vendor files

vendor/k8s.io/kubernetes/plugin/pkg/admission/podpreset/BUILD

@@ -0,0 +1,61 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["admission_test.go"],
+    importpath = "k8s.io/kubernetes/plugin/pkg/admission/podpreset",
+    library = ":go_default_library",
+    deps = [
+        "//pkg/apis/core:go_default_library",
+        "//pkg/apis/settings:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset/fake:go_default_library",
+        "//pkg/client/informers/informers_generated/internalversion:go_default_library",
+        "//pkg/client/listers/settings/internalversion:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library",
+    ],
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["admission.go"],
+    importpath = "k8s.io/kubernetes/plugin/pkg/admission/podpreset",
+    deps = [
+        "//pkg/api/legacyscheme:go_default_library",
+        "//pkg/api/ref:go_default_library",
+        "//pkg/apis/core:go_default_library",
+        "//pkg/apis/settings:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset:go_default_library",
+        "//pkg/client/informers/informers_generated/internalversion:go_default_library",
+        "//pkg/client/listers/settings/internalversion:go_default_library",
+        "//pkg/kubeapiserver/admission:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/errors:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/plugin/pkg/admission/podpreset/admission.go

@@ -0,0 +1,410 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package podpreset
+
+import (
+	"fmt"
+	"io"
+	"reflect"
+	"strings"
+
+	"github.com/golang/glog"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/kubernetes/pkg/api/legacyscheme"
+	"k8s.io/kubernetes/pkg/api/ref"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/apis/settings"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
+	informers "k8s.io/kubernetes/pkg/client/informers/informers_generated/internalversion"
+	settingslisters "k8s.io/kubernetes/pkg/client/listers/settings/internalversion"
+	kubeapiserveradmission "k8s.io/kubernetes/pkg/kubeapiserver/admission"
+)
+
+const (
+	annotationPrefix = "podpreset.admission.kubernetes.io"
+	pluginName       = "PodPreset"
+)
+
+// Register registers a plugin
+func Register(plugins *admission.Plugins) {
+	plugins.Register(pluginName, func(config io.Reader) (admission.Interface, error) {
+		return NewPlugin(), nil
+	})
+}
+
+// podPresetPlugin is an implementation of admission.Interface.
+type podPresetPlugin struct {
+	*admission.Handler
+	client internalclientset.Interface
+
+	lister settingslisters.PodPresetLister
+}
+
+var _ admission.MutationInterface = &podPresetPlugin{}
+var _ = kubeapiserveradmission.WantsInternalKubeInformerFactory(&podPresetPlugin{})
+var _ = kubeapiserveradmission.WantsInternalKubeClientSet(&podPresetPlugin{})
+
+// NewPlugin creates a new pod preset admission plugin.
+func NewPlugin() *podPresetPlugin {
+	return &podPresetPlugin{
+		Handler: admission.NewHandler(admission.Create, admission.Update),
+	}
+}
+
+func (plugin *podPresetPlugin) ValidateInitialization() error {
+	if plugin.client == nil {
+		return fmt.Errorf("%s requires a client", pluginName)
+	}
+	if plugin.lister == nil {
+		return fmt.Errorf("%s requires a lister", pluginName)
+	}
+	return nil
+}
+
+func (a *podPresetPlugin) SetInternalKubeClientSet(client internalclientset.Interface) {
+	a.client = client
+}
+
+func (a *podPresetPlugin) SetInternalKubeInformerFactory(f informers.SharedInformerFactory) {
+	podPresetInformer := f.Settings().InternalVersion().PodPresets()
+	a.lister = podPresetInformer.Lister()
+	a.SetReadyFunc(podPresetInformer.Informer().HasSynced)
+}
+
+// Admit injects a pod with the specific fields for each pod preset it matches.
+func (c *podPresetPlugin) Admit(a admission.Attributes) error {
+	// Ignore all calls to subresources or resources other than pods.
+	// Ignore all operations other than CREATE.
+	if len(a.GetSubresource()) != 0 || a.GetResource().GroupResource() != api.Resource("pods") || a.GetOperation() != admission.Create {
+		return nil
+	}
+
+	pod, ok := a.GetObject().(*api.Pod)
+	if !ok {
+		return errors.NewBadRequest("Resource was marked with kind Pod but was unable to be converted")
+	}
+
+	if _, isMirrorPod := pod.Annotations[api.MirrorPodAnnotationKey]; isMirrorPod {
+		return nil
+	}
+
+	// Ignore if exclusion annotation is present
+	if podAnnotations := pod.GetAnnotations(); podAnnotations != nil {
+		glog.V(5).Infof("Looking at pod annotations, found: %v", podAnnotations)
+		if podAnnotations[api.PodPresetOptOutAnnotationKey] == "true" {
+			return nil
+		}
+	}
+
+	list, err := c.lister.PodPresets(a.GetNamespace()).List(labels.Everything())
+	if err != nil {
+		return fmt.Errorf("listing pod presets failed: %v", err)
+	}
+
+	matchingPPs, err := filterPodPresets(list, pod)
+	if err != nil {
+		return fmt.Errorf("filtering pod presets failed: %v", err)
+	}
+
+	if len(matchingPPs) == 0 {
+		return nil
+	}
+
+	presetNames := make([]string, len(matchingPPs))
+	for i, pp := range matchingPPs {
+		presetNames[i] = pp.GetName()
+	}
+
+	// detect merge conflict
+	err = safeToApplyPodPresetsOnPod(pod, matchingPPs)
+	if err != nil {
+		// conflict, ignore the error, but raise an event
+		glog.Warningf("conflict occurred while applying podpresets: %s on pod: %v err: %v",
+			strings.Join(presetNames, ","), pod.GetGenerateName(), err)
+		return nil
+	}
+
+	applyPodPresetsOnPod(pod, matchingPPs)
+
+	glog.Infof("applied podpresets: %s successfully on Pod: %+v ", strings.Join(presetNames, ","), pod.GetGenerateName())
+
+	return nil
+}
+
+// filterPodPresets returns list of PodPresets which match given Pod.
+func filterPodPresets(list []*settings.PodPreset, pod *api.Pod) ([]*settings.PodPreset, error) {
+	var matchingPPs []*settings.PodPreset
+
+	for _, pp := range list {
+		selector, err := metav1.LabelSelectorAsSelector(&pp.Spec.Selector)
+		if err != nil {
+			return nil, fmt.Errorf("label selector conversion failed: %v for selector: %v", pp.Spec.Selector, err)
+		}
+
+		// check if the pod labels match the selector
+		if !selector.Matches(labels.Set(pod.Labels)) {
+			continue
+		}
+		glog.V(4).Infof("PodPreset %s matches pod %s labels", pp.GetName(), pod.GetName())
+		matchingPPs = append(matchingPPs, pp)
+	}
+	return matchingPPs, nil
+}
+
+// safeToApplyPodPresetsOnPod determines if there is any conflict in information
+// injected by given PodPresets in the Pod.
+func safeToApplyPodPresetsOnPod(pod *api.Pod, podPresets []*settings.PodPreset) error {
+	var errs []error
+
+	// volumes attribute is defined at the Pod level, so determine if volumes
+	// injection is causing any conflict.
+	if _, err := mergeVolumes(pod.Spec.Volumes, podPresets); err != nil {
+		errs = append(errs, err)
+	}
+	for _, ctr := range pod.Spec.Containers {
+		if err := safeToApplyPodPresetsOnContainer(&ctr, podPresets); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return utilerrors.NewAggregate(errs)
+}
+
+// safeToApplyPodPresetsOnContainer determines if there is any conflict in
+// information injected by given PodPresets in the given container.
+func safeToApplyPodPresetsOnContainer(ctr *api.Container, podPresets []*settings.PodPreset) error {
+	var errs []error
+	// check if it is safe to merge env vars and volume mounts from given podpresets and
+	// container's existing env vars.
+	if _, err := mergeEnv(ctr.Env, podPresets); err != nil {
+		errs = append(errs, err)
+	}
+	if _, err := mergeVolumeMounts(ctr.VolumeMounts, podPresets); err != nil {
+		errs = append(errs, err)
+	}
+
+	return utilerrors.NewAggregate(errs)
+}
+
+// mergeEnv merges a list of env vars with the env vars injected by given list podPresets.
+// It returns an error if it detects any conflict during the merge.
+func mergeEnv(envVars []api.EnvVar, podPresets []*settings.PodPreset) ([]api.EnvVar, error) {
+	origEnv := map[string]api.EnvVar{}
+	for _, v := range envVars {
+		origEnv[v.Name] = v
+	}
+
+	mergedEnv := make([]api.EnvVar, len(envVars))
+	copy(mergedEnv, envVars)
+
+	var errs []error
+
+	for _, pp := range podPresets {
+		for _, v := range pp.Spec.Env {
+			found, ok := origEnv[v.Name]
+			if !ok {
+				// if we don't already have it append it and continue
+				origEnv[v.Name] = v
+				mergedEnv = append(mergedEnv, v)
+				continue
+			}
+
+			// make sure they are identical or throw an error
+			if !reflect.DeepEqual(found, v) {
+				errs = append(errs, fmt.Errorf("merging env for %s has a conflict on %s: \n%#v\ndoes not match\n%#v\n in container", pp.GetName(), v.Name, v, found))
+			}
+		}
+	}
+
+	err := utilerrors.NewAggregate(errs)
+	if err != nil {
+		return nil, err
+	}
+
+	return mergedEnv, err
+}
+
+func mergeEnvFrom(envSources []api.EnvFromSource, podPresets []*settings.PodPreset) ([]api.EnvFromSource, error) {
+	var mergedEnvFrom []api.EnvFromSource
+
+	mergedEnvFrom = append(mergedEnvFrom, envSources...)
+	for _, pp := range podPresets {
+		mergedEnvFrom = append(mergedEnvFrom, pp.Spec.EnvFrom...)
+	}
+
+	return mergedEnvFrom, nil
+}
+
+// mergeVolumeMounts merges given list of VolumeMounts with the volumeMounts
+// injected by given podPresets. It returns an error if it detects any conflict during the merge.
+func mergeVolumeMounts(volumeMounts []api.VolumeMount, podPresets []*settings.PodPreset) ([]api.VolumeMount, error) {
+
+	origVolumeMounts := map[string]api.VolumeMount{}
+	volumeMountsByPath := map[string]api.VolumeMount{}
+	for _, v := range volumeMounts {
+		origVolumeMounts[v.Name] = v
+		volumeMountsByPath[v.MountPath] = v
+	}
+
+	mergedVolumeMounts := make([]api.VolumeMount, len(volumeMounts))
+	copy(mergedVolumeMounts, volumeMounts)
+
+	var errs []error
+
+	for _, pp := range podPresets {
+		for _, v := range pp.Spec.VolumeMounts {
+			found, ok := origVolumeMounts[v.Name]
+			if !ok {
+				// if we don't already have it append it and continue
+				origVolumeMounts[v.Name] = v
+				mergedVolumeMounts = append(mergedVolumeMounts, v)
+			} else {
+				// make sure they are identical or throw an error
+				// shall we throw an error for identical volumeMounts ?
+				if !reflect.DeepEqual(found, v) {
+					errs = append(errs, fmt.Errorf("merging volume mounts for %s has a conflict on %s: \n%#v\ndoes not match\n%#v\n in container", pp.GetName(), v.Name, v, found))
+				}
+			}
+
+			found, ok = volumeMountsByPath[v.MountPath]
+			if !ok {
+				// if we don't already have it append it and continue
+				volumeMountsByPath[v.MountPath] = v
+			} else {
+				// make sure they are identical or throw an error
+				if !reflect.DeepEqual(found, v) {
+					errs = append(errs, fmt.Errorf("merging volume mounts for %s has a conflict on mount path %s: \n%#v\ndoes not match\n%#v\n in container", pp.GetName(), v.MountPath, v, found))
+				}
+			}
+		}
+	}
+
+	err := utilerrors.NewAggregate(errs)
+	if err != nil {
+		return nil, err
+	}
+
+	return mergedVolumeMounts, err
+}
+
+// mergeVolumes merges given list of Volumes with the volumes injected by given
+// podPresets. It returns an error if it detects any conflict during the merge.
+func mergeVolumes(volumes []api.Volume, podPresets []*settings.PodPreset) ([]api.Volume, error) {
+	origVolumes := map[string]api.Volume{}
+	for _, v := range volumes {
+		origVolumes[v.Name] = v
+	}
+
+	mergedVolumes := make([]api.Volume, len(volumes))
+	copy(mergedVolumes, volumes)
+
+	var errs []error
+
+	for _, pp := range podPresets {
+		for _, v := range pp.Spec.Volumes {
+			found, ok := origVolumes[v.Name]
+			if !ok {
+				// if we don't already have it append it and continue
+				origVolumes[v.Name] = v
+				mergedVolumes = append(mergedVolumes, v)
+				continue
+			}
+
+			// make sure they are identical or throw an error
+			if !reflect.DeepEqual(found, v) {
+				errs = append(errs, fmt.Errorf("merging volumes for %s has a conflict on %s: \n%#v\ndoes not match\n%#v\n in container", pp.GetName(), v.Name, v, found))
+			}
+		}
+	}
+
+	err := utilerrors.NewAggregate(errs)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(mergedVolumes) == 0 {
+		return nil, nil
+	}
+
+	return mergedVolumes, err
+}
+
+func (c *podPresetPlugin) addEvent(pod *api.Pod, pip *settings.PodPreset, message string) {
+	ref, err := ref.GetReference(legacyscheme.Scheme, pod)
+	if err != nil {
+		glog.Errorf("pip %s: get reference for pod %s failed: %v", pip.GetName(), pod.GetName(), err)
+		return
+	}
+
+	e := &api.Event{
+		InvolvedObject: *ref,
+		Message:        message,
+		Source: api.EventSource{
+			Component: fmt.Sprintf("pip %s", pip.GetName()),
+		},
+		Type: "Warning",
+	}
+
+	if _, err := c.client.Core().Events(pod.GetNamespace()).Create(e); err != nil {
+		glog.Errorf("pip %s: creating pod event failed: %v", pip.GetName(), err)
+		return
+	}
+}
+
+// applyPodPresetsOnPod updates the PodSpec with merged information from all the
+// applicable PodPresets. It ignores the errors of merge functions because merge
+// errors have already been checked in safeToApplyPodPresetsOnPod function.
+func applyPodPresetsOnPod(pod *api.Pod, podPresets []*settings.PodPreset) {
+	if len(podPresets) == 0 {
+		return
+	}
+
+	volumes, _ := mergeVolumes(pod.Spec.Volumes, podPresets)
+	pod.Spec.Volumes = volumes
+
+	for i, ctr := range pod.Spec.Containers {
+		applyPodPresetsOnContainer(&ctr, podPresets)
+		pod.Spec.Containers[i] = ctr
+	}
+
+	// add annotation
+	if pod.ObjectMeta.Annotations == nil {
+		pod.ObjectMeta.Annotations = map[string]string{}
+	}
+
+	for _, pp := range podPresets {
+		pod.ObjectMeta.Annotations[fmt.Sprintf("%s/podpreset-%s", annotationPrefix, pp.GetName())] = pp.GetResourceVersion()
+	}
+}
+
+// applyPodPresetsOnContainer injects envVars, VolumeMounts and envFrom from
+// given podPresets in to the given container. It ignores conflict errors
+// because it assumes those have been checked already by the caller.
+func applyPodPresetsOnContainer(ctr *api.Container, podPresets []*settings.PodPreset) {
+	envVars, _ := mergeEnv(ctr.Env, podPresets)
+	ctr.Env = envVars
+
+	volumeMounts, _ := mergeVolumeMounts(ctr.VolumeMounts, podPresets)
+	ctr.VolumeMounts = volumeMounts
+
+	envFrom, _ := mergeEnvFrom(ctr.EnvFrom, podPresets)
+	ctr.EnvFrom = envFrom
+}

vendor/k8s.io/kubernetes/plugin/pkg/admission/podpreset/admission_test.go

@@ -0,0 +1,831 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package podpreset
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	kadmission "k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/authentication/user"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/apis/settings"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/fake"
+	informers "k8s.io/kubernetes/pkg/client/informers/informers_generated/internalversion"
+	settingslisters "k8s.io/kubernetes/pkg/client/listers/settings/internalversion"
+	"k8s.io/kubernetes/pkg/controller"
+)
+
+func TestMergeEnv(t *testing.T) {
+	tests := map[string]struct {
+		orig       []api.EnvVar
+		mod        []api.EnvVar
+		result     []api.EnvVar
+		shouldFail bool
+	}{
+		"empty original": {
+			mod:        []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "ABC", Value: "value3"}},
+			result:     []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "ABC", Value: "value3"}},
+			shouldFail: false,
+		},
+		"good merge": {
+			orig:       []api.EnvVar{{Name: "abcd", Value: "value2"}, {Name: "hello", Value: "value3"}},
+			mod:        []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "ABC", Value: "value3"}},
+			result:     []api.EnvVar{{Name: "abcd", Value: "value2"}, {Name: "hello", Value: "value3"}, {Name: "abc", Value: "value2"}, {Name: "ABC", Value: "value3"}},
+			shouldFail: false,
+		},
+		"conflict": {
+			orig:       []api.EnvVar{{Name: "abc", Value: "value3"}},
+			mod:        []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "ABC", Value: "value3"}},
+			shouldFail: true,
+		},
+		"one is exact same": {
+			orig:       []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "hello", Value: "value3"}},
+			mod:        []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "ABC", Value: "value3"}},
+			result:     []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "hello", Value: "value3"}, {Name: "ABC", Value: "value3"}},
+			shouldFail: false,
+		},
+	}
+
+	for name, test := range tests {
+		result, err := mergeEnv(
+			test.orig,
+			[]*settings.PodPreset{{Spec: settings.PodPresetSpec{Env: test.mod}}},
+		)
+		if test.shouldFail && err == nil {
+			t.Fatalf("expected test %q to fail but got nil", name)
+		}
+		if !test.shouldFail && err != nil {
+			t.Fatalf("test %q failed: %v", name, err)
+		}
+		if !reflect.DeepEqual(test.result, result) {
+			t.Fatalf("results were not equal for test %q: got %#v; expected: %#v", name, result, test.result)
+		}
+	}
+}
+
+func TestMergeEnvFrom(t *testing.T) {
+	tests := map[string]struct {
+		orig       []api.EnvFromSource
+		mod        []api.EnvFromSource
+		result     []api.EnvFromSource
+		shouldFail bool
+	}{
+		"empty original": {
+			mod: []api.EnvFromSource{
+				{
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+				{
+					Prefix: "pre_",
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+			},
+			result: []api.EnvFromSource{
+				{
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+				{
+					Prefix: "pre_",
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+			},
+			shouldFail: false,
+		},
+		"good merge": {
+			orig: []api.EnvFromSource{
+				{
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "thing"},
+					},
+				},
+			},
+			mod: []api.EnvFromSource{
+				{
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+				{
+					Prefix: "pre_",
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+			},
+			result: []api.EnvFromSource{
+				{
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "thing"},
+					},
+				},
+				{
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+				{
+					Prefix: "pre_",
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+			},
+			shouldFail: false,
+		},
+	}
+
+	for name, test := range tests {
+		result, err := mergeEnvFrom(
+			test.orig,
+			[]*settings.PodPreset{{Spec: settings.PodPresetSpec{EnvFrom: test.mod}}},
+		)
+		if test.shouldFail && err == nil {
+			t.Fatalf("expected test %q to fail but got nil", name)
+		}
+		if !test.shouldFail && err != nil {
+			t.Fatalf("test %q failed: %v", name, err)
+		}
+		if !reflect.DeepEqual(test.result, result) {
+			t.Fatalf("results were not equal for test %q: got %#v; expected: %#v", name, result, test.result)
+		}
+	}
+}
+
+func TestMergeVolumeMounts(t *testing.T) {
+	tests := map[string]struct {
+		orig       []api.VolumeMount
+		mod        []api.VolumeMount
+		result     []api.VolumeMount
+		shouldFail bool
+	}{
+		"empty original": {
+			mod: []api.VolumeMount{
+				{
+					Name:      "simply-mounted-volume",
+					MountPath: "/opt/",
+				},
+			},
+			result: []api.VolumeMount{
+				{
+					Name:      "simply-mounted-volume",
+					MountPath: "/opt/",
+				},
+			},
+			shouldFail: false,
+		},
+		"good merge": {
+			mod: []api.VolumeMount{
+				{
+					Name:      "simply-mounted-volume",
+					MountPath: "/opt/",
+				},
+			},
+			orig: []api.VolumeMount{
+				{
+					Name:      "etc-volume",
+					MountPath: "/etc/",
+				},
+			},
+			result: []api.VolumeMount{
+				{
+					Name:      "etc-volume",
+					MountPath: "/etc/",
+				},
+				{
+					Name:      "simply-mounted-volume",
+					MountPath: "/opt/",
+				},
+			},
+			shouldFail: false,
+		},
+		"conflict": {
+			mod: []api.VolumeMount{
+				{
+					Name:      "simply-mounted-volume",
+					MountPath: "/opt/",
+				},
+				{
+					Name:      "etc-volume",
+					MountPath: "/things/",
+				},
+			},
+			orig: []api.VolumeMount{
+				{
+					Name:      "etc-volume",
+					MountPath: "/etc/",
+				},
+			},
+			shouldFail: true,
+		},
+		"conflict on mount path": {
+			mod: []api.VolumeMount{
+				{
+					Name:      "simply-mounted-volume",
+					MountPath: "/opt/",
+				},
+				{
+					Name:      "things-volume",
+					MountPath: "/etc/",
+				},
+			},
+			orig: []api.VolumeMount{
+				{
+					Name:      "etc-volume",
+					MountPath: "/etc/",
+				},
+			},
+			shouldFail: true,
+		},
+		"one is exact same": {
+			mod: []api.VolumeMount{
+				{
+					Name:      "simply-mounted-volume",
+					MountPath: "/opt/",
+				},
+				{
+					Name:      "etc-volume",
+					MountPath: "/etc/",
+				},
+			},
+			orig: []api.VolumeMount{
+				{
+					Name:      "etc-volume",
+					MountPath: "/etc/",
+				},
+			},
+			result: []api.VolumeMount{
+				{
+					Name:      "etc-volume",
+					MountPath: "/etc/",
+				},
+				{
+					Name:      "simply-mounted-volume",
+					MountPath: "/opt/",
+				},
+			},
+			shouldFail: false,
+		},
+	}
+
+	for name, test := range tests {
+		result, err := mergeVolumeMounts(
+			test.orig,
+			[]*settings.PodPreset{{Spec: settings.PodPresetSpec{VolumeMounts: test.mod}}},
+		)
+		if test.shouldFail && err == nil {
+			t.Fatalf("expected test %q to fail but got nil", name)
+		}
+		if !test.shouldFail && err != nil {
+			t.Fatalf("test %q failed: %v", name, err)
+		}
+		if !reflect.DeepEqual(test.result, result) {
+			t.Fatalf("results were not equal for test %q: got %#v; expected: %#v", name, result, test.result)
+		}
+	}
+}
+
+func TestMergeVolumes(t *testing.T) {
+	tests := map[string]struct {
+		orig       []api.Volume
+		mod        []api.Volume
+		result     []api.Volume
+		shouldFail bool
+	}{
+		"empty original": {
+			mod: []api.Volume{
+				{Name: "vol", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+				{Name: "vol2", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+			},
+			result: []api.Volume{
+				{Name: "vol", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+				{Name: "vol2", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+			},
+			shouldFail: false,
+		},
+		"good merge": {
+			orig: []api.Volume{
+				{Name: "vol3", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+				{Name: "vol4", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+			},
+			mod: []api.Volume{
+				{Name: "vol", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+				{Name: "vol2", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+			},
+			result: []api.Volume{
+				{Name: "vol3", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+				{Name: "vol4", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+				{Name: "vol", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+				{Name: "vol2", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+			},
+			shouldFail: false,
+		},
+		"conflict": {
+			orig: []api.Volume{
+				{Name: "vol3", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+				{Name: "vol4", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+			},
+			mod: []api.Volume{
+				{Name: "vol3", VolumeSource: api.VolumeSource{HostPath: &api.HostPathVolumeSource{Path: "/etc/apparmor.d"}}},
+				{Name: "vol2", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+			},
+			shouldFail: true,
+		},
+		"one is exact same": {
+			orig: []api.Volume{
+				{Name: "vol3", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+				{Name: "vol4", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+			},
+			mod: []api.Volume{
+				{Name: "vol3", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+				{Name: "vol2", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+			},
+			result: []api.Volume{
+				{Name: "vol3", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+				{Name: "vol4", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+				{Name: "vol2", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}},
+			},
+			shouldFail: false,
+		},
+	}
+
+	for name, test := range tests {
+		result, err := mergeVolumes(
+			test.orig,
+			[]*settings.PodPreset{{Spec: settings.PodPresetSpec{Volumes: test.mod}}},
+		)
+		if test.shouldFail && err == nil {
+			t.Fatalf("expected test %q to fail but got nil", name)
+		}
+		if !test.shouldFail && err != nil {
+			t.Fatalf("test %q failed: %v", name, err)
+		}
+		if !reflect.DeepEqual(test.result, result) {
+			t.Fatalf("results were not equal for test %q: got %#v; expected: %#v", name, result, test.result)
+		}
+	}
+}
+
+// NewTestAdmission provides an admission plugin with test implementations of internal structs.  It uses
+// an authorizer that always returns true.
+func NewTestAdmission(lister settingslisters.PodPresetLister, objects ...runtime.Object) kadmission.MutationInterface {
+	// Build a test client that the admission plugin can use to look up the service account missing from its cache
+	client := fake.NewSimpleClientset(objects...)
+
+	return &podPresetPlugin{
+		client:  client,
+		Handler: kadmission.NewHandler(kadmission.Create),
+		lister:  lister,
+	}
+}
+
+func TestAdmitConflictWithDifferentNamespaceShouldDoNothing(t *testing.T) {
+	containerName := "container"
+
+	pod := &api.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mypod",
+			Namespace: "namespace",
+			Labels: map[string]string{
+				"security": "S2",
+			},
+		},
+		Spec: api.PodSpec{
+			Containers: []api.Container{
+				{
+					Name: containerName,
+					Env:  []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "ABC", Value: "value3"}},
+				},
+			},
+		},
+	}
+
+	pip := &settings.PodPreset{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "hello",
+			Namespace: "othernamespace",
+		},
+		Spec: settings.PodPresetSpec{
+			Selector: v1.LabelSelector{
+				MatchExpressions: []v1.LabelSelectorRequirement{
+					{
+						Key:      "security",
+						Operator: v1.LabelSelectorOpIn,
+						Values:   []string{"S2"},
+					},
+				},
+			},
+			Env: []api.EnvVar{{Name: "abc", Value: "value"}, {Name: "ABC", Value: "value"}},
+		},
+	}
+
+	err := admitPod(pod, pip)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestAdmitConflictWithNonMatchingLabelsShouldNotError(t *testing.T) {
+	containerName := "container"
+
+	pod := &api.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mypod",
+			Namespace: "namespace",
+			Labels: map[string]string{
+				"security": "S2",
+			},
+		},
+		Spec: api.PodSpec{
+			Containers: []api.Container{
+				{
+					Name: containerName,
+					Env:  []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "ABC", Value: "value3"}},
+				},
+			},
+		},
+	}
+
+	pip := &settings.PodPreset{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "hello",
+			Namespace: "namespace",
+		},
+		Spec: settings.PodPresetSpec{
+			Selector: v1.LabelSelector{
+				MatchExpressions: []v1.LabelSelectorRequirement{
+					{
+						Key:      "security",
+						Operator: v1.LabelSelectorOpIn,
+						Values:   []string{"S3"},
+					},
+				},
+			},
+			Env: []api.EnvVar{{Name: "abc", Value: "value"}, {Name: "ABC", Value: "value"}},
+		},
+	}
+
+	err := admitPod(pod, pip)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestAdmitConflictShouldNotModifyPod(t *testing.T) {
+	containerName := "container"
+
+	pod := &api.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mypod",
+			Namespace: "namespace",
+			Labels: map[string]string{
+				"security": "S2",
+			},
+		},
+		Spec: api.PodSpec{
+			Containers: []api.Container{
+				{
+					Name: containerName,
+					Env:  []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "ABC", Value: "value3"}},
+				},
+			},
+		},
+	}
+	origPod := *pod
+
+	pip := &settings.PodPreset{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "hello",
+			Namespace: "namespace",
+		},
+		Spec: settings.PodPresetSpec{
+			Selector: v1.LabelSelector{
+				MatchExpressions: []v1.LabelSelectorRequirement{
+					{
+						Key:      "security",
+						Operator: v1.LabelSelectorOpIn,
+						Values:   []string{"S2"},
+					},
+				},
+			},
+			Env: []api.EnvVar{{Name: "abc", Value: "value"}, {Name: "ABC", Value: "value"}},
+		},
+	}
+
+	err := admitPod(pod, pip)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(&origPod, pod) {
+		t.Fatalf("pod should not get modified in case of conflict origPod: %+v got: %+v", &origPod, pod)
+	}
+}
+
+func TestAdmit(t *testing.T) {
+	containerName := "container"
+
+	pod := &api.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mypod",
+			Namespace: "namespace",
+			Labels: map[string]string{
+				"security": "S2",
+			},
+		},
+		Spec: api.PodSpec{
+			Containers: []api.Container{
+				{
+					Name: containerName,
+					Env:  []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "ABCD", Value: "value3"}},
+				},
+			},
+		},
+	}
+
+	pip := &settings.PodPreset{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "hello",
+			Namespace: "namespace",
+		},
+		Spec: settings.PodPresetSpec{
+			Selector: v1.LabelSelector{
+				MatchExpressions: []v1.LabelSelectorRequirement{
+					{
+						Key:      "security",
+						Operator: v1.LabelSelectorOpIn,
+						Values:   []string{"S2"},
+					},
+				},
+			},
+			Volumes: []api.Volume{{Name: "vol", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}}},
+			Env:     []api.EnvVar{{Name: "abcd", Value: "value"}, {Name: "ABC", Value: "value"}},
+			EnvFrom: []api.EnvFromSource{
+				{
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+				{
+					Prefix: "pre_",
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+			},
+		},
+	}
+
+	err := admitPod(pod, pip)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestAdmitMirrorPod(t *testing.T) {
+	containerName := "container"
+
+	mirrorPod := &api.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mypod",
+			Namespace: "namespace",
+			Labels: map[string]string{
+				"security": "S2",
+			},
+			Annotations: map[string]string{api.MirrorPodAnnotationKey: "mirror"},
+		},
+		Spec: api.PodSpec{
+			Containers: []api.Container{
+				{
+					Name: containerName,
+				},
+			},
+		},
+	}
+
+	pip := &settings.PodPreset{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "hello",
+			Namespace: "namespace",
+		},
+		Spec: settings.PodPresetSpec{
+			Selector: v1.LabelSelector{
+				MatchExpressions: []v1.LabelSelectorRequirement{
+					{
+						Key:      "security",
+						Operator: v1.LabelSelectorOpIn,
+						Values:   []string{"S2"},
+					},
+				},
+			},
+			Volumes: []api.Volume{{Name: "vol", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}}},
+			Env:     []api.EnvVar{{Name: "abcd", Value: "value"}, {Name: "ABC", Value: "value"}},
+			EnvFrom: []api.EnvFromSource{
+				{
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+				{
+					Prefix: "pre_",
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+			},
+		},
+	}
+
+	if err := admitPod(mirrorPod, pip); err != nil {
+		t.Fatal(err)
+	}
+
+	container := mirrorPod.Spec.Containers[0]
+	if len(mirrorPod.Spec.Volumes) != 0 ||
+		len(container.VolumeMounts) != 0 ||
+		len(container.Env) != 0 ||
+		len(container.EnvFrom) != 0 {
+		t.Fatalf("mirror pod is updated by PodPreset admission:\n\tVolumes got %d, expected 0\n\tVolumeMounts go %d, expected 0\n\tEnv got, %d expected 0\n\tEnvFrom got %d, expected 0", len(mirrorPod.Spec.Volumes), len(container.VolumeMounts), len(container.Env), len(container.EnvFrom))
+	}
+}
+
+func TestExclusionNoAdmit(t *testing.T) {
+	containerName := "container"
+
+	pod := &api.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mypod",
+			Namespace: "namespace",
+			Labels: map[string]string{
+				"security": "S2",
+			},
+			Annotations: map[string]string{
+				api.PodPresetOptOutAnnotationKey: "true",
+			},
+		},
+		Spec: api.PodSpec{
+			Containers: []api.Container{
+				{
+					Name: containerName,
+					Env:  []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "ABCD", Value: "value3"}},
+				},
+			},
+		},
+	}
+
+	pip := &settings.PodPreset{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "hello",
+			Namespace: "namespace",
+		},
+		Spec: settings.PodPresetSpec{
+			Selector: v1.LabelSelector{
+				MatchExpressions: []v1.LabelSelectorRequirement{
+					{
+						Key:      "security",
+						Operator: v1.LabelSelectorOpIn,
+						Values:   []string{"S2"},
+					},
+				},
+			},
+			Volumes: []api.Volume{{Name: "vol", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}}},
+			Env:     []api.EnvVar{{Name: "abcd", Value: "value"}, {Name: "ABC", Value: "value"}},
+			EnvFrom: []api.EnvFromSource{
+				{
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+				{
+					Prefix: "pre_",
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+			},
+		},
+	}
+	originalPod := pod.DeepCopy()
+	err := admitPod(pod, pip)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// verify PodSpec has not been mutated
+	if !reflect.DeepEqual(pod, originalPod) {
+		t.Fatalf("Expected pod spec of '%v' to be unchanged", pod.Name)
+	}
+}
+
+func TestAdmitEmptyPodNamespace(t *testing.T) {
+	containerName := "container"
+
+	pod := &api.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "mypod",
+			Labels: map[string]string{
+				"security": "S2",
+			},
+		},
+		Spec: api.PodSpec{
+			Containers: []api.Container{
+				{
+					Name: containerName,
+					Env:  []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "ABCD", Value: "value3"}},
+				},
+			},
+		},
+	}
+
+	pip := &settings.PodPreset{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "hello",
+			Namespace: "different", // (pod will be submitted to namespace 'namespace')
+		},
+		Spec: settings.PodPresetSpec{
+			Selector: v1.LabelSelector{
+				MatchExpressions: []v1.LabelSelectorRequirement{
+					{
+						Key:      "security",
+						Operator: v1.LabelSelectorOpIn,
+						Values:   []string{"S2"},
+					},
+				},
+			},
+			Volumes: []api.Volume{{Name: "vol", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}}},
+			Env:     []api.EnvVar{{Name: "abcd", Value: "value"}, {Name: "ABC", Value: "value"}},
+			EnvFrom: []api.EnvFromSource{
+				{
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+				{
+					Prefix: "pre_",
+					ConfigMapRef: &api.ConfigMapEnvSource{
+						LocalObjectReference: api.LocalObjectReference{Name: "abc"},
+					},
+				},
+			},
+		},
+	}
+	originalPod := pod.DeepCopy()
+	err := admitPod(pod, pip)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// verify PodSpec has not been mutated
+	if !reflect.DeepEqual(pod, originalPod) {
+		t.Fatalf("pod should not get modified in case of emptyNamespace origPod: %+v got: %+v", originalPod, pod)
+	}
+}
+
+func admitPod(pod *api.Pod, pip *settings.PodPreset) error {
+	informerFactory := informers.NewSharedInformerFactory(nil, controller.NoResyncPeriodFunc())
+	store := informerFactory.Settings().InternalVersion().PodPresets().Informer().GetStore()
+	store.Add(pip)
+	plugin := NewTestAdmission(informerFactory.Settings().InternalVersion().PodPresets().Lister())
+	attrs := kadmission.NewAttributesRecord(
+		pod,
+		nil,
+		api.Kind("Pod").WithVersion("version"),
+		"namespace",
+		"",
+		api.Resource("pods").WithVersion("version"),
+		"",
+		kadmission.Create,
+		&user.DefaultInfo{},
+	)
+
+	err := plugin.Admit(attrs)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}