Subresource for metadata

[enisoc]

This is a tracker to consider the idea of a subresource for object metadata. In particular, for Secrets, you may want to grant a controller permission to read/edit metadata without granting access to the data.

Forked from https://github.com/kubernetes/community/pull/1163/files#r143342579:

@smarterclayton wrote:

Somewhat of a red flag in that it gives those controllers access to all secrets in the system.

@bgrant0607 wrote:

If we're concerned about permissions, we could create a subresource for updating ownerReferences, finalizers, and possibly other metadata in order to facilitate lifecycle management without privilege escalation.

[bgrant0607]

GET supports this via mime type, which doesn't facilitate permissions checks AFAIK, and doesn't support writes. #40848

Also, we may want to exclude annotations.

Related: #1459

[bgrant0607]

cc @kubernetes/sig-api-machinery-feature-requests

[lavalamp]

@smarterclayton already has a "alternative object representation" proposal which covers metadata, I think? But maybe it is not separately permissioned.

[smarterclayton]

Unfortunately both list and watch can't use subresources, so we'd still need another mechanism. On Oct 23, 2017, at 3:47 PM, Daniel Smith <notifications@github.com> wrote: @smarterclayton <https://github.com/smarterclayton> already has a "alternative object representation" proposal which covers metadata, I think? But maybe it is not separately permissioned. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#54269 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABG_p5p9RJNAEy1TXbLVcF8Z6pi7bCbVks5svO1agaJpZM4QADcH> .

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[nikhita]

/remove-lifecycle stale
/lifecycle frozen