vendor files

vendor/k8s.io/kubernetes/pkg/quota/BUILD

@@ -0,0 +1,55 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "interfaces.go",
+        "resources.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/quota",
+    deps = [
+        "//pkg/apis/core:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
+        "//vendor/k8s.io/client-go/tools/cache:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["resources_test.go"],
+    importpath = "k8s.io/kubernetes/pkg/quota",
+    library = ":go_default_library",
+    deps = [
+        "//pkg/apis/core:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//pkg/quota/evaluator/core:all-srcs",
+        "//pkg/quota/generic:all-srcs",
+        "//pkg/quota/install:all-srcs",
+    ],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/quota/OWNERS

@@ -0,0 +1,8 @@
+approvers:
+- derekwaynecarr
+- vishh
+reviewers:
+- smarterclayton
+- deads2k
+- derekwaynecarr
+- vishh

vendor/k8s.io/kubernetes/pkg/quota/evaluator/OWNERS

@@ -0,0 +1,5 @@
+reviewers:
+- smarterclayton
+- deads2k
+- derekwaynecarr
+- vishh

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/BUILD

@@ -0,0 +1,76 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "persistent_volume_claims.go",
+        "pods.go",
+        "registry.go",
+        "services.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/quota/evaluator/core",
+    deps = [
+        "//pkg/apis/core:go_default_library",
+        "//pkg/apis/core/helper:go_default_library",
+        "//pkg/apis/core/helper/qos:go_default_library",
+        "//pkg/apis/core/v1:go_default_library",
+        "//pkg/apis/core/validation:go_default_library",
+        "//pkg/features:go_default_library",
+        "//pkg/kubeapiserver/admission/util:go_default_library",
+        "//pkg/quota:go_default_library",
+        "//pkg/quota/generic:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/clock:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/initialization:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/validation/field:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/features:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/util/feature:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "persistent_volume_claims_test.go",
+        "pods_test.go",
+        "services_test.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/quota/evaluator/core",
+    library = ":go_default_library",
+    deps = [
+        "//pkg/apis/core:go_default_library",
+        "//pkg/quota:go_default_library",
+        "//pkg/quota/generic:go_default_library",
+        "//pkg/util/node:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/clock:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/doc.go

@@ -0,0 +1,18 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// core contains modules that interface with the core api group
+package core // import "k8s.io/kubernetes/pkg/quota/evaluator/core"

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/persistent_volume_claims.go

@@ -0,0 +1,208 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"fmt"
+	"strings"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/initialization"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/features"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/apis/core/helper"
+	k8s_api_v1 "k8s.io/kubernetes/pkg/apis/core/v1"
+	k8sfeatures "k8s.io/kubernetes/pkg/features"
+	"k8s.io/kubernetes/pkg/kubeapiserver/admission/util"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// the name used for object count quota
+var pvcObjectCountName = generic.ObjectCountQuotaResourceNameFor(v1.SchemeGroupVersion.WithResource("persistentvolumeclaims").GroupResource())
+
+// pvcResources are the set of static resources managed by quota associated with pvcs.
+// for each resouce in this list, it may be refined dynamically based on storage class.
+var pvcResources = []api.ResourceName{
+	api.ResourcePersistentVolumeClaims,
+	api.ResourceRequestsStorage,
+}
+
+// storageClassSuffix is the suffix to the qualified portion of storage class resource name.
+// For example, if you want to quota storage by storage class, you would have a declaration
+// that follows <storage-class>.storageclass.storage.k8s.io/<resource>.
+// For example:
+// * gold.storageclass.storage.k8s.io/: 500Gi
+// * bronze.storageclass.storage.k8s.io/requests.storage: 500Gi
+const storageClassSuffix string = ".storageclass.storage.k8s.io/"
+
+// ResourceByStorageClass returns a quota resource name by storage class.
+func ResourceByStorageClass(storageClass string, resourceName api.ResourceName) api.ResourceName {
+	return api.ResourceName(string(storageClass + storageClassSuffix + string(resourceName)))
+}
+
+// V1ResourceByStorageClass returns a quota resource name by storage class.
+func V1ResourceByStorageClass(storageClass string, resourceName v1.ResourceName) v1.ResourceName {
+	return v1.ResourceName(string(storageClass + storageClassSuffix + string(resourceName)))
+}
+
+// NewPersistentVolumeClaimEvaluator returns an evaluator that can evaluate persistent volume claims
+func NewPersistentVolumeClaimEvaluator(f quota.ListerForResourceFunc) quota.Evaluator {
+	listFuncByNamespace := generic.ListResourceUsingListerFunc(f, v1.SchemeGroupVersion.WithResource("persistentvolumeclaims"))
+	pvcEvaluator := &pvcEvaluator{listFuncByNamespace: listFuncByNamespace}
+	return pvcEvaluator
+}
+
+// pvcEvaluator knows how to evaluate quota usage for persistent volume claims
+type pvcEvaluator struct {
+	// listFuncByNamespace knows how to list pvc claims
+	listFuncByNamespace generic.ListFuncByNamespace
+}
+
+// Constraints verifies that all required resources are present on the item.
+func (p *pvcEvaluator) Constraints(required []api.ResourceName, item runtime.Object) error {
+	// no-op for persistent volume claims
+	return nil
+}
+
+// GroupResource that this evaluator tracks
+func (p *pvcEvaluator) GroupResource() schema.GroupResource {
+	return v1.SchemeGroupVersion.WithResource("persistentvolumeclaims").GroupResource()
+}
+
+// Handles returns true if the evaluator should handle the specified operation.
+func (p *pvcEvaluator) Handles(a admission.Attributes) bool {
+	op := a.GetOperation()
+	if op == admission.Create {
+		return true
+	}
+	if op == admission.Update && utilfeature.DefaultFeatureGate.Enabled(k8sfeatures.ExpandPersistentVolumes) {
+		initialized, err := initialization.IsObjectInitialized(a.GetObject())
+		if err != nil {
+			// fail closed, will try to give an evaluation.
+			utilruntime.HandleError(err)
+			return true
+		}
+		// only handle the update if the object is initialized after the update.
+		return initialized
+	}
+	// TODO: when the ExpandPersistentVolumes feature gate is removed, remove
+	// the initializationCompletion check as well, because it will become a
+	// subset of the "initialized" condition.
+	initializationCompletion, err := util.IsInitializationCompletion(a)
+	if err != nil {
+		// fail closed, will try to give an evaluation.
+		utilruntime.HandleError(err)
+		return true
+	}
+	return initializationCompletion
+}
+
+// Matches returns true if the evaluator matches the specified quota with the provided input item
+func (p *pvcEvaluator) Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error) {
+	return generic.Matches(resourceQuota, item, p.MatchingResources, generic.MatchesNoScopeFunc)
+}
+
+// MatchingResources takes the input specified list of resources and returns the set of resources it matches.
+func (p *pvcEvaluator) MatchingResources(items []api.ResourceName) []api.ResourceName {
+	result := []api.ResourceName{}
+	for _, item := range items {
+		// match object count quota fields
+		if quota.Contains([]api.ResourceName{pvcObjectCountName}, item) {
+			result = append(result, item)
+			continue
+		}
+		// match pvc resources
+		if quota.Contains(pvcResources, item) {
+			result = append(result, item)
+			continue
+		}
+		// match pvc resources scoped by storage class (<storage-class-name>.storage-class.kubernetes.io/<resource>)
+		for _, resource := range pvcResources {
+			byStorageClass := storageClassSuffix + string(resource)
+			if strings.HasSuffix(string(item), byStorageClass) {
+				result = append(result, item)
+				break
+			}
+		}
+	}
+	return result
+}
+
+// Usage knows how to measure usage associated with item.
+func (p *pvcEvaluator) Usage(item runtime.Object) (api.ResourceList, error) {
+	result := api.ResourceList{}
+	pvc, err := toInternalPersistentVolumeClaimOrError(item)
+	if err != nil {
+		return result, err
+	}
+
+	// charge for claim
+	result[api.ResourcePersistentVolumeClaims] = *(resource.NewQuantity(1, resource.DecimalSI))
+	result[pvcObjectCountName] = *(resource.NewQuantity(1, resource.DecimalSI))
+	if utilfeature.DefaultFeatureGate.Enabled(features.Initializers) {
+		if !initialization.IsInitialized(pvc.Initializers) {
+			// Only charge pvc count for uninitialized pvc.
+			return result, nil
+		}
+	}
+	storageClassRef := helper.GetPersistentVolumeClaimClass(pvc)
+	if len(storageClassRef) > 0 {
+		storageClassClaim := api.ResourceName(storageClassRef + storageClassSuffix + string(api.ResourcePersistentVolumeClaims))
+		result[storageClassClaim] = *(resource.NewQuantity(1, resource.DecimalSI))
+	}
+
+	// charge for storage
+	if request, found := pvc.Spec.Resources.Requests[api.ResourceStorage]; found {
+		result[api.ResourceRequestsStorage] = request
+		// charge usage to the storage class (if present)
+		if len(storageClassRef) > 0 {
+			storageClassStorage := api.ResourceName(storageClassRef + storageClassSuffix + string(api.ResourceRequestsStorage))
+			result[storageClassStorage] = request
+		}
+	}
+	return result, nil
+}
+
+// UsageStats calculates aggregate usage for the object.
+func (p *pvcEvaluator) UsageStats(options quota.UsageStatsOptions) (quota.UsageStats, error) {
+	return generic.CalculateUsageStats(options, p.listFuncByNamespace, generic.MatchesNoScopeFunc, p.Usage)
+}
+
+// ensure we implement required interface
+var _ quota.Evaluator = &pvcEvaluator{}
+
+func toInternalPersistentVolumeClaimOrError(obj runtime.Object) (*api.PersistentVolumeClaim, error) {
+	pvc := &api.PersistentVolumeClaim{}
+	switch t := obj.(type) {
+	case *v1.PersistentVolumeClaim:
+		if err := k8s_api_v1.Convert_v1_PersistentVolumeClaim_To_core_PersistentVolumeClaim(t, pvc, nil); err != nil {
+			return nil, err
+		}
+	case *api.PersistentVolumeClaim:
+		pvc = t
+	default:
+		return nil, fmt.Errorf("expect *api.PersistentVolumeClaim or *v1.PersistentVolumeClaim, got %v", t)
+	}
+	return pvc, nil
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/persistent_volume_claims_test.go

@@ -0,0 +1,112 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+func testVolumeClaim(name string, namespace string, spec api.PersistentVolumeClaimSpec) *api.PersistentVolumeClaim {
+	return &api.PersistentVolumeClaim{
+		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace},
+		Spec:       spec,
+	}
+}
+
+func TestPersistentVolumeClaimEvaluatorUsage(t *testing.T) {
+	classGold := "gold"
+	validClaim := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{
+				api.ResourceName(api.ResourceStorage): resource.MustParse("10Gi"),
+			},
+		},
+	})
+	validClaimByStorageClass := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{
+				api.ResourceName(api.ResourceStorage): resource.MustParse("10Gi"),
+			},
+		},
+		StorageClassName: &classGold,
+	})
+
+	evaluator := NewPersistentVolumeClaimEvaluator(nil)
+	testCases := map[string]struct {
+		pvc   *api.PersistentVolumeClaim
+		usage api.ResourceList
+	}{
+		"pvc-usage": {
+			pvc: validClaim,
+			usage: api.ResourceList{
+				api.ResourceRequestsStorage:                                                                       resource.MustParse("10Gi"),
+				api.ResourcePersistentVolumeClaims:                                                                resource.MustParse("1"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "persistentvolumeclaims"}): resource.MustParse("1"),
+			},
+		},
+		"pvc-usage-by-class": {
+			pvc: validClaimByStorageClass,
+			usage: api.ResourceList{
+				api.ResourceRequestsStorage:                                                                       resource.MustParse("10Gi"),
+				api.ResourcePersistentVolumeClaims:                                                                resource.MustParse("1"),
+				ResourceByStorageClass(classGold, api.ResourceRequestsStorage):                                    resource.MustParse("10Gi"),
+				ResourceByStorageClass(classGold, api.ResourcePersistentVolumeClaims):                             resource.MustParse("1"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "persistentvolumeclaims"}): resource.MustParse("1"),
+			},
+		},
+	}
+	for testName, testCase := range testCases {
+		actual, err := evaluator.Usage(testCase.pvc)
+		if err != nil {
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
+		if !quota.Equals(testCase.usage, actual) {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.usage, actual)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/pods.go

@@ -0,0 +1,393 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	"k8s.io/apimachinery/pkg/util/clock"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/apiserver/pkg/admission"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/apis/core/helper/qos"
+	k8s_api_v1 "k8s.io/kubernetes/pkg/apis/core/v1"
+	"k8s.io/kubernetes/pkg/apis/core/validation"
+	"k8s.io/kubernetes/pkg/kubeapiserver/admission/util"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// the name used for object count quota
+var podObjectCountName = generic.ObjectCountQuotaResourceNameFor(v1.SchemeGroupVersion.WithResource("pods").GroupResource())
+
+// podResources are the set of resources managed by quota associated with pods.
+var podResources = []api.ResourceName{
+	podObjectCountName,
+	api.ResourceCPU,
+	api.ResourceMemory,
+	api.ResourceEphemeralStorage,
+	api.ResourceRequestsCPU,
+	api.ResourceRequestsMemory,
+	api.ResourceRequestsEphemeralStorage,
+	api.ResourceLimitsCPU,
+	api.ResourceLimitsMemory,
+	api.ResourceLimitsEphemeralStorage,
+	api.ResourcePods,
+}
+
+// podResourcePrefixes are the set of prefixes for resources (Hugepages, and other
+// potential extended reources with specific prefix) managed by quota associated with pods.
+var podResourcePrefixes = []string{
+	api.ResourceHugePagesPrefix,
+	api.ResourceRequestsHugePagesPrefix,
+}
+
+// requestedResourcePrefixes are the set of prefixes for resources
+// that might be declared in pod's Resources.Requests/Limits
+var requestedResourcePrefixes = []string{
+	api.ResourceHugePagesPrefix,
+}
+
+const (
+	requestsPrefix = "requests."
+	limitsPrefix   = "limits."
+)
+
+// maskResourceWithPrefix mask resource with certain prefix
+// e.g. hugepages-XXX -> requests.hugepages-XXX
+func maskResourceWithPrefix(resource api.ResourceName, prefix string) api.ResourceName {
+	return api.ResourceName(fmt.Sprintf("%s%s", prefix, string(resource)))
+}
+
+// NOTE: it was a mistake, but if a quota tracks cpu or memory related resources,
+// the incoming pod is required to have those values set.  we should not repeat
+// this mistake for other future resources (gpus, ephemeral-storage,etc).
+// do not add more resources to this list!
+var validationSet = sets.NewString(
+	string(api.ResourceCPU),
+	string(api.ResourceMemory),
+	string(api.ResourceRequestsCPU),
+	string(api.ResourceRequestsMemory),
+	string(api.ResourceLimitsCPU),
+	string(api.ResourceLimitsMemory),
+)
+
+// NewPodEvaluator returns an evaluator that can evaluate pods
+func NewPodEvaluator(f quota.ListerForResourceFunc, clock clock.Clock) quota.Evaluator {
+	listFuncByNamespace := generic.ListResourceUsingListerFunc(f, v1.SchemeGroupVersion.WithResource("pods"))
+	podEvaluator := &podEvaluator{listFuncByNamespace: listFuncByNamespace, clock: clock}
+	return podEvaluator
+}
+
+// podEvaluator knows how to measure usage of pods.
+type podEvaluator struct {
+	// knows how to list pods
+	listFuncByNamespace generic.ListFuncByNamespace
+	// used to track time
+	clock clock.Clock
+}
+
+// Constraints verifies that all required resources are present on the pod
+// In addition, it validates that the resources are valid (i.e. requests < limits)
+func (p *podEvaluator) Constraints(required []api.ResourceName, item runtime.Object) error {
+	pod, ok := item.(*api.Pod)
+	if !ok {
+		return fmt.Errorf("Unexpected input object %v", item)
+	}
+
+	// Pod level resources are often set during admission control
+	// As a consequence, we want to verify that resources are valid prior
+	// to ever charging quota prematurely in case they are not.
+	// TODO remove this entire section when we have a validation step in admission.
+	allErrs := field.ErrorList{}
+	fldPath := field.NewPath("spec").Child("containers")
+	for i, ctr := range pod.Spec.Containers {
+		allErrs = append(allErrs, validation.ValidateResourceRequirements(&ctr.Resources, fldPath.Index(i).Child("resources"))...)
+	}
+	fldPath = field.NewPath("spec").Child("initContainers")
+	for i, ctr := range pod.Spec.InitContainers {
+		allErrs = append(allErrs, validation.ValidateResourceRequirements(&ctr.Resources, fldPath.Index(i).Child("resources"))...)
+	}
+	if len(allErrs) > 0 {
+		return allErrs.ToAggregate()
+	}
+
+	// BACKWARD COMPATIBILITY REQUIREMENT: if we quota cpu or memory, then each container
+	// must make an explicit request for the resource.  this was a mistake.  it coupled
+	// validation with resource counting, but we did this before QoS was even defined.
+	// let's not make that mistake again with other resources now that QoS is defined.
+	requiredSet := quota.ToSet(required).Intersection(validationSet)
+	missingSet := sets.NewString()
+	for i := range pod.Spec.Containers {
+		enforcePodContainerConstraints(&pod.Spec.Containers[i], requiredSet, missingSet)
+	}
+	for i := range pod.Spec.InitContainers {
+		enforcePodContainerConstraints(&pod.Spec.InitContainers[i], requiredSet, missingSet)
+	}
+	if len(missingSet) == 0 {
+		return nil
+	}
+	return fmt.Errorf("must specify %s", strings.Join(missingSet.List(), ","))
+}
+
+// GroupResource that this evaluator tracks
+func (p *podEvaluator) GroupResource() schema.GroupResource {
+	return v1.SchemeGroupVersion.WithResource("pods").GroupResource()
+}
+
+// Handles returns true if the evaluator should handle the specified attributes.
+func (p *podEvaluator) Handles(a admission.Attributes) bool {
+	op := a.GetOperation()
+	if op == admission.Create {
+		return true
+	}
+	initializationCompletion, err := util.IsInitializationCompletion(a)
+	if err != nil {
+		// fail closed, will try to give an evaluation.
+		utilruntime.HandleError(err)
+		return true
+	}
+	// only uninitialized pods might be updated.
+	return initializationCompletion
+}
+
+// Matches returns true if the evaluator matches the specified quota with the provided input item
+func (p *podEvaluator) Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error) {
+	return generic.Matches(resourceQuota, item, p.MatchingResources, podMatchesScopeFunc)
+}
+
+// MatchingResources takes the input specified list of resources and returns the set of resources it matches.
+func (p *podEvaluator) MatchingResources(input []api.ResourceName) []api.ResourceName {
+	result := quota.Intersection(input, podResources)
+	for _, resource := range input {
+		if quota.ContainsPrefix(podResourcePrefixes, resource) {
+			result = append(result, resource)
+		}
+	}
+
+	return result
+}
+
+// Usage knows how to measure usage associated with pods
+func (p *podEvaluator) Usage(item runtime.Object) (api.ResourceList, error) {
+	// delegate to normal usage
+	return PodUsageFunc(item, p.clock)
+}
+
+// UsageStats calculates aggregate usage for the object.
+func (p *podEvaluator) UsageStats(options quota.UsageStatsOptions) (quota.UsageStats, error) {
+	return generic.CalculateUsageStats(options, p.listFuncByNamespace, podMatchesScopeFunc, p.Usage)
+}
+
+// verifies we implement the required interface.
+var _ quota.Evaluator = &podEvaluator{}
+
+// enforcePodContainerConstraints checks for required resources that are not set on this container and
+// adds them to missingSet.
+func enforcePodContainerConstraints(container *api.Container, requiredSet, missingSet sets.String) {
+	requests := container.Resources.Requests
+	limits := container.Resources.Limits
+	containerUsage := podComputeUsageHelper(requests, limits)
+	containerSet := quota.ToSet(quota.ResourceNames(containerUsage))
+	if !containerSet.Equal(requiredSet) {
+		difference := requiredSet.Difference(containerSet)
+		missingSet.Insert(difference.List()...)
+	}
+}
+
+// podComputeUsageHelper can summarize the pod compute quota usage based on requests and limits
+func podComputeUsageHelper(requests api.ResourceList, limits api.ResourceList) api.ResourceList {
+	result := api.ResourceList{}
+	result[api.ResourcePods] = resource.MustParse("1")
+	if request, found := requests[api.ResourceCPU]; found {
+		result[api.ResourceCPU] = request
+		result[api.ResourceRequestsCPU] = request
+	}
+	if limit, found := limits[api.ResourceCPU]; found {
+		result[api.ResourceLimitsCPU] = limit
+	}
+	if request, found := requests[api.ResourceMemory]; found {
+		result[api.ResourceMemory] = request
+		result[api.ResourceRequestsMemory] = request
+	}
+	if limit, found := limits[api.ResourceMemory]; found {
+		result[api.ResourceLimitsMemory] = limit
+	}
+	if request, found := requests[api.ResourceEphemeralStorage]; found {
+		result[api.ResourceEphemeralStorage] = request
+		result[api.ResourceRequestsEphemeralStorage] = request
+	}
+	if limit, found := limits[api.ResourceEphemeralStorage]; found {
+		result[api.ResourceLimitsEphemeralStorage] = limit
+	}
+	for resource, request := range requests {
+		if quota.ContainsPrefix(requestedResourcePrefixes, resource) {
+			result[resource] = request
+			result[maskResourceWithPrefix(resource, requestsPrefix)] = request
+		}
+	}
+	for resource, limit := range limits {
+		if quota.ContainsPrefix(requestedResourcePrefixes, resource) {
+			result[maskResourceWithPrefix(resource, limitsPrefix)] = limit
+		}
+	}
+
+	return result
+}
+
+func toInternalPodOrError(obj runtime.Object) (*api.Pod, error) {
+	pod := &api.Pod{}
+	switch t := obj.(type) {
+	case *v1.Pod:
+		if err := k8s_api_v1.Convert_v1_Pod_To_core_Pod(t, pod, nil); err != nil {
+			return nil, err
+		}
+	case *api.Pod:
+		pod = t
+	default:
+		return nil, fmt.Errorf("expect *api.Pod or *v1.Pod, got %v", t)
+	}
+	return pod, nil
+}
+
+// podMatchesScopeFunc is a function that knows how to evaluate if a pod matches a scope
+func podMatchesScopeFunc(scope api.ResourceQuotaScope, object runtime.Object) (bool, error) {
+	pod, err := toInternalPodOrError(object)
+	if err != nil {
+		return false, err
+	}
+	switch scope {
+	case api.ResourceQuotaScopeTerminating:
+		return isTerminating(pod), nil
+	case api.ResourceQuotaScopeNotTerminating:
+		return !isTerminating(pod), nil
+	case api.ResourceQuotaScopeBestEffort:
+		return isBestEffort(pod), nil
+	case api.ResourceQuotaScopeNotBestEffort:
+		return !isBestEffort(pod), nil
+	}
+	return false, nil
+}
+
+// PodUsageFunc returns the quota usage for a pod.
+// A pod is charged for quota if the following are not true.
+//  - pod has a terminal phase (failed or succeeded)
+//  - pod has been marked for deletion and grace period has expired
+func PodUsageFunc(obj runtime.Object, clock clock.Clock) (api.ResourceList, error) {
+	pod, err := toInternalPodOrError(obj)
+	if err != nil {
+		return api.ResourceList{}, err
+	}
+
+	// always quota the object count (even if the pod is end of life)
+	// object count quotas track all objects that are in storage.
+	// where "pods" tracks all pods that have not reached a terminal state,
+	// count/pods tracks all pods independent of state.
+	result := api.ResourceList{
+		podObjectCountName: *(resource.NewQuantity(1, resource.DecimalSI)),
+	}
+
+	// by convention, we do not quota compute resources that have reached end-of life
+	// note: the "pods" resource is considered a compute resource since it is tied to life-cycle.
+	if !QuotaPod(pod, clock) {
+		return result, nil
+	}
+
+	requests := api.ResourceList{}
+	limits := api.ResourceList{}
+	// TODO: ideally, we have pod level requests and limits in the future.
+	for i := range pod.Spec.Containers {
+		requests = quota.Add(requests, pod.Spec.Containers[i].Resources.Requests)
+		limits = quota.Add(limits, pod.Spec.Containers[i].Resources.Limits)
+	}
+	// InitContainers are run sequentially before other containers start, so the highest
+	// init container resource is compared against the sum of app containers to determine
+	// the effective usage for both requests and limits.
+	for i := range pod.Spec.InitContainers {
+		requests = quota.Max(requests, pod.Spec.InitContainers[i].Resources.Requests)
+		limits = quota.Max(limits, pod.Spec.InitContainers[i].Resources.Limits)
+	}
+
+	result = quota.Add(result, podComputeUsageHelper(requests, limits))
+	return result, nil
+}
+
+func isBestEffort(pod *api.Pod) bool {
+	return qos.GetPodQOS(pod) == api.PodQOSBestEffort
+}
+
+func isTerminating(pod *api.Pod) bool {
+	if pod.Spec.ActiveDeadlineSeconds != nil && *pod.Spec.ActiveDeadlineSeconds >= int64(0) {
+		return true
+	}
+	return false
+}
+
+// QuotaPod returns true if the pod is eligible to track against a quota
+// A pod is eligible for quota, unless any of the following are true:
+//  - pod has a terminal phase (failed or succeeded)
+//  - pod has been marked for deletion and grace period has expired.
+func QuotaPod(pod *api.Pod, clock clock.Clock) bool {
+	// if pod is terminal, ignore it for quota
+	if api.PodFailed == pod.Status.Phase || api.PodSucceeded == pod.Status.Phase {
+		return false
+	}
+	// deleted pods that should be gone should not be charged to user quota.
+	// this can happen if a node is lost, and the kubelet is never able to confirm deletion.
+	// even though the cluster may have drifting clocks, quota makes a reasonable effort
+	// to balance cluster needs against user needs.  user's do not control clocks,
+	// but at worst a small drive in clocks will only slightly impact quota.
+	if pod.DeletionTimestamp != nil && pod.DeletionGracePeriodSeconds != nil {
+		now := clock.Now()
+		deletionTime := pod.DeletionTimestamp.Time
+		gracePeriod := time.Duration(*pod.DeletionGracePeriodSeconds) * time.Second
+		if now.After(deletionTime.Add(gracePeriod)) {
+			return false
+		}
+	}
+	return true
+}
+
+// QuotaV1Pod returns true if the pod is eligible to track against a quota
+// if it's not in a terminal state according to its phase.
+func QuotaV1Pod(pod *v1.Pod, clock clock.Clock) bool {
+	// if pod is terminal, ignore it for quota
+	if v1.PodFailed == pod.Status.Phase || v1.PodSucceeded == pod.Status.Phase {
+		return false
+	}
+	// if pods are stuck terminating (for example, a node is lost), we do not want
+	// to charge the user for that pod in quota because it could prevent them from
+	// scaling up new pods to service their application.
+	if pod.DeletionTimestamp != nil && pod.DeletionGracePeriodSeconds != nil {
+		now := clock.Now()
+		deletionTime := pod.DeletionTimestamp.Time
+		gracePeriod := time.Duration(*pod.DeletionGracePeriodSeconds) * time.Second
+		if now.After(deletionTime.Add(gracePeriod)) {
+			return false
+		}
+	}
+	return true
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/pods_test.go

@@ -0,0 +1,410 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/clock"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+	"k8s.io/kubernetes/pkg/util/node"
+)
+
+func TestPodConstraintsFunc(t *testing.T) {
+	testCases := map[string]struct {
+		pod      *api.Pod
+		required []api.ResourceName
+		err      string
+	}{
+		"init container resource invalid": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					InitContainers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceCPU: resource.MustParse("2m")},
+							Limits:   api.ResourceList{api.ResourceCPU: resource.MustParse("1m")},
+						},
+					}},
+				},
+			},
+			err: `spec.initContainers[0].resources.requests: Invalid value: "2m": must be less than or equal to cpu limit`,
+		},
+		"container resource invalid": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					Containers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceCPU: resource.MustParse("2m")},
+							Limits:   api.ResourceList{api.ResourceCPU: resource.MustParse("1m")},
+						},
+					}},
+				},
+			},
+			err: `spec.containers[0].resources.requests: Invalid value: "2m": must be less than or equal to cpu limit`,
+		},
+		"init container resource missing": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					InitContainers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceCPU: resource.MustParse("1m")},
+							Limits:   api.ResourceList{api.ResourceCPU: resource.MustParse("2m")},
+						},
+					}},
+				},
+			},
+			required: []api.ResourceName{api.ResourceMemory},
+			err:      `must specify memory`,
+		},
+		"container resource missing": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					Containers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceCPU: resource.MustParse("1m")},
+							Limits:   api.ResourceList{api.ResourceCPU: resource.MustParse("2m")},
+						},
+					}},
+				},
+			},
+			required: []api.ResourceName{api.ResourceMemory},
+			err:      `must specify memory`,
+		},
+	}
+	evaluator := NewPodEvaluator(nil, clock.RealClock{})
+	for testName, test := range testCases {
+		err := evaluator.Constraints(test.required, test.pod)
+		switch {
+		case err != nil && len(test.err) == 0,
+			err == nil && len(test.err) != 0,
+			err != nil && test.err != err.Error():
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
+	}
+}
+
+func TestPodEvaluatorUsage(t *testing.T) {
+	fakeClock := clock.NewFakeClock(time.Now())
+	evaluator := NewPodEvaluator(nil, fakeClock)
+
+	// fields use to simulate a pod undergoing termination
+	// note: we set the deletion time in the past
+	now := fakeClock.Now()
+	terminationGracePeriodSeconds := int64(30)
+	deletionTimestampPastGracePeriod := metav1.NewTime(now.Add(time.Duration(terminationGracePeriodSeconds) * time.Second * time.Duration(-2)))
+	deletionTimestampNotPastGracePeriod := metav1.NewTime(fakeClock.Now())
+
+	testCases := map[string]struct {
+		pod   *api.Pod
+		usage api.ResourceList
+	}{
+		"init container CPU": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					InitContainers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceCPU: resource.MustParse("1m")},
+							Limits:   api.ResourceList{api.ResourceCPU: resource.MustParse("2m")},
+						},
+					}},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceRequestsCPU: resource.MustParse("1m"),
+				api.ResourceLimitsCPU:   resource.MustParse("2m"),
+				api.ResourcePods:        resource.MustParse("1"),
+				api.ResourceCPU:         resource.MustParse("1m"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "pods"}): resource.MustParse("1"),
+			},
+		},
+		"init container MEM": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					InitContainers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceMemory: resource.MustParse("1m")},
+							Limits:   api.ResourceList{api.ResourceMemory: resource.MustParse("2m")},
+						},
+					}},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceRequestsMemory: resource.MustParse("1m"),
+				api.ResourceLimitsMemory:   resource.MustParse("2m"),
+				api.ResourcePods:           resource.MustParse("1"),
+				api.ResourceMemory:         resource.MustParse("1m"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "pods"}): resource.MustParse("1"),
+			},
+		},
+		"init container local ephemeral storage": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					InitContainers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceEphemeralStorage: resource.MustParse("32Mi")},
+							Limits:   api.ResourceList{api.ResourceEphemeralStorage: resource.MustParse("64Mi")},
+						},
+					}},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceEphemeralStorage:         resource.MustParse("32Mi"),
+				api.ResourceRequestsEphemeralStorage: resource.MustParse("32Mi"),
+				api.ResourceLimitsEphemeralStorage:   resource.MustParse("64Mi"),
+				api.ResourcePods:                     resource.MustParse("1"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "pods"}): resource.MustParse("1"),
+			},
+		},
+		"init container hugepages": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					InitContainers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceName(api.ResourceHugePagesPrefix + "2Mi"): resource.MustParse("100Mi")},
+						},
+					}},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceName(api.ResourceHugePagesPrefix + "2Mi"):         resource.MustParse("100Mi"),
+				api.ResourceName(api.ResourceRequestsHugePagesPrefix + "2Mi"): resource.MustParse("100Mi"),
+				api.ResourcePods:                                              resource.MustParse("1"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "pods"}): resource.MustParse("1"),
+			},
+		},
+		"container CPU": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					Containers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceCPU: resource.MustParse("1m")},
+							Limits:   api.ResourceList{api.ResourceCPU: resource.MustParse("2m")},
+						},
+					}},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceRequestsCPU: resource.MustParse("1m"),
+				api.ResourceLimitsCPU:   resource.MustParse("2m"),
+				api.ResourcePods:        resource.MustParse("1"),
+				api.ResourceCPU:         resource.MustParse("1m"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "pods"}): resource.MustParse("1"),
+			},
+		},
+		"container MEM": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					Containers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceMemory: resource.MustParse("1m")},
+							Limits:   api.ResourceList{api.ResourceMemory: resource.MustParse("2m")},
+						},
+					}},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceRequestsMemory: resource.MustParse("1m"),
+				api.ResourceLimitsMemory:   resource.MustParse("2m"),
+				api.ResourcePods:           resource.MustParse("1"),
+				api.ResourceMemory:         resource.MustParse("1m"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "pods"}): resource.MustParse("1"),
+			},
+		},
+		"container local ephemeral storage": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					Containers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceEphemeralStorage: resource.MustParse("32Mi")},
+							Limits:   api.ResourceList{api.ResourceEphemeralStorage: resource.MustParse("64Mi")},
+						},
+					}},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceEphemeralStorage:         resource.MustParse("32Mi"),
+				api.ResourceRequestsEphemeralStorage: resource.MustParse("32Mi"),
+				api.ResourceLimitsEphemeralStorage:   resource.MustParse("64Mi"),
+				api.ResourcePods:                     resource.MustParse("1"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "pods"}): resource.MustParse("1"),
+			},
+		},
+		"container hugepages": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					Containers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceName(api.ResourceHugePagesPrefix + "2Mi"): resource.MustParse("100Mi")},
+						},
+					}},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceName(api.ResourceHugePagesPrefix + "2Mi"):         resource.MustParse("100Mi"),
+				api.ResourceName(api.ResourceRequestsHugePagesPrefix + "2Mi"): resource.MustParse("100Mi"),
+				api.ResourcePods:                                              resource.MustParse("1"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "pods"}): resource.MustParse("1"),
+			},
+		},
+		"init container maximums override sum of containers": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					InitContainers: []api.Container{
+						{
+							Resources: api.ResourceRequirements{
+								Requests: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("4"),
+									api.ResourceMemory: resource.MustParse("100M"),
+								},
+								Limits: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("8"),
+									api.ResourceMemory: resource.MustParse("200M"),
+								},
+							},
+						},
+						{
+							Resources: api.ResourceRequirements{
+								Requests: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("1"),
+									api.ResourceMemory: resource.MustParse("50M"),
+								},
+								Limits: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("2"),
+									api.ResourceMemory: resource.MustParse("100M"),
+								},
+							},
+						},
+					},
+					Containers: []api.Container{
+						{
+							Resources: api.ResourceRequirements{
+								Requests: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("1"),
+									api.ResourceMemory: resource.MustParse("50M"),
+								},
+								Limits: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("2"),
+									api.ResourceMemory: resource.MustParse("100M"),
+								},
+							},
+						},
+						{
+							Resources: api.ResourceRequirements{
+								Requests: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("2"),
+									api.ResourceMemory: resource.MustParse("25M"),
+								},
+								Limits: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("5"),
+									api.ResourceMemory: resource.MustParse("50M"),
+								},
+							},
+						},
+					},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceRequestsCPU:    resource.MustParse("4"),
+				api.ResourceRequestsMemory: resource.MustParse("100M"),
+				api.ResourceLimitsCPU:      resource.MustParse("8"),
+				api.ResourceLimitsMemory:   resource.MustParse("200M"),
+				api.ResourcePods:           resource.MustParse("1"),
+				api.ResourceCPU:            resource.MustParse("4"),
+				api.ResourceMemory:         resource.MustParse("100M"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "pods"}): resource.MustParse("1"),
+			},
+		},
+		"pod deletion timestamp exceeded": {
+			pod: &api.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					DeletionTimestamp:          &deletionTimestampPastGracePeriod,
+					DeletionGracePeriodSeconds: &terminationGracePeriodSeconds,
+				},
+				Status: api.PodStatus{
+					Reason: node.NodeUnreachablePodReason,
+				},
+				Spec: api.PodSpec{
+					TerminationGracePeriodSeconds: &terminationGracePeriodSeconds,
+					Containers: []api.Container{
+						{
+							Resources: api.ResourceRequirements{
+								Requests: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("1"),
+									api.ResourceMemory: resource.MustParse("50M"),
+								},
+								Limits: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("2"),
+									api.ResourceMemory: resource.MustParse("100M"),
+								},
+							},
+						},
+					},
+				},
+			},
+			usage: api.ResourceList{
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "pods"}): resource.MustParse("1"),
+			},
+		},
+		"pod deletion timestamp not exceeded": {
+			pod: &api.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					DeletionTimestamp:          &deletionTimestampNotPastGracePeriod,
+					DeletionGracePeriodSeconds: &terminationGracePeriodSeconds,
+				},
+				Status: api.PodStatus{
+					Reason: node.NodeUnreachablePodReason,
+				},
+				Spec: api.PodSpec{
+					Containers: []api.Container{
+						{
+							Resources: api.ResourceRequirements{
+								Requests: api.ResourceList{
+									api.ResourceCPU: resource.MustParse("1"),
+								},
+								Limits: api.ResourceList{
+									api.ResourceCPU: resource.MustParse("2"),
+								},
+							},
+						},
+					},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceRequestsCPU: resource.MustParse("1"),
+				api.ResourceLimitsCPU:   resource.MustParse("2"),
+				api.ResourcePods:        resource.MustParse("1"),
+				api.ResourceCPU:         resource.MustParse("1"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "pods"}): resource.MustParse("1"),
+			},
+		},
+	}
+	for testName, testCase := range testCases {
+		actual, err := evaluator.Usage(testCase.pod)
+		if err != nil {
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
+		if !quota.Equals(testCase.usage, actual) {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.usage, actual)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/registry.go

@@ -0,0 +1,50 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/clock"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// legacyObjectCountAliases are what we used to do simple object counting quota with mapped to alias
+var legacyObjectCountAliases = map[schema.GroupVersionResource]api.ResourceName{
+	v1.SchemeGroupVersion.WithResource("configmaps"):             api.ResourceConfigMaps,
+	v1.SchemeGroupVersion.WithResource("resourcequotas"):         api.ResourceQuotas,
+	v1.SchemeGroupVersion.WithResource("replicationcontrollers"): api.ResourceReplicationControllers,
+	v1.SchemeGroupVersion.WithResource("secrets"):                api.ResourceSecrets,
+}
+
+// NewEvaluators returns the list of static evaluators that manage more than counts
+func NewEvaluators(f quota.ListerForResourceFunc) []quota.Evaluator {
+	// these evaluators have special logic
+	result := []quota.Evaluator{
+		NewPodEvaluator(f, clock.RealClock{}),
+		NewServiceEvaluator(f),
+		NewPersistentVolumeClaimEvaluator(f),
+	}
+	// these evaluators require an alias for backwards compatibility
+	for gvr, alias := range legacyObjectCountAliases {
+		result = append(result,
+			generic.NewObjectCountEvaluator(false, gvr.GroupResource(), generic.ListResourceUsingListerFunc(f, gvr), alias))
+	}
+	return result
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/services.go

@@ -0,0 +1,153 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"fmt"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/admission"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	k8s_api_v1 "k8s.io/kubernetes/pkg/apis/core/v1"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// the name used for object count quota
+var serviceObjectCountName = generic.ObjectCountQuotaResourceNameFor(v1.SchemeGroupVersion.WithResource("services").GroupResource())
+
+// serviceResources are the set of resources managed by quota associated with services.
+var serviceResources = []api.ResourceName{
+	serviceObjectCountName,
+	api.ResourceServices,
+	api.ResourceServicesNodePorts,
+	api.ResourceServicesLoadBalancers,
+}
+
+// NewServiceEvaluator returns an evaluator that can evaluate services.
+func NewServiceEvaluator(f quota.ListerForResourceFunc) quota.Evaluator {
+	listFuncByNamespace := generic.ListResourceUsingListerFunc(f, v1.SchemeGroupVersion.WithResource("services"))
+	serviceEvaluator := &serviceEvaluator{listFuncByNamespace: listFuncByNamespace}
+	return serviceEvaluator
+}
+
+// serviceEvaluator knows how to measure usage for services.
+type serviceEvaluator struct {
+	// knows how to list items by namespace
+	listFuncByNamespace generic.ListFuncByNamespace
+}
+
+// Constraints verifies that all required resources are present on the item
+func (p *serviceEvaluator) Constraints(required []api.ResourceName, item runtime.Object) error {
+	// this is a no-op for services
+	return nil
+}
+
+// GroupResource that this evaluator tracks
+func (p *serviceEvaluator) GroupResource() schema.GroupResource {
+	return v1.SchemeGroupVersion.WithResource("services").GroupResource()
+}
+
+// Handles returns true of the evaluator should handle the specified operation.
+func (p *serviceEvaluator) Handles(a admission.Attributes) bool {
+	operation := a.GetOperation()
+	// We handle create and update because a service type can change.
+	return admission.Create == operation || admission.Update == operation
+}
+
+// Matches returns true if the evaluator matches the specified quota with the provided input item
+func (p *serviceEvaluator) Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error) {
+	return generic.Matches(resourceQuota, item, p.MatchingResources, generic.MatchesNoScopeFunc)
+}
+
+// MatchingResources takes the input specified list of resources and returns the set of resources it matches.
+func (p *serviceEvaluator) MatchingResources(input []api.ResourceName) []api.ResourceName {
+	return quota.Intersection(input, serviceResources)
+}
+
+// convert the input object to an internal service object or error.
+func toInternalServiceOrError(obj runtime.Object) (*api.Service, error) {
+	svc := &api.Service{}
+	switch t := obj.(type) {
+	case *v1.Service:
+		if err := k8s_api_v1.Convert_v1_Service_To_core_Service(t, svc, nil); err != nil {
+			return nil, err
+		}
+	case *api.Service:
+		svc = t
+	default:
+		return nil, fmt.Errorf("expect *api.Service or *v1.Service, got %v", t)
+	}
+	return svc, nil
+}
+
+// Usage knows how to measure usage associated with services
+func (p *serviceEvaluator) Usage(item runtime.Object) (api.ResourceList, error) {
+	result := api.ResourceList{}
+	svc, err := toInternalServiceOrError(item)
+	if err != nil {
+		return result, err
+	}
+	ports := len(svc.Spec.Ports)
+	// default service usage
+	result[serviceObjectCountName] = *(resource.NewQuantity(1, resource.DecimalSI))
+	result[api.ResourceServices] = *(resource.NewQuantity(1, resource.DecimalSI))
+	result[api.ResourceServicesLoadBalancers] = resource.Quantity{Format: resource.DecimalSI}
+	result[api.ResourceServicesNodePorts] = resource.Quantity{Format: resource.DecimalSI}
+	switch svc.Spec.Type {
+	case api.ServiceTypeNodePort:
+		// node port services need to count node ports
+		value := resource.NewQuantity(int64(ports), resource.DecimalSI)
+		result[api.ResourceServicesNodePorts] = *value
+	case api.ServiceTypeLoadBalancer:
+		// load balancer services need to count node ports and load balancers
+		value := resource.NewQuantity(int64(ports), resource.DecimalSI)
+		result[api.ResourceServicesNodePorts] = *value
+		result[api.ResourceServicesLoadBalancers] = *(resource.NewQuantity(1, resource.DecimalSI))
+	}
+	return result, nil
+}
+
+// UsageStats calculates aggregate usage for the object.
+func (p *serviceEvaluator) UsageStats(options quota.UsageStatsOptions) (quota.UsageStats, error) {
+	return generic.CalculateUsageStats(options, p.listFuncByNamespace, generic.MatchesNoScopeFunc, p.Usage)
+}
+
+var _ quota.Evaluator = &serviceEvaluator{}
+
+// QuotaServiceType returns true if the service type is eligible to track against a quota
+func QuotaServiceType(service *v1.Service) bool {
+	switch service.Spec.Type {
+	case v1.ServiceTypeNodePort, v1.ServiceTypeLoadBalancer:
+		return true
+	}
+	return false
+}
+
+//GetQuotaServiceType returns ServiceType if the service type is eligible to track against a quota, nor return ""
+func GetQuotaServiceType(service *v1.Service) v1.ServiceType {
+	switch service.Spec.Type {
+	case v1.ServiceTypeNodePort:
+		return v1.ServiceTypeNodePort
+	case v1.ServiceTypeLoadBalancer:
+		return v1.ServiceTypeLoadBalancer
+	}
+	return v1.ServiceType("")
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/services_test.go

@@ -0,0 +1,215 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+func TestServiceEvaluatorMatchesResources(t *testing.T) {
+	evaluator := NewServiceEvaluator(nil)
+	// we give a lot of resources
+	input := []api.ResourceName{
+		api.ResourceConfigMaps,
+		api.ResourceCPU,
+		api.ResourceServices,
+		api.ResourceServicesNodePorts,
+		api.ResourceServicesLoadBalancers,
+	}
+	// but we only match these...
+	expected := quota.ToSet([]api.ResourceName{
+		api.ResourceServices,
+		api.ResourceServicesNodePorts,
+		api.ResourceServicesLoadBalancers,
+	})
+	actual := quota.ToSet(evaluator.MatchingResources(input))
+	if !expected.Equal(actual) {
+		t.Errorf("expected: %v, actual: %v", expected, actual)
+	}
+}
+
+func TestServiceEvaluatorUsage(t *testing.T) {
+	evaluator := NewServiceEvaluator(nil)
+	testCases := map[string]struct {
+		service *api.Service
+		usage   api.ResourceList
+	}{
+		"loadbalancer": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeLoadBalancer,
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceServicesNodePorts:     resource.MustParse("0"),
+				api.ResourceServicesLoadBalancers: resource.MustParse("1"),
+				api.ResourceServices:              resource.MustParse("1"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "services"}): resource.MustParse("1"),
+			},
+		},
+		"loadbalancer_ports": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeLoadBalancer,
+					Ports: []api.ServicePort{
+						{
+							Port: 27443,
+						},
+					},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceServicesNodePorts:     resource.MustParse("1"),
+				api.ResourceServicesLoadBalancers: resource.MustParse("1"),
+				api.ResourceServices:              resource.MustParse("1"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "services"}): resource.MustParse("1"),
+			},
+		},
+		"clusterip": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeClusterIP,
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceServices:                                                                resource.MustParse("1"),
+				api.ResourceServicesNodePorts:                                                       resource.MustParse("0"),
+				api.ResourceServicesLoadBalancers:                                                   resource.MustParse("0"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "services"}): resource.MustParse("1"),
+			},
+		},
+		"nodeports": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeNodePort,
+					Ports: []api.ServicePort{
+						{
+							Port: 27443,
+						},
+					},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceServices:                                                                resource.MustParse("1"),
+				api.ResourceServicesNodePorts:                                                       resource.MustParse("1"),
+				api.ResourceServicesLoadBalancers:                                                   resource.MustParse("0"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "services"}): resource.MustParse("1"),
+			},
+		},
+		"multi-nodeports": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeNodePort,
+					Ports: []api.ServicePort{
+						{
+							Port: 27443,
+						},
+						{
+							Port: 27444,
+						},
+					},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceServices:                                                                resource.MustParse("1"),
+				api.ResourceServicesNodePorts:                                                       resource.MustParse("2"),
+				api.ResourceServicesLoadBalancers:                                                   resource.MustParse("0"),
+				generic.ObjectCountQuotaResourceNameFor(schema.GroupResource{Resource: "services"}): resource.MustParse("1"),
+			},
+		},
+	}
+	for testName, testCase := range testCases {
+		actual, err := evaluator.Usage(testCase.service)
+		if err != nil {
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
+		if !quota.Equals(testCase.usage, actual) {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.usage, actual)
+		}
+	}
+}
+
+func TestServiceConstraintsFunc(t *testing.T) {
+	testCases := map[string]struct {
+		service  *api.Service
+		required []api.ResourceName
+		err      string
+	}{
+		"loadbalancer": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeLoadBalancer,
+				},
+			},
+			required: []api.ResourceName{api.ResourceServicesLoadBalancers},
+		},
+		"clusterip": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeClusterIP,
+				},
+			},
+			required: []api.ResourceName{api.ResourceServicesLoadBalancers, api.ResourceServices},
+		},
+		"nodeports": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeNodePort,
+					Ports: []api.ServicePort{
+						{
+							Port: 27443,
+						},
+					},
+				},
+			},
+			required: []api.ResourceName{api.ResourceServicesNodePorts},
+		},
+		"multi-nodeports": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeNodePort,
+					Ports: []api.ServicePort{
+						{
+							Port: 27443,
+						},
+						{
+							Port: 27444,
+						},
+					},
+				},
+			},
+			required: []api.ResourceName{api.ResourceServicesNodePorts},
+		},
+	}
+
+	evaluator := NewServiceEvaluator(nil)
+	for testName, test := range testCases {
+		err := evaluator.Constraints(test.required, test.service)
+		switch {
+		case err != nil && len(test.err) == 0,
+			err == nil && len(test.err) != 0,
+			err != nil && test.err != err.Error():
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/quota/generic/BUILD

@@ -0,0 +1,40 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "configuration.go",
+        "evaluator.go",
+        "registry.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/quota/generic",
+    deps = [
+        "//pkg/apis/core:go_default_library",
+        "//pkg/quota:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
+        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//vendor/k8s.io/client-go/tools/cache:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/quota/generic/OWNERS

@@ -0,0 +1,5 @@
+reviewers:
+- smarterclayton
+- derekwaynecarr
+- david-mcmahon
+- goltermann

vendor/k8s.io/kubernetes/pkg/quota/generic/configuration.go

@@ -0,0 +1,44 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generic
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/quota"
+)
+
+// implements a basic configuration
+type simpleConfiguration struct {
+	evaluators       []quota.Evaluator
+	ignoredResources map[schema.GroupResource]struct{}
+}
+
+// NewConfiguration creates a quota configuration
+func NewConfiguration(evaluators []quota.Evaluator, ignoredResources map[schema.GroupResource]struct{}) quota.Configuration {
+	return &simpleConfiguration{
+		evaluators:       evaluators,
+		ignoredResources: ignoredResources,
+	}
+}
+
+func (c *simpleConfiguration) IgnoredResources() map[schema.GroupResource]struct{} {
+	return c.ignoredResources
+}
+
+func (c *simpleConfiguration) Evaluators() []quota.Evaluator {
+	return c.evaluators
+}

vendor/k8s.io/kubernetes/pkg/quota/generic/evaluator.go

@@ -0,0 +1,222 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generic
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/client-go/informers"
+	"k8s.io/client-go/tools/cache"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/quota"
+)
+
+// InformerForResourceFunc knows how to provision an informer
+type InformerForResourceFunc func(schema.GroupVersionResource) (informers.GenericInformer, error)
+
+// ListerFuncForResourceFunc knows how to provision a lister from an informer func
+func ListerFuncForResourceFunc(f InformerForResourceFunc) quota.ListerForResourceFunc {
+	return func(gvr schema.GroupVersionResource) (cache.GenericLister, error) {
+		informer, err := f(gvr)
+		if err != nil {
+			return nil, err
+		}
+		return informer.Lister(), nil
+	}
+}
+
+// ListResourceUsingListerFunc returns a listing function based on the shared informer factory for the specified resource.
+func ListResourceUsingListerFunc(l quota.ListerForResourceFunc, resource schema.GroupVersionResource) ListFuncByNamespace {
+	return func(namespace string) ([]runtime.Object, error) {
+		lister, err := l(resource)
+		if err != nil {
+			return nil, err
+		}
+		return lister.ByNamespace(namespace).List(labels.Everything())
+	}
+}
+
+// ObjectCountQuotaResourceNameFor returns the object count quota name for specified groupResource
+func ObjectCountQuotaResourceNameFor(groupResource schema.GroupResource) api.ResourceName {
+	if len(groupResource.Group) == 0 {
+		return api.ResourceName("count/" + groupResource.Resource)
+	}
+	return api.ResourceName("count/" + groupResource.Resource + "." + groupResource.Group)
+}
+
+// ListFuncByNamespace knows how to list resources in a namespace
+type ListFuncByNamespace func(namespace string) ([]runtime.Object, error)
+
+// MatchesScopeFunc knows how to evaluate if an object matches a scope
+type MatchesScopeFunc func(scope api.ResourceQuotaScope, object runtime.Object) (bool, error)
+
+// UsageFunc knows how to measure usage associated with an object
+type UsageFunc func(object runtime.Object) (api.ResourceList, error)
+
+// MatchingResourceNamesFunc is a function that returns the list of resources matched
+type MatchingResourceNamesFunc func(input []api.ResourceName) []api.ResourceName
+
+// MatchesNoScopeFunc returns false on all match checks
+func MatchesNoScopeFunc(scope api.ResourceQuotaScope, object runtime.Object) (bool, error) {
+	return false, nil
+}
+
+// Matches returns true if the quota matches the specified item.
+func Matches(resourceQuota *api.ResourceQuota, item runtime.Object, matchFunc MatchingResourceNamesFunc, scopeFunc MatchesScopeFunc) (bool, error) {
+	if resourceQuota == nil {
+		return false, fmt.Errorf("expected non-nil quota")
+	}
+	// verify the quota matches on at least one resource
+	matchResource := len(matchFunc(quota.ResourceNames(resourceQuota.Status.Hard))) > 0
+	// by default, no scopes matches all
+	matchScope := true
+	for _, scope := range resourceQuota.Spec.Scopes {
+		innerMatch, err := scopeFunc(scope, item)
+		if err != nil {
+			return false, err
+		}
+		matchScope = matchScope && innerMatch
+	}
+	return matchResource && matchScope, nil
+}
+
+// CalculateUsageStats is a utility function that knows how to calculate aggregate usage.
+func CalculateUsageStats(options quota.UsageStatsOptions,
+	listFunc ListFuncByNamespace,
+	scopeFunc MatchesScopeFunc,
+	usageFunc UsageFunc) (quota.UsageStats, error) {
+	// default each tracked resource to zero
+	result := quota.UsageStats{Used: api.ResourceList{}}
+	for _, resourceName := range options.Resources {
+		result.Used[resourceName] = resource.Quantity{Format: resource.DecimalSI}
+	}
+	items, err := listFunc(options.Namespace)
+	if err != nil {
+		return result, fmt.Errorf("failed to list content: %v", err)
+	}
+	for _, item := range items {
+		// need to verify that the item matches the set of scopes
+		matchesScopes := true
+		for _, scope := range options.Scopes {
+			innerMatch, err := scopeFunc(scope, item)
+			if err != nil {
+				return result, nil
+			}
+			if !innerMatch {
+				matchesScopes = false
+			}
+		}
+		// only count usage if there was a match
+		if matchesScopes {
+			usage, err := usageFunc(item)
+			if err != nil {
+				return result, err
+			}
+			result.Used = quota.Add(result.Used, usage)
+		}
+	}
+	return result, nil
+}
+
+// objectCountEvaluator provides an implementation for quota.Evaluator
+// that associates usage of the specified resource based on the number of items
+// returned by the specified listing function.
+type objectCountEvaluator struct {
+	// allowCreateOnUpdate if true will ensure the evaluator tracks create
+	// and update operations.
+	allowCreateOnUpdate bool
+	// GroupResource that this evaluator tracks.
+	// It is used to construct a generic object count quota name
+	groupResource schema.GroupResource
+	// A function that knows how to list resources by namespace.
+	// TODO move to dynamic client in future
+	listFuncByNamespace ListFuncByNamespace
+	// Names associated with this resource in the quota for generic counting.
+	resourceNames []api.ResourceName
+}
+
+// Constraints returns an error if the configured resource name is not in the required set.
+func (o *objectCountEvaluator) Constraints(required []api.ResourceName, item runtime.Object) error {
+	// no-op for object counting
+	return nil
+}
+
+// Handles returns true if the object count evaluator needs to track this attributes.
+func (o *objectCountEvaluator) Handles(a admission.Attributes) bool {
+	operation := a.GetOperation()
+	return operation == admission.Create || (o.allowCreateOnUpdate && operation == admission.Update)
+}
+
+// Matches returns true if the evaluator matches the specified quota with the provided input item
+func (o *objectCountEvaluator) Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error) {
+	return Matches(resourceQuota, item, o.MatchingResources, MatchesNoScopeFunc)
+}
+
+// MatchingResources takes the input specified list of resources and returns the set of resources it matches.
+func (o *objectCountEvaluator) MatchingResources(input []api.ResourceName) []api.ResourceName {
+	return quota.Intersection(input, o.resourceNames)
+}
+
+// Usage returns the resource usage for the specified object
+func (o *objectCountEvaluator) Usage(object runtime.Object) (api.ResourceList, error) {
+	quantity := resource.NewQuantity(1, resource.DecimalSI)
+	resourceList := api.ResourceList{}
+	for _, resourceName := range o.resourceNames {
+		resourceList[resourceName] = *quantity
+	}
+	return resourceList, nil
+}
+
+// GroupResource tracked by this evaluator
+func (o *objectCountEvaluator) GroupResource() schema.GroupResource {
+	return o.groupResource
+}
+
+// UsageStats calculates aggregate usage for the object.
+func (o *objectCountEvaluator) UsageStats(options quota.UsageStatsOptions) (quota.UsageStats, error) {
+	return CalculateUsageStats(options, o.listFuncByNamespace, MatchesNoScopeFunc, o.Usage)
+}
+
+// Verify implementation of interface at compile time.
+var _ quota.Evaluator = &objectCountEvaluator{}
+
+// NewObjectCountEvaluator returns an evaluator that can perform generic
+// object quota counting.  It allows an optional alias for backwards compatibilty
+// purposes for the legacy object counting names in quota.  Unless its supporting
+// backward compatibility, alias should not be used.
+func NewObjectCountEvaluator(
+	allowCreateOnUpdate bool,
+	groupResource schema.GroupResource, listFuncByNamespace ListFuncByNamespace,
+	alias api.ResourceName) quota.Evaluator {
+
+	resourceNames := []api.ResourceName{ObjectCountQuotaResourceNameFor(groupResource)}
+	if len(alias) > 0 {
+		resourceNames = append(resourceNames, alias)
+	}
+
+	return &objectCountEvaluator{
+		allowCreateOnUpdate: allowCreateOnUpdate,
+		groupResource:       groupResource,
+		listFuncByNamespace: listFuncByNamespace,
+		resourceNames:       resourceNames,
+	}
+}

vendor/k8s.io/kubernetes/pkg/quota/generic/registry.go

@@ -0,0 +1,81 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generic
+
+import (
+	"sync"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/quota"
+)
+
+// implements a basic registry
+type simpleRegistry struct {
+	lock sync.RWMutex
+	// evaluators tracked by the registry
+	evaluators map[schema.GroupResource]quota.Evaluator
+}
+
+// NewRegistry creates a simple registry with initial list of evaluators
+func NewRegistry(evaluators []quota.Evaluator) quota.Registry {
+	return &simpleRegistry{
+		evaluators: evaluatorsByGroupResource(evaluators),
+	}
+}
+
+func (r *simpleRegistry) Add(e quota.Evaluator) {
+	r.lock.Lock()
+	defer r.lock.Unlock()
+	r.evaluators[e.GroupResource()] = e
+}
+
+func (r *simpleRegistry) Remove(e quota.Evaluator) {
+	r.lock.Lock()
+	defer r.lock.Unlock()
+	delete(r.evaluators, e.GroupResource())
+}
+
+func (r *simpleRegistry) Get(gr schema.GroupResource) quota.Evaluator {
+	r.lock.RLock()
+	defer r.lock.RUnlock()
+	return r.evaluators[gr]
+}
+
+func (r *simpleRegistry) List() []quota.Evaluator {
+	r.lock.RLock()
+	defer r.lock.RUnlock()
+
+	return evaluatorsList(r.evaluators)
+}
+
+// evaluatorsByGroupResource converts a list of evaluators to a map by group resource.
+func evaluatorsByGroupResource(items []quota.Evaluator) map[schema.GroupResource]quota.Evaluator {
+	result := map[schema.GroupResource]quota.Evaluator{}
+	for _, item := range items {
+		result[item.GroupResource()] = item
+	}
+	return result
+}
+
+// evaluatorsList converts a map of evaluators to list
+func evaluatorsList(input map[schema.GroupResource]quota.Evaluator) []quota.Evaluator {
+	var result []quota.Evaluator
+	for _, item := range input {
+		result = append(result, item)
+	}
+	return result
+}

vendor/k8s.io/kubernetes/pkg/quota/install/BUILD

@@ -0,0 +1,31 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["registry.go"],
+    importpath = "k8s.io/kubernetes/pkg/quota/install",
+    deps = [
+        "//pkg/quota:go_default_library",
+        "//pkg/quota/evaluator/core:go_default_library",
+        "//pkg/quota/generic:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/quota/install/OWNERS

@@ -0,0 +1,2 @@
+reviewers:
+- derekwaynecarr

vendor/k8s.io/kubernetes/pkg/quota/install/registry.go

@@ -0,0 +1,58 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package install
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/evaluator/core"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// NewQuotaConfigurationForAdmission returns a quota configuration for admission control.
+func NewQuotaConfigurationForAdmission() quota.Configuration {
+	evaluators := core.NewEvaluators(nil)
+	return generic.NewConfiguration(evaluators, DefaultIgnoredResources())
+}
+
+// NewQuotaConfigurationForControllers returns a quota configuration for controllers.
+func NewQuotaConfigurationForControllers(f quota.ListerForResourceFunc) quota.Configuration {
+	evaluators := core.NewEvaluators(f)
+	return generic.NewConfiguration(evaluators, DefaultIgnoredResources())
+}
+
+// ignoredResources are ignored by quota by default
+var ignoredResources = map[schema.GroupResource]struct{}{
+	{Group: "extensions", Resource: "replicationcontrollers"}:              {},
+	{Group: "extensions", Resource: "networkpolicies"}:                     {},
+	{Group: "", Resource: "bindings"}:                                      {},
+	{Group: "", Resource: "componentstatuses"}:                             {},
+	{Group: "", Resource: "events"}:                                        {},
+	{Group: "authentication.k8s.io", Resource: "tokenreviews"}:             {},
+	{Group: "authorization.k8s.io", Resource: "subjectaccessreviews"}:      {},
+	{Group: "authorization.k8s.io", Resource: "selfsubjectaccessreviews"}:  {},
+	{Group: "authorization.k8s.io", Resource: "localsubjectaccessreviews"}: {},
+	{Group: "authorization.k8s.io", Resource: "selfsubjectrulesreviews"}:   {},
+	{Group: "apiregistration.k8s.io", Resource: "apiservices"}:             {},
+	{Group: "apiextensions.k8s.io", Resource: "customresourcedefinitions"}: {},
+}
+
+// DefaultIgnoredResources returns the default set of resources that quota system
+// should ignore. This is exposed so downstream integrators can have access to them.
+func DefaultIgnoredResources() map[schema.GroupResource]struct{} {
+	return ignoredResources
+}

vendor/k8s.io/kubernetes/pkg/quota/interfaces.go

@@ -0,0 +1,83 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package quota
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/client-go/tools/cache"
+	api "k8s.io/kubernetes/pkg/apis/core"
+)
+
+// UsageStatsOptions is an options structs that describes how stats should be calculated
+type UsageStatsOptions struct {
+	// Namespace where stats should be calculate
+	Namespace string
+	// Scopes that must match counted objects
+	Scopes []api.ResourceQuotaScope
+	// Resources are the set of resources to include in the measurement
+	Resources []api.ResourceName
+}
+
+// UsageStats is result of measuring observed resource use in the system
+type UsageStats struct {
+	// Used maps resource to quantity used
+	Used api.ResourceList
+}
+
+// Evaluator knows how to evaluate quota usage for a particular group resource
+type Evaluator interface {
+	// Constraints ensures that each required resource is present on item
+	Constraints(required []api.ResourceName, item runtime.Object) error
+	// GroupResource returns the groupResource that this object knows how to evaluate
+	GroupResource() schema.GroupResource
+	// Handles determines if quota could be impacted by the specified attribute.
+	// If true, admission control must perform quota processing for the operation, otherwise it is safe to ignore quota.
+	Handles(operation admission.Attributes) bool
+	// Matches returns true if the specified quota matches the input item
+	Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error)
+	// MatchingResources takes the input specified list of resources and returns the set of resources evaluator matches.
+	MatchingResources(input []api.ResourceName) []api.ResourceName
+	// Usage returns the resource usage for the specified object
+	Usage(item runtime.Object) (api.ResourceList, error)
+	// UsageStats calculates latest observed usage stats for all objects
+	UsageStats(options UsageStatsOptions) (UsageStats, error)
+}
+
+// Configuration defines how the quota system is configured.
+type Configuration interface {
+	// IgnoredResources are ignored by quota.
+	IgnoredResources() map[schema.GroupResource]struct{}
+	// Evaluators for quota evaluation.
+	Evaluators() []Evaluator
+}
+
+// Registry maintains a list of evaluators
+type Registry interface {
+	// Add to registry
+	Add(e Evaluator)
+	// Remove from registry
+	Remove(e Evaluator)
+	// Get by group resource
+	Get(gr schema.GroupResource) Evaluator
+	// List from registry
+	List() []Evaluator
+}
+
+// ListerForResourceFunc knows how to get a lister for a specific resource
+type ListerForResourceFunc func(schema.GroupVersionResource) (cache.GenericLister, error)

vendor/k8s.io/kubernetes/pkg/quota/resources.go

@@ -0,0 +1,291 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package quota
+
+import (
+	"strings"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/util/sets"
+	api "k8s.io/kubernetes/pkg/apis/core"
+)
+
+// Equals returns true if the two lists are equivalent
+func Equals(a api.ResourceList, b api.ResourceList) bool {
+	for key, value1 := range a {
+		value2, found := b[key]
+		if !found {
+			return false
+		}
+		if value1.Cmp(value2) != 0 {
+			return false
+		}
+	}
+	for key, value1 := range b {
+		value2, found := a[key]
+		if !found {
+			return false
+		}
+		if value1.Cmp(value2) != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// V1Equals returns true if the two lists are equivalent
+func V1Equals(a v1.ResourceList, b v1.ResourceList) bool {
+	for key, value1 := range a {
+		value2, found := b[key]
+		if !found {
+			return false
+		}
+		if value1.Cmp(value2) != 0 {
+			return false
+		}
+	}
+	for key, value1 := range b {
+		value2, found := a[key]
+		if !found {
+			return false
+		}
+		if value1.Cmp(value2) != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// LessThanOrEqual returns true if a < b for each key in b
+// If false, it returns the keys in a that exceeded b
+func LessThanOrEqual(a api.ResourceList, b api.ResourceList) (bool, []api.ResourceName) {
+	result := true
+	resourceNames := []api.ResourceName{}
+	for key, value := range b {
+		if other, found := a[key]; found {
+			if other.Cmp(value) > 0 {
+				result = false
+				resourceNames = append(resourceNames, key)
+			}
+		}
+	}
+	return result, resourceNames
+}
+
+// Max returns the result of Max(a, b) for each named resource
+func Max(a api.ResourceList, b api.ResourceList) api.ResourceList {
+	result := api.ResourceList{}
+	for key, value := range a {
+		if other, found := b[key]; found {
+			if value.Cmp(other) <= 0 {
+				result[key] = *other.Copy()
+				continue
+			}
+		}
+		result[key] = *value.Copy()
+	}
+	for key, value := range b {
+		if _, found := result[key]; !found {
+			result[key] = *value.Copy()
+		}
+	}
+	return result
+}
+
+// Add returns the result of a + b for each named resource
+func Add(a api.ResourceList, b api.ResourceList) api.ResourceList {
+	result := api.ResourceList{}
+	for key, value := range a {
+		quantity := *value.Copy()
+		if other, found := b[key]; found {
+			quantity.Add(other)
+		}
+		result[key] = quantity
+	}
+	for key, value := range b {
+		if _, found := result[key]; !found {
+			quantity := *value.Copy()
+			result[key] = quantity
+		}
+	}
+	return result
+}
+
+// SubtractWithNonNegativeResult - substracts and returns result of a - b but
+// makes sure we don't return negative values to prevent negative resource usage.
+func SubtractWithNonNegativeResult(a api.ResourceList, b api.ResourceList) api.ResourceList {
+	zero := resource.MustParse("0")
+
+	result := api.ResourceList{}
+	for key, value := range a {
+		quantity := *value.Copy()
+		if other, found := b[key]; found {
+			quantity.Sub(other)
+		}
+		if quantity.Cmp(zero) > 0 {
+			result[key] = quantity
+		} else {
+			result[key] = zero
+		}
+	}
+
+	for key := range b {
+		if _, found := result[key]; !found {
+			result[key] = zero
+		}
+	}
+	return result
+}
+
+// Subtract returns the result of a - b for each named resource
+func Subtract(a api.ResourceList, b api.ResourceList) api.ResourceList {
+	result := api.ResourceList{}
+	for key, value := range a {
+		quantity := *value.Copy()
+		if other, found := b[key]; found {
+			quantity.Sub(other)
+		}
+		result[key] = quantity
+	}
+	for key, value := range b {
+		if _, found := result[key]; !found {
+			quantity := *value.Copy()
+			quantity.Neg()
+			result[key] = quantity
+		}
+	}
+	return result
+}
+
+// Mask returns a new resource list that only has the values with the specified names
+func Mask(resources api.ResourceList, names []api.ResourceName) api.ResourceList {
+	nameSet := ToSet(names)
+	result := api.ResourceList{}
+	for key, value := range resources {
+		if nameSet.Has(string(key)) {
+			result[key] = *value.Copy()
+		}
+	}
+	return result
+}
+
+// ResourceNames returns a list of all resource names in the ResourceList
+func ResourceNames(resources api.ResourceList) []api.ResourceName {
+	result := []api.ResourceName{}
+	for resourceName := range resources {
+		result = append(result, resourceName)
+	}
+	return result
+}
+
+// Contains returns true if the specified item is in the list of items
+func Contains(items []api.ResourceName, item api.ResourceName) bool {
+	return ToSet(items).Has(string(item))
+}
+
+// ContainsPrefix returns true if the specified item has a prefix that contained in given prefix Set
+func ContainsPrefix(prefixSet []string, item api.ResourceName) bool {
+	for _, prefix := range prefixSet {
+		if strings.HasPrefix(string(item), prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+// Intersection returns the intersection of both list of resources
+func Intersection(a []api.ResourceName, b []api.ResourceName) []api.ResourceName {
+	setA := ToSet(a)
+	setB := ToSet(b)
+	setC := setA.Intersection(setB)
+	result := []api.ResourceName{}
+	for _, resourceName := range setC.List() {
+		result = append(result, api.ResourceName(resourceName))
+	}
+	return result
+}
+
+// IsZero returns true if each key maps to the quantity value 0
+func IsZero(a api.ResourceList) bool {
+	zero := resource.MustParse("0")
+	for _, v := range a {
+		if v.Cmp(zero) != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// IsNegative returns the set of resource names that have a negative value.
+func IsNegative(a api.ResourceList) []api.ResourceName {
+	results := []api.ResourceName{}
+	zero := resource.MustParse("0")
+	for k, v := range a {
+		if v.Cmp(zero) < 0 {
+			results = append(results, k)
+		}
+	}
+	return results
+}
+
+// ToSet takes a list of resource names and converts to a string set
+func ToSet(resourceNames []api.ResourceName) sets.String {
+	result := sets.NewString()
+	for _, resourceName := range resourceNames {
+		result.Insert(string(resourceName))
+	}
+	return result
+}
+
+// CalculateUsage calculates and returns the requested ResourceList usage
+func CalculateUsage(namespaceName string, scopes []api.ResourceQuotaScope, hardLimits api.ResourceList, registry Registry) (api.ResourceList, error) {
+	// find the intersection between the hard resources on the quota
+	// and the resources this controller can track to know what we can
+	// look to measure updated usage stats for
+	hardResources := ResourceNames(hardLimits)
+	potentialResources := []api.ResourceName{}
+	evaluators := registry.List()
+	for _, evaluator := range evaluators {
+		potentialResources = append(potentialResources, evaluator.MatchingResources(hardResources)...)
+	}
+	// NOTE: the intersection just removes duplicates since the evaluator match intersects wtih hard
+	matchedResources := Intersection(hardResources, potentialResources)
+
+	// sum the observed usage from each evaluator
+	newUsage := api.ResourceList{}
+	for _, evaluator := range evaluators {
+		// only trigger the evaluator if it matches a resource in the quota, otherwise, skip calculating anything
+		intersection := evaluator.MatchingResources(matchedResources)
+		if len(intersection) == 0 {
+			continue
+		}
+
+		usageStatsOptions := UsageStatsOptions{Namespace: namespaceName, Scopes: scopes, Resources: intersection}
+		stats, err := evaluator.UsageStats(usageStatsOptions)
+		if err != nil {
+			return nil, err
+		}
+		newUsage = Add(newUsage, stats.Used)
+	}
+
+	// mask the observed usage to only the set of resources tracked by this quota
+	// merge our observed usage with the quota usage status
+	// if the new usage is different than the last usage, we will need to do an update
+	newUsage = Mask(newUsage, matchedResources)
+	return newUsage, nil
+}

vendor/k8s.io/kubernetes/pkg/quota/resources_test.go

@@ -0,0 +1,316 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package quota
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+	api "k8s.io/kubernetes/pkg/apis/core"
+)
+
+func TestEquals(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		b        api.ResourceList
+		expected bool
+	}{
+		"isEqual": {
+			a:        api.ResourceList{},
+			b:        api.ResourceList{},
+			expected: true,
+		},
+		"isEqualWithKeys": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("100m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			b: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("100m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			expected: true,
+		},
+		"isNotEqualSameKeys": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("200m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			b: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("100m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			expected: false,
+		},
+		"isNotEqualDiffKeys": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("100m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			b: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("100m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+				api.ResourcePods:   resource.MustParse("1"),
+			},
+			expected: false,
+		},
+	}
+	for testName, testCase := range testCases {
+		if result := Equals(testCase.a, testCase.b); result != testCase.expected {
+			t.Errorf("%s expected: %v, actual: %v, a=%v, b=%v", testName, testCase.expected, result, testCase.a, testCase.b)
+		}
+	}
+}
+
+func TestMax(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		b        api.ResourceList
+		expected api.ResourceList
+	}{
+		"noKeys": {
+			a:        api.ResourceList{},
+			b:        api.ResourceList{},
+			expected: api.ResourceList{},
+		},
+		"toEmpty": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			b:        api.ResourceList{},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+		},
+		"matching": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			b:        api.ResourceList{api.ResourceCPU: resource.MustParse("150m")},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("150m")},
+		},
+		"matching(reverse)": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("150m")},
+			b:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("150m")},
+		},
+	}
+	for testName, testCase := range testCases {
+		sum := Max(testCase.a, testCase.b)
+		if result := Equals(testCase.expected, sum); !result {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.expected, sum)
+		}
+	}
+}
+
+func TestAdd(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		b        api.ResourceList
+		expected api.ResourceList
+	}{
+		"noKeys": {
+			a:        api.ResourceList{},
+			b:        api.ResourceList{},
+			expected: api.ResourceList{},
+		},
+		"toEmpty": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			b:        api.ResourceList{},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+		},
+		"matching": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			b:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("200m")},
+		},
+	}
+	for testName, testCase := range testCases {
+		sum := Add(testCase.a, testCase.b)
+		if result := Equals(testCase.expected, sum); !result {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.expected, sum)
+		}
+	}
+}
+
+func TestSubtract(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		b        api.ResourceList
+		expected api.ResourceList
+	}{
+		"noKeys": {
+			a:        api.ResourceList{},
+			b:        api.ResourceList{},
+			expected: api.ResourceList{},
+		},
+		"value-empty": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			b:        api.ResourceList{},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+		},
+		"empty-value": {
+			a:        api.ResourceList{},
+			b:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("-100m")},
+		},
+		"value-value": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("200m")},
+			b:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+		},
+	}
+	for testName, testCase := range testCases {
+		sub := Subtract(testCase.a, testCase.b)
+		if result := Equals(testCase.expected, sub); !result {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.expected, sub)
+		}
+	}
+}
+
+func TestResourceNames(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		expected []api.ResourceName
+	}{
+		"empty": {
+			a:        api.ResourceList{},
+			expected: []api.ResourceName{},
+		},
+		"values": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("100m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			expected: []api.ResourceName{api.ResourceMemory, api.ResourceCPU},
+		},
+	}
+	for testName, testCase := range testCases {
+		actualSet := ToSet(ResourceNames(testCase.a))
+		expectedSet := ToSet(testCase.expected)
+		if !actualSet.Equal(expectedSet) {
+			t.Errorf("%s expected: %v, actual: %v", testName, expectedSet, actualSet)
+		}
+	}
+}
+
+func TestContains(t *testing.T) {
+	testCases := map[string]struct {
+		a        []api.ResourceName
+		b        api.ResourceName
+		expected bool
+	}{
+		"does-not-contain": {
+			a:        []api.ResourceName{api.ResourceMemory},
+			b:        api.ResourceCPU,
+			expected: false,
+		},
+		"does-contain": {
+			a:        []api.ResourceName{api.ResourceMemory, api.ResourceCPU},
+			b:        api.ResourceCPU,
+			expected: true,
+		},
+	}
+	for testName, testCase := range testCases {
+		if actual := Contains(testCase.a, testCase.b); actual != testCase.expected {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.expected, actual)
+		}
+	}
+}
+
+func TestContainsPrefix(t *testing.T) {
+	testCases := map[string]struct {
+		a        []string
+		b        api.ResourceName
+		expected bool
+	}{
+		"does-not-contain": {
+			a:        []string{api.ResourceHugePagesPrefix},
+			b:        api.ResourceCPU,
+			expected: false,
+		},
+		"does-contain": {
+			a:        []string{api.ResourceHugePagesPrefix},
+			b:        api.ResourceName(api.ResourceHugePagesPrefix + "2Mi"),
+			expected: true,
+		},
+	}
+	for testName, testCase := range testCases {
+		if actual := ContainsPrefix(testCase.a, testCase.b); actual != testCase.expected {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.expected, actual)
+		}
+	}
+}
+
+func TestIsZero(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		expected bool
+	}{
+		"empty": {
+			a:        api.ResourceList{},
+			expected: true,
+		},
+		"zero": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("0"),
+				api.ResourceMemory: resource.MustParse("0"),
+			},
+			expected: true,
+		},
+		"non-zero": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("200m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			expected: false,
+		},
+	}
+	for testName, testCase := range testCases {
+		if result := IsZero(testCase.a); result != testCase.expected {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.expected, result)
+		}
+	}
+}
+
+func TestIsNegative(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		expected []api.ResourceName
+	}{
+		"empty": {
+			a:        api.ResourceList{},
+			expected: []api.ResourceName{},
+		},
+		"some-negative": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("-10"),
+				api.ResourceMemory: resource.MustParse("0"),
+			},
+			expected: []api.ResourceName{api.ResourceCPU},
+		},
+		"all-negative": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("-200m"),
+				api.ResourceMemory: resource.MustParse("-1Gi"),
+			},
+			expected: []api.ResourceName{api.ResourceCPU, api.ResourceMemory},
+		},
+	}
+	for testName, testCase := range testCases {
+		actual := IsNegative(testCase.a)
+		actualSet := ToSet(actual)
+		expectedSet := ToSet(testCase.expected)
+		if !actualSet.Equal(expectedSet) {
+			t.Errorf("%s expected: %v, actual: %v", testName, expectedSet, actualSet)
+		}
+	}
+}