namespace level. This includes the identity.\r\n2. This model currently does not allow matching `identity.namespace == pod.namespace` \r\n\r\n**Proposed change**:\r\n\r\n1. Remove the hardcoded selector in https://github.com/Azure/aad-pod-identity/blob/master/pkg/crd/crd.go#L128 (along with any reference to default namespace in `listXXX` calls)\r\n2. Add annotation to `azureIdentity` to force matching to current namespace only. i.e `true = (pod.namespace == azureIdentity.namespace)` When the annotation is not found then we match in any namespace.\r\n\r\n\r\n@kkmsft @rite2nikhil @ritazh Thoughts?\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/Azure/aad-pod-identity/issues/comments/437977542","html_url":"https://github.com/Azure/aad-pod-identity/issues/115#issuecomment-437977542","issue_url":"https://api.github.com/repos/Azure/aad-pod-identity/issues/115","id":437977542,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNzk3NzU0Mg==","user":{"login":"rite2nikhil","id":19174673,"node_id":"MDQ6VXNlcjE5MTc0Njcz","avatar_url":"https://avatars1.githubusercontent.com/u/19174673?v=4","gravatar_id":"","url":"https://api.github.com/users/rite2nikhil","html_url":"https://github.com/rite2nikhil","followers_url":"https://api.github.com/users/rite2nikhil/followers","following_url":"https://api.github.com/users/rite2nikhil/following{/other_user}","gists_url":"https://api.github.com/users/rite2nikhil/gists{/gist_id}","starred_url":"https://api.github.com/users/rite2nikhil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rite2nikhil/subscriptions","organizations_url":"https://api.github.com/users/rite2nikhil/orgs","repos_url":"https://api.github.com/users/rite2nikhil/repos","events_url":"https://api.github.com/users/rite2nikhil/events{/privacy}","received_events_url":"https://api.github.com/users/rite2nikhil/received_events","type":"User","site_admin":false},"created_at":"2018-11-12T18:10:44Z","updated_at":"2018-11-12T18:10:44Z","author_association":"COLLABORATOR","body":"The default is to match on any namespace, we will be backward compatible /lgtm "}}
{"actor":{"display_login":"rite2nikhil"}}