Update to kube v1.17

Signed-off-by: Humble Chirammal <hchiramm@redhat.com>

vendor/k8s.io/kubernetes/pkg/volume/util/fsquota/common/quota_linux_common.go

@@ -0,0 +1,105 @@
+// +build linux
+
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package common
+
+import (
+	"regexp"
+)
+
+// QuotaID is generic quota identifier.
+// Data type based on quotactl(2).
+type QuotaID int32
+
+const (
+	// UnknownQuotaID -- cannot determine whether a quota is in force
+	UnknownQuotaID QuotaID = -1
+	// BadQuotaID -- Invalid quota
+	BadQuotaID QuotaID = 0
+)
+
+const (
+	acct      = iota
+	enforcing = iota
+)
+
+// QuotaType -- type of quota to be applied
+type QuotaType int
+
+const (
+	// FSQuotaAccounting for quotas for accounting only
+	FSQuotaAccounting QuotaType = 1 << iota
+	// FSQuotaEnforcing for quotas for enforcement
+	FSQuotaEnforcing QuotaType = 1 << iota
+)
+
+// FirstQuota is the quota ID we start with.
+// XXXXXXX Need a better way of doing this...
+var FirstQuota QuotaID = 1048577
+
+// MountsFile is the location of the system mount data
+var MountsFile = "/proc/self/mounts"
+
+// MountParseRegexp parses out /proc/sys/self/mounts
+var MountParseRegexp = regexp.MustCompilePOSIX("^([^ ]*)[ \t]*([^ ]*)[ \t]*([^ ]*)") // Ignore options etc.
+
+// LinuxVolumeQuotaProvider returns an appropriate quota applier
+// object if we can support quotas on this device
+type LinuxVolumeQuotaProvider interface {
+	// GetQuotaApplier retrieves an object that can apply
+	// quotas (or nil if this provider cannot support quotas
+	// on the device)
+	GetQuotaApplier(mountpoint string, backingDev string) LinuxVolumeQuotaApplier
+}
+
+// LinuxVolumeQuotaApplier is a generic interface to any quota
+// mechanism supported by Linux
+type LinuxVolumeQuotaApplier interface {
+	// GetQuotaOnDir gets the quota ID (if any) that applies to
+	// this directory
+	GetQuotaOnDir(path string) (QuotaID, error)
+
+	// SetQuotaOnDir applies the specified quota ID to a directory.
+	// Negative value for bytes means that a non-enforcing quota
+	// should be applied (perhaps by setting a quota too large to
+	// be hit)
+	SetQuotaOnDir(path string, id QuotaID, bytes int64) error
+
+	// QuotaIDIsInUse determines whether the quota ID is in use.
+	// Implementations should not check /etc/project or /etc/projid,
+	// only whether their underlying mechanism already has the ID in
+	// use.
+	// Return value of false with no error means that the ID is not
+	// in use; true means that it is already in use.  An error
+	// return means that any quota ID will fail.
+	QuotaIDIsInUse(id QuotaID) (bool, error)
+
+	// GetConsumption returns the consumption (in bytes) of the
+	// directory, determined by the implementation's quota-based
+	// mechanism.  If it is unable to do so using that mechanism,
+	// it should return an error and allow higher layers to
+	// enumerate the directory.
+	GetConsumption(path string, id QuotaID) (int64, error)
+
+	// GetInodes returns the number of inodes used by the
+	// directory, determined by the implementation's quota-based
+	// mechanism.  If it is unable to do so using that mechanism,
+	// it should return an error and allow higher layers to
+	// enumerate the directory.
+	GetInodes(path string, id QuotaID) (int64, error)
+}

vendor/k8s.io/kubernetes/pkg/volume/util/fsquota/common/quota_linux_common_impl.go

@@ -0,0 +1,286 @@
+// +build linux
+
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package common
+
+import (
+	"bufio"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"syscall"
+
+	"k8s.io/klog"
+)
+
+var quotaCmd string
+var quotaCmdInitialized bool
+var quotaCmdLock sync.RWMutex
+
+// If we later get a filesystem that uses project quota semantics other than
+// XFS, we'll need to change this.
+// Higher levels don't need to know what's inside
+type linuxFilesystemType struct {
+	name             string
+	typeMagic        int64 // Filesystem magic number, per statfs(2)
+	maxQuota         int64
+	allowEmptyOutput bool // Accept empty output from "quota" command
+}
+
+const (
+	bitsPerWord = 32 << (^uint(0) >> 63) // either 32 or 64
+)
+
+var (
+	linuxSupportedFilesystems = []linuxFilesystemType{
+		{
+			name:             "XFS",
+			typeMagic:        0x58465342,
+			maxQuota:         1<<(bitsPerWord-1) - 1,
+			allowEmptyOutput: true, // XFS filesystems report nothing if a quota is not present
+		}, {
+			name:             "ext4fs",
+			typeMagic:        0xef53,
+			maxQuota:         (1<<(bitsPerWord-1) - 1) & (1<<58 - 1),
+			allowEmptyOutput: false, // ext4 filesystems always report something even if a quota is not present
+		},
+	}
+)
+
+// VolumeProvider supplies a quota applier to the generic code.
+type VolumeProvider struct {
+}
+
+var quotaCmds = []string{"/sbin/xfs_quota",
+	"/usr/sbin/xfs_quota",
+	"/bin/xfs_quota"}
+
+var quotaParseRegexp = regexp.MustCompilePOSIX("^[^ \t]*[ \t]*([0-9]+)")
+
+var lsattrCmd = "/usr/bin/lsattr"
+var lsattrParseRegexp = regexp.MustCompilePOSIX("^ *([0-9]+) [^ ]+ (.*)$")
+
+// GetQuotaApplier -- does this backing device support quotas that
+// can be applied to directories?
+func (*VolumeProvider) GetQuotaApplier(mountpoint string, backingDev string) LinuxVolumeQuotaApplier {
+	for _, fsType := range linuxSupportedFilesystems {
+		if isFilesystemOfType(mountpoint, backingDev, fsType.typeMagic) {
+			return linuxVolumeQuotaApplier{mountpoint: mountpoint,
+				maxQuota:         fsType.maxQuota,
+				allowEmptyOutput: fsType.allowEmptyOutput,
+			}
+		}
+	}
+	return nil
+}
+
+type linuxVolumeQuotaApplier struct {
+	mountpoint       string
+	maxQuota         int64
+	allowEmptyOutput bool
+}
+
+func getXFSQuotaCmd() (string, error) {
+	quotaCmdLock.Lock()
+	defer quotaCmdLock.Unlock()
+	if quotaCmdInitialized {
+		return quotaCmd, nil
+	}
+	for _, program := range quotaCmds {
+		fileinfo, err := os.Stat(program)
+		if err == nil && ((fileinfo.Mode().Perm() & (1 << 6)) != 0) {
+			klog.V(3).Infof("Found xfs_quota program %s", program)
+			quotaCmd = program
+			quotaCmdInitialized = true
+			return quotaCmd, nil
+		}
+	}
+	quotaCmdInitialized = true
+	return "", fmt.Errorf("No xfs_quota program found")
+}
+
+func doRunXFSQuotaCommand(mountpoint string, mountsFile, command string) (string, error) {
+	quotaCmd, err := getXFSQuotaCmd()
+	if err != nil {
+		return "", err
+	}
+	// We're using numeric project IDs directly; no need to scan
+	// /etc/projects or /etc/projid
+	klog.V(4).Infof("runXFSQuotaCommand %s -t %s -P/dev/null -D/dev/null -x -f %s -c %s", quotaCmd, mountsFile, mountpoint, command)
+	cmd := exec.Command(quotaCmd, "-t", mountsFile, "-P/dev/null", "-D/dev/null", "-x", "-f", mountpoint, "-c", command)
+
+	data, err := cmd.Output()
+	if err != nil {
+		return "", err
+	}
+	klog.V(4).Infof("runXFSQuotaCommand output %q", string(data))
+	return string(data), nil
+}
+
+// Extract the mountpoint we care about into a temporary mounts file so that xfs_quota does
+// not attempt to scan every mount on the filesystem, which could hang if e. g.
+// a stuck NFS mount is present.
+// See https://bugzilla.redhat.com/show_bug.cgi?id=237120 for an example
+// of the problem that could be caused if this were to happen.
+func runXFSQuotaCommand(mountpoint string, command string) (string, error) {
+	tmpMounts, err := ioutil.TempFile("", "mounts")
+	if err != nil {
+		return "", fmt.Errorf("Cannot create temporary mount file: %v", err)
+	}
+	tmpMountsFileName := tmpMounts.Name()
+	defer tmpMounts.Close()
+	defer os.Remove(tmpMountsFileName)
+
+	mounts, err := os.Open(MountsFile)
+	if err != nil {
+		return "", fmt.Errorf("Cannot open mounts file %s: %v", MountsFile, err)
+	}
+	defer mounts.Close()
+
+	scanner := bufio.NewScanner(mounts)
+	for scanner.Scan() {
+		match := MountParseRegexp.FindStringSubmatch(scanner.Text())
+		if match != nil {
+			mount := match[2]
+			if mount == mountpoint {
+				if _, err := tmpMounts.WriteString(fmt.Sprintf("%s\n", scanner.Text())); err != nil {
+					return "", fmt.Errorf("Cannot write temporary mounts file: %v", err)
+				}
+				if err := tmpMounts.Sync(); err != nil {
+					return "", fmt.Errorf("Cannot sync temporary mounts file: %v", err)
+				}
+				return doRunXFSQuotaCommand(mountpoint, tmpMountsFileName, command)
+			}
+		}
+	}
+	return "", fmt.Errorf("Cannot run xfs_quota: cannot find mount point %s in %s", mountpoint, MountsFile)
+}
+
+// SupportsQuotas determines whether the filesystem supports quotas.
+func SupportsQuotas(mountpoint string, qType QuotaType) (bool, error) {
+	data, err := runXFSQuotaCommand(mountpoint, "state -p")
+	if err != nil {
+		return false, err
+	}
+	if qType == FSQuotaEnforcing {
+		return strings.Contains(data, "Enforcement: ON"), nil
+	}
+	return strings.Contains(data, "Accounting: ON"), nil
+}
+
+func isFilesystemOfType(mountpoint string, backingDev string, typeMagic int64) bool {
+	var buf syscall.Statfs_t
+	err := syscall.Statfs(mountpoint, &buf)
+	if err != nil {
+		klog.Warningf("Warning: Unable to statfs %s: %v", mountpoint, err)
+		return false
+	}
+	if int64(buf.Type) != typeMagic {
+		return false
+	}
+	if answer, _ := SupportsQuotas(mountpoint, FSQuotaAccounting); answer {
+		return true
+	}
+	return false
+}
+
+// GetQuotaOnDir retrieves the quota ID (if any) associated with the specified directory
+// If we can't make system calls, all we can say is that we don't know whether
+// it has a quota, and higher levels have to make the call.
+func (v linuxVolumeQuotaApplier) GetQuotaOnDir(path string) (QuotaID, error) {
+	cmd := exec.Command(lsattrCmd, "-pd", path)
+	data, err := cmd.Output()
+	if err != nil {
+		return BadQuotaID, fmt.Errorf("cannot run lsattr: %v", err)
+	}
+	match := lsattrParseRegexp.FindStringSubmatch(string(data))
+	if match == nil {
+		return BadQuotaID, fmt.Errorf("Unable to parse lsattr -pd %s output %s", path, string(data))
+	}
+	if match[2] != path {
+		return BadQuotaID, fmt.Errorf("Mismatch between supplied and returned path (%s != %s)", path, match[2])
+	}
+	projid, err := strconv.ParseInt(match[1], 10, 32)
+	if err != nil {
+		return BadQuotaID, fmt.Errorf("Unable to parse project ID from %s (%v)", match[1], err)
+	}
+	return QuotaID(projid), nil
+}
+
+// SetQuotaOnDir applies a quota to the specified directory under the specified mountpoint.
+func (v linuxVolumeQuotaApplier) SetQuotaOnDir(path string, id QuotaID, bytes int64) error {
+	if bytes < 0 || bytes > v.maxQuota {
+		bytes = v.maxQuota
+	}
+	_, err := runXFSQuotaCommand(v.mountpoint, fmt.Sprintf("limit -p bhard=%v bsoft=%v %v", bytes, bytes, id))
+	if err != nil {
+		return err
+	}
+
+	_, err = runXFSQuotaCommand(v.mountpoint, fmt.Sprintf("project -s -p %s %v", path, id))
+	return err
+}
+
+func getQuantity(mountpoint string, id QuotaID, xfsQuotaArg string, multiplier int64, allowEmptyOutput bool) (int64, error) {
+	data, err := runXFSQuotaCommand(mountpoint, fmt.Sprintf("quota -p -N -n -v %s %v", xfsQuotaArg, id))
+	if err != nil {
+		return 0, fmt.Errorf("Unable to run xfs_quota: %v", err)
+	}
+	if data == "" && allowEmptyOutput {
+		return 0, nil
+	}
+	match := quotaParseRegexp.FindStringSubmatch(data)
+	if match == nil {
+		return 0, fmt.Errorf("Unable to parse quota output '%s'", data)
+	}
+	size, err := strconv.ParseInt(match[1], 10, 64)
+	if err != nil {
+		return 0, fmt.Errorf("Unable to parse data size '%s' from '%s': %v", match[1], data, err)
+	}
+	klog.V(4).Infof("getQuantity %s %d %s %d => %d %v", mountpoint, id, xfsQuotaArg, multiplier, size, err)
+	return size * multiplier, nil
+}
+
+// GetConsumption returns the consumption in bytes if available via quotas
+func (v linuxVolumeQuotaApplier) GetConsumption(_ string, id QuotaID) (int64, error) {
+	return getQuantity(v.mountpoint, id, "-b", 1024, v.allowEmptyOutput)
+}
+
+// GetInodes returns the inodes in use if available via quotas
+func (v linuxVolumeQuotaApplier) GetInodes(_ string, id QuotaID) (int64, error) {
+	return getQuantity(v.mountpoint, id, "-i", 1, v.allowEmptyOutput)
+}
+
+// QuotaIDIsInUse checks whether the specified quota ID is in use on the specified
+// filesystem
+func (v linuxVolumeQuotaApplier) QuotaIDIsInUse(id QuotaID) (bool, error) {
+	bytes, err := v.GetConsumption(v.mountpoint, id)
+	if err != nil {
+		return false, err
+	}
+	if bytes > 0 {
+		return true, nil
+	}
+	inodes, err := v.GetInodes(v.mountpoint, id)
+	return inodes > 0, err
+}

vendor/k8s.io/kubernetes/pkg/volume/util/fsquota/project.go

@@ -0,0 +1,357 @@
+// +build linux
+
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fsquota
+
+import (
+	"bufio"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"sync"
+
+	"golang.org/x/sys/unix"
+	"k8s.io/kubernetes/pkg/volume/util/fsquota/common"
+)
+
+var projectsFile = "/etc/projects"
+var projidFile = "/etc/projid"
+
+var projectsParseRegexp = regexp.MustCompilePOSIX("^([[:digit:]]+):(.*)$")
+var projidParseRegexp = regexp.MustCompilePOSIX("^([^#][^:]*):([[:digit:]]+)$")
+
+var quotaIDLock sync.RWMutex
+
+const maxUnusedQuotasToSearch = 128 // Don't go into an infinite loop searching for an unused quota
+
+type projectType struct {
+	isValid bool // False if we need to remove this line
+	id      common.QuotaID
+	data    string // Project name (projid) or directory (projects)
+	line    string
+}
+
+type projectsList struct {
+	projects []projectType
+	projid   []projectType
+}
+
+func projFilesAreOK() error {
+	if sf, err := os.Lstat(projectsFile); err != nil || sf.Mode().IsRegular() {
+		if sf, err := os.Lstat(projidFile); err != nil || sf.Mode().IsRegular() {
+			return nil
+		}
+		return fmt.Errorf("%s exists but is not a plain file, cannot continue", projidFile)
+	}
+	return fmt.Errorf("%s exists but is not a plain file, cannot continue", projectsFile)
+}
+
+func lockFile(file *os.File) error {
+	return unix.Flock(int(file.Fd()), unix.LOCK_EX)
+}
+
+func unlockFile(file *os.File) error {
+	return unix.Flock(int(file.Fd()), unix.LOCK_UN)
+}
+
+// openAndLockProjectFiles opens /etc/projects and /etc/projid locked.
+// Creates them if they don't exist
+func openAndLockProjectFiles() (*os.File, *os.File, error) {
+	// Make sure neither project-related file is a symlink!
+	if err := projFilesAreOK(); err != nil {
+		return nil, nil, fmt.Errorf("system project files failed verification: %v", err)
+	}
+	// We don't actually modify the original files; we create temporaries and
+	// move them over the originals
+	fProjects, err := os.OpenFile(projectsFile, os.O_RDONLY|os.O_CREATE, 0644)
+	if err != nil {
+		err = fmt.Errorf("unable to open %s: %v", projectsFile, err)
+		return nil, nil, err
+	}
+	fProjid, err := os.OpenFile(projidFile, os.O_RDONLY|os.O_CREATE, 0644)
+	if err == nil {
+		// Check once more, to ensure nothing got changed out from under us
+		if err := projFilesAreOK(); err == nil {
+			err = lockFile(fProjects)
+			if err == nil {
+				err = lockFile(fProjid)
+				if err == nil {
+					return fProjects, fProjid, nil
+				}
+				// Nothing useful we can do if we get an error here
+				err = fmt.Errorf("unable to lock %s: %v", projidFile, err)
+				unlockFile(fProjects)
+			} else {
+				err = fmt.Errorf("unable to lock %s: %v", projectsFile, err)
+			}
+		} else {
+			err = fmt.Errorf("system project files failed re-verification: %v", err)
+		}
+		fProjid.Close()
+	} else {
+		err = fmt.Errorf("unable to open %s: %v", projidFile, err)
+	}
+	fProjects.Close()
+	return nil, nil, err
+}
+
+func closeProjectFiles(fProjects *os.File, fProjid *os.File) error {
+	// Nothing useful we can do if either of these fail,
+	// but we have to close (and thereby unlock) the files anyway.
+	var err error
+	var err1 error
+	if fProjid != nil {
+		err = fProjid.Close()
+	}
+	if fProjects != nil {
+		err1 = fProjects.Close()
+	}
+	if err == nil {
+		return err1
+	}
+	return err
+}
+
+func parseProject(l string) projectType {
+	if match := projectsParseRegexp.FindStringSubmatch(l); match != nil {
+		i, err := strconv.Atoi(match[1])
+		if err == nil {
+			return projectType{true, common.QuotaID(i), match[2], l}
+		}
+	}
+	return projectType{true, common.BadQuotaID, "", l}
+}
+
+func parseProjid(l string) projectType {
+	if match := projidParseRegexp.FindStringSubmatch(l); match != nil {
+		i, err := strconv.Atoi(match[2])
+		if err == nil {
+			return projectType{true, common.QuotaID(i), match[1], l}
+		}
+	}
+	return projectType{true, common.BadQuotaID, "", l}
+}
+
+func parseProjFile(f *os.File, parser func(l string) projectType) []projectType {
+	var answer []projectType
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		answer = append(answer, parser(scanner.Text()))
+	}
+	return answer
+}
+
+func readProjectFiles(projects *os.File, projid *os.File) projectsList {
+	return projectsList{parseProjFile(projects, parseProject), parseProjFile(projid, parseProjid)}
+}
+
+func findAvailableQuota(path string, idMap map[common.QuotaID]bool) (common.QuotaID, error) {
+	unusedQuotasSearched := 0
+	for id := common.FirstQuota; id == id; id++ {
+		if _, ok := idMap[id]; !ok {
+			isInUse, err := getApplier(path).QuotaIDIsInUse(id)
+			if err != nil {
+				return common.BadQuotaID, err
+			} else if !isInUse {
+				return id, nil
+			}
+			unusedQuotasSearched++
+			if unusedQuotasSearched > maxUnusedQuotasToSearch {
+				break
+			}
+		}
+	}
+	return common.BadQuotaID, fmt.Errorf("Cannot find available quota ID")
+}
+
+func addDirToProject(path string, id common.QuotaID, list *projectsList) (common.QuotaID, bool, error) {
+	idMap := make(map[common.QuotaID]bool)
+	for _, project := range list.projects {
+		if project.data == path {
+			if id != project.id {
+				return common.BadQuotaID, false, fmt.Errorf("Attempt to reassign project ID for %s", path)
+			}
+			// Trying to reassign a directory to the project it's
+			// already in.  Maybe this should be an error, but for
+			// now treat it as an idempotent operation
+			return id, false, nil
+		}
+		idMap[project.id] = true
+	}
+	var needToAddProjid = true
+	for _, projid := range list.projid {
+		idMap[projid.id] = true
+		if projid.id == id && id != common.BadQuotaID {
+			needToAddProjid = false
+		}
+	}
+	var err error
+	if id == common.BadQuotaID {
+		id, err = findAvailableQuota(path, idMap)
+		if err != nil {
+			return common.BadQuotaID, false, err
+		}
+		needToAddProjid = true
+	}
+	if needToAddProjid {
+		name := fmt.Sprintf("volume%v", id)
+		line := fmt.Sprintf("%s:%v", name, id)
+		list.projid = append(list.projid, projectType{true, id, name, line})
+	}
+	line := fmt.Sprintf("%v:%s", id, path)
+	list.projects = append(list.projects, projectType{true, id, path, line})
+	return id, needToAddProjid, nil
+}
+
+func removeDirFromProject(path string, id common.QuotaID, list *projectsList) (bool, error) {
+	if id == common.BadQuotaID {
+		return false, fmt.Errorf("Attempt to remove invalid quota ID from %s", path)
+	}
+	foundAt := -1
+	countByID := make(map[common.QuotaID]int)
+	for i, project := range list.projects {
+		if project.data == path {
+			if id != project.id {
+				return false, fmt.Errorf("Attempting to remove quota ID %v from path %s, but expecting ID %v", id, path, project.id)
+			} else if foundAt != -1 {
+				return false, fmt.Errorf("Found multiple quota IDs for path %s", path)
+			}
+			// Faster and easier than deleting an element
+			list.projects[i].isValid = false
+			foundAt = i
+		}
+		countByID[project.id]++
+	}
+	if foundAt == -1 {
+		return false, fmt.Errorf("Cannot find quota associated with path %s", path)
+	}
+	if countByID[id] <= 1 {
+		// Removing the last entry means that we're no longer using
+		// the quota ID, so remove that as well
+		for i, projid := range list.projid {
+			if projid.id == id {
+				list.projid[i].isValid = false
+			}
+		}
+		return true, nil
+	}
+	return false, nil
+}
+
+func writeProjectFile(base *os.File, projects []projectType) (string, error) {
+	oname := base.Name()
+	stat, err := base.Stat()
+	if err != nil {
+		return "", err
+	}
+	mode := stat.Mode() & os.ModePerm
+	f, err := ioutil.TempFile(filepath.Dir(oname), filepath.Base(oname))
+	if err != nil {
+		return "", err
+	}
+	filename := f.Name()
+	if err := os.Chmod(filename, mode); err != nil {
+		return "", err
+	}
+	for _, proj := range projects {
+		if proj.isValid {
+			if _, err := f.WriteString(fmt.Sprintf("%s\n", proj.line)); err != nil {
+				f.Close()
+				os.Remove(filename)
+				return "", err
+			}
+		}
+	}
+	if err := f.Close(); err != nil {
+		os.Remove(filename)
+		return "", err
+	}
+	return filename, nil
+}
+
+func writeProjectFiles(fProjects *os.File, fProjid *os.File, writeProjid bool, list projectsList) error {
+	tmpProjects, err := writeProjectFile(fProjects, list.projects)
+	if err == nil {
+		// Ensure that both files are written before we try to rename either.
+		if writeProjid {
+			tmpProjid, err := writeProjectFile(fProjid, list.projid)
+			if err == nil {
+				err = os.Rename(tmpProjid, fProjid.Name())
+				if err != nil {
+					os.Remove(tmpProjid)
+				}
+			}
+		}
+		if err == nil {
+			err = os.Rename(tmpProjects, fProjects.Name())
+			if err == nil {
+				return nil
+			}
+			// We're in a bit of trouble here; at this
+			// point we've successfully renamed tmpProjid
+			// to the real thing, but renaming tmpProject
+			// to the real file failed.  There's not much we
+			// can do in this position.  Anything we could do
+			// to try to undo it would itself be likely to fail.
+		}
+		os.Remove(tmpProjects)
+	}
+	return fmt.Errorf("Unable to write project files: %v", err)
+}
+
+func createProjectID(path string, ID common.QuotaID) (common.QuotaID, error) {
+	quotaIDLock.Lock()
+	defer quotaIDLock.Unlock()
+	fProjects, fProjid, err := openAndLockProjectFiles()
+	if err == nil {
+		defer closeProjectFiles(fProjects, fProjid)
+		list := readProjectFiles(fProjects, fProjid)
+		writeProjid := true
+		ID, writeProjid, err = addDirToProject(path, ID, &list)
+		if err == nil && ID != common.BadQuotaID {
+			if err = writeProjectFiles(fProjects, fProjid, writeProjid, list); err == nil {
+				return ID, nil
+			}
+		}
+	}
+	return common.BadQuotaID, fmt.Errorf("createProjectID %s %v failed %v", path, ID, err)
+}
+
+func removeProjectID(path string, ID common.QuotaID) error {
+	if ID == common.BadQuotaID {
+		return fmt.Errorf("attempting to remove invalid quota ID %v", ID)
+	}
+	quotaIDLock.Lock()
+	defer quotaIDLock.Unlock()
+	fProjects, fProjid, err := openAndLockProjectFiles()
+	if err == nil {
+		defer closeProjectFiles(fProjects, fProjid)
+		list := readProjectFiles(fProjects, fProjid)
+		writeProjid := true
+		writeProjid, err = removeDirFromProject(path, ID, &list)
+		if err == nil {
+			if err = writeProjectFiles(fProjects, fProjid, writeProjid, list); err == nil {
+				return nil
+			}
+		}
+	}
+	return fmt.Errorf("removeProjectID %s %v failed %v", path, ID, err)
+}

vendor/k8s.io/kubernetes/pkg/volume/util/fsquota/quota.go

@@ -0,0 +1,50 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fsquota
+
+import (
+	"k8s.io/utils/mount"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/types"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
+	"k8s.io/kubernetes/pkg/features"
+)
+
+// Interface -- quota interface
+type Interface interface {
+	// Does the path provided support quotas, and if so, what types
+	SupportsQuotas(m mount.Interface, path string) (bool, error)
+	// Assign a quota (picked by the quota mechanism) to a path,
+	// and return it.
+	AssignQuota(m mount.Interface, path string, poduid types.UID, bytes *resource.Quantity) error
+
+	// Get the quota-based storage consumption for the path
+	GetConsumption(path string) (*resource.Quantity, error)
+
+	// Get the quota-based inode consumption for the path
+	GetInodes(path string) (*resource.Quantity, error)
+
+	// Remove the quota from a path
+	// Implementations may assume that any data covered by the
+	// quota has already been removed.
+	ClearQuota(m mount.Interface, path string) error
+}
+
+func enabledQuotasForMonitoring() bool {
+	return utilfeature.DefaultFeatureGate.Enabled(features.LocalStorageCapacityIsolationFSQuotaMonitoring)
+}

vendor/k8s.io/kubernetes/pkg/volume/util/fsquota/quota_linux.go

@@ -0,0 +1,442 @@
+// +build linux
+
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fsquota
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"k8s.io/klog"
+	"k8s.io/utils/mount"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/uuid"
+	"k8s.io/kubernetes/pkg/volume/util/fsquota/common"
+)
+
+// Pod -> ID
+var podQuotaMap = make(map[types.UID]common.QuotaID)
+
+// Dir -> ID (for convenience)
+var dirQuotaMap = make(map[string]common.QuotaID)
+
+// ID -> pod
+var quotaPodMap = make(map[common.QuotaID]types.UID)
+
+// Directory -> pod
+var dirPodMap = make(map[string]types.UID)
+
+// Backing device -> applier
+// This is *not* cleaned up; its size will be bounded.
+var devApplierMap = make(map[string]common.LinuxVolumeQuotaApplier)
+
+// Directory -> applier
+var dirApplierMap = make(map[string]common.LinuxVolumeQuotaApplier)
+var dirApplierLock sync.RWMutex
+
+// Pod -> refcount
+var podDirCountMap = make(map[types.UID]int)
+
+// ID -> size
+var quotaSizeMap = make(map[common.QuotaID]int64)
+var quotaLock sync.RWMutex
+
+var supportsQuotasMap = make(map[string]bool)
+var supportsQuotasLock sync.RWMutex
+
+// Directory -> backingDev
+var backingDevMap = make(map[string]string)
+var backingDevLock sync.RWMutex
+
+var mountpointMap = make(map[string]string)
+var mountpointLock sync.RWMutex
+
+var providers = []common.LinuxVolumeQuotaProvider{
+	&common.VolumeProvider{},
+}
+
+// Separate the innards for ease of testing
+func detectBackingDevInternal(mountpoint string, mounts string) (string, error) {
+	file, err := os.Open(mounts)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		match := common.MountParseRegexp.FindStringSubmatch(scanner.Text())
+		if match != nil {
+			device := match[1]
+			mount := match[2]
+			if mount == mountpoint {
+				return device, nil
+			}
+		}
+	}
+	return "", fmt.Errorf("couldn't find backing device for %s", mountpoint)
+}
+
+// detectBackingDev assumes that the mount point provided is valid
+func detectBackingDev(_ mount.Interface, mountpoint string) (string, error) {
+	return detectBackingDevInternal(mountpoint, common.MountsFile)
+}
+
+func clearBackingDev(path string) {
+	backingDevLock.Lock()
+	defer backingDevLock.Unlock()
+	delete(backingDevMap, path)
+}
+
+// Assumes that the path has been fully canonicalized
+// Breaking this up helps with testing
+func detectMountpointInternal(m mount.Interface, path string) (string, error) {
+	for path != "" && path != "/" {
+		// per k8s.io/utils/mount/mount_linux this detects all but
+		// a bind mount from one part of a mount to another.
+		// For our purposes that's fine; we simply want the "true"
+		// mount point
+		//
+		// IsNotMountPoint proved much more troublesome; it actually
+		// scans the mounts, and when a lot of mount/unmount
+		// activity takes place, it is not able to get a consistent
+		// view of /proc/self/mounts, causing it to time out and
+		// report incorrectly.
+		isNotMount, err := m.IsLikelyNotMountPoint(path)
+		if err != nil {
+			return "/", err
+		}
+		if !isNotMount {
+			return path, nil
+		}
+		path = filepath.Dir(path)
+	}
+	return "/", nil
+}
+
+func detectMountpoint(m mount.Interface, path string) (string, error) {
+	xpath, err := filepath.Abs(path)
+	if err != nil {
+		return "/", err
+	}
+	xpath, err = filepath.EvalSymlinks(xpath)
+	if err != nil {
+		return "/", err
+	}
+	if xpath, err = detectMountpointInternal(m, xpath); err == nil {
+		return xpath, nil
+	}
+	return "/", err
+}
+
+func clearMountpoint(path string) {
+	mountpointLock.Lock()
+	defer mountpointLock.Unlock()
+	delete(mountpointMap, path)
+}
+
+// getFSInfo Returns mountpoint and backing device
+// getFSInfo should cache the mountpoint and backing device for the
+// path.
+func getFSInfo(m mount.Interface, path string) (string, string, error) {
+	mountpointLock.Lock()
+	defer mountpointLock.Unlock()
+
+	backingDevLock.Lock()
+	defer backingDevLock.Unlock()
+
+	var err error
+
+	mountpoint, okMountpoint := mountpointMap[path]
+	if !okMountpoint {
+		mountpoint, err = detectMountpoint(m, path)
+		if err != nil {
+			return "", "", fmt.Errorf("Cannot determine mountpoint for %s: %v", path, err)
+		}
+	}
+
+	backingDev, okBackingDev := backingDevMap[path]
+	if !okBackingDev {
+		backingDev, err = detectBackingDev(m, mountpoint)
+		if err != nil {
+			return "", "", fmt.Errorf("Cannot determine backing device for %s: %v", path, err)
+		}
+	}
+	mountpointMap[path] = mountpoint
+	backingDevMap[path] = backingDev
+	return mountpoint, backingDev, nil
+}
+
+func clearFSInfo(path string) {
+	clearMountpoint(path)
+	clearBackingDev(path)
+}
+
+func getApplier(path string) common.LinuxVolumeQuotaApplier {
+	dirApplierLock.Lock()
+	defer dirApplierLock.Unlock()
+	return dirApplierMap[path]
+}
+
+func setApplier(path string, applier common.LinuxVolumeQuotaApplier) {
+	dirApplierLock.Lock()
+	defer dirApplierLock.Unlock()
+	dirApplierMap[path] = applier
+}
+
+func clearApplier(path string) {
+	dirApplierLock.Lock()
+	defer dirApplierLock.Unlock()
+	delete(dirApplierMap, path)
+}
+
+func setQuotaOnDir(path string, id common.QuotaID, bytes int64) error {
+	return getApplier(path).SetQuotaOnDir(path, id, bytes)
+}
+
+func getQuotaOnDir(m mount.Interface, path string) (common.QuotaID, error) {
+	_, _, err := getFSInfo(m, path)
+	if err != nil {
+		return common.BadQuotaID, err
+	}
+	return getApplier(path).GetQuotaOnDir(path)
+}
+
+func clearQuotaOnDir(m mount.Interface, path string) error {
+	// Since we may be called without path being in the map,
+	// we explicitly have to check in this case.
+	klog.V(4).Infof("clearQuotaOnDir %s", path)
+	supportsQuotas, err := SupportsQuotas(m, path)
+	if !supportsQuotas {
+		return nil
+	}
+	projid, err := getQuotaOnDir(m, path)
+	if err == nil && projid != common.BadQuotaID {
+		// This means that we have a quota on the directory but
+		// we can't clear it.  That's not good.
+		err = setQuotaOnDir(path, projid, 0)
+		if err != nil {
+			klog.V(3).Infof("Attempt to clear quota failed: %v", err)
+		}
+		// Even if clearing the quota failed, we still need to
+		// try to remove the project ID, or that may be left dangling.
+		err1 := removeProjectID(path, projid)
+		if err1 != nil {
+			klog.V(3).Infof("Attempt to remove quota ID from system files failed: %v", err1)
+		}
+		clearFSInfo(path)
+		if err != nil {
+			return err
+		}
+		return err1
+	}
+	// If we couldn't get a quota, that's fine -- there may
+	// never have been one, and we have no way to know otherwise
+	klog.V(3).Infof("clearQuotaOnDir fails %v", err)
+	return nil
+}
+
+// SupportsQuotas -- Does the path support quotas
+// Cache the applier for paths that support quotas.  For paths that don't,
+// don't cache the result because nothing will clean it up.
+// However, do cache the device->applier map; the number of devices
+// is bounded.
+func SupportsQuotas(m mount.Interface, path string) (bool, error) {
+	if !enabledQuotasForMonitoring() {
+		klog.V(3).Info("SupportsQuotas called, but quotas disabled")
+		return false, nil
+	}
+	supportsQuotasLock.Lock()
+	defer supportsQuotasLock.Unlock()
+	if supportsQuotas, ok := supportsQuotasMap[path]; ok {
+		return supportsQuotas, nil
+	}
+	mount, dev, err := getFSInfo(m, path)
+	if err != nil {
+		return false, err
+	}
+	// Do we know about this device?
+	applier, ok := devApplierMap[mount]
+	if !ok {
+		for _, provider := range providers {
+			if applier = provider.GetQuotaApplier(mount, dev); applier != nil {
+				devApplierMap[mount] = applier
+				break
+			}
+		}
+	}
+	if applier != nil {
+		supportsQuotasMap[path] = true
+		setApplier(path, applier)
+		return true, nil
+	}
+	delete(backingDevMap, path)
+	delete(mountpointMap, path)
+	return false, nil
+}
+
+// AssignQuota -- assign a quota to the specified directory.
+// AssignQuota chooses the quota ID based on the pod UID and path.
+// If the pod UID is identical to another one known, it may (but presently
+// doesn't) choose the same quota ID as other volumes in the pod.
+func AssignQuota(m mount.Interface, path string, poduid types.UID, bytes *resource.Quantity) error {
+	if bytes == nil {
+		return fmt.Errorf("Attempting to assign null quota to %s", path)
+	}
+	ibytes := bytes.Value()
+	if ok, err := SupportsQuotas(m, path); !ok {
+		return fmt.Errorf("Quotas not supported on %s: %v", path, err)
+	}
+	quotaLock.Lock()
+	defer quotaLock.Unlock()
+	// Current policy is to set individual quotas on each volumes.
+	// If we decide later that we want to assign one quota for all
+	// volumes in a pod, we can simply remove this line of code.
+	// If and when we decide permanently that we're going to adop
+	// one quota per volume, we can rip all of the pod code out.
+	poduid = types.UID(uuid.NewUUID())
+	if pod, ok := dirPodMap[path]; ok && pod != poduid {
+		return fmt.Errorf("Requesting quota on existing directory %s but different pod %s %s", path, pod, poduid)
+	}
+	oid, ok := podQuotaMap[poduid]
+	if ok {
+		if quotaSizeMap[oid] != ibytes {
+			return fmt.Errorf("Requesting quota of different size: old %v new %v", quotaSizeMap[oid], bytes)
+		}
+	} else {
+		oid = common.BadQuotaID
+	}
+	id, err := createProjectID(path, oid)
+	if err == nil {
+		if oid != common.BadQuotaID && oid != id {
+			return fmt.Errorf("Attempt to reassign quota %v to %v", oid, id)
+		}
+		// When enforcing quotas are enabled, we'll condition this
+		// on their being disabled also.
+		if ibytes > 0 {
+			ibytes = -1
+		}
+		if err = setQuotaOnDir(path, id, ibytes); err == nil {
+			quotaPodMap[id] = poduid
+			quotaSizeMap[id] = ibytes
+			podQuotaMap[poduid] = id
+			dirQuotaMap[path] = id
+			dirPodMap[path] = poduid
+			podDirCountMap[poduid]++
+			klog.V(4).Infof("Assigning quota ID %d (%d) to %s", id, ibytes, path)
+			return nil
+		}
+		removeProjectID(path, id)
+	}
+	return fmt.Errorf("Assign quota FAILED %v", err)
+}
+
+// GetConsumption -- retrieve the consumption (in bytes) of the directory
+func GetConsumption(path string) (*resource.Quantity, error) {
+	// Note that we actually need to hold the lock at least through
+	// running the quota command, so it can't get recycled behind our back
+	quotaLock.Lock()
+	defer quotaLock.Unlock()
+	applier := getApplier(path)
+	// No applier means directory is not under quota management
+	if applier == nil {
+		return nil, nil
+	}
+	ibytes, err := applier.GetConsumption(path, dirQuotaMap[path])
+	if err != nil {
+		return nil, err
+	}
+	return resource.NewQuantity(ibytes, resource.DecimalSI), nil
+}
+
+// GetInodes -- retrieve the number of inodes in use under the directory
+func GetInodes(path string) (*resource.Quantity, error) {
+	// Note that we actually need to hold the lock at least through
+	// running the quota command, so it can't get recycled behind our back
+	quotaLock.Lock()
+	defer quotaLock.Unlock()
+	applier := getApplier(path)
+	// No applier means directory is not under quota management
+	if applier == nil {
+		return nil, nil
+	}
+	inodes, err := applier.GetInodes(path, dirQuotaMap[path])
+	if err != nil {
+		return nil, err
+	}
+	return resource.NewQuantity(inodes, resource.DecimalSI), nil
+}
+
+// ClearQuota -- remove the quota assigned to a directory
+func ClearQuota(m mount.Interface, path string) error {
+	klog.V(3).Infof("ClearQuota %s", path)
+	if !enabledQuotasForMonitoring() {
+		return fmt.Errorf("ClearQuota called, but quotas disabled")
+	}
+	quotaLock.Lock()
+	defer quotaLock.Unlock()
+	poduid, ok := dirPodMap[path]
+	if !ok {
+		// Nothing in the map either means that there was no
+		// quota to begin with or that we're clearing a
+		// stale directory, so if we find a quota, just remove it.
+		// The process of clearing the quota requires that an applier
+		// be found, which needs to be cleaned up.
+		defer delete(supportsQuotasMap, path)
+		defer clearApplier(path)
+		return clearQuotaOnDir(m, path)
+	}
+	_, ok = podQuotaMap[poduid]
+	if !ok {
+		return fmt.Errorf("ClearQuota: No quota available for %s", path)
+	}
+	var err error
+	projid, err := getQuotaOnDir(m, path)
+	if projid != dirQuotaMap[path] {
+		return fmt.Errorf("Expected quota ID %v on dir %s does not match actual %v", dirQuotaMap[path], path, projid)
+	}
+	count, ok := podDirCountMap[poduid]
+	if count <= 1 || !ok {
+		err = clearQuotaOnDir(m, path)
+		// This error should be noted; we still need to clean up
+		// and otherwise handle in the same way.
+		if err != nil {
+			klog.V(3).Infof("Unable to clear quota %v %s: %v", dirQuotaMap[path], path, err)
+		}
+		delete(quotaSizeMap, podQuotaMap[poduid])
+		delete(quotaPodMap, podQuotaMap[poduid])
+		delete(podDirCountMap, poduid)
+		delete(podQuotaMap, poduid)
+	} else {
+		err = removeProjectID(path, projid)
+		podDirCountMap[poduid]--
+		klog.V(4).Infof("Not clearing quota for pod %s; still %v dirs outstanding", poduid, podDirCountMap[poduid])
+	}
+	delete(dirPodMap, path)
+	delete(dirQuotaMap, path)
+	delete(supportsQuotasMap, path)
+	clearApplier(path)
+	if err != nil {
+		return fmt.Errorf("Unable to clear quota for %s: %v", path, err)
+	}
+	return nil
+}

vendor/k8s.io/kubernetes/pkg/volume/util/fsquota/quota_unsupported.go

@@ -0,0 +1,58 @@
+// +build !linux
+
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fsquota
+
+import (
+	"errors"
+
+	"k8s.io/utils/mount"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// Dummy quota implementation for systems that do not implement support
+// for volume quotas
+
+var errNotImplemented = errors.New("not implemented")
+
+// SupportsQuotas -- dummy implementation
+func SupportsQuotas(_ mount.Interface, _ string) (bool, error) {
+	return false, errNotImplemented
+}
+
+// AssignQuota -- dummy implementation
+func AssignQuota(_ mount.Interface, _ string, _ types.UID, _ *resource.Quantity) error {
+	return errNotImplemented
+}
+
+// GetConsumption -- dummy implementation
+func GetConsumption(_ string) (*resource.Quantity, error) {
+	return nil, errNotImplemented
+}
+
+// GetInodes -- dummy implementation
+func GetInodes(_ string) (*resource.Quantity, error) {
+	return nil, errNotImplemented
+}
+
+// ClearQuota -- dummy implementation
+func ClearQuota(_ mount.Interface, _ string) error {
+	return errNotImplemented
+}