OpenShift is most interested in the kubernetes service. Is that going away on GKE? I actually plan to use that to support running OpenShift as a pod on Kubernetes.

Sent from my iPhone

On Feb 18, 2015, at 6:27 PM, Eric Tune notifications@github.com wrote:

Now that the "secrets" type has been merged, and we have namespaces, I don't think it often makes sense to give blanket readonly access to objects. So, lets deprecated it.

I don't know that we want to rip it out all in one go.
Nothing is using the kubernetes-ro service as far as I can see from searching the codebase, however some customers might depend on it, and maybe openshift does. For GKE, I think we'd like it gone. So, lets add a flag to the master that disables its creation. If a customer needs it we can tell them how to get it back, but it will discourage new uses.

Once service-accounts land, we can give people that need it a way to automatically generate policy and credentials for things in pods. Then we can delete kubernetes-ro it altogether.

—
Reply to this email directly or view it on GitHub.

I think it is used by third parties-- isn't that the way our SkyDNS pod knows where to get the list of things to populate DNS with?

Heapster uses the RO service to get information about running things
On Feb 18, 2015 4:23 PM, "Daniel Smith" notifications@github.com wrote:

I think it is used by third parties-- isn't that the way our SkyDNS pod
knows where to get the list of things to populate DNS with?

—
Reply to this email directly or view it on GitHub
#4567 (comment)
.

DNS uses it. I sort of like that it is automatically rate limited, but I
also have not looked at the secrets stuff yet.

I will go with the flow, but please don't break DNS.
On Feb 18, 2015 6:00 PM, "Victor Marmol" notifications@github.com wrote:

Heapster uses the RO service to get information about running things
On Feb 18, 2015 4:23 PM, "Daniel Smith" notifications@github.com wrote:

I think it is used by third parties-- isn't that the way our SkyDNS pod
knows where to get the list of things to populate DNS with?

Reply to this email directly or view it on GitHub
<
#4567 (comment)

.

Reply to this email directly or view it on GitHub
#4567 (comment)
.

@derekwaynecarr @lavalamp @thockin @vmarmol
We aren't going to break the existing use cases. They will be grandfathered in until we have the ability to automatically distribute credentials to pods. Then each existing use case will be lovingly and tenderly migrated to the kubernetes service.

@thockin
yes rate limiting is nice. we should have it for the kubernetes service.

@derekwaynecarr
no, GKE does not want to get rid of kubernetes service. It wants to get rid of the insecure endpoint on the apiserver.

#5921

#5917

@erictune can you confirm that deprecating kubernetes-ro is needed for v1.0 (as opposed to the other issues you mentioned, and this one being optional for 1.0)?

This is not needed for 1.0, but the other two are. Fixing labels.

thinking about this more, this is needed for v1.

@erictune Is it OK if we assign this issue to you?

Yes.

On Tue, Apr 28, 2015 at 2:54 PM, David Oppenheimer <notifications@github.com

wrote:

@erictune https://github.com/erictune Is it OK if we assign this issue
to you?

—
Reply to this email directly or view it on GitHub
#4567 (comment)
.

#7444 and #5921 are vaguely related and both marked for 1.0

This is a rookie question, but if the RO service is being removed, how would I access the list of services from within a container?

Use a service account to inject credentials and access the secure (read/write) port on the master.

@ sujaymansingh if you describe your client, I can suggest the best way to
access the API.

On Wed, Jun 3, 2015 at 9:16 PM, Brian Grant notifications@github.com
wrote:

Closed #4567
#4567 via #8155
#8155.

—
Reply to this email directly or view it on GitHub
#4567 (comment)
.

Hi @erictune
Sorry about the delay and thanks for reaching out!

It will mainly be python (though if it is HTTP anything could access it right?)

I'm mainly interested in a mix of python APIs (probably using flask) and standalone scripts.