<p dir="auto">An HPA request is submitted against namespaceA, but contains a reference to namespaceB (<a href="https://github.com/kubernetes/kubernetes/blob/master/pkg/apis/extensions/types.go#L75">https://github.com/kubernetes/kubernetes/blob/master/pkg/apis/extensions/types.go#L75</a>).  The request is accepted because I have rights to create on in namespaceA, but no checking is done to see if I can scale what I'm asking.</p>
<p dir="auto">The HPA request has a namespace, but it also duplicated a namespace field instead of using a <code class="notranslate">LocalObjectReference</code> extended with <code class="notranslate">kind</code> and <code class="notranslate">subresource</code> field.  The HPA controller then blindly uses the second namespace field: <a href="https://github.com/kubernetes/kubernetes/blob/master/pkg/controller/podautoscaler/horizontal.go#L99">https://github.com/kubernetes/kubernetes/blob/master/pkg/controller/podautoscaler/horizontal.go#L99</a>.</p>
<p dir="auto">This allowed someone in the dev namespace to accidentally (or intentionally) scale down resources in the production namespace.</p>
<p dir="auto"><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/ncdc/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/ncdc">@ncdc</a> Can you help me find the right groups to call out?</p>
<p dir="auto">Vagrant getting started guide:  kubernetes/docs/getting-started-guides/vagrant.md is an empty shell pointing to its new location on the web at <a href="http://releases.k8s.io/release-1.2/docs/getting-started-guides/vagrant.md" rel="nofollow">http://releases.k8s.io/release-1.2/docs/getting-started-guides/vagrant.md</a> with the source for said web page being located at kubernetes.github.io/docs/getting-started-guides/vagrant.md.  However, <a href="http://releases.k8s.io/release-1.2/docs/getting-started-guides/vagrant.md" rel="nofollow">http://releases.k8s.io/release-1.2/docs/getting-started-guides/vagrant.md</a> has been deleted. See <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="144753032" data-permission-text="Title is private" data-url="https://github.com/kubernetes/website/issues/294" data-hovercard-type="pull_request" data-hovercard-url="/kubernetes/website/pull/294/hovercard" href="https://github.com/kubernetes/website/pull/294">kubernetes/website#294</a>.  1) Thus, the file kubernetes/docs/getting-started-guides/vagrant.md, the empty shell, is now pointing to a file that  no longer exists.  This file should be deleted.</p>
<p dir="auto">There was a similar almost duplicate version of the file that was deleted that is in the devel/ tree:<br>
<a href="https://github.com/kubernetes/kubernetes/blob/release-1.2/docs/devel/developer-guides/vagrant.md">https://github.com/kubernetes/kubernetes/blob/release-1.2/docs/devel/developer-guides/vagrant.md</a>.  This version of the vagrant guide as with the other documents in the devel/ tree have not been moved to the web site docs in the releases.k8s.io fork. However the file docs/devel/running-locally.md has a link in it that is pointing to the now deleted version of the vagrant guide.  <code class="notranslate">Not running Linux? Consider running Linux in a local virtual machine with [Vagrant](../getting-started-guides/vagrant.md), or on a cloud provider like [Google Compute Engine](../getting-started-guides/gce.md).</code> 2) This link needs to be updated to point to the remaining version of the vagrant guide instead of pointing to the deleted version.</p>
<p dir="auto">I have a PR that addresses these two issues: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="149582277" data-permission-text="Title is private" data-url="https://github.com/kubernetes/kubernetes/issues/24495" data-hovercard-type="pull_request" data-hovercard-url="/kubernetes/kubernetes/pull/24495/hovercard" href="https://github.com/kubernetes/kubernetes/pull/24495">#24495</a></p>