Issue 1:
I created policy.jsonl

{"user":"alice", "namespace": "projectCaribou"}

And I tried to get pods by kubectl.

$ kubectl get po --username=alice --password=password --server=https://localhost:6443 --insecure-skip-tls-verify=true
error: couldn't read version from server: the server does not allow access to the requested resource

At first, kubectl seems to access https://localhost:6443/api/ and fail because the "alice" can only have access on https://localhost:6443/api/v1/namespaces/projectCaribou.

Issue 2:
what I have

kube cluster version:

./kube-apiserver --version
Kubernetes v1.0.0-1057-ged9975b0310eaf

auth_policy.json:

{"user":"admin"}
{"user":"monitoring", "readonly": true}
{"user":"scheduler", "readonly": true, "resource": "pods"}
{"user":"scheduler", "resource": "bindings"}
{"user":"kubelet", "readonly": true, "resource": "pods"}
{"user":"kubelet", "readonly": true, "resource": "services"}
{"user":"kubelet", "readonly": true, "resource": "endpoints"}
{"user":"kubelet", "resource": "events"}
{"user":"discover", "ns": "discover"}

kube-apiserver startup parameteres:

/usr/local/bin/kube-apiserver --address=0.0.0.0 --admission_control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota --service-cluster-ip-range=10.116.0.0/23 --client_ca_file=/srv/kubernetes/ca.crt --basic_auth_file=/srv/kubernetes/basic_auth.csv --authorization-mode=ABAC --authorization-policy-file=/srv/kubernetes/auth_policy.json --tls_cert_file=/srv/kubernetes/server.cert --tls_private_key_file=/srv/kubernetes/server.key --secure_port=6443 --token_auth_file=/srv/kubernetes/known_tokens.csv --v=2 --cors_allowed_origins=.* --etcd-config=/etc/kubernetes/etcd.config --allow_privileged=False

token authorization in known_tokens.csv

72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ,discover,discover

_kubeconfig for kubectl: cat .kube/config _

apiVersion: v1
clusters:
- cluster:
insecure-skip-tls-verify: true
server: "https://10.116.0.1"
name: local
contexts:
- context:
cluster: local
user: discover
namespace: discover
name: discover
current-context: discover
kind: Config
preferences: {}
users:
- name: discover
user:
token: 72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ

what I do

kubectl get namespaces
NAME LABELS STATUS
default <none> Active
infra <none> Active
kube-system <none> Active
objects <none> Active

~$ kubectl --namespace=infra get rc
CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS
docker-registry-v1 docker-registry registry:2.0.0 k8s-app=docker-registry,version=v1 1
zabbix-proxy-v1 zabbix-proxy otechlabs/zabbix_proxy k8s-app=zabbix-proxy,version=v1 1

~$ kubectl --namespace=infra get po
NAME READY STATUS RESTARTS AGE
docker-registry-v1-u7nvo 0/1 Pending 0 20m
zabbix-proxy-v1-xnsep 0/1 Pending 0 20m

~$ kubectl --namespace=infra delete po zabbix-proxy-v1-xnsep
pod "zabbix-proxy-v1-xnsep" deleted

~$ kubectl --namespace=infra get po
NAME READY STATUS RESTARTS AGE
docker-registry-v1-u7nvo 0/1 Pending 0 21m
zabbix-proxy-v1-pavzv 0/1 Pending 0 -30s

~$ kubectl --v=10 --namespace=infra get rc
I0731 21:14:46.401721 257 debugging.go:101] curl -k -v -XGET -H "User-Agent: kubectl/v1.0.0 (linux/amd64) kubernetes/ed9975b" -H "Authorization: Bearer 72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ" https://10.116.0.1/api
I0731 21:14:46.468688 257 debugging.go:120] GET https://10.116.0.1/api 200 OK in 66 milliseconds
I0731 21:14:46.468724 257 debugging.go:126] Response Headers:
I0731 21:14:46.468736 257 debugging.go:129] Content-Type: application/json
I0731 21:14:46.468748 257 debugging.go:129] Date: Fri, 31 Jul 2015 21:15:42 GMT
I0731 21:14:46.468759 257 debugging.go:129] Content-Length: 32
I0731 21:14:46.468792 257 request.go:748] Response Body: {
"versions": [
"v1"
]
}
I0731 21:14:46.469095 257 debugging.go:101] curl -k -v -XGET -H "User-Agent: kubectl/v1.0.0 (linux/amd64) kubernetes/ed9975b" -H "Authorization: Bearer 72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ" https://10.116.0.1/api/v1/namespaces/infra/replicationcontrollers
I0731 21:14:46.530797 257 debugging.go:120] GET https://10.116.0.1/api/v1/namespaces/infra/replicationcontrollers 200 OK in 61 milliseconds
I0731 21:14:46.530831 257 debugging.go:126] Response Headers:
I0731 21:14:46.530844 257 debugging.go:129] Content-Type: application/json
I0731 21:14:46.530856 257 debugging.go:129] Date: Fri, 31 Jul 2015 21:15:42 GMT
I0731 21:14:46.530912 257 request.go:748] Response Body: {"kind":"ReplicationControllerList","apiVersion":"v1","metadata":{"selfLink":"/api/v1/namespaces/infra/replicationcontrollers","resourceVersion":"10119186"},"items":[{"metadata":{"name":"docker-registry-v1","namespace":"infra","selfLink":"/api/v1/namespaces/infra/replicationcontrollers/docker-registry-v1","uid":"51b1c5f1-1fd3-11e5-a2d1-b083fec18c38","resourceVersion":"10109207","creationTimestamp":"2015-07-01T09:26:57Z","labels":{"k8s-app":"docker-registry-v1","sc01p-service":"true"}},"spec":{"replicas":1,"selector":{"k8s-app":"docker-registry","version":"v1"},"template":{"metadata":{"creationTimestamp":null,"labels":{"k8s-app":"docker-registry","sc01p-service":"true","version":"v1"}},"spec":{"volumes":[{"name":"docker-images-storage","hostPath":{"path":"/var/persistent_data/infra/docker-registry"}}],"containers":[{"name":"docker-registry","image":"registry:2.0.0","ports":[{"name":"docker-registry","containerPort":5000,"protocol":"TCP"}],"env":[{"name":"REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY","value":"/var/lib/registry"}],"resources":{},"volumeMounts":[{"name":"docker-images-storage","mountPath":"/var/lib/registry"}],"livenessProbe":{"tcpSocket":{"port":5000},"initialDelaySeconds":30,"timeoutSeconds":5},"terminationMessagePath":"/dev/termination-log","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","dnsPolicy":"Default","nodeSelector":{"zone":"common"}}}},"status":{"replicas":1}},{"metadata":{"name":"zabbix-proxy-v1","namespace":"infra","selfLink":"/api/v1/namespaces/infra/replicationcontrollers/zabbix-proxy-v1","uid":"0f383d9a-1fcb-11e5-a2d1-b083fec18c38","resourceVersion":"10116339","creationTimestamp":"2015-07-01T08:27:49Z","labels":{"k8s-app":"zabbix-proxy-v1","sc01p-service":"true"}},"spec":{"replicas":1,"selector":{"k8s-app":"zabbix-proxy","version":"v1"},"template":{"metadata":{"creationTimestamp":null,"labels":{"k8s-app":"zabbix-proxy","sc01p-service":"true","version":"v1"}},"spec":{"volumes":[{"name":"zabbix-proxy-config","secret":{"secretName":"zabbix-proxy-config"}}],"containers":[{"name":"zabbix-proxy","image":"otechlabs/zabbix_proxy","args":["/usr/local/bin/bg2fg","-c","/usr/sbin/zabbix_proxy -c /opt/zabbix/zabbix-proxy.conf","-p","/var/run/zabbix/zabbix_proxy.pid"],"ports":[{"name":"zabbix-proxy","containerPort":10051,"protocol":"TCP"}],"resources":{},"volumeMounts":[{"name":"zabbix-proxy-config","readOnly":true,"mountPath":"/opt/zabbix/"}],"livenessProbe":{"tcpSocket":{"port":10051},"initialDelaySeconds":30,"timeoutSeconds":5},"terminationMessagePath":"/dev/termination-log","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","dnsPolicy":"Default","nodeSelector":{"zone":"common"}}}},"status":{"replicas":1}}]}
CONTROLLER CONTAINER(S) IMAGE(S) SELECTOR REPLICAS
docker-registry-v1 docker-registry registry:2.0.0 k8s-app=docker-registry,version=v1 1
zabbix-proxy-v1 zabbix-proxy otechlabs/zabbix_proxy k8s-app=zabbix-proxy,version=v1 1

expected result

I expected to get forbidden error instead of deleting pod/rc or any other object, I would like to also forbid namespaces listing for the user. In current state it has no difference with AlwaysAllow mode.