GitHub PullRequestReviewCommentEvent at 2014-09-02 17:39:24
Repository: kubernetes
Actor: derekwaynecarr
Payload: {"action":"created","comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/comments/17002379","id":17002379,"diff_hunk":"@@ -0,0 +1,273 @@\n+# K8s Identity and Access Management Sketch\n+\n+This document suggests a direction for identity and access management in the Kubernetes system. \n+\n+\n+## Background\n+\n+High level goals are:\n+   - Have a plan for how identity, authentication, and authorization will fit in to the API.\n+   - Have a plan for partitioning resources within a cluster between independent organizational units.\n+   - Ease integration with existing enterprise and hosted scenarios.\n+\n+### Actors\n+Each of these can act as normal users or attackers.\n+   - External Users: People who are accessing applications running on K8s (e.g. a web site served by webserver running in a container on K8s), but who do not have K8s API access.\n+   - K8s Users : People who access the K8s API (e.g. create K8s API objects like Pods)\n+   - K8s Project Admins: People who manage access for some K8s Users\n+   - K8s Cluster Admins: People who control the machines, networks, or binaries that comprise a K8s cluster.\n+   - K8s Admin means K8s Cluster Admins and K8s Project Admins taken together.\n+\n+### Threats\n+Both intentional attacks and accidental use of privilege are concerns.\n+\n+For both cases it may be useful to think about these categories differently:\n+  - Application Path - attack by sending network messages from the internet to the IP/port of any application running on K8s.  May exploit weakness in application or misconfiguration of K8s.\n+  - K8s API Path - attack by sending network messages to any K8s API endpoint.\n+  - Insider Path - attack on K8s system components.  Attacker may have privileged access to networks, machines or K8s software and data.  Software errors in K8s system components and administrator error are some types of threat in this category.\n+\n+This document is primarily concerned with K8s API paths, and secondarily with Internal paths.   The Application path also needs to be secure, but is not the focus of this document.\n+ \n+### Assets to protect\n+\n+External User assets:\n+   - Personal information like private messages, or images uploaded by External Users\n+   - web server logs\n+\n+K8s User assets:\n+  - External User assets of each K8s User\n+  - things private to the K8s app, like:\n+    - credentials for accessing other services (docker private repos, storage services, facebook, etc)\n+    - SSL certificates for web servers\n+    - proprietary data and code\n+\n+K8s Cluster assets:\n+  - Assets of each K8s User\n+  - Machine Certificates or secrets.\n+  - The value of K8s cluster computing resources (cpu, memory, etc).\n+\n+This document is primarily about protecting K8s User assets and K8s cluster assets from other K8s Users and K8s Project and Cluster Admins.\n+ \n+### Usage environments\n+Cluster in Small organization:  \n+   - K8s Admins may be the same people as K8s Users.  \n+   - few K8s Admins.  \n+    - prefer ease of use to fine-grained access control/precise accounting, etc.\n+ - Product requirement that it be easy for potential K8s Cluster Admin to try out setting up a simple cluster.\n+\n+Cluster in Large organization: \n+   - K8s Admins typically distinct people from K8s Users.  May need to divide K8s Cluster Admin access by roles. \n+   - K8s Users need to be protected from each other.  \n+   - Auditing of K8s User and K8s Admin actions important.   \n+   - flexible accurate usage accounting and resource controls important.\n+   - Lots of automated access to APIs.  \n+   - Need to integrate with existing enterprise directory, authentication, accounting, auditing, and security policy infrastructure.\n+\n+Org-run cluster: \n+   - organization that runs K8s master components is same as the org that runs apps on K8s.  \n+   - Minions may be on-premises VMs or physical machines; Cloud VMs; or a mix.\n+ \n+Hosted cluster:\n+  - Offering K8s API as a service, or offering a Paas or Saas built on K8s\n+  - May already offer web services, and need to integrate with existing customer account concept, and existing authentication, accounting, auditing, and security policy infrastructure.\n+  - May want to leverage K8s User accounts and accounting to manage their User accounts (not a priority to support this use case.)\n+  - Precise and accurate accounting of resources needed.  Resource controls needed for hard limits (Users given limited slice of data) and soft limits (Users can grow up to some limit and then be expanded).\n+\n+K8s ecosystem services:\n+ - There may be companies that want to offer their existing services (Build, CI, A/B-test, release automation, etc) for use with K8s.  There should be some story for this case.\n+\n+Pods configs should be largely portable between Org-run and hosted configurations.  \n+\n+\n+# Design \n+Related discussion:\n+- https://github.com/GoogleCloudPlatform/kubernetes/issues/442\n+- https://github.com/GoogleCloudPlatform/kubernetes/issues/443\n+\n+This doc describes two security profiles:\n+  - Simple profile:  like single-user mode.  Make it easy to evaluate K8s without lots of configuring accounts and policies.  Protects from unauthorized users, but does not partition authorized users.\n+  - Enterprise profile: Provide mechanisms needed for large numbers of users.  Defence in depth.  Should integrate with existing enterprise security infrastructure.\n+ \n+K8s distribution should include templates of config, and documentation, for simple and enterprise profiles.  System should be flexible enough for knowledgeable users to create intermediate profiles, but K8s developers should only reason about those two Profiles, not a matrix.\n+\n+Features in this doc are divided into \"Initial Feature\", and \"Improvements\".   Initial features would be candidates for version 1.00.\n+\n+## Identity\n+###userAccount\n+K8s will have a `userAccount` API object.\n+- `userAccount` has a UID which is immutable.  This is used to associate users with objects and to record actions in audit logs.\n+- `userAccount` has a name which is a string and human readable and unique among userAccounts.  It is used to refer to users in Policies, to ensure that the Policies are human readable.  It can be changed only when there are no Policy objects or other objects which refer to that name.  An email address is a suggested format for this field.\n+- `userAccount` is not related to the unix username of processes in Pods created by that userAccount.\n+- `userAccount` API objects can have labels\n+\n+The system may associate one or more Authentication Methods with a\n+`userAccount` (but they are not formally part of the userAccount object.)\n+In a simple deployment, the authentication method for a\n+user might be an authentication token which is verified by a K8s server.  In a\n+more complex deployment, the authentication might be delegated to\n+another system which is trusted by the K8s API to authenticate users, but where\n+the authentication details are unknown to K8s.\n+\n+Initial Features:\n+- there is no superuser `userAccount`\n+- `userAccount` objects are statically populated in the K8s API store by reading a config file.  Only a K8s Cluster Admin can do this.\n+- `userAccount` can have a default `project`.  If API call does not specify a `project`, the default `project` for that caller is assumed.\n+- `userAccount` is global.  A single human with access to multiple projects is recommended to only have one userAccount.\n+\n+Improvements:\n+- Make `userAccount` part of a separate API group from core K8s objects like `pod`.  Facilitates plugging in alternate Access Management.\n+\n+Simple Profile:\n+   - single `userAccount`, used by all K8s Users and Project Admins.  One access token shared by all.\n+\n+Enterprise Profile:\n+   - every human user has own `userAccount`. \n+   - `userAccount`s have labels that indicate both membership in groups, and ability to act in certain roles.\n+   - each service using the API has own `userAccount` too. (e.g. `scheduler`, `repcontroller`)\n+   - automated jobs to denormalize the ldap group info into the local system list of users into the K8s userAccount file.\n+\n+###Unix accounts \n+A `userAccount` is not a Unix user account.  The fact that a pod is started by a `userAccount` does not mean that the processes in that pod's containers run as a Unix user with a corresponding name or identity.  \n+\n+Initially:\n+- The unix accounts available in a container, and used by the processes running in a container are those that are provided by the combination of the base operating system and the Docker manifest. \n+- Kubernetes doesn't enforce any relation between `userAccount` and unix accounts.\n+\n+Improvements:\n+- Kubelet allocates disjoint blocks of root-namespace uids for each container.  This may provide some defense-in-depth against container escapes. (https://github.com/docker/docker/pull/4572)\n+- requires docker to integrate user namespace support, and deciding what getpwnam() does for these uids.\n+- any features that help users avoid use of privileged containers (https://github.com/GoogleCloudPlatform/kubernetes/issues/391)\n+\n+###project\n+K8s will have a have a `project` API object.\n+\n+Initial Features:\n+- `project` object is immutable.\n+- `project` objects are statically populated in the K8s API store by reading a config file.  Only a K8s Cluster Admin can do this.\n+- In order to allow using `project` name as namespace for objects under that `project`, and to ensure the compound names are still DNS-compatible names, `project` names must be DNS label format.  \n+\n+Improvements:\n+- have API calls to create and delete `project` objects.\n+\n+Most API objects have an associated `project`:\n+- pods have a `project`.\n+- `project`s don't have a `project`, nor do `userAccount`s\n+   -  or else they belong to a special global `project`? \n+- An object's `project` cannot be changed after creation.\n+\n+In the Enterprise Profile:\n+   - a `userAccount` may have permission to access several `project`s.  API calls need to specify a `project`.  Client libs may fill this in using a stored preference.\n+\n+In the Simple Profile:\n+   - There is a single default `project`.  No need to specify `project` when making an API call.\n+\n+Project versus userAccount vs Labels:\n+- `userAccount`s are intended for audit logging (both name and UID should be logged), and to define who has access to `project`s.\n+- `labels` (see docs/labels.md) should be used to distinguish pods, users, and other objects that cooperate towards a common goal but are different in some way, such as version, or responsibilities.  \n+- `project`s provide a namespace for objects.\n+\n+\n+*To Be Determined*\n+How is project selected when making a REST call?\n+- subdomain, e.g. http://myproject.kubernetes.example.com\n+  - In hosted environment, may need to avoid profane or vanity names.\n+  - Requires that the apiservers be tied into DNS, which is onerous to configure in some environments. Nice in some contexts.\n+- query parameter\n+  - e.g. `/pods/<name>?project=<projectid>`\n+  - tedious to add to every request, but necessary to disambiguate object names \n+- project in resource name ","path":"docs/access.md","position":178,"original_position":178,"commit_id":"371e7020b56bd307e3944c8ffdd0293ed9320009","original_commit_id":"371e7020b56bd307e3944c8ffdd0293ed9320009","user":{"login":"derekwaynecarr","id":6233452,"avatar_url":"https://avatars.githubusercontent.com/u/6233452?v=2","gravatar_id":"2ab4ec9034819445678e5423d843f8df","url":"https://api.github.com/users/derekwaynecarr","html_url":"https://github.com/derekwaynecarr","followers_url":"https://api.github.com/users/derekwaynecarr/followers","following_url":"https://api.github.com/users/derekwaynecarr/following{/other_user}","gists_url":"https://api.github.com/users/derekwaynecarr/gists{/gist_id}","starred_url":"https://api.github.com/users/derekwaynecarr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/derekwaynecarr/subscriptions","organizations_url":"https://api.github.com/users/derekwaynecarr/orgs","repos_url":"https://api.github.com/users/derekwaynecarr/repos","events_url":"https://api.github.com/users/derekwaynecarr/events{/privacy}","received_events_url":"https://api.github.com/users/derekwaynecarr/received_events","type":"User","site_admin":false},"body":"This is the preferred pattern that I presented in #1114 .  ","created_at":"2014-09-02T17:39:24Z","updated_at":"2014-09-02T17:39:24Z","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/891#discussion_r17002379","pull_request_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/891","_links":{"self":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/comments/17002379"},"html":{"href":"https://github.com/GoogleCloudPlatform/kubernetes/pull/891#discussion_r17002379"},"pull_request":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/891"}}},"pull_request":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/891","id":19760540,"html_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/891","diff_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/891.diff","patch_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/891.patch","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/891","number":891,"state":"open","locked":false,"title":"Access.md added.","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=2","gravatar_id":"dc5a6e8761e435823171e2d7654a349c","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"body":"Some thoughts around identity and access management.  \r\nIdeas still rough, but trying to share early.  Comments welcomed.\r\n\r\nSome of this maybe should go into docs/security.md","created_at":"2014-08-13T23:40:11Z","updated_at":"2014-09-02T17:39:24Z","closed_at":null,"merged_at":null,"merge_commit_sha":"17e66758810544c4369729bc27e89e351294f1d8","assignee":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=2","gravatar_id":"df83d905f402066ed435c8b3550573eb","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/891/commits","review_comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/891/comments","review_comment_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/comments/{number}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/891/comments","statuses_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/statuses/371e7020b56bd307e3944c8ffdd0293ed9320009","head":{"label":"erictune:security_md","ref":"security_md","sha":"371e7020b56bd307e3944c8ffdd0293ed9320009","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=2","gravatar_id":"dc5a6e8761e435823171e2d7654a349c","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"repo":{"id":21629362,"name":"kubernetes","full_name":"erictune/kubernetes","owner":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=2","gravatar_id":"dc5a6e8761e435823171e2d7654a349c","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/erictune/kubernetes","description":"Container Cluster Manager","fork":true,"url":"https://api.github.com/repos/erictune/kubernetes","forks_url":"https://api.github.com/repos/erictune/kubernetes/forks","keys_url":"https://api.github.com/repos/erictune/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/erictune/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/erictune/kubernetes/teams","hooks_url":"https://api.github.com/repos/erictune/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/erictune/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/erictune/kubernetes/events","assignees_url":"https://api.github.com/repos/erictune/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/erictune/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/erictune/kubernetes/tags","blobs_url":"https://api.github.com/repos/erictune/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/erictune/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/erictune/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/erictune/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/erictune/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/erictune/kubernetes/languages","stargazers_url":"https://api.github.com/repos/erictune/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/erictune/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/erictune/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/erictune/kubernetes/subscription","commits_url":"https://api.github.com/repos/erictune/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/erictune/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/erictune/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/erictune/kubernetes/issues/comments/{number}","contents_url":"https://api.github.com/repos/erictune/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/erictune/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/erictune/kubernetes/merges","archive_url":"https://api.github.com/repos/erictune/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/erictune/kubernetes/downloads","issues_url":"https://api.github.com/repos/erictune/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/erictune/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/erictune/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/erictune/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/erictune/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/erictune/kubernetes/releases{/id}","created_at":"2014-07-08T21:00:59Z","updated_at":"2014-07-17T20:45:22Z","pushed_at":"2014-08-27T20:03:47Z","git_url":"git://github.com/erictune/kubernetes.git","ssh_url":"git@github.com:erictune/kubernetes.git","clone_url":"https://github.com/erictune/kubernetes.git","svn_url":"https://github.com/erictune/kubernetes","homepage":null,"size":8765,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"GoogleCloudPlatform:master","ref":"master","sha":"e1998e5a07e56543a60f4f4bfaac0cc9a96a1424","user":{"login":"GoogleCloudPlatform","id":2810941,"avatar_url":"https://avatars.githubusercontent.com/u/2810941?v=2","gravatar_id":"3db02c6238c8b1fb844871330744ec5d","url":"https://api.github.com/users/GoogleCloudPlatform","html_url":"https://github.com/GoogleCloudPlatform","followers_url":"https://api.github.com/users/GoogleCloudPlatform/followers","following_url":"https://api.github.com/users/GoogleCloudPlatform/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCloudPlatform/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCloudPlatform/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCloudPlatform/subscriptions","organizations_url":"https://api.github.com/users/GoogleCloudPlatform/orgs","repos_url":"https://api.github.com/users/GoogleCloudPlatform/repos","events_url":"https://api.github.com/users/GoogleCloudPlatform/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCloudPlatform/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"GoogleCloudPlatform/kubernetes","owner":{"login":"GoogleCloudPlatform","id":2810941,"avatar_url":"https://avatars.githubusercontent.com/u/2810941?v=2","gravatar_id":"3db02c6238c8b1fb844871330744ec5d","url":"https://api.github.com/users/GoogleCloudPlatform","html_url":"https://github.com/GoogleCloudPlatform","followers_url":"https://api.github.com/users/GoogleCloudPlatform/followers","following_url":"https://api.github.com/users/GoogleCloudPlatform/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCloudPlatform/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCloudPlatform/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCloudPlatform/subscriptions","organizations_url":"https://api.github.com/users/GoogleCloudPlatform/orgs","repos_url":"https://api.github.com/users/GoogleCloudPlatform/repos","events_url":"https://api.github.com/users/GoogleCloudPlatform/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCloudPlatform/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/GoogleCloudPlatform/kubernetes","description":"Container Cluster Manager","fork":false,"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes","forks_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/forks","keys_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/teams","hooks_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/events","assignees_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/tags","blobs_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/languages","stargazers_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/subscription","commits_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/{number}","contents_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/merges","archive_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/downloads","issues_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/releases{/id}","created_at":"2014-06-06T22:56:04Z","updated_at":"2014-09-02T14:55:52Z","pushed_at":"2014-09-02T16:45:05Z","git_url":"git://github.com/GoogleCloudPlatform/kubernetes.git","ssh_url":"git@github.com:GoogleCloudPlatform/kubernetes.git","clone_url":"https://github.com/GoogleCloudPlatform/kubernetes.git","svn_url":"https://github.com/GoogleCloudPlatform/kubernetes","homepage":null,"size":26113,"stargazers_count":3367,"watchers_count":3367,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"forks_count":443,"mirror_url":null,"open_issues_count":178,"forks":443,"open_issues":178,"watchers":3367,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/891"},"html":{"href":"https://github.com/GoogleCloudPlatform/kubernetes/pull/891"},"issue":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/891"},"comments":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/891/comments"},"review_comments":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/891/comments"},"review_comment":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/891/commits"},"statuses":{"href":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/statuses/371e7020b56bd307e3944c8ffdd0293ed9320009"}}}}