Proposal for capabilities

That design is the bare minimum design for right now.  The future design is documented more in the pull request that landed it, including verbs, attributes on verbs, and potentially allow/deny.  

----- Original Message -----
> > +
> > +1. Features that are turned on/off for the whole openshift deployment
> > +2. Global resource constraints, ex: setting a minimum allocatable size per
> > container for a given system resource (mem / cpu / disk)
> > +
> > +## Project (namespace) level capabilities
> > +Capabilities for the project will consist of two main types:
> > +
> > +1. Features that are turned on/off for the project
> > +2. Resource constraints
> > +
> > +Resource constraints for the project will be stored on the
> > “ResourceController” associated with the namespace.  The
> > ResourceController is the same object used by the admission control
> > system, both to check allowed usage and to store actual usage.
> > +
> > +## Account level capabilities
> > +Account is a separate entity from user, many users might be associated
> > with a single account, and users will have a role on the account.
> > +
> > +Once we have accounts, they will have a ResourceController associated with
> > them.
> 
> So in this design:
> https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/authorization.md,
> the request attributes section you have: username, isReadOnly, Kind (api
> object or empty), and namespace.
> 
> ---
> Reply to this email directly or view it on GitHub:
> https://github.com/openshift/origin/pull/569/files#r22049034