Switch to github.com/golang/dep for vendoring

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

vendor/k8s.io/kubernetes/pkg/controller/.import-restrictions

@@ -0,0 +1,18 @@
+{
+  "Rules": [
+    {
+      "SelectorRegexp": "k8s[.]io/kubernetes/pkg/client/unversioned$",
+      "ForbiddenPrefixes": [
+        "k8s.io/kubernetes/pkg/client/unversioned"
+      ]
+    },
+    {
+      "SelectorRegexp": "k8s[.]io/kubernetes/pkg/client/unversioned/testclient$",
+      "ForbiddenPrefixes": [
+        "k8s.io/kubernetes/pkg/client/unversioned/testclient"
+      ]
+    }
+
+  ]
+}
+

vendor/k8s.io/kubernetes/pkg/controller/BUILD

@@ -0,0 +1,108 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "client_builder.go",
+        "controller_ref_manager.go",
+        "controller_utils.go",
+        "doc.go",
+        "lookup_cache.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/api/validation:go_default_library",
+        "//pkg/apis/extensions/v1beta1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/core/v1:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/client/restclient:go_default_library",
+        "//pkg/fields:go_default_library",
+        "//pkg/serviceaccount:go_default_library",
+        "//pkg/util/clock:go_default_library",
+        "//pkg/util/hash:go_default_library",
+        "//pkg/util/integer:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/golang/groupcache/lru",
+        "//vendor:k8s.io/apimachinery/pkg/api/errors",
+        "//vendor:k8s.io/apimachinery/pkg/api/meta",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/labels",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/util/sets",
+        "//vendor:k8s.io/apimachinery/pkg/watch",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["controller_utils_test.go"],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/client/restclient:go_default_library",
+        "//pkg/securitycontext:go_default_library",
+        "//pkg/util/clock:go_default_library",
+        "//pkg/util/testing:go_default_library",
+        "//pkg/util/uuid:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/sets",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//pkg/controller/certificates:all-srcs",
+        "//pkg/controller/cloud:all-srcs",
+        "//pkg/controller/cronjob:all-srcs",
+        "//pkg/controller/daemon:all-srcs",
+        "//pkg/controller/deployment:all-srcs",
+        "//pkg/controller/disruption:all-srcs",
+        "//pkg/controller/endpoint:all-srcs",
+        "//pkg/controller/garbagecollector:all-srcs",
+        "//pkg/controller/informers:all-srcs",
+        "//pkg/controller/job:all-srcs",
+        "//pkg/controller/namespace:all-srcs",
+        "//pkg/controller/node:all-srcs",
+        "//pkg/controller/petset:all-srcs",
+        "//pkg/controller/podautoscaler:all-srcs",
+        "//pkg/controller/podgc:all-srcs",
+        "//pkg/controller/replicaset:all-srcs",
+        "//pkg/controller/replication:all-srcs",
+        "//pkg/controller/resourcequota:all-srcs",
+        "//pkg/controller/route:all-srcs",
+        "//pkg/controller/service:all-srcs",
+        "//pkg/controller/serviceaccount:all-srcs",
+        "//pkg/controller/volume/attachdetach:all-srcs",
+        "//pkg/controller/volume/persistentvolume:all-srcs",
+    ],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/OWNERS

@@ -0,0 +1,6 @@
+approvers:
+- bprashanth
+- derekwaynecarr
+- mikedanese
+reviewers:
+- deads2k

vendor/k8s.io/kubernetes/pkg/controller/certificates/BUILD

@@ -0,0 +1,73 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "certificate_controller.go",
+        "certificate_controller_utils.go",
+        "cfssl_signer.go",
+        "doc.go",
+        "groupapprove.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/certificates/v1alpha1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/certificates/v1alpha1:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/core/v1:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/util/workqueue:go_default_library",
+        "//vendor:github.com/cloudflare/cfssl/config",
+        "//vendor:github.com/cloudflare/cfssl/helpers",
+        "//vendor:github.com/cloudflare/cfssl/signer",
+        "//vendor:github.com/cloudflare/cfssl/signer/local",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+        "//vendor:k8s.io/apimachinery/pkg/watch",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "cfssl_signer_test.go",
+        "groupapprove_test.go",
+    ],
+    data = [
+        "testdata/ca.crt",
+        "testdata/ca.key",
+        "testdata/kubelet.csr",
+    ],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/apis/certificates/v1alpha1:go_default_library",
+        "//pkg/util/cert:go_default_library",
+    ],
+)

vendor/k8s.io/kubernetes/pkg/controller/certificates/OWNERS

@@ -0,0 +1,3 @@
+reviewers:
+- deads2k
+- mikedanese

vendor/k8s.io/kubernetes/pkg/controller/certificates/certificate_controller.go

@@ -0,0 +1,216 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package certificates
+
+import (
+	"fmt"
+	"time"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api/v1"
+	certificates "k8s.io/kubernetes/pkg/apis/certificates/v1alpha1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	v1core "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/core/v1"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/util/workqueue"
+
+	"github.com/golang/glog"
+)
+
+type AutoApprover interface {
+	AutoApprove(csr *certificates.CertificateSigningRequest) (*certificates.CertificateSigningRequest, error)
+}
+
+type Signer interface {
+	Sign(csr *certificates.CertificateSigningRequest) ([]byte, error)
+}
+
+type CertificateController struct {
+	kubeClient clientset.Interface
+
+	// CSR framework and store
+	csrController cache.Controller
+	csrStore      cache.StoreToCertificateRequestLister
+
+	syncHandler func(csrKey string) error
+
+	approver AutoApprover
+	signer   Signer
+
+	queue workqueue.RateLimitingInterface
+}
+
+func NewCertificateController(kubeClient clientset.Interface, syncPeriod time.Duration, caCertFile, caKeyFile string, approver AutoApprover) (*CertificateController, error) {
+	// Send events to the apiserver
+	eventBroadcaster := record.NewBroadcaster()
+	eventBroadcaster.StartLogging(glog.Infof)
+	eventBroadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: kubeClient.Core().Events("")})
+
+	s, err := NewCFSSLSigner(caCertFile, caKeyFile)
+	if err != nil {
+		return nil, err
+	}
+
+	cc := &CertificateController{
+		kubeClient: kubeClient,
+		queue:      workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "certificate"),
+		signer:     s,
+		approver:   approver,
+	}
+
+	// Manage the addition/update of certificate requests
+	cc.csrStore.Store, cc.csrController = cache.NewInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return cc.kubeClient.Certificates().CertificateSigningRequests().List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return cc.kubeClient.Certificates().CertificateSigningRequests().Watch(options)
+			},
+		},
+		&certificates.CertificateSigningRequest{},
+		syncPeriod,
+		cache.ResourceEventHandlerFuncs{
+			AddFunc: func(obj interface{}) {
+				csr := obj.(*certificates.CertificateSigningRequest)
+				glog.V(4).Infof("Adding certificate request %s", csr.Name)
+				cc.enqueueCertificateRequest(obj)
+			},
+			UpdateFunc: func(old, new interface{}) {
+				oldCSR := old.(*certificates.CertificateSigningRequest)
+				glog.V(4).Infof("Updating certificate request %s", oldCSR.Name)
+				cc.enqueueCertificateRequest(new)
+			},
+			DeleteFunc: func(obj interface{}) {
+				csr, ok := obj.(*certificates.CertificateSigningRequest)
+				if !ok {
+					tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+					if !ok {
+						glog.V(2).Infof("Couldn't get object from tombstone %#v", obj)
+						return
+					}
+					csr, ok = tombstone.Obj.(*certificates.CertificateSigningRequest)
+					if !ok {
+						glog.V(2).Infof("Tombstone contained object that is not a CSR: %#v", obj)
+						return
+					}
+				}
+				glog.V(4).Infof("Deleting certificate request %s", csr.Name)
+				cc.enqueueCertificateRequest(obj)
+			},
+		},
+	)
+	cc.syncHandler = cc.maybeSignCertificate
+	return cc, nil
+}
+
+// Run the main goroutine responsible for watching and syncing jobs.
+func (cc *CertificateController) Run(workers int, stopCh <-chan struct{}) {
+	defer utilruntime.HandleCrash()
+	defer cc.queue.ShutDown()
+
+	go cc.csrController.Run(stopCh)
+
+	glog.Infof("Starting certificate controller manager")
+	for i := 0; i < workers; i++ {
+		go wait.Until(cc.worker, time.Second, stopCh)
+	}
+	<-stopCh
+	glog.Infof("Shutting down certificate controller")
+}
+
+// worker runs a thread that dequeues CSRs, handles them, and marks them done.
+func (cc *CertificateController) worker() {
+	for cc.processNextWorkItem() {
+	}
+}
+
+// processNextWorkItem deals with one key off the queue.  It returns false when it's time to quit.
+func (cc *CertificateController) processNextWorkItem() bool {
+	cKey, quit := cc.queue.Get()
+	if quit {
+		return false
+	}
+	defer cc.queue.Done(cKey)
+
+	err := cc.syncHandler(cKey.(string))
+	if err == nil {
+		cc.queue.Forget(cKey)
+		return true
+	}
+
+	cc.queue.AddRateLimited(cKey)
+	utilruntime.HandleError(fmt.Errorf("Sync %v failed with : %v", cKey, err))
+	return true
+}
+
+func (cc *CertificateController) enqueueCertificateRequest(obj interface{}) {
+	key, err := controller.KeyFunc(obj)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("Couldn't get key for object %+v: %v", obj, err))
+		return
+	}
+	cc.queue.Add(key)
+}
+
+// maybeSignCertificate will inspect the certificate request and, if it has
+// been approved and meets policy expectations, generate an X509 cert using the
+// cluster CA assets. If successful it will update the CSR approve subresource
+// with the signed certificate.
+func (cc *CertificateController) maybeSignCertificate(key string) error {
+	startTime := time.Now()
+	defer func() {
+		glog.V(4).Infof("Finished syncing certificate request %q (%v)", key, time.Now().Sub(startTime))
+	}()
+	obj, exists, err := cc.csrStore.Store.GetByKey(key)
+	if err != nil {
+		return err
+	}
+	if !exists {
+		glog.V(3).Infof("csr has been deleted: %v", key)
+		return nil
+	}
+	csr := obj.(*certificates.CertificateSigningRequest)
+
+	if cc.approver != nil {
+		csr, err = cc.approver.AutoApprove(csr)
+		if err != nil {
+			return fmt.Errorf("error auto approving csr: %v", err)
+		}
+	}
+
+	// At this point, the controller needs to:
+	// 1. Check the approval conditions
+	// 2. Generate a signed certificate
+	// 3. Update the Status subresource
+
+	if csr.Status.Certificate == nil && IsCertificateRequestApproved(csr) {
+		certBytes, err := cc.signer.Sign(csr)
+		if err != nil {
+			return err
+		}
+		csr.Status.Certificate = certBytes
+	}
+
+	_, err = cc.kubeClient.Certificates().CertificateSigningRequests().UpdateStatus(csr)
+	return err
+}

vendor/k8s.io/kubernetes/pkg/controller/certificates/certificate_controller_utils.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package certificates
+
+import certificates "k8s.io/kubernetes/pkg/apis/certificates/v1alpha1"
+
+// IsCertificateRequestApproved returns true if a certificate request has the
+// "Approved" condition and no "Denied" conditions; false otherwise.
+func IsCertificateRequestApproved(csr *certificates.CertificateSigningRequest) bool {
+	approved, denied := getCertApprovalCondition(&csr.Status)
+	return approved && !denied
+}
+
+func getCertApprovalCondition(status *certificates.CertificateSigningRequestStatus) (approved bool, denied bool) {
+	for _, c := range status.Conditions {
+		if c.Type == certificates.CertificateApproved {
+			approved = true
+		}
+		if c.Type == certificates.CertificateDenied {
+			denied = true
+		}
+	}
+	return
+}

vendor/k8s.io/kubernetes/pkg/controller/certificates/cfssl_signer.go

@@ -0,0 +1,99 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package certificates
+
+import (
+	"crypto"
+	"crypto/x509"
+	"fmt"
+	"io/ioutil"
+	"os"
+
+	certificates "k8s.io/kubernetes/pkg/apis/certificates/v1alpha1"
+
+	"github.com/cloudflare/cfssl/config"
+	"github.com/cloudflare/cfssl/helpers"
+	"github.com/cloudflare/cfssl/signer"
+	"github.com/cloudflare/cfssl/signer/local"
+)
+
+var onlySigningPolicy = &config.Signing{
+	Default: &config.SigningProfile{
+		Usage:        []string{"signing"},
+		Expiry:       helpers.OneYear,
+		ExpiryString: "8760h",
+	},
+}
+
+type CFSSLSigner struct {
+	ca      *x509.Certificate
+	priv    crypto.Signer
+	sigAlgo x509.SignatureAlgorithm
+}
+
+func NewCFSSLSigner(caFile, caKeyFile string) (*CFSSLSigner, error) {
+	ca, err := ioutil.ReadFile(caFile)
+	if err != nil {
+		return nil, err
+	}
+	cakey, err := ioutil.ReadFile(caKeyFile)
+	if err != nil {
+		return nil, err
+	}
+
+	parsedCa, err := helpers.ParseCertificatePEM(ca)
+	if err != nil {
+		return nil, err
+	}
+
+	strPassword := os.Getenv("CFSSL_CA_PK_PASSWORD")
+	password := []byte(strPassword)
+	if strPassword == "" {
+		password = nil
+	}
+
+	priv, err := helpers.ParsePrivateKeyPEMWithPassword(cakey, password)
+	if err != nil {
+		return nil, fmt.Errorf("Malformed private key %v", err)
+	}
+	return &CFSSLSigner{
+		priv:    priv,
+		ca:      parsedCa,
+		sigAlgo: signer.DefaultSigAlgo(priv),
+	}, nil
+}
+
+func (cs *CFSSLSigner) Sign(csr *certificates.CertificateSigningRequest) ([]byte, error) {
+	var usages []string
+	for _, usage := range csr.Spec.Usages {
+		usages = append(usages, string(usage))
+	}
+	policy := &config.Signing{
+		Default: &config.SigningProfile{
+			Usage:        usages,
+			Expiry:       helpers.OneYear,
+			ExpiryString: "8760h",
+		},
+	}
+	s, err := local.NewSigner(cs.priv, cs.ca, cs.sigAlgo, policy)
+	if err != nil {
+		return nil, err
+	}
+	return s.Sign(signer.SignRequest{
+		Request: string(csr.Spec.Request),
+	})
+}

vendor/k8s.io/kubernetes/pkg/controller/certificates/cfssl_signer_test.go

@@ -0,0 +1,82 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package certificates
+
+import (
+	"crypto/x509"
+	"io/ioutil"
+	"reflect"
+	"testing"
+
+	capi "k8s.io/kubernetes/pkg/apis/certificates/v1alpha1"
+	"k8s.io/kubernetes/pkg/util/cert"
+)
+
+func TestSigner(t *testing.T) {
+	s, err := NewCFSSLSigner("./testdata/ca.crt", "./testdata/ca.key")
+	if err != nil {
+		t.Fatalf("failed to create signer: %v", err)
+	}
+
+	csrb, err := ioutil.ReadFile("./testdata/kubelet.csr")
+	if err != nil {
+		t.Fatalf("failed to read CSR: %v", err)
+	}
+
+	csr := &capi.CertificateSigningRequest{
+		Spec: capi.CertificateSigningRequestSpec{
+			Request: []byte(csrb),
+			Usages: []capi.KeyUsage{
+				capi.UsageSigning,
+				capi.UsageKeyEncipherment,
+				capi.UsageServerAuth,
+				capi.UsageClientAuth,
+			},
+		},
+	}
+
+	certData, err := s.Sign(csr)
+	if err != nil {
+		t.Fatalf("failed to sign CSR: %v", err)
+	}
+	if len(certData) == 0 {
+		t.Fatalf("expected a certificate after signing")
+	}
+
+	certs, err := cert.ParseCertsPEM(certData)
+	if err != nil {
+		t.Fatalf("failed to parse certificate: %v", err)
+	}
+	if len(certs) != 1 {
+		t.Fatalf("expected one certificate")
+	}
+
+	crt := certs[0]
+
+	if crt.Subject.CommonName != "system:node:k-a-node-s36b" {
+		t.Errorf("expected common name of 'system:node:k-a-node-s36b', but got: %v", certs[0].Subject.CommonName)
+	}
+	if !reflect.DeepEqual(crt.Subject.Organization, []string{"system:nodes"}) {
+		t.Errorf("expected organization to be [system:nodes] but got: %v", crt.Subject.Organization)
+	}
+	if crt.KeyUsage != x509.KeyUsageDigitalSignature|x509.KeyUsageKeyEncipherment {
+		t.Errorf("bad key usage")
+	}
+	if !reflect.DeepEqual(crt.ExtKeyUsage, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth}) {
+		t.Errorf("bad extended key usage")
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/certificates/doc.go

@@ -0,0 +1,19 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package certificates contains logic for watching and synchronizing
+// CertificateSigningRequests.
+package certificates

vendor/k8s.io/kubernetes/pkg/controller/certificates/groupapprove.go

@@ -0,0 +1,113 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package certificates
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	certificates "k8s.io/kubernetes/pkg/apis/certificates/v1alpha1"
+	clientcertificates "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/certificates/v1alpha1"
+)
+
+// groupApprover implements AutoApprover for signing Kubelet certificates.
+type groupApprover struct {
+	client                        clientcertificates.CertificateSigningRequestInterface
+	approveAllKubeletCSRsForGroup string
+}
+
+// NewGroupApprover creates an approver that accepts any CSR requests where the subject group contains approveAllKubeletCSRsForGroup.
+func NewGroupApprover(client clientcertificates.CertificateSigningRequestInterface, approveAllKubeletCSRsForGroup string) AutoApprover {
+	return &groupApprover{
+		client: client,
+		approveAllKubeletCSRsForGroup: approveAllKubeletCSRsForGroup,
+	}
+}
+
+func (cc *groupApprover) AutoApprove(csr *certificates.CertificateSigningRequest) (*certificates.CertificateSigningRequest, error) {
+	// short-circuit if we're not auto-approving
+	if cc.approveAllKubeletCSRsForGroup == "" {
+		return csr, nil
+	}
+	// short-circuit if we're already approved or denied
+	if approved, denied := getCertApprovalCondition(&csr.Status); approved || denied {
+		return csr, nil
+	}
+
+	isKubeletBootstrapGroup := false
+	for _, g := range csr.Spec.Groups {
+		if g == cc.approveAllKubeletCSRsForGroup {
+			isKubeletBootstrapGroup = true
+			break
+		}
+	}
+	if !isKubeletBootstrapGroup {
+		return csr, nil
+	}
+
+	x509cr, err := certificates.ParseCSR(csr)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("unable to parse csr %q: %v", csr.Name, err))
+		return csr, nil
+	}
+	if !reflect.DeepEqual([]string{"system:nodes"}, x509cr.Subject.Organization) {
+		return csr, nil
+	}
+	if !strings.HasPrefix(x509cr.Subject.CommonName, "system:node:") {
+		return csr, nil
+	}
+	if len(x509cr.DNSNames)+len(x509cr.EmailAddresses)+len(x509cr.IPAddresses) != 0 {
+		return csr, nil
+	}
+	if !hasExactUsages(csr, kubeletClientUsages) {
+		return csr, nil
+	}
+
+	csr.Status.Conditions = append(csr.Status.Conditions, certificates.CertificateSigningRequestCondition{
+		Type:    certificates.CertificateApproved,
+		Reason:  "AutoApproved",
+		Message: "Auto approving of all kubelet CSRs is enabled on the controller manager",
+	})
+	return cc.client.UpdateApproval(csr)
+}
+
+var kubeletClientUsages = []certificates.KeyUsage{
+	certificates.UsageKeyEncipherment,
+	certificates.UsageDigitalSignature,
+	certificates.UsageClientAuth,
+}
+
+func hasExactUsages(csr *certificates.CertificateSigningRequest, usages []certificates.KeyUsage) bool {
+	if len(usages) != len(csr.Spec.Usages) {
+		return false
+	}
+
+	usageMap := map[certificates.KeyUsage]struct{}{}
+	for _, u := range usages {
+		usageMap[u] = struct{}{}
+	}
+
+	for _, u := range csr.Spec.Usages {
+		if _, ok := usageMap[u]; !ok {
+			return false
+		}
+	}
+
+	return true
+}

vendor/k8s.io/kubernetes/pkg/controller/certificates/groupapprove_test.go

@@ -0,0 +1,71 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package certificates
+
+import (
+	"testing"
+
+	certificates "k8s.io/kubernetes/pkg/apis/certificates/v1alpha1"
+)
+
+func TestHasKubeletUsages(t *testing.T) {
+	cases := []struct {
+		usages   []certificates.KeyUsage
+		expected bool
+	}{
+		{
+			usages:   nil,
+			expected: false,
+		},
+		{
+			usages:   []certificates.KeyUsage{},
+			expected: false,
+		},
+		{
+			usages: []certificates.KeyUsage{
+				certificates.UsageKeyEncipherment,
+				certificates.UsageDigitalSignature,
+			},
+			expected: false,
+		},
+		{
+			usages: []certificates.KeyUsage{
+				certificates.UsageKeyEncipherment,
+				certificates.UsageDigitalSignature,
+				certificates.UsageServerAuth,
+			},
+			expected: false,
+		},
+		{
+			usages: []certificates.KeyUsage{
+				certificates.UsageKeyEncipherment,
+				certificates.UsageDigitalSignature,
+				certificates.UsageClientAuth,
+			},
+			expected: true,
+		},
+	}
+	for _, c := range cases {
+		if hasExactUsages(&certificates.CertificateSigningRequest{
+			Spec: certificates.CertificateSigningRequestSpec{
+				Usages: c.usages,
+			},
+		}, kubeletClientUsages) != c.expected {
+			t.Errorf("unexpected result of hasKubeletUsages(%v), expecting: %v", c.usages, c.expected)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/certificates/testdata/ca.crt

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC9zCCAd+gAwIBAgIJAOWJ8tWNUIsZMA0GCSqGSIb3DQEBCwUAMBIxEDAOBgNV
+BAMMB2t1YmUtY2EwHhcNMTYxMjIyMDAyNTI5WhcNNDQwNTA5MDAyNTI5WjASMRAw
+DgYDVQQDDAdrdWJlLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+1HK1d2p7N7UC6px8lVtABw8jPpVyNYjrJmI+TKTTdCgWGsUTFMCw4t4Q/KQDDlvB
+P19uPhbfp8aLwOWXBCxOPZzlM2mAEjSUgKjbyGCW/8vaXa2VgQm3tKZdydKiFvIo
+fEsNA+58w8A0WWEB8wYFcdCt8uPyQ0ws/TxE+WW3u7EPlC0/inIX9JqeZZMpDk3N
+lHEv/pGEjQmoet/hBwGHq9PKepkN5/V6rrSADJ5I4Uklp2f7G9MCP/zV8xKfs0lK
+CMoJsIPK3nL9N3C0rqBQPfcyKE2fnEkxC3UVZA8brvLTkBfOgmM2eVg/nauU1ejv
+zOJL7tDwUioLriw2hiGrFwIDAQABo1AwTjAdBgNVHQ4EFgQUbGJxJeW7BgZ4xSmW
+d3Aw3gq8YZUwHwYDVR0jBBgwFoAUbGJxJeW7BgZ4xSmWd3Aw3gq8YZUwDAYDVR0T
+BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAunzpYAxpzguzxG83pK5n3ObsGDwO
+78d38qX1VRvMLPvioZxYgquqqFPdLI3xe8b8KdZNzb65549tgjAI17tTKGTRgJu5
+yzLU1tO4vNaAFecMCtPvElYfkrAv2vbGCVJ1bYKTnjdu3083jG3sY9TDj0364A57
+lNwKEd5uxHGWg4H+NbyHkDqfKmllzLvJ9XjSWBPmNVLSW50hV+h9fUXgz9LN+qVY
+VEDfAEWqb6PVy9ANw8A8QLnuSRxbd7hAigtlC4MwzYJ6tyFIIH6bCIgfoZuA+brm
+WGcpIxl4fKEGafSgjsK/6Yhb61mkhHmG16mzEUZNkNsjiYJuF2QxpOlQrw==
+-----END CERTIFICATE-----

vendor/k8s.io/kubernetes/pkg/controller/certificates/testdata/ca.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEA1HK1d2p7N7UC6px8lVtABw8jPpVyNYjrJmI+TKTTdCgWGsUT
+FMCw4t4Q/KQDDlvBP19uPhbfp8aLwOWXBCxOPZzlM2mAEjSUgKjbyGCW/8vaXa2V
+gQm3tKZdydKiFvIofEsNA+58w8A0WWEB8wYFcdCt8uPyQ0ws/TxE+WW3u7EPlC0/
+inIX9JqeZZMpDk3NlHEv/pGEjQmoet/hBwGHq9PKepkN5/V6rrSADJ5I4Uklp2f7
+G9MCP/zV8xKfs0lKCMoJsIPK3nL9N3C0rqBQPfcyKE2fnEkxC3UVZA8brvLTkBfO
+gmM2eVg/nauU1ejvzOJL7tDwUioLriw2hiGrFwIDAQABAoIBAFJCmEFE2bEYRajS
+LusmCgSxt9PjyfUwrtyN7dF/gODZJLX42QqQEe3GTo2EdCp7HLiNGwKvmKo+Fp76
+Rx82iJUSyyy9DPn/ogCvYWqU++LP7B2ZuOnd+WPZhzc+d8Sqv0JhTQjYrzaclaiG
+B1syWalYRAJogMXOGR102MA4wovJrlHFuTVSWiDe0uguLxyjoTMIRqbib9ZAMSLX
+bfcM2abGpXgq10abda3KKAJbZyr2fnBvqKTs4a4zYeHJpQT+NBPMiryb2WnPFg+b
+93nrjDxUtPsx8NJz6HGkSQLagXkZX2J1JpT8loaNIdyQHab1LNXptc84LR8xxusy
+bs5NowECgYEA+j+SwVgeC+NCUIfxr3F9zPAD9A0Tk3gD4z+j0opfLIMghX4jtK0e
+9fQyglecAbojlkEUk/js5IVZ0IIhBNPWXxKtdShZO7EmJ6Z5IEmFrZK1xUomYBa2
+BfysqSAkxVLsTDIfI0Q4DHQNDOV+iY3j8WoaR51cXr+IY+mYBGSNI80CgYEA2VS5
+X5QHDxoh3r5ORiyab3ciubEofJ29D3NR1tCe9ZgSYRV5Y7T/4KPpZdpsEX/ydYD6
+X4DyURuYNK7PUR8DSlX7/VuMzHThqGJMaT0LE+alU4bruiad33X1WXgtcPTGCic0
+8il50TZTgba0CwxuCO1eVb3IijwgJBX/byM67nMCgYEA7As1KSwtwzbMoVtpa/xY
+Fgu7HuOKuIn22M55fylH1puk/GXb1huJ3aNGVU2/+J0T3jFq8JxXDsJ90kA8Vupe
+BXV/qceyS6yv+ax8Cilvbya4T+y+P9qMPR912V1Zccri2ohYeJJrb8uzV5vM/ICb
+JmbXfP+AVlrBksSOwG37920CgYEAsSi2X6o8QtxLhdZd2ihbz8cu4G4AkezHhAO+
+T70KBytquAcYR+Xwu38CMEvn0jAZRh3YeueTH/i9jxx81STRutPysSni0Xvpwyg2
+H4dqM1PNqxQNrlXyVYlDciZb7HsrwHULXOfgbGG7mr6Db4o3XEGap4woID84+BGS
+glcWn+8CgYEA36uulmZcodfet04qQvlDtr1d7mwLdTR/JAO0ZBIgFH7eGZdEVh8O
+DoTJTdSSJGiv8J35PwEXfhKHjhgOjDocLYu+yCOwVj7jRdHqlDS1BaE36Hzdw0rb
+mWkBRMGJtGhzhoRJEFHAnoLXc9danRfnHwVR58drlf7bjR5I9eU9u1I=
+-----END RSA PRIVATE KEY-----

vendor/k8s.io/kubernetes/pkg/controller/certificates/testdata/kubelet.csr

@@ -0,0 +1,8 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIH1MIGdAgEAMDsxFTATBgNVBAoTDHN5c3RlbTpub2RlczEiMCAGA1UEAxMZc3lz
+dGVtOm5vZGU6ay1hLW5vZGUtczM2YjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA
+BJbxa5Y8SrUJVHpOoWD5ceqH+5R9mjIhwVP2sqfTcLkjvbitzOiLlxSq/LwJ+qq7
+kVpf9f3GopZVhRWbYSCg0YGgADAKBggqhkjOPQQDAgNHADBEAiAabb6XFtPOJUCQ
++84NhxLEvPANhrtwFq3Q0qFZ9TzH5QIgc/697RTTcbri2lVj+10dLFIC3VYJ7br4
+QjA7haCYXrA=
+-----END CERTIFICATE REQUEST-----

vendor/k8s.io/kubernetes/pkg/controller/client_builder.go

@@ -0,0 +1,185 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"fmt"
+	"time"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	v1core "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/core/v1"
+	"k8s.io/kubernetes/pkg/client/restclient"
+	"k8s.io/kubernetes/pkg/fields"
+	"k8s.io/kubernetes/pkg/serviceaccount"
+
+	"github.com/golang/glog"
+)
+
+// ControllerClientBuilder allow syou to get clients and configs for controllers
+type ControllerClientBuilder interface {
+	Config(name string) (*restclient.Config, error)
+	ConfigOrDie(name string) *restclient.Config
+	Client(name string) (clientset.Interface, error)
+	ClientOrDie(name string) clientset.Interface
+}
+
+// SimpleControllerClientBuilder returns a fixed client with different user agents
+type SimpleControllerClientBuilder struct {
+	// ClientConfig is a skeleton config to clone and use as the basis for each controller client
+	ClientConfig *restclient.Config
+}
+
+func (b SimpleControllerClientBuilder) Config(name string) (*restclient.Config, error) {
+	clientConfig := *b.ClientConfig
+	return restclient.AddUserAgent(&clientConfig, name), nil
+}
+
+func (b SimpleControllerClientBuilder) ConfigOrDie(name string) *restclient.Config {
+	clientConfig, err := b.Config(name)
+	if err != nil {
+		glog.Fatal(err)
+	}
+	return clientConfig
+}
+
+func (b SimpleControllerClientBuilder) Client(name string) (clientset.Interface, error) {
+	clientConfig, err := b.Config(name)
+	if err != nil {
+		return nil, err
+	}
+	return clientset.NewForConfig(clientConfig)
+}
+
+func (b SimpleControllerClientBuilder) ClientOrDie(name string) clientset.Interface {
+	client, err := b.Client(name)
+	if err != nil {
+		glog.Fatal(err)
+	}
+	return client
+}
+
+// SAControllerClientBuilder is a ControllerClientBuilder that returns clients identifying as
+// service accounts
+type SAControllerClientBuilder struct {
+	// ClientConfig is a skeleton config to clone and use as the basis for each controller client
+	ClientConfig *restclient.Config
+
+	// CoreClient is used to provision service accounts if needed and watch for their associated tokens
+	// to construct a controller client
+	CoreClient v1core.CoreV1Interface
+
+	// Namespace is the namespace used to host the service accounts that will back the
+	// controllers.  It must be highly privileged namespace which normal users cannot inspect.
+	Namespace string
+}
+
+// config returns a complete clientConfig for constructing clients.  This is separate in anticipation of composition
+// which means that not all clientsets are known here
+func (b SAControllerClientBuilder) Config(name string) (*restclient.Config, error) {
+	clientConfig := restclient.AnonymousClientConfig(b.ClientConfig)
+
+	// we need the SA UID to find a matching SA token
+	sa, err := b.CoreClient.ServiceAccounts(b.Namespace).Get(name, metav1.GetOptions{})
+	if err != nil && !apierrors.IsNotFound(err) {
+		return nil, err
+	} else if apierrors.IsNotFound(err) {
+		// check to see if the namespace exists.  If it isn't a NotFound, just try to create the SA.
+		// It'll probably fail, but perhaps that will have a better message.
+		if _, err := b.CoreClient.Namespaces().Get(b.Namespace, metav1.GetOptions{}); apierrors.IsNotFound(err) {
+			_, err = b.CoreClient.Namespaces().Create(&v1.Namespace{ObjectMeta: v1.ObjectMeta{Name: b.Namespace}})
+			if err != nil && !apierrors.IsAlreadyExists(err) {
+				return nil, err
+			}
+		}
+
+		sa, err = b.CoreClient.ServiceAccounts(b.Namespace).Create(
+			&v1.ServiceAccount{ObjectMeta: v1.ObjectMeta{Namespace: b.Namespace, Name: name}})
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	lw := &cache.ListWatch{
+		ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+			options.FieldSelector = fields.SelectorFromSet(map[string]string{api.SecretTypeField: string(v1.SecretTypeServiceAccountToken)}).String()
+			return b.CoreClient.Secrets(b.Namespace).List(options)
+		},
+		WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+			options.FieldSelector = fields.SelectorFromSet(map[string]string{api.SecretTypeField: string(v1.SecretTypeServiceAccountToken)}).String()
+			return b.CoreClient.Secrets(b.Namespace).Watch(options)
+		},
+	}
+	_, err = cache.ListWatchUntil(30*time.Second, lw,
+		func(event watch.Event) (bool, error) {
+			switch event.Type {
+			case watch.Deleted:
+				return false, nil
+			case watch.Error:
+				return false, fmt.Errorf("error watching")
+
+			case watch.Added, watch.Modified:
+				secret := event.Object.(*v1.Secret)
+				if !serviceaccount.IsServiceAccountToken(secret, sa) ||
+					len(secret.Data[v1.ServiceAccountTokenKey]) == 0 {
+					return false, nil
+				}
+				// TODO maybe verify the token is valid
+				clientConfig.BearerToken = string(secret.Data[v1.ServiceAccountTokenKey])
+				restclient.AddUserAgent(clientConfig, serviceaccount.MakeUsername(b.Namespace, name))
+				return true, nil
+
+			default:
+				return false, fmt.Errorf("unexpected event type: %v", event.Type)
+			}
+		})
+	if err != nil {
+		return nil, fmt.Errorf("unable to get token for service account: %v", err)
+	}
+
+	return clientConfig, nil
+}
+
+func (b SAControllerClientBuilder) ConfigOrDie(name string) *restclient.Config {
+	clientConfig, err := b.Config(name)
+	if err != nil {
+		glog.Fatal(err)
+	}
+	return clientConfig
+}
+
+func (b SAControllerClientBuilder) Client(name string) (clientset.Interface, error) {
+	clientConfig, err := b.Config(name)
+	if err != nil {
+		return nil, err
+	}
+	return clientset.NewForConfig(clientConfig)
+}
+
+func (b SAControllerClientBuilder) ClientOrDie(name string) clientset.Interface {
+	client, err := b.Client(name)
+	if err != nil {
+		glog.Fatal(err)
+	}
+	return client
+}

vendor/k8s.io/kubernetes/pkg/controller/cloud/BUILD

@@ -0,0 +1,61 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["nodecontroller.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api/v1:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/core/v1:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/cloudprovider:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/types",
+        "//vendor:k8s.io/apimachinery/pkg/util/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["nodecontroller_test.go"],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api/v1:go_default_library",
+        "//pkg/client/clientset_generated/clientset/fake:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/cloudprovider:go_default_library",
+        "//pkg/cloudprovider/providers/fake:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/controller/node/testutil:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/cloud/nodecontroller.go

@@ -0,0 +1,155 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/golang/glog"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	v1core "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/core/v1"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	"k8s.io/kubernetes/pkg/controller/informers"
+)
+
+type CloudNodeController struct {
+	nodeInformer informers.NodeInformer
+	kubeClient   clientset.Interface
+	recorder     record.EventRecorder
+
+	cloud cloudprovider.Interface
+
+	// Value controlling NodeController monitoring period, i.e. how often does NodeController
+	// check node status posted from kubelet. This value should be lower than nodeMonitorGracePeriod
+	// set in controller-manager
+	nodeMonitorPeriod time.Duration
+}
+
+const (
+	// nodeStatusUpdateRetry controls the number of retries of writing NodeStatus update.
+	nodeStatusUpdateRetry = 5
+
+	// The amount of time the nodecontroller should sleep between retrying NodeStatus updates
+	retrySleepTime = 20 * time.Millisecond
+)
+
+// NewCloudNodeController creates a CloudNodeController object
+func NewCloudNodeController(
+	nodeInformer informers.NodeInformer,
+	kubeClient clientset.Interface,
+	cloud cloudprovider.Interface,
+	nodeMonitorPeriod time.Duration) (*CloudNodeController, error) {
+
+	eventBroadcaster := record.NewBroadcaster()
+	recorder := eventBroadcaster.NewRecorder(v1.EventSource{Component: "cloudcontrollermanager"})
+	eventBroadcaster.StartLogging(glog.Infof)
+	if kubeClient != nil {
+		glog.V(0).Infof("Sending events to api server.")
+		eventBroadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: kubeClient.Core().Events("")})
+	} else {
+		glog.V(0).Infof("No api server defined - no events will be sent to API server.")
+	}
+
+	cnc := &CloudNodeController{
+		nodeInformer:      nodeInformer,
+		kubeClient:        kubeClient,
+		recorder:          recorder,
+		cloud:             cloud,
+		nodeMonitorPeriod: nodeMonitorPeriod,
+	}
+	return cnc, nil
+}
+
+// This controller deletes a node if kubelet is not reporting
+// and the node is gone from the cloud provider.
+func (cnc *CloudNodeController) Run() {
+	go func() {
+		defer utilruntime.HandleCrash()
+
+		go wait.Until(func() {
+			nodes, err := cnc.kubeClient.Core().Nodes().List(v1.ListOptions{ResourceVersion: "0"})
+			if err != nil {
+				glog.Errorf("Error monitoring node status: %v", err)
+			}
+
+			for i := range nodes.Items {
+				var currentReadyCondition *v1.NodeCondition
+				node := &nodes.Items[i]
+				// Try to get the current node status
+				// If node status is empty, then kubelet has not posted ready status yet. In this case, process next node
+				for rep := 0; rep < nodeStatusUpdateRetry; rep++ {
+					_, currentReadyCondition = v1.GetNodeCondition(&node.Status, v1.NodeReady)
+					if currentReadyCondition != nil {
+						break
+					}
+					name := node.Name
+					node, err = cnc.kubeClient.Core().Nodes().Get(name, metav1.GetOptions{})
+					if err != nil {
+						glog.Errorf("Failed while getting a Node to retry updating NodeStatus. Probably Node %s was deleted.", name)
+						break
+					}
+					time.Sleep(retrySleepTime)
+				}
+				if currentReadyCondition == nil {
+					glog.Errorf("Update status of Node %v from CloudNodeController exceeds retry count.", node.Name)
+					continue
+				}
+				// If the known node status says that Node is NotReady, then check if the node has been removed
+				// from the cloud provider. If node cannot be found in cloudprovider, then delete the node immediately
+				if currentReadyCondition != nil {
+					if currentReadyCondition.Status != v1.ConditionTrue {
+						instances, ok := cnc.cloud.Instances()
+						if !ok {
+							glog.Errorf("cloud provider does not support instances.")
+							continue
+						}
+						// Check with the cloud provider to see if the node still exists. If it
+						// doesn't, delete the node immediately.
+						if _, err := instances.ExternalID(types.NodeName(node.Name)); err != nil {
+							if err == cloudprovider.InstanceNotFound {
+								glog.V(2).Infof("Deleting node no longer present in cloud provider: %s", node.Name)
+								ref := &v1.ObjectReference{
+									Kind:      "Node",
+									Name:      node.Name,
+									UID:       types.UID(node.UID),
+									Namespace: "",
+								}
+								glog.V(2).Infof("Recording %s event message for node %s", "DeletingNode", node.Name)
+								cnc.recorder.Eventf(ref, v1.EventTypeNormal, fmt.Sprintf("Deleting Node %v because it's not present according to cloud provider", node.Name), "Node %s event: %s", node.Name, "DeletingNode")
+								go func(nodeName string) {
+									defer utilruntime.HandleCrash()
+									if err := cnc.kubeClient.Core().Nodes().Delete(node.Name, nil); err != nil {
+										glog.Errorf("unable to delete node %q: %v", node.Name, err)
+									}
+								}(node.Name)
+							}
+							glog.Errorf("Error getting node data from cloud: %v", err)
+						}
+					}
+				}
+			}
+		}, cnc.nodeMonitorPeriod, wait.NeverStop)
+	}()
+}

vendor/k8s.io/kubernetes/pkg/controller/cloud/nodecontroller_test.go

@@ -0,0 +1,122 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"testing"
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/fake"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	fakecloud "k8s.io/kubernetes/pkg/cloudprovider/providers/fake"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/controller/node/testutil"
+)
+
+// This test checks that the node is deleted when kubelet stops reporting
+// and cloud provider says node is gone
+func TestNodeDeleted(t *testing.T) {
+	pod0 := &v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Namespace: "default",
+			Name:      "pod0",
+		},
+		Spec: v1.PodSpec{
+			NodeName: "node0",
+		},
+		Status: v1.PodStatus{
+			Conditions: []v1.PodCondition{
+				{
+					Type:   v1.PodReady,
+					Status: v1.ConditionTrue,
+				},
+			},
+		},
+	}
+
+	pod1 := &v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Namespace: "default",
+			Name:      "pod1",
+		},
+		Spec: v1.PodSpec{
+			NodeName: "node0",
+		},
+		Status: v1.PodStatus{
+			Conditions: []v1.PodCondition{
+				{
+					Type:   v1.PodReady,
+					Status: v1.ConditionTrue,
+				},
+			},
+		},
+	}
+
+	fnh := &testutil.FakeNodeHandler{
+		Existing: []*v1.Node{
+			{
+				ObjectMeta: v1.ObjectMeta{
+					Name:              "node0",
+					CreationTimestamp: metav1.Date(2012, 1, 1, 0, 0, 0, 0, time.UTC),
+				},
+				Status: v1.NodeStatus{
+					Conditions: []v1.NodeCondition{
+						{
+							Type:               v1.NodeReady,
+							Status:             v1.ConditionUnknown,
+							LastHeartbeatTime:  metav1.Date(2015, 1, 1, 12, 0, 0, 0, time.UTC),
+							LastTransitionTime: metav1.Date(2015, 1, 1, 12, 0, 0, 0, time.UTC),
+						},
+					},
+				},
+			},
+		},
+		Clientset:      fake.NewSimpleClientset(&v1.PodList{Items: []v1.Pod{*pod0, *pod1}}),
+		DeleteWaitChan: make(chan struct{}),
+	}
+
+	factory := informers.NewSharedInformerFactory(fnh, nil, controller.NoResyncPeriodFunc())
+
+	eventBroadcaster := record.NewBroadcaster()
+	cloudNodeController := &CloudNodeController{
+		kubeClient:        fnh,
+		nodeInformer:      factory.Nodes(),
+		cloud:             &fakecloud.FakeCloud{Err: cloudprovider.InstanceNotFound},
+		nodeMonitorPeriod: 5 * time.Second,
+		recorder:          eventBroadcaster.NewRecorder(v1.EventSource{Component: "controllermanager"}),
+	}
+	eventBroadcaster.StartLogging(glog.Infof)
+
+	cloudNodeController.Run()
+
+	select {
+	case <-fnh.DeleteWaitChan:
+	case <-time.After(wait.ForeverTestTimeout):
+		t.Errorf("Timed out waiting %v for node to be deleted", wait.ForeverTestTimeout)
+	}
+	if len(fnh.DeletedNodes) != 1 || fnh.DeletedNodes[0].Name != "node0" {
+		t.Errorf("Node was not deleted")
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/controller_ref_manager.go

@@ -0,0 +1,247 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/golang/glog"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/api/v1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+)
+
+type PodControllerRefManager struct {
+	podControl         PodControlInterface
+	controllerObject   v1.ObjectMeta
+	controllerSelector labels.Selector
+	controllerKind     schema.GroupVersionKind
+}
+
+// NewPodControllerRefManager returns a PodControllerRefManager that exposes
+// methods to manage the controllerRef of pods.
+func NewPodControllerRefManager(
+	podControl PodControlInterface,
+	controllerObject v1.ObjectMeta,
+	controllerSelector labels.Selector,
+	controllerKind schema.GroupVersionKind,
+) *PodControllerRefManager {
+	return &PodControllerRefManager{podControl, controllerObject, controllerSelector, controllerKind}
+}
+
+// Classify first filters out inactive pods, then it classify the remaining pods
+// into three categories: 1. matchesAndControlled are the pods whose labels
+// match the selector of the RC, and have a controllerRef pointing to the
+// controller 2. matchesNeedsController are the pods whose labels match the RC,
+// but don't have a controllerRef. (Pods with matching labels but with a
+// controllerRef pointing to other object are ignored) 3. controlledDoesNotMatch
+// are the pods that have a controllerRef pointing to the controller, but their
+// labels no longer match the selector.
+func (m *PodControllerRefManager) Classify(pods []*v1.Pod) (
+	matchesAndControlled []*v1.Pod,
+	matchesNeedsController []*v1.Pod,
+	controlledDoesNotMatch []*v1.Pod) {
+	for i := range pods {
+		pod := pods[i]
+		if !IsPodActive(pod) {
+			glog.V(4).Infof("Ignoring inactive pod %v/%v in state %v, deletion time %v",
+				pod.Namespace, pod.Name, pod.Status.Phase, pod.DeletionTimestamp)
+			continue
+		}
+		controllerRef := GetControllerOf(&pod.ObjectMeta)
+		if controllerRef != nil {
+			if controllerRef.UID == m.controllerObject.UID {
+				// already controlled
+				if m.controllerSelector.Matches(labels.Set(pod.Labels)) {
+					matchesAndControlled = append(matchesAndControlled, pod)
+				} else {
+					controlledDoesNotMatch = append(controlledDoesNotMatch, pod)
+				}
+			} else {
+				// ignoring the pod controlled by other controller
+				glog.V(4).Infof("Ignoring pod %v/%v, it's owned by [%s/%s, name: %s, uid: %s]",
+					pod.Namespace, pod.Name, controllerRef.APIVersion, controllerRef.Kind, controllerRef.Name, controllerRef.UID)
+				continue
+			}
+		} else {
+			if !m.controllerSelector.Matches(labels.Set(pod.Labels)) {
+				continue
+			}
+			matchesNeedsController = append(matchesNeedsController, pod)
+		}
+	}
+	return matchesAndControlled, matchesNeedsController, controlledDoesNotMatch
+}
+
+// GetControllerOf returns the controllerRef if controllee has a controller,
+// otherwise returns nil.
+func GetControllerOf(controllee *v1.ObjectMeta) *metav1.OwnerReference {
+	for i := range controllee.OwnerReferences {
+		owner := &controllee.OwnerReferences[i]
+		// controlled by other controller
+		if owner.Controller != nil && *owner.Controller == true {
+			return owner
+		}
+	}
+	return nil
+}
+
+// AdoptPod sends a patch to take control of the pod. It returns the error if
+// the patching fails.
+func (m *PodControllerRefManager) AdoptPod(pod *v1.Pod) error {
+	// we should not adopt any pods if the controller is about to be deleted
+	if m.controllerObject.DeletionTimestamp != nil {
+		return fmt.Errorf("cancel the adopt attempt for pod %s because the controlller is being deleted",
+			strings.Join([]string{pod.Namespace, pod.Name, string(pod.UID)}, "_"))
+	}
+	addControllerPatch := fmt.Sprintf(
+		`{"metadata":{"ownerReferences":[{"apiVersion":"%s","kind":"%s","name":"%s","uid":"%s","controller":true}],"uid":"%s"}}`,
+		m.controllerKind.GroupVersion(), m.controllerKind.Kind,
+		m.controllerObject.Name, m.controllerObject.UID, pod.UID)
+	return m.podControl.PatchPod(pod.Namespace, pod.Name, []byte(addControllerPatch))
+}
+
+// ReleasePod sends a patch to free the pod from the control of the controller.
+// It returns the error if the patching fails. 404 and 422 errors are ignored.
+func (m *PodControllerRefManager) ReleasePod(pod *v1.Pod) error {
+	glog.V(2).Infof("patching pod %s_%s to remove its controllerRef to %s/%s:%s",
+		pod.Namespace, pod.Name, m.controllerKind.GroupVersion(), m.controllerKind.Kind, m.controllerObject.Name)
+	deleteOwnerRefPatch := fmt.Sprintf(`{"metadata":{"ownerReferences":[{"$patch":"delete","uid":"%s"}],"uid":"%s"}}`, m.controllerObject.UID, pod.UID)
+	err := m.podControl.PatchPod(pod.Namespace, pod.Name, []byte(deleteOwnerRefPatch))
+	if err != nil {
+		if errors.IsNotFound(err) {
+			// If the pod no longer exists, ignore it.
+			return nil
+		}
+		if errors.IsInvalid(err) {
+			// Invalid error will be returned in two cases: 1. the pod
+			// has no owner reference, 2. the uid of the pod doesn't
+			// match, which means the pod is deleted and then recreated.
+			// In both cases, the error can be ignored.
+
+			// TODO: If the pod has owner references, but none of them
+			// has the owner.UID, server will silently ignore the patch.
+			// Investigate why.
+			return nil
+		}
+	}
+	return err
+}
+
+// ReplicaSetControllerRefManager is used to manage controllerRef of ReplicaSets.
+// Three methods are defined on this object 1: Classify 2: AdoptReplicaSet and
+// 3: ReleaseReplicaSet which are used to classify the ReplicaSets into appropriate
+// categories and accordingly adopt or release them. See comments on these functions
+// for more details.
+type ReplicaSetControllerRefManager struct {
+	rsControl          RSControlInterface
+	controllerObject   v1.ObjectMeta
+	controllerSelector labels.Selector
+	controllerKind     schema.GroupVersionKind
+}
+
+// NewReplicaSetControllerRefManager returns a ReplicaSetControllerRefManager that exposes
+// methods to manage the controllerRef of ReplicaSets.
+func NewReplicaSetControllerRefManager(
+	rsControl RSControlInterface,
+	controllerObject v1.ObjectMeta,
+	controllerSelector labels.Selector,
+	controllerKind schema.GroupVersionKind,
+) *ReplicaSetControllerRefManager {
+	return &ReplicaSetControllerRefManager{rsControl, controllerObject, controllerSelector, controllerKind}
+}
+
+// Classify, classifies the ReplicaSets into three categories:
+// 1. matchesAndControlled are the ReplicaSets whose labels
+// match the selector of the Deployment, and have a controllerRef pointing to the
+// Deployment.
+// 2. matchesNeedsController are ReplicaSets ,whose labels match the Deployment,
+// but don't have a controllerRef. (ReplicaSets with matching labels but with a
+// controllerRef pointing to other object are ignored)
+// 3. controlledDoesNotMatch are the ReplicaSets that have a controllerRef pointing
+// to the Deployment, but their labels no longer match the selector.
+func (m *ReplicaSetControllerRefManager) Classify(replicaSets []*extensions.ReplicaSet) (
+	matchesAndControlled []*extensions.ReplicaSet,
+	matchesNeedsController []*extensions.ReplicaSet,
+	controlledDoesNotMatch []*extensions.ReplicaSet) {
+	for i := range replicaSets {
+		replicaSet := replicaSets[i]
+		controllerRef := GetControllerOf(&replicaSet.ObjectMeta)
+		if controllerRef != nil {
+			if controllerRef.UID != m.controllerObject.UID {
+				// ignoring the ReplicaSet controlled by other Deployment
+				glog.V(4).Infof("Ignoring ReplicaSet %v/%v, it's owned by [%s/%s, name: %s, uid: %s]",
+					replicaSet.Namespace, replicaSet.Name, controllerRef.APIVersion, controllerRef.Kind, controllerRef.Name, controllerRef.UID)
+				continue
+			}
+			// already controlled by this Deployment
+			if m.controllerSelector.Matches(labels.Set(replicaSet.Labels)) {
+				matchesAndControlled = append(matchesAndControlled, replicaSet)
+			} else {
+				controlledDoesNotMatch = append(controlledDoesNotMatch, replicaSet)
+			}
+		} else {
+			if !m.controllerSelector.Matches(labels.Set(replicaSet.Labels)) {
+				continue
+			}
+			matchesNeedsController = append(matchesNeedsController, replicaSet)
+		}
+	}
+	return matchesAndControlled, matchesNeedsController, controlledDoesNotMatch
+}
+
+// AdoptReplicaSet sends a patch to take control of the ReplicaSet. It returns the error if
+// the patching fails.
+func (m *ReplicaSetControllerRefManager) AdoptReplicaSet(replicaSet *extensions.ReplicaSet) error {
+	// we should not adopt any ReplicaSets if the Deployment is about to be deleted
+	if m.controllerObject.DeletionTimestamp != nil {
+		return fmt.Errorf("cancel the adopt attempt for RS %s because the controller %v is being deleted",
+			strings.Join([]string{replicaSet.Namespace, replicaSet.Name, string(replicaSet.UID)}, "_"), m.controllerObject.Name)
+	}
+	addControllerPatch := fmt.Sprintf(
+		`{"metadata":{"ownerReferences":[{"apiVersion":"%s","kind":"%s","name":"%s","uid":"%s","controller":true}],"uid":"%s"}}`,
+		m.controllerKind.GroupVersion(), m.controllerKind.Kind,
+		m.controllerObject.Name, m.controllerObject.UID, replicaSet.UID)
+	return m.rsControl.PatchReplicaSet(replicaSet.Namespace, replicaSet.Name, []byte(addControllerPatch))
+}
+
+// ReleaseReplicaSet sends a patch to free the ReplicaSet from the control of the Deployment controller.
+// It returns the error if the patching fails. 404 and 422 errors are ignored.
+func (m *ReplicaSetControllerRefManager) ReleaseReplicaSet(replicaSet *extensions.ReplicaSet) error {
+	glog.V(2).Infof("patching ReplicaSet %s_%s to remove its controllerRef to %s/%s:%s",
+		replicaSet.Namespace, replicaSet.Name, m.controllerKind.GroupVersion(), m.controllerKind.Kind, m.controllerObject.Name)
+	deleteOwnerRefPatch := fmt.Sprintf(`{"metadata":{"ownerReferences":[{"$patch":"delete","uid":"%s"}],"uid":"%s"}}`, m.controllerObject.UID, replicaSet.UID)
+	err := m.rsControl.PatchReplicaSet(replicaSet.Namespace, replicaSet.Name, []byte(deleteOwnerRefPatch))
+	if err != nil {
+		if errors.IsNotFound(err) {
+			// If the ReplicaSet no longer exists, ignore it.
+			return nil
+		}
+		if errors.IsInvalid(err) {
+			// Invalid error will be returned in two cases: 1. the ReplicaSet
+			// has no owner reference, 2. the uid of the ReplicaSet doesn't
+			// match, which means the ReplicaSet is deleted and then recreated.
+			// In both cases, the error can be ignored.
+			return nil
+		}
+	}
+	return err
+}

vendor/k8s.io/kubernetes/pkg/controller/controller_utils.go

@@ -0,0 +1,823 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/golang/glog"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/api/validation"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/util/clock"
+	"k8s.io/kubernetes/pkg/util/integer"
+)
+
+const (
+	// If a watch drops a delete event for a pod, it'll take this long
+	// before a dormant controller waiting for those packets is woken up anyway. It is
+	// specifically targeted at the case where some problem prevents an update
+	// of expectations, without it the controller could stay asleep forever. This should
+	// be set based on the expected latency of watch events.
+	//
+	// Currently a controller can service (create *and* observe the watch events for said
+	// creation) about 10 pods a second, so it takes about 1 min to service
+	// 500 pods. Just creation is limited to 20qps, and watching happens with ~10-30s
+	// latency/pod at the scale of 3000 pods over 100 nodes.
+	ExpectationsTimeout = 5 * time.Minute
+)
+
+var (
+	KeyFunc = cache.DeletionHandlingMetaNamespaceKeyFunc
+)
+
+type ResyncPeriodFunc func() time.Duration
+
+// Returns 0 for resyncPeriod in case resyncing is not needed.
+func NoResyncPeriodFunc() time.Duration {
+	return 0
+}
+
+// StaticResyncPeriodFunc returns the resync period specified
+func StaticResyncPeriodFunc(resyncPeriod time.Duration) ResyncPeriodFunc {
+	return func() time.Duration {
+		return resyncPeriod
+	}
+}
+
+// Expectations are a way for controllers to tell the controller manager what they expect. eg:
+//	ControllerExpectations: {
+//		controller1: expects  2 adds in 2 minutes
+//		controller2: expects  2 dels in 2 minutes
+//		controller3: expects -1 adds in 2 minutes => controller3's expectations have already been met
+//	}
+//
+// Implementation:
+//	ControlleeExpectation = pair of atomic counters to track controllee's creation/deletion
+//	ControllerExpectationsStore = TTLStore + a ControlleeExpectation per controller
+//
+// * Once set expectations can only be lowered
+// * A controller isn't synced till its expectations are either fulfilled, or expire
+// * Controllers that don't set expectations will get woken up for every matching controllee
+
+// ExpKeyFunc to parse out the key from a ControlleeExpectation
+var ExpKeyFunc = func(obj interface{}) (string, error) {
+	if e, ok := obj.(*ControlleeExpectations); ok {
+		return e.key, nil
+	}
+	return "", fmt.Errorf("Could not find key for obj %#v", obj)
+}
+
+// ControllerExpectationsInterface is an interface that allows users to set and wait on expectations.
+// Only abstracted out for testing.
+// Warning: if using KeyFunc it is not safe to use a single ControllerExpectationsInterface with different
+// types of controllers, because the keys might conflict across types.
+type ControllerExpectationsInterface interface {
+	GetExpectations(controllerKey string) (*ControlleeExpectations, bool, error)
+	SatisfiedExpectations(controllerKey string) bool
+	DeleteExpectations(controllerKey string)
+	SetExpectations(controllerKey string, add, del int) error
+	ExpectCreations(controllerKey string, adds int) error
+	ExpectDeletions(controllerKey string, dels int) error
+	CreationObserved(controllerKey string)
+	DeletionObserved(controllerKey string)
+	RaiseExpectations(controllerKey string, add, del int)
+	LowerExpectations(controllerKey string, add, del int)
+}
+
+// ControllerExpectations is a cache mapping controllers to what they expect to see before being woken up for a sync.
+type ControllerExpectations struct {
+	cache.Store
+}
+
+// GetExpectations returns the ControlleeExpectations of the given controller.
+func (r *ControllerExpectations) GetExpectations(controllerKey string) (*ControlleeExpectations, bool, error) {
+	if exp, exists, err := r.GetByKey(controllerKey); err == nil && exists {
+		return exp.(*ControlleeExpectations), true, nil
+	} else {
+		return nil, false, err
+	}
+}
+
+// DeleteExpectations deletes the expectations of the given controller from the TTLStore.
+func (r *ControllerExpectations) DeleteExpectations(controllerKey string) {
+	if exp, exists, err := r.GetByKey(controllerKey); err == nil && exists {
+		if err := r.Delete(exp); err != nil {
+			glog.V(2).Infof("Error deleting expectations for controller %v: %v", controllerKey, err)
+		}
+	}
+}
+
+// SatisfiedExpectations returns true if the required adds/dels for the given controller have been observed.
+// Add/del counts are established by the controller at sync time, and updated as controllees are observed by the controller
+// manager.
+func (r *ControllerExpectations) SatisfiedExpectations(controllerKey string) bool {
+	if exp, exists, err := r.GetExpectations(controllerKey); exists {
+		if exp.Fulfilled() {
+			return true
+		} else if exp.isExpired() {
+			glog.V(4).Infof("Controller expectations expired %#v", exp)
+			return true
+		} else {
+			glog.V(4).Infof("Controller still waiting on expectations %#v", exp)
+			return false
+		}
+	} else if err != nil {
+		glog.V(2).Infof("Error encountered while checking expectations %#v, forcing sync", err)
+	} else {
+		// When a new controller is created, it doesn't have expectations.
+		// When it doesn't see expected watch events for > TTL, the expectations expire.
+		//	- In this case it wakes up, creates/deletes controllees, and sets expectations again.
+		// When it has satisfied expectations and no controllees need to be created/destroyed > TTL, the expectations expire.
+		//	- In this case it continues without setting expectations till it needs to create/delete controllees.
+		glog.V(4).Infof("Controller %v either never recorded expectations, or the ttl expired.", controllerKey)
+	}
+	// Trigger a sync if we either encountered and error (which shouldn't happen since we're
+	// getting from local store) or this controller hasn't established expectations.
+	return true
+}
+
+// TODO: Extend ExpirationCache to support explicit expiration.
+// TODO: Make this possible to disable in tests.
+// TODO: Support injection of clock.
+func (exp *ControlleeExpectations) isExpired() bool {
+	return clock.RealClock{}.Since(exp.timestamp) > ExpectationsTimeout
+}
+
+// SetExpectations registers new expectations for the given controller. Forgets existing expectations.
+func (r *ControllerExpectations) SetExpectations(controllerKey string, add, del int) error {
+	exp := &ControlleeExpectations{add: int64(add), del: int64(del), key: controllerKey, timestamp: clock.RealClock{}.Now()}
+	glog.V(4).Infof("Setting expectations %#v", exp)
+	return r.Add(exp)
+}
+
+func (r *ControllerExpectations) ExpectCreations(controllerKey string, adds int) error {
+	return r.SetExpectations(controllerKey, adds, 0)
+}
+
+func (r *ControllerExpectations) ExpectDeletions(controllerKey string, dels int) error {
+	return r.SetExpectations(controllerKey, 0, dels)
+}
+
+// Decrements the expectation counts of the given controller.
+func (r *ControllerExpectations) LowerExpectations(controllerKey string, add, del int) {
+	if exp, exists, err := r.GetExpectations(controllerKey); err == nil && exists {
+		exp.Add(int64(-add), int64(-del))
+		// The expectations might've been modified since the update on the previous line.
+		glog.V(4).Infof("Lowered expectations %#v", exp)
+	}
+}
+
+// Increments the expectation counts of the given controller.
+func (r *ControllerExpectations) RaiseExpectations(controllerKey string, add, del int) {
+	if exp, exists, err := r.GetExpectations(controllerKey); err == nil && exists {
+		exp.Add(int64(add), int64(del))
+		// The expectations might've been modified since the update on the previous line.
+		glog.V(4).Infof("Raised expectations %#v", exp)
+	}
+}
+
+// CreationObserved atomically decrements the `add` expectation count of the given controller.
+func (r *ControllerExpectations) CreationObserved(controllerKey string) {
+	r.LowerExpectations(controllerKey, 1, 0)
+}
+
+// DeletionObserved atomically decrements the `del` expectation count of the given controller.
+func (r *ControllerExpectations) DeletionObserved(controllerKey string) {
+	r.LowerExpectations(controllerKey, 0, 1)
+}
+
+// Expectations are either fulfilled, or expire naturally.
+type Expectations interface {
+	Fulfilled() bool
+}
+
+// ControlleeExpectations track controllee creates/deletes.
+type ControlleeExpectations struct {
+	// Important: Since these two int64 fields are using sync/atomic, they have to be at the top of the struct due to a bug on 32-bit platforms
+	// See: https://golang.org/pkg/sync/atomic/ for more information
+	add       int64
+	del       int64
+	key       string
+	timestamp time.Time
+}
+
+// Add increments the add and del counters.
+func (e *ControlleeExpectations) Add(add, del int64) {
+	atomic.AddInt64(&e.add, add)
+	atomic.AddInt64(&e.del, del)
+}
+
+// Fulfilled returns true if this expectation has been fulfilled.
+func (e *ControlleeExpectations) Fulfilled() bool {
+	// TODO: think about why this line being atomic doesn't matter
+	return atomic.LoadInt64(&e.add) <= 0 && atomic.LoadInt64(&e.del) <= 0
+}
+
+// GetExpectations returns the add and del expectations of the controllee.
+func (e *ControlleeExpectations) GetExpectations() (int64, int64) {
+	return atomic.LoadInt64(&e.add), atomic.LoadInt64(&e.del)
+}
+
+// NewControllerExpectations returns a store for ControllerExpectations.
+func NewControllerExpectations() *ControllerExpectations {
+	return &ControllerExpectations{cache.NewStore(ExpKeyFunc)}
+}
+
+// UIDSetKeyFunc to parse out the key from a UIDSet.
+var UIDSetKeyFunc = func(obj interface{}) (string, error) {
+	if u, ok := obj.(*UIDSet); ok {
+		return u.key, nil
+	}
+	return "", fmt.Errorf("Could not find key for obj %#v", obj)
+}
+
+// UIDSet holds a key and a set of UIDs. Used by the
+// UIDTrackingControllerExpectations to remember which UID it has seen/still
+// waiting for.
+type UIDSet struct {
+	sets.String
+	key string
+}
+
+// UIDTrackingControllerExpectations tracks the UID of the pods it deletes.
+// This cache is needed over plain old expectations to safely handle graceful
+// deletion. The desired behavior is to treat an update that sets the
+// DeletionTimestamp on an object as a delete. To do so consistenly, one needs
+// to remember the expected deletes so they aren't double counted.
+// TODO: Track creates as well (#22599)
+type UIDTrackingControllerExpectations struct {
+	ControllerExpectationsInterface
+	// TODO: There is a much nicer way to do this that involves a single store,
+	// a lock per entry, and a ControlleeExpectationsInterface type.
+	uidStoreLock sync.Mutex
+	// Store used for the UIDs associated with any expectation tracked via the
+	// ControllerExpectationsInterface.
+	uidStore cache.Store
+}
+
+// GetUIDs is a convenience method to avoid exposing the set of expected uids.
+// The returned set is not thread safe, all modifications must be made holding
+// the uidStoreLock.
+func (u *UIDTrackingControllerExpectations) GetUIDs(controllerKey string) sets.String {
+	if uid, exists, err := u.uidStore.GetByKey(controllerKey); err == nil && exists {
+		return uid.(*UIDSet).String
+	}
+	return nil
+}
+
+// ExpectDeletions records expectations for the given deleteKeys, against the given controller.
+func (u *UIDTrackingControllerExpectations) ExpectDeletions(rcKey string, deletedKeys []string) error {
+	u.uidStoreLock.Lock()
+	defer u.uidStoreLock.Unlock()
+
+	if existing := u.GetUIDs(rcKey); existing != nil && existing.Len() != 0 {
+		glog.Errorf("Clobbering existing delete keys: %+v", existing)
+	}
+	expectedUIDs := sets.NewString()
+	for _, k := range deletedKeys {
+		expectedUIDs.Insert(k)
+	}
+	glog.V(4).Infof("Controller %v waiting on deletions for: %+v", rcKey, deletedKeys)
+	if err := u.uidStore.Add(&UIDSet{expectedUIDs, rcKey}); err != nil {
+		return err
+	}
+	return u.ControllerExpectationsInterface.ExpectDeletions(rcKey, expectedUIDs.Len())
+}
+
+// DeletionObserved records the given deleteKey as a deletion, for the given rc.
+func (u *UIDTrackingControllerExpectations) DeletionObserved(rcKey, deleteKey string) {
+	u.uidStoreLock.Lock()
+	defer u.uidStoreLock.Unlock()
+
+	uids := u.GetUIDs(rcKey)
+	if uids != nil && uids.Has(deleteKey) {
+		glog.V(4).Infof("Controller %v received delete for pod %v", rcKey, deleteKey)
+		u.ControllerExpectationsInterface.DeletionObserved(rcKey)
+		uids.Delete(deleteKey)
+	}
+}
+
+// DeleteExpectations deletes the UID set and invokes DeleteExpectations on the
+// underlying ControllerExpectationsInterface.
+func (u *UIDTrackingControllerExpectations) DeleteExpectations(rcKey string) {
+	u.uidStoreLock.Lock()
+	defer u.uidStoreLock.Unlock()
+
+	u.ControllerExpectationsInterface.DeleteExpectations(rcKey)
+	if uidExp, exists, err := u.uidStore.GetByKey(rcKey); err == nil && exists {
+		if err := u.uidStore.Delete(uidExp); err != nil {
+			glog.V(2).Infof("Error deleting uid expectations for controller %v: %v", rcKey, err)
+		}
+	}
+}
+
+// NewUIDTrackingControllerExpectations returns a wrapper around
+// ControllerExpectations that is aware of deleteKeys.
+func NewUIDTrackingControllerExpectations(ce ControllerExpectationsInterface) *UIDTrackingControllerExpectations {
+	return &UIDTrackingControllerExpectations{ControllerExpectationsInterface: ce, uidStore: cache.NewStore(UIDSetKeyFunc)}
+}
+
+// Reasons for pod events
+const (
+	// FailedCreatePodReason is added in an event and in a replica set condition
+	// when a pod for a replica set is failed to be created.
+	FailedCreatePodReason = "FailedCreate"
+	// SuccessfulCreatePodReason is added in an event when a pod for a replica set
+	// is successfully created.
+	SuccessfulCreatePodReason = "SuccessfulCreate"
+	// FailedDeletePodReason is added in an event and in a replica set condition
+	// when a pod for a replica set is failed to be deleted.
+	FailedDeletePodReason = "FailedDelete"
+	// SuccessfulDeletePodReason is added in an event when a pod for a replica set
+	// is successfully deleted.
+	SuccessfulDeletePodReason = "SuccessfulDelete"
+)
+
+// RSControlInterface is an interface that knows how to add or delete
+// ReplicaSets, as well as increment or decrement them. It is used
+// by the deployment controller to ease testing of actions that it takes.
+type RSControlInterface interface {
+	PatchReplicaSet(namespace, name string, data []byte) error
+}
+
+// RealRSControl is the default implementation of RSControllerInterface.
+type RealRSControl struct {
+	KubeClient clientset.Interface
+	Recorder   record.EventRecorder
+}
+
+var _ RSControlInterface = &RealRSControl{}
+
+func (r RealRSControl) PatchReplicaSet(namespace, name string, data []byte) error {
+	_, err := r.KubeClient.Extensions().ReplicaSets(namespace).Patch(name, api.StrategicMergePatchType, data)
+	return err
+}
+
+// PodControlInterface is an interface that knows how to add or delete pods
+// created as an interface to allow testing.
+type PodControlInterface interface {
+	// CreatePods creates new pods according to the spec.
+	CreatePods(namespace string, template *v1.PodTemplateSpec, object runtime.Object) error
+	// CreatePodsOnNode creates a new pod according to the spec on the specified node.
+	CreatePodsOnNode(nodeName, namespace string, template *v1.PodTemplateSpec, object runtime.Object) error
+	// CreatePodsWithControllerRef creates new pods according to the spec, and sets object as the pod's controller.
+	CreatePodsWithControllerRef(namespace string, template *v1.PodTemplateSpec, object runtime.Object, controllerRef *metav1.OwnerReference) error
+	// DeletePod deletes the pod identified by podID.
+	DeletePod(namespace string, podID string, object runtime.Object) error
+	// PatchPod patches the pod.
+	PatchPod(namespace, name string, data []byte) error
+}
+
+// RealPodControl is the default implementation of PodControlInterface.
+type RealPodControl struct {
+	KubeClient clientset.Interface
+	Recorder   record.EventRecorder
+}
+
+var _ PodControlInterface = &RealPodControl{}
+
+func getPodsLabelSet(template *v1.PodTemplateSpec) labels.Set {
+	desiredLabels := make(labels.Set)
+	for k, v := range template.Labels {
+		desiredLabels[k] = v
+	}
+	return desiredLabels
+}
+
+func getPodsFinalizers(template *v1.PodTemplateSpec) []string {
+	desiredFinalizers := make([]string, len(template.Finalizers))
+	copy(desiredFinalizers, template.Finalizers)
+	return desiredFinalizers
+}
+
+func getPodsAnnotationSet(template *v1.PodTemplateSpec, object runtime.Object) (labels.Set, error) {
+	desiredAnnotations := make(labels.Set)
+	for k, v := range template.Annotations {
+		desiredAnnotations[k] = v
+	}
+	createdByRef, err := v1.GetReference(object)
+	if err != nil {
+		return desiredAnnotations, fmt.Errorf("unable to get controller reference: %v", err)
+	}
+
+	// TODO: this code was not safe previously - as soon as new code came along that switched to v2, old clients
+	//   would be broken upon reading it. This is explicitly hardcoded to v1 to guarantee predictable deployment.
+	//   We need to consistently handle this case of annotation versioning.
+	codec := api.Codecs.LegacyCodec(schema.GroupVersion{Group: v1.GroupName, Version: "v1"})
+
+	createdByRefJson, err := runtime.Encode(codec, &v1.SerializedReference{
+		Reference: *createdByRef,
+	})
+	if err != nil {
+		return desiredAnnotations, fmt.Errorf("unable to serialize controller reference: %v", err)
+	}
+	desiredAnnotations[v1.CreatedByAnnotation] = string(createdByRefJson)
+	return desiredAnnotations, nil
+}
+
+func getPodsPrefix(controllerName string) string {
+	// use the dash (if the name isn't too long) to make the pod name a bit prettier
+	prefix := fmt.Sprintf("%s-", controllerName)
+	if len(validation.ValidatePodName(prefix, true)) != 0 {
+		prefix = controllerName
+	}
+	return prefix
+}
+
+func (r RealPodControl) CreatePods(namespace string, template *v1.PodTemplateSpec, object runtime.Object) error {
+	return r.createPods("", namespace, template, object, nil)
+}
+
+func (r RealPodControl) CreatePodsWithControllerRef(namespace string, template *v1.PodTemplateSpec, controllerObject runtime.Object, controllerRef *metav1.OwnerReference) error {
+	if controllerRef == nil {
+		return fmt.Errorf("controllerRef is nil")
+	}
+	if len(controllerRef.APIVersion) == 0 {
+		return fmt.Errorf("controllerRef has empty APIVersion")
+	}
+	if len(controllerRef.Kind) == 0 {
+		return fmt.Errorf("controllerRef has empty Kind")
+	}
+	if controllerRef.Controller == nil || *controllerRef.Controller != true {
+		return fmt.Errorf("controllerRef.Controller is not set")
+	}
+	return r.createPods("", namespace, template, controllerObject, controllerRef)
+}
+
+func (r RealPodControl) CreatePodsOnNode(nodeName, namespace string, template *v1.PodTemplateSpec, object runtime.Object) error {
+	return r.createPods(nodeName, namespace, template, object, nil)
+}
+
+func (r RealPodControl) PatchPod(namespace, name string, data []byte) error {
+	_, err := r.KubeClient.Core().Pods(namespace).Patch(name, api.StrategicMergePatchType, data)
+	return err
+}
+
+func GetPodFromTemplate(template *v1.PodTemplateSpec, parentObject runtime.Object, controllerRef *metav1.OwnerReference) (*v1.Pod, error) {
+	desiredLabels := getPodsLabelSet(template)
+	desiredFinalizers := getPodsFinalizers(template)
+	desiredAnnotations, err := getPodsAnnotationSet(template, parentObject)
+	if err != nil {
+		return nil, err
+	}
+	accessor, err := meta.Accessor(parentObject)
+	if err != nil {
+		return nil, fmt.Errorf("parentObject does not have ObjectMeta, %v", err)
+	}
+	prefix := getPodsPrefix(accessor.GetName())
+
+	pod := &v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Labels:       desiredLabels,
+			Annotations:  desiredAnnotations,
+			GenerateName: prefix,
+			Finalizers:   desiredFinalizers,
+		},
+	}
+	if controllerRef != nil {
+		pod.OwnerReferences = append(pod.OwnerReferences, *controllerRef)
+	}
+	clone, err := api.Scheme.DeepCopy(&template.Spec)
+	if err != nil {
+		return nil, err
+	}
+	pod.Spec = *clone.(*v1.PodSpec)
+	return pod, nil
+}
+
+func (r RealPodControl) createPods(nodeName, namespace string, template *v1.PodTemplateSpec, object runtime.Object, controllerRef *metav1.OwnerReference) error {
+	pod, err := GetPodFromTemplate(template, object, controllerRef)
+	if err != nil {
+		return err
+	}
+	if len(nodeName) != 0 {
+		pod.Spec.NodeName = nodeName
+	}
+	if labels.Set(pod.Labels).AsSelectorPreValidated().Empty() {
+		return fmt.Errorf("unable to create pods, no labels")
+	}
+	if newPod, err := r.KubeClient.Core().Pods(namespace).Create(pod); err != nil {
+		r.Recorder.Eventf(object, v1.EventTypeWarning, FailedCreatePodReason, "Error creating: %v", err)
+		return fmt.Errorf("unable to create pods: %v", err)
+	} else {
+		accessor, err := meta.Accessor(object)
+		if err != nil {
+			glog.Errorf("parentObject does not have ObjectMeta, %v", err)
+			return nil
+		}
+		glog.V(4).Infof("Controller %v created pod %v", accessor.GetName(), newPod.Name)
+		r.Recorder.Eventf(object, v1.EventTypeNormal, SuccessfulCreatePodReason, "Created pod: %v", newPod.Name)
+	}
+	return nil
+}
+
+func (r RealPodControl) DeletePod(namespace string, podID string, object runtime.Object) error {
+	accessor, err := meta.Accessor(object)
+	if err != nil {
+		return fmt.Errorf("object does not have ObjectMeta, %v", err)
+	}
+	glog.V(2).Infof("Controller %v deleting pod %v/%v", accessor.GetName(), namespace, podID)
+	if err := r.KubeClient.Core().Pods(namespace).Delete(podID, nil); err != nil {
+		r.Recorder.Eventf(object, v1.EventTypeWarning, FailedDeletePodReason, "Error deleting: %v", err)
+		return fmt.Errorf("unable to delete pods: %v", err)
+	} else {
+		r.Recorder.Eventf(object, v1.EventTypeNormal, SuccessfulDeletePodReason, "Deleted pod: %v", podID)
+	}
+	return nil
+}
+
+type FakePodControl struct {
+	sync.Mutex
+	Templates      []v1.PodTemplateSpec
+	ControllerRefs []metav1.OwnerReference
+	DeletePodName  []string
+	Patches        [][]byte
+	Err            error
+}
+
+var _ PodControlInterface = &FakePodControl{}
+
+func (f *FakePodControl) PatchPod(namespace, name string, data []byte) error {
+	f.Lock()
+	defer f.Unlock()
+	f.Patches = append(f.Patches, data)
+	if f.Err != nil {
+		return f.Err
+	}
+	return nil
+}
+
+func (f *FakePodControl) CreatePods(namespace string, spec *v1.PodTemplateSpec, object runtime.Object) error {
+	f.Lock()
+	defer f.Unlock()
+	f.Templates = append(f.Templates, *spec)
+	if f.Err != nil {
+		return f.Err
+	}
+	return nil
+}
+
+func (f *FakePodControl) CreatePodsWithControllerRef(namespace string, spec *v1.PodTemplateSpec, object runtime.Object, controllerRef *metav1.OwnerReference) error {
+	f.Lock()
+	defer f.Unlock()
+	f.Templates = append(f.Templates, *spec)
+	f.ControllerRefs = append(f.ControllerRefs, *controllerRef)
+	if f.Err != nil {
+		return f.Err
+	}
+	return nil
+}
+
+func (f *FakePodControl) CreatePodsOnNode(nodeName, namespace string, template *v1.PodTemplateSpec, object runtime.Object) error {
+	f.Lock()
+	defer f.Unlock()
+	f.Templates = append(f.Templates, *template)
+	if f.Err != nil {
+		return f.Err
+	}
+	return nil
+}
+
+func (f *FakePodControl) DeletePod(namespace string, podID string, object runtime.Object) error {
+	f.Lock()
+	defer f.Unlock()
+	f.DeletePodName = append(f.DeletePodName, podID)
+	if f.Err != nil {
+		return f.Err
+	}
+	return nil
+}
+
+func (f *FakePodControl) Clear() {
+	f.Lock()
+	defer f.Unlock()
+	f.DeletePodName = []string{}
+	f.Templates = []v1.PodTemplateSpec{}
+	f.ControllerRefs = []metav1.OwnerReference{}
+	f.Patches = [][]byte{}
+}
+
+// ByLogging allows custom sorting of pods so the best one can be picked for getting its logs.
+type ByLogging []*v1.Pod
+
+func (s ByLogging) Len() int      { return len(s) }
+func (s ByLogging) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
+
+func (s ByLogging) Less(i, j int) bool {
+	// 1. assigned < unassigned
+	if s[i].Spec.NodeName != s[j].Spec.NodeName && (len(s[i].Spec.NodeName) == 0 || len(s[j].Spec.NodeName) == 0) {
+		return len(s[i].Spec.NodeName) > 0
+	}
+	// 2. PodRunning < PodUnknown < PodPending
+	m := map[v1.PodPhase]int{v1.PodRunning: 0, v1.PodUnknown: 1, v1.PodPending: 2}
+	if m[s[i].Status.Phase] != m[s[j].Status.Phase] {
+		return m[s[i].Status.Phase] < m[s[j].Status.Phase]
+	}
+	// 3. ready < not ready
+	if v1.IsPodReady(s[i]) != v1.IsPodReady(s[j]) {
+		return v1.IsPodReady(s[i])
+	}
+	// TODO: take availability into account when we push minReadySeconds information from deployment into pods,
+	//       see https://github.com/kubernetes/kubernetes/issues/22065
+	// 4. Been ready for more time < less time < empty time
+	if v1.IsPodReady(s[i]) && v1.IsPodReady(s[j]) && !podReadyTime(s[i]).Equal(podReadyTime(s[j])) {
+		return afterOrZero(podReadyTime(s[j]), podReadyTime(s[i]))
+	}
+	// 5. Pods with containers with higher restart counts < lower restart counts
+	if maxContainerRestarts(s[i]) != maxContainerRestarts(s[j]) {
+		return maxContainerRestarts(s[i]) > maxContainerRestarts(s[j])
+	}
+	// 6. older pods < newer pods < empty timestamp pods
+	if !s[i].CreationTimestamp.Equal(s[j].CreationTimestamp) {
+		return afterOrZero(s[j].CreationTimestamp, s[i].CreationTimestamp)
+	}
+	return false
+}
+
+// ActivePods type allows custom sorting of pods so a controller can pick the best ones to delete.
+type ActivePods []*v1.Pod
+
+func (s ActivePods) Len() int      { return len(s) }
+func (s ActivePods) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
+
+func (s ActivePods) Less(i, j int) bool {
+	// 1. Unassigned < assigned
+	// If only one of the pods is unassigned, the unassigned one is smaller
+	if s[i].Spec.NodeName != s[j].Spec.NodeName && (len(s[i].Spec.NodeName) == 0 || len(s[j].Spec.NodeName) == 0) {
+		return len(s[i].Spec.NodeName) == 0
+	}
+	// 2. PodPending < PodUnknown < PodRunning
+	m := map[v1.PodPhase]int{v1.PodPending: 0, v1.PodUnknown: 1, v1.PodRunning: 2}
+	if m[s[i].Status.Phase] != m[s[j].Status.Phase] {
+		return m[s[i].Status.Phase] < m[s[j].Status.Phase]
+	}
+	// 3. Not ready < ready
+	// If only one of the pods is not ready, the not ready one is smaller
+	if v1.IsPodReady(s[i]) != v1.IsPodReady(s[j]) {
+		return !v1.IsPodReady(s[i])
+	}
+	// TODO: take availability into account when we push minReadySeconds information from deployment into pods,
+	//       see https://github.com/kubernetes/kubernetes/issues/22065
+	// 4. Been ready for empty time < less time < more time
+	// If both pods are ready, the latest ready one is smaller
+	if v1.IsPodReady(s[i]) && v1.IsPodReady(s[j]) && !podReadyTime(s[i]).Equal(podReadyTime(s[j])) {
+		return afterOrZero(podReadyTime(s[i]), podReadyTime(s[j]))
+	}
+	// 5. Pods with containers with higher restart counts < lower restart counts
+	if maxContainerRestarts(s[i]) != maxContainerRestarts(s[j]) {
+		return maxContainerRestarts(s[i]) > maxContainerRestarts(s[j])
+	}
+	// 6. Empty creation time pods < newer pods < older pods
+	if !s[i].CreationTimestamp.Equal(s[j].CreationTimestamp) {
+		return afterOrZero(s[i].CreationTimestamp, s[j].CreationTimestamp)
+	}
+	return false
+}
+
+// afterOrZero checks if time t1 is after time t2; if one of them
+// is zero, the zero time is seen as after non-zero time.
+func afterOrZero(t1, t2 metav1.Time) bool {
+	if t1.Time.IsZero() || t2.Time.IsZero() {
+		return t1.Time.IsZero()
+	}
+	return t1.After(t2.Time)
+}
+
+func podReadyTime(pod *v1.Pod) metav1.Time {
+	if v1.IsPodReady(pod) {
+		for _, c := range pod.Status.Conditions {
+			// we only care about pod ready conditions
+			if c.Type == v1.PodReady && c.Status == v1.ConditionTrue {
+				return c.LastTransitionTime
+			}
+		}
+	}
+	return metav1.Time{}
+}
+
+func maxContainerRestarts(pod *v1.Pod) int {
+	maxRestarts := 0
+	for _, c := range pod.Status.ContainerStatuses {
+		maxRestarts = integer.IntMax(maxRestarts, int(c.RestartCount))
+	}
+	return maxRestarts
+}
+
+// FilterActivePods returns pods that have not terminated.
+func FilterActivePods(pods []*v1.Pod) []*v1.Pod {
+	var result []*v1.Pod
+	for _, p := range pods {
+		if IsPodActive(p) {
+			result = append(result, p)
+		} else {
+			glog.V(4).Infof("Ignoring inactive pod %v/%v in state %v, deletion time %v",
+				p.Namespace, p.Name, p.Status.Phase, p.DeletionTimestamp)
+		}
+	}
+	return result
+}
+
+func IsPodActive(p *v1.Pod) bool {
+	return v1.PodSucceeded != p.Status.Phase &&
+		v1.PodFailed != p.Status.Phase &&
+		p.DeletionTimestamp == nil
+}
+
+// FilterActiveReplicaSets returns replica sets that have (or at least ought to have) pods.
+func FilterActiveReplicaSets(replicaSets []*extensions.ReplicaSet) []*extensions.ReplicaSet {
+	active := []*extensions.ReplicaSet{}
+	for i := range replicaSets {
+		rs := replicaSets[i]
+
+		if rs != nil && *(rs.Spec.Replicas) > 0 {
+			active = append(active, replicaSets[i])
+		}
+	}
+	return active
+}
+
+// PodKey returns a key unique to the given pod within a cluster.
+// It's used so we consistently use the same key scheme in this module.
+// It does exactly what cache.MetaNamespaceKeyFunc would have done
+// except there's not possibility for error since we know the exact type.
+func PodKey(pod *v1.Pod) string {
+	return fmt.Sprintf("%v/%v", pod.Namespace, pod.Name)
+}
+
+// ControllersByCreationTimestamp sorts a list of ReplicationControllers by creation timestamp, using their names as a tie breaker.
+type ControllersByCreationTimestamp []*v1.ReplicationController
+
+func (o ControllersByCreationTimestamp) Len() int      { return len(o) }
+func (o ControllersByCreationTimestamp) Swap(i, j int) { o[i], o[j] = o[j], o[i] }
+func (o ControllersByCreationTimestamp) Less(i, j int) bool {
+	if o[i].CreationTimestamp.Equal(o[j].CreationTimestamp) {
+		return o[i].Name < o[j].Name
+	}
+	return o[i].CreationTimestamp.Before(o[j].CreationTimestamp)
+}
+
+// ReplicaSetsByCreationTimestamp sorts a list of ReplicaSet by creation timestamp, using their names as a tie breaker.
+type ReplicaSetsByCreationTimestamp []*extensions.ReplicaSet
+
+func (o ReplicaSetsByCreationTimestamp) Len() int      { return len(o) }
+func (o ReplicaSetsByCreationTimestamp) Swap(i, j int) { o[i], o[j] = o[j], o[i] }
+func (o ReplicaSetsByCreationTimestamp) Less(i, j int) bool {
+	if o[i].CreationTimestamp.Equal(o[j].CreationTimestamp) {
+		return o[i].Name < o[j].Name
+	}
+	return o[i].CreationTimestamp.Before(o[j].CreationTimestamp)
+}
+
+// ReplicaSetsBySizeOlder sorts a list of ReplicaSet by size in descending order, using their creation timestamp or name as a tie breaker.
+// By using the creation timestamp, this sorts from old to new replica sets.
+type ReplicaSetsBySizeOlder []*extensions.ReplicaSet
+
+func (o ReplicaSetsBySizeOlder) Len() int      { return len(o) }
+func (o ReplicaSetsBySizeOlder) Swap(i, j int) { o[i], o[j] = o[j], o[i] }
+func (o ReplicaSetsBySizeOlder) Less(i, j int) bool {
+	if *(o[i].Spec.Replicas) == *(o[j].Spec.Replicas) {
+		return ReplicaSetsByCreationTimestamp(o).Less(i, j)
+	}
+	return *(o[i].Spec.Replicas) > *(o[j].Spec.Replicas)
+}
+
+// ReplicaSetsBySizeNewer sorts a list of ReplicaSet by size in descending order, using their creation timestamp or name as a tie breaker.
+// By using the creation timestamp, this sorts from new to old replica sets.
+type ReplicaSetsBySizeNewer []*extensions.ReplicaSet
+
+func (o ReplicaSetsBySizeNewer) Len() int      { return len(o) }
+func (o ReplicaSetsBySizeNewer) Swap(i, j int) { o[i], o[j] = o[j], o[i] }
+func (o ReplicaSetsBySizeNewer) Less(i, j int) bool {
+	if *(o[i].Spec.Replicas) == *(o[j].Spec.Replicas) {
+		return ReplicaSetsByCreationTimestamp(o).Less(j, i)
+	}
+	return *(o[i].Spec.Replicas) > *(o[j].Spec.Replicas)
+}

vendor/k8s.io/kubernetes/pkg/controller/controller_utils_test.go

@@ -0,0 +1,382 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"encoding/json"
+	"fmt"
+	"math/rand"
+	"net/http/httptest"
+	"reflect"
+	"sort"
+	"sync"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/client/restclient"
+	"k8s.io/kubernetes/pkg/securitycontext"
+	"k8s.io/kubernetes/pkg/util/clock"
+	utiltesting "k8s.io/kubernetes/pkg/util/testing"
+	"k8s.io/kubernetes/pkg/util/uuid"
+)
+
+// NewFakeControllerExpectationsLookup creates a fake store for PodExpectations.
+func NewFakeControllerExpectationsLookup(ttl time.Duration) (*ControllerExpectations, *clock.FakeClock) {
+	fakeTime := time.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC)
+	fakeClock := clock.NewFakeClock(fakeTime)
+	ttlPolicy := &cache.TTLPolicy{Ttl: ttl, Clock: fakeClock}
+	ttlStore := cache.NewFakeExpirationStore(
+		ExpKeyFunc, nil, ttlPolicy, fakeClock)
+	return &ControllerExpectations{ttlStore}, fakeClock
+}
+
+func newReplicationController(replicas int) *v1.ReplicationController {
+	rc := &v1.ReplicationController{
+		TypeMeta: metav1.TypeMeta{APIVersion: api.Registry.GroupOrDie(v1.GroupName).GroupVersion.String()},
+		ObjectMeta: v1.ObjectMeta{
+			UID:             uuid.NewUUID(),
+			Name:            "foobar",
+			Namespace:       v1.NamespaceDefault,
+			ResourceVersion: "18",
+		},
+		Spec: v1.ReplicationControllerSpec{
+			Replicas: func() *int32 { i := int32(replicas); return &i }(),
+			Selector: map[string]string{"foo": "bar"},
+			Template: &v1.PodTemplateSpec{
+				ObjectMeta: v1.ObjectMeta{
+					Labels: map[string]string{
+						"name": "foo",
+						"type": "production",
+					},
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{
+							Image: "foo/bar",
+							TerminationMessagePath: v1.TerminationMessagePathDefault,
+							ImagePullPolicy:        v1.PullIfNotPresent,
+							SecurityContext:        securitycontext.ValidSecurityContextWithContainerDefaults(),
+						},
+					},
+					RestartPolicy: v1.RestartPolicyAlways,
+					DNSPolicy:     v1.DNSDefault,
+					NodeSelector: map[string]string{
+						"baz": "blah",
+					},
+				},
+			},
+		},
+	}
+	return rc
+}
+
+// create count pods with the given phase for the given rc (same selectors and namespace), and add them to the store.
+func newPodList(store cache.Store, count int, status v1.PodPhase, rc *v1.ReplicationController) *v1.PodList {
+	pods := []v1.Pod{}
+	for i := 0; i < count; i++ {
+		newPod := v1.Pod{
+			ObjectMeta: v1.ObjectMeta{
+				Name:      fmt.Sprintf("pod%d", i),
+				Labels:    rc.Spec.Selector,
+				Namespace: rc.Namespace,
+			},
+			Status: v1.PodStatus{Phase: status},
+		}
+		if store != nil {
+			store.Add(&newPod)
+		}
+		pods = append(pods, newPod)
+	}
+	return &v1.PodList{
+		Items: pods,
+	}
+}
+
+func TestControllerExpectations(t *testing.T) {
+	ttl := 30 * time.Second
+	e, fakeClock := NewFakeControllerExpectationsLookup(ttl)
+	// In practice we can't really have add and delete expectations since we only either create or
+	// delete replicas in one rc pass, and the rc goes to sleep soon after until the expectations are
+	// either fulfilled or timeout.
+	adds, dels := 10, 30
+	rc := newReplicationController(1)
+
+	// RC fires off adds and deletes at apiserver, then sets expectations
+	rcKey, err := KeyFunc(rc)
+	if err != nil {
+		t.Errorf("Couldn't get key for object %#v: %v", rc, err)
+	}
+	e.SetExpectations(rcKey, adds, dels)
+	var wg sync.WaitGroup
+	for i := 0; i < adds+1; i++ {
+		wg.Add(1)
+		go func() {
+			// In prod this can happen either because of a failed create by the rc
+			// or after having observed a create via informer
+			e.CreationObserved(rcKey)
+			wg.Done()
+		}()
+	}
+	wg.Wait()
+
+	// There are still delete expectations
+	if e.SatisfiedExpectations(rcKey) {
+		t.Errorf("Rc will sync before expectations are met")
+	}
+	for i := 0; i < dels+1; i++ {
+		wg.Add(1)
+		go func() {
+			e.DeletionObserved(rcKey)
+			wg.Done()
+		}()
+	}
+	wg.Wait()
+
+	// Expectations have been surpassed
+	if podExp, exists, err := e.GetExpectations(rcKey); err == nil && exists {
+		add, del := podExp.GetExpectations()
+		if add != -1 || del != -1 {
+			t.Errorf("Unexpected pod expectations %#v", podExp)
+		}
+	} else {
+		t.Errorf("Could not get expectations for rc, exists %v and err %v", exists, err)
+	}
+	if !e.SatisfiedExpectations(rcKey) {
+		t.Errorf("Expectations are met but the rc will not sync")
+	}
+
+	// Next round of rc sync, old expectations are cleared
+	e.SetExpectations(rcKey, 1, 2)
+	if podExp, exists, err := e.GetExpectations(rcKey); err == nil && exists {
+		add, del := podExp.GetExpectations()
+		if add != 1 || del != 2 {
+			t.Errorf("Unexpected pod expectations %#v", podExp)
+		}
+	} else {
+		t.Errorf("Could not get expectations for rc, exists %v and err %v", exists, err)
+	}
+
+	// Expectations have expired because of ttl
+	fakeClock.Step(ttl + 1)
+	if !e.SatisfiedExpectations(rcKey) {
+		t.Errorf("Expectations should have expired but didn't")
+	}
+}
+
+func TestUIDExpectations(t *testing.T) {
+	uidExp := NewUIDTrackingControllerExpectations(NewControllerExpectations())
+	rcList := []*v1.ReplicationController{
+		newReplicationController(2),
+		newReplicationController(1),
+		newReplicationController(0),
+		newReplicationController(5),
+	}
+	rcToPods := map[string][]string{}
+	rcKeys := []string{}
+	for i := range rcList {
+		rc := rcList[i]
+		rcName := fmt.Sprintf("rc-%v", i)
+		rc.Name = rcName
+		rc.Spec.Selector[rcName] = rcName
+		podList := newPodList(nil, 5, v1.PodRunning, rc)
+		rcKey, err := KeyFunc(rc)
+		if err != nil {
+			t.Fatalf("Couldn't get key for object %#v: %v", rc, err)
+		}
+		rcKeys = append(rcKeys, rcKey)
+		rcPodNames := []string{}
+		for i := range podList.Items {
+			p := &podList.Items[i]
+			p.Name = fmt.Sprintf("%v-%v", p.Name, rc.Name)
+			rcPodNames = append(rcPodNames, PodKey(p))
+		}
+		rcToPods[rcKey] = rcPodNames
+		uidExp.ExpectDeletions(rcKey, rcPodNames)
+	}
+	for i := range rcKeys {
+		j := rand.Intn(i + 1)
+		rcKeys[i], rcKeys[j] = rcKeys[j], rcKeys[i]
+	}
+	for _, rcKey := range rcKeys {
+		if uidExp.SatisfiedExpectations(rcKey) {
+			t.Errorf("Controller %v satisfied expectations before deletion", rcKey)
+		}
+		for _, p := range rcToPods[rcKey] {
+			uidExp.DeletionObserved(rcKey, p)
+		}
+		if !uidExp.SatisfiedExpectations(rcKey) {
+			t.Errorf("Controller %v didn't satisfy expectations after deletion", rcKey)
+		}
+		uidExp.DeleteExpectations(rcKey)
+		if uidExp.GetUIDs(rcKey) != nil {
+			t.Errorf("Failed to delete uid expectations for %v", rcKey)
+		}
+	}
+}
+
+func TestCreatePods(t *testing.T) {
+	ns := v1.NamespaceDefault
+	body := runtime.EncodeOrDie(testapi.Default.Codec(), &v1.Pod{ObjectMeta: v1.ObjectMeta{Name: "empty_pod"}})
+	fakeHandler := utiltesting.FakeHandler{
+		StatusCode:   200,
+		ResponseBody: string(body),
+	}
+	testServer := httptest.NewServer(&fakeHandler)
+	defer testServer.Close()
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+
+	podControl := RealPodControl{
+		KubeClient: clientset,
+		Recorder:   &record.FakeRecorder{},
+	}
+
+	controllerSpec := newReplicationController(1)
+
+	// Make sure createReplica sends a POST to the apiserver with a pod from the controllers pod template
+	if err := podControl.CreatePods(ns, controllerSpec.Spec.Template, controllerSpec); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	expectedPod := v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Labels:       controllerSpec.Spec.Template.Labels,
+			GenerateName: fmt.Sprintf("%s-", controllerSpec.Name),
+		},
+		Spec: controllerSpec.Spec.Template.Spec,
+	}
+	fakeHandler.ValidateRequest(t, testapi.Default.ResourcePath("pods", v1.NamespaceDefault, ""), "POST", nil)
+	var actualPod = &v1.Pod{}
+	err := json.Unmarshal([]byte(fakeHandler.RequestBody), actualPod)
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	if !api.Semantic.DeepDerivative(&expectedPod, actualPod) {
+		t.Logf("Body: %s", fakeHandler.RequestBody)
+		t.Errorf("Unexpected mismatch.  Expected\n %#v,\n Got:\n %#v", &expectedPod, actualPod)
+	}
+}
+
+func TestActivePodFiltering(t *testing.T) {
+	// This rc is not needed by the test, only the newPodList to give the pods labels/a namespace.
+	rc := newReplicationController(0)
+	podList := newPodList(nil, 5, v1.PodRunning, rc)
+	podList.Items[0].Status.Phase = v1.PodSucceeded
+	podList.Items[1].Status.Phase = v1.PodFailed
+	expectedNames := sets.NewString()
+	for _, pod := range podList.Items[2:] {
+		expectedNames.Insert(pod.Name)
+	}
+
+	var podPointers []*v1.Pod
+	for i := range podList.Items {
+		podPointers = append(podPointers, &podList.Items[i])
+	}
+	got := FilterActivePods(podPointers)
+	gotNames := sets.NewString()
+	for _, pod := range got {
+		gotNames.Insert(pod.Name)
+	}
+	if expectedNames.Difference(gotNames).Len() != 0 || gotNames.Difference(expectedNames).Len() != 0 {
+		t.Errorf("expected %v, got %v", expectedNames.List(), gotNames.List())
+	}
+}
+
+func TestSortingActivePods(t *testing.T) {
+	numPods := 9
+	// This rc is not needed by the test, only the newPodList to give the pods labels/a namespace.
+	rc := newReplicationController(0)
+	podList := newPodList(nil, numPods, v1.PodRunning, rc)
+
+	pods := make([]*v1.Pod, len(podList.Items))
+	for i := range podList.Items {
+		pods[i] = &podList.Items[i]
+	}
+	// pods[0] is not scheduled yet.
+	pods[0].Spec.NodeName = ""
+	pods[0].Status.Phase = v1.PodPending
+	// pods[1] is scheduled but pending.
+	pods[1].Spec.NodeName = "bar"
+	pods[1].Status.Phase = v1.PodPending
+	// pods[2] is unknown.
+	pods[2].Spec.NodeName = "foo"
+	pods[2].Status.Phase = v1.PodUnknown
+	// pods[3] is running but not ready.
+	pods[3].Spec.NodeName = "foo"
+	pods[3].Status.Phase = v1.PodRunning
+	// pods[4] is running and ready but without LastTransitionTime.
+	now := metav1.Now()
+	pods[4].Spec.NodeName = "foo"
+	pods[4].Status.Phase = v1.PodRunning
+	pods[4].Status.Conditions = []v1.PodCondition{{Type: v1.PodReady, Status: v1.ConditionTrue}}
+	pods[4].Status.ContainerStatuses = []v1.ContainerStatus{{RestartCount: 3}, {RestartCount: 0}}
+	// pods[5] is running and ready and with LastTransitionTime.
+	pods[5].Spec.NodeName = "foo"
+	pods[5].Status.Phase = v1.PodRunning
+	pods[5].Status.Conditions = []v1.PodCondition{{Type: v1.PodReady, Status: v1.ConditionTrue, LastTransitionTime: now}}
+	pods[5].Status.ContainerStatuses = []v1.ContainerStatus{{RestartCount: 3}, {RestartCount: 0}}
+	// pods[6] is running ready for a longer time than pods[5].
+	then := metav1.Time{Time: now.AddDate(0, -1, 0)}
+	pods[6].Spec.NodeName = "foo"
+	pods[6].Status.Phase = v1.PodRunning
+	pods[6].Status.Conditions = []v1.PodCondition{{Type: v1.PodReady, Status: v1.ConditionTrue, LastTransitionTime: then}}
+	pods[6].Status.ContainerStatuses = []v1.ContainerStatus{{RestartCount: 3}, {RestartCount: 0}}
+	// pods[7] has lower container restart count than pods[6].
+	pods[7].Spec.NodeName = "foo"
+	pods[7].Status.Phase = v1.PodRunning
+	pods[7].Status.Conditions = []v1.PodCondition{{Type: v1.PodReady, Status: v1.ConditionTrue, LastTransitionTime: then}}
+	pods[7].Status.ContainerStatuses = []v1.ContainerStatus{{RestartCount: 2}, {RestartCount: 1}}
+	pods[7].CreationTimestamp = now
+	// pods[8] is older than pods[7].
+	pods[8].Spec.NodeName = "foo"
+	pods[8].Status.Phase = v1.PodRunning
+	pods[8].Status.Conditions = []v1.PodCondition{{Type: v1.PodReady, Status: v1.ConditionTrue, LastTransitionTime: then}}
+	pods[8].Status.ContainerStatuses = []v1.ContainerStatus{{RestartCount: 2}, {RestartCount: 1}}
+	pods[8].CreationTimestamp = then
+
+	getOrder := func(pods []*v1.Pod) []string {
+		names := make([]string, len(pods))
+		for i := range pods {
+			names[i] = pods[i].Name
+		}
+		return names
+	}
+
+	expected := getOrder(pods)
+
+	for i := 0; i < 20; i++ {
+		idx := rand.Perm(numPods)
+		randomizedPods := make([]*v1.Pod, numPods)
+		for j := 0; j < numPods; j++ {
+			randomizedPods[j] = pods[idx[j]]
+		}
+		sort.Sort(ActivePods(randomizedPods))
+		actual := getOrder(randomizedPods)
+
+		if !reflect.DeepEqual(actual, expected) {
+			t.Errorf("expected %v, got %v", expected, actual)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/cronjob/BUILD

@@ -0,0 +1,70 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "cronjob_controller.go",
+        "doc.go",
+        "injection.go",
+        "utils.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/batch/v2alpha1:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/core/v1:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/util/metrics:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/robfig/cron",
+        "//vendor:k8s.io/apimachinery/pkg/api/errors",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/labels",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/types",
+        "//vendor:k8s.io/apimachinery/pkg/util/errors",
+        "//vendor:k8s.io/apimachinery/pkg/util/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "cronjob_controller_test.go",
+        "utils_test.go",
+    ],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/batch/v2alpha1:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/types",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/cronjob/cronjob_controller.go

@@ -0,0 +1,311 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cronjob
+
+/*
+I did not use watch or expectations.  Those add a lot of corner cases, and we aren't
+expecting a large volume of jobs or scheduledJobs.  (We are favoring correctness
+over scalability.  If we find a single controller thread is too slow because
+there are a lot of Jobs or CronJobs, we we can parallelize by Namespace.
+If we find the load on the API server is too high, we can use a watch and
+UndeltaStore.)
+
+Just periodically list jobs and SJs, and then reconcile them.
+
+*/
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/kubernetes/pkg/api/v1"
+	batch "k8s.io/kubernetes/pkg/apis/batch/v2alpha1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	v1core "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/core/v1"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/util/metrics"
+)
+
+// Utilities for dealing with Jobs and CronJobs and time.
+
+type CronJobController struct {
+	kubeClient clientset.Interface
+	jobControl jobControlInterface
+	sjControl  sjControlInterface
+	podControl podControlInterface
+	recorder   record.EventRecorder
+}
+
+func NewCronJobController(kubeClient clientset.Interface) *CronJobController {
+	eventBroadcaster := record.NewBroadcaster()
+	eventBroadcaster.StartLogging(glog.Infof)
+	// TODO: remove the wrapper when every clients have moved to use the clientset.
+	eventBroadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: kubeClient.Core().Events("")})
+
+	if kubeClient != nil && kubeClient.Core().RESTClient().GetRateLimiter() != nil {
+		metrics.RegisterMetricAndTrackRateLimiterUsage("cronjob_controller", kubeClient.Core().RESTClient().GetRateLimiter())
+	}
+
+	jm := &CronJobController{
+		kubeClient: kubeClient,
+		jobControl: realJobControl{KubeClient: kubeClient},
+		sjControl:  &realSJControl{KubeClient: kubeClient},
+		podControl: &realPodControl{KubeClient: kubeClient},
+		recorder:   eventBroadcaster.NewRecorder(v1.EventSource{Component: "cronjob-controller"}),
+	}
+
+	return jm
+}
+
+func NewCronJobControllerFromClient(kubeClient clientset.Interface) *CronJobController {
+	jm := NewCronJobController(kubeClient)
+	return jm
+}
+
+// Run the main goroutine responsible for watching and syncing jobs.
+func (jm *CronJobController) Run(stopCh <-chan struct{}) {
+	defer utilruntime.HandleCrash()
+	glog.Infof("Starting CronJob Manager")
+	// Check things every 10 second.
+	go wait.Until(jm.SyncAll, 10*time.Second, stopCh)
+	<-stopCh
+	glog.Infof("Shutting down CronJob Manager")
+}
+
+// SyncAll lists all the CronJobs and Jobs and reconciles them.
+func (jm *CronJobController) SyncAll() {
+	sjl, err := jm.kubeClient.BatchV2alpha1().CronJobs(v1.NamespaceAll).List(v1.ListOptions{})
+	if err != nil {
+		glog.Errorf("Error listing cronjobs: %v", err)
+		return
+	}
+	sjs := sjl.Items
+	glog.V(4).Infof("Found %d cronjobs", len(sjs))
+
+	jl, err := jm.kubeClient.BatchV2alpha1().Jobs(v1.NamespaceAll).List(v1.ListOptions{})
+	if err != nil {
+		glog.Errorf("Error listing jobs")
+		return
+	}
+	js := jl.Items
+	glog.V(4).Infof("Found %d jobs", len(js))
+
+	jobsBySj := groupJobsByParent(sjs, js)
+	glog.V(4).Infof("Found %d groups", len(jobsBySj))
+
+	for _, sj := range sjs {
+		SyncOne(sj, jobsBySj[sj.UID], time.Now(), jm.jobControl, jm.sjControl, jm.podControl, jm.recorder)
+	}
+}
+
+// SyncOne reconciles a CronJob with a list of any Jobs that it created.
+// All known jobs created by "sj" should be included in "js".
+// The current time is passed in to facilitate testing.
+// It has no receiver, to facilitate testing.
+func SyncOne(sj batch.CronJob, js []batch.Job, now time.Time, jc jobControlInterface, sjc sjControlInterface, pc podControlInterface, recorder record.EventRecorder) {
+	nameForLog := fmt.Sprintf("%s/%s", sj.Namespace, sj.Name)
+
+	childrenJobs := make(map[types.UID]bool)
+	for i := range js {
+		j := js[i]
+		childrenJobs[j.ObjectMeta.UID] = true
+		found := inActiveList(sj, j.ObjectMeta.UID)
+		if !found && !IsJobFinished(&j) {
+			recorder.Eventf(&sj, v1.EventTypeWarning, "UnexpectedJob", "Saw a job that the controller did not create or forgot: %v", j.Name)
+			// We found an unfinished job that has us as the parent, but it is not in our Active list.
+			// This could happen if we crashed right after creating the Job and before updating the status,
+			// or if our jobs list is newer than our sj status after a relist, or if someone intentionally created
+			// a job that they wanted us to adopt.
+
+			// TODO: maybe handle the adoption case?  Concurrency/suspend rules will not apply in that case, obviously, since we can't
+			// stop users from creating jobs if they have permission.  It is assumed that if a
+			// user has permission to create a job within a namespace, then they have permission to make any scheduledJob
+			// in the same namespace "adopt" that job.  ReplicaSets and their Pods work the same way.
+			// TBS: how to update sj.Status.LastScheduleTime if the adopted job is newer than any we knew about?
+		} else if found && IsJobFinished(&j) {
+			deleteFromActiveList(&sj, j.ObjectMeta.UID)
+			// TODO: event to call out failure vs success.
+			recorder.Eventf(&sj, v1.EventTypeNormal, "SawCompletedJob", "Saw completed job: %v", j.Name)
+		}
+	}
+
+	// Remove any job reference from the active list if the corresponding job does not exist any more.
+	// Otherwise, the cronjob may be stuck in active mode forever even though there is no matching
+	// job running.
+	for _, j := range sj.Status.Active {
+		if found := childrenJobs[j.UID]; !found {
+			recorder.Eventf(&sj, v1.EventTypeNormal, "MissingJob", "Active job went missing: %v", j.Name)
+			deleteFromActiveList(&sj, j.UID)
+		}
+	}
+
+	updatedSJ, err := sjc.UpdateStatus(&sj)
+	if err != nil {
+		glog.Errorf("Unable to update status for %s (rv = %s): %v", nameForLog, sj.ResourceVersion, err)
+	}
+	sj = *updatedSJ
+
+	if sj.Spec.Suspend != nil && *sj.Spec.Suspend {
+		glog.V(4).Infof("Not starting job for %s because it is suspended", nameForLog)
+		return
+	}
+	times, err := getRecentUnmetScheduleTimes(sj, now)
+	if err != nil {
+		glog.Errorf("Cannot determine if %s needs to be started: %v", nameForLog, err)
+	}
+	// TODO: handle multiple unmet start times, from oldest to newest, updating status as needed.
+	if len(times) == 0 {
+		glog.V(4).Infof("No unmet start times for %s", nameForLog)
+		return
+	}
+	if len(times) > 1 {
+		glog.V(4).Infof("Multiple unmet start times for %s so only starting last one", nameForLog)
+	}
+	scheduledTime := times[len(times)-1]
+	tooLate := false
+	if sj.Spec.StartingDeadlineSeconds != nil {
+		tooLate = scheduledTime.Add(time.Second * time.Duration(*sj.Spec.StartingDeadlineSeconds)).Before(now)
+	}
+	if tooLate {
+		glog.V(4).Infof("Missed starting window for %s", nameForLog)
+		// TODO: generate an event for a miss.  Use a warning level event because it indicates a
+		// problem with the controller (restart or long queue), and is not expected by user either.
+		// Since we don't set LastScheduleTime when not scheduling, we are going to keep noticing
+		// the miss every cycle.  In order to avoid sending multiple events, and to avoid processing
+		// the sj again and again, we could set a Status.LastMissedTime when we notice a miss.
+		// Then, when we call getRecentUnmetScheduleTimes, we can take max(creationTimestamp,
+		// Status.LastScheduleTime, Status.LastMissedTime), and then so we won't generate
+		// and event the next time we process it, and also so the user looking at the status
+		// can see easily that there was a missed execution.
+		return
+	}
+	if sj.Spec.ConcurrencyPolicy == batch.ForbidConcurrent && len(sj.Status.Active) > 0 {
+		// Regardless which source of information we use for the set of active jobs,
+		// there is some risk that we won't see an active job when there is one.
+		// (because we haven't seen the status update to the SJ or the created pod).
+		// So it is theoretically possible to have concurrency with Forbid.
+		// As long the as the invokations are "far enough apart in time", this usually won't happen.
+		//
+		// TODO: for Forbid, we could use the same name for every execution, as a lock.
+		// With replace, we could use a name that is deterministic per execution time.
+		// But that would mean that you could not inspect prior successes or failures of Forbid jobs.
+		glog.V(4).Infof("Not starting job for %s because of prior execution still running and concurrency policy is Forbid", nameForLog)
+		return
+	}
+	if sj.Spec.ConcurrencyPolicy == batch.ReplaceConcurrent {
+		for _, j := range sj.Status.Active {
+			// TODO: this should be replaced with server side job deletion
+			// currently this mimics JobReaper from pkg/kubectl/stop.go
+			glog.V(4).Infof("Deleting job %s of %s that was still running at next scheduled start time", j.Name, nameForLog)
+			job, err := jc.GetJob(j.Namespace, j.Name)
+			if err != nil {
+				recorder.Eventf(&sj, v1.EventTypeWarning, "FailedGet", "Get job: %v", err)
+				return
+			}
+			// scale job down to 0
+			if *job.Spec.Parallelism != 0 {
+				zero := int32(0)
+				job.Spec.Parallelism = &zero
+				job, err = jc.UpdateJob(job.Namespace, job)
+				if err != nil {
+					recorder.Eventf(&sj, v1.EventTypeWarning, "FailedUpdate", "Update job: %v", err)
+					return
+				}
+			}
+			// remove all pods...
+			selector, _ := metav1.LabelSelectorAsSelector(job.Spec.Selector)
+			options := v1.ListOptions{LabelSelector: selector.String()}
+			podList, err := pc.ListPods(job.Namespace, options)
+			if err != nil {
+				recorder.Eventf(&sj, v1.EventTypeWarning, "FailedList", "List job-pods: %v", err)
+			}
+			errList := []error{}
+			for _, pod := range podList.Items {
+				glog.V(2).Infof("CronJob controller is deleting Pod %v/%v", pod.Namespace, pod.Name)
+				if err := pc.DeletePod(pod.Namespace, pod.Name); err != nil {
+					// ignores the error when the pod isn't found
+					if !errors.IsNotFound(err) {
+						errList = append(errList, err)
+					}
+				}
+			}
+			if len(errList) != 0 {
+				recorder.Eventf(&sj, v1.EventTypeWarning, "FailedDelete", "Deleted job-pods: %v", utilerrors.NewAggregate(errList))
+				return
+			}
+			// ... the job itself...
+			if err := jc.DeleteJob(job.Namespace, job.Name); err != nil {
+				recorder.Eventf(&sj, v1.EventTypeWarning, "FailedDelete", "Deleted job: %v", err)
+				glog.Errorf("Error deleting job %s from %s: %v", job.Name, nameForLog, err)
+				return
+			}
+			// ... and its reference from active list
+			deleteFromActiveList(&sj, job.ObjectMeta.UID)
+			recorder.Eventf(&sj, v1.EventTypeNormal, "SuccessfulDelete", "Deleted job %v", j.Name)
+		}
+	}
+
+	jobReq, err := getJobFromTemplate(&sj, scheduledTime)
+	if err != nil {
+		glog.Errorf("Unable to make Job from template in %s: %v", nameForLog, err)
+		return
+	}
+	jobResp, err := jc.CreateJob(sj.Namespace, jobReq)
+	if err != nil {
+		recorder.Eventf(&sj, v1.EventTypeWarning, "FailedCreate", "Error creating job: %v", err)
+		return
+	}
+	glog.V(4).Infof("Created Job %s for %s", jobResp.Name, nameForLog)
+	recorder.Eventf(&sj, v1.EventTypeNormal, "SuccessfulCreate", "Created job %v", jobResp.Name)
+
+	// ------------------------------------------------------------------ //
+
+	// If this process restarts at this point (after posting a job, but
+	// before updating the status), then we might try to start the job on
+	// the next time.  Actually, if we relist the SJs and Jobs on the next
+	// iteration of SyncAll, we might not see our own status update, and
+	// then post one again.  So, we need to use the job name as a lock to
+	// prevent us from making the job twice (name the job with hash of its
+	// scheduled time).
+
+	// Add the just-started job to the status list.
+	ref, err := getRef(jobResp)
+	if err != nil {
+		glog.V(2).Infof("Unable to make object reference for job for %s", nameForLog)
+	} else {
+		sj.Status.Active = append(sj.Status.Active, *ref)
+	}
+	sj.Status.LastScheduleTime = &metav1.Time{Time: scheduledTime}
+	if _, err := sjc.UpdateStatus(&sj); err != nil {
+		glog.Infof("Unable to update status for %s (rv = %s): %v", nameForLog, sj.ResourceVersion, err)
+	}
+
+	return
+}
+
+func getRef(object runtime.Object) (*v1.ObjectReference, error) {
+	return v1.GetReference(object)
+}

vendor/k8s.io/kubernetes/pkg/controller/cronjob/cronjob_controller_test.go

@@ -0,0 +1,478 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cronjob
+
+import (
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/kubernetes/pkg/api/v1"
+	batch "k8s.io/kubernetes/pkg/apis/batch/v2alpha1"
+	"k8s.io/kubernetes/pkg/client/record"
+)
+
+// schedule is hourly on the hour
+var (
+	onTheHour string = "0 * * * ?"
+)
+
+func justBeforeTheHour() time.Time {
+	T1, err := time.Parse(time.RFC3339, "2016-05-19T09:59:00Z")
+	if err != nil {
+		panic("test setup error")
+	}
+	return T1
+}
+
+func topOfTheHour() time.Time {
+	T1, err := time.Parse(time.RFC3339, "2016-05-19T10:00:00Z")
+	if err != nil {
+		panic("test setup error")
+	}
+	return T1
+}
+
+func justAfterTheHour() time.Time {
+	T1, err := time.Parse(time.RFC3339, "2016-05-19T10:01:00Z")
+	if err != nil {
+		panic("test setup error")
+	}
+	return T1
+}
+
+func weekAfterTheHour() time.Time {
+	T1, err := time.Parse(time.RFC3339, "2016-05-26T10:00:00Z")
+	if err != nil {
+		panic("test setup error")
+	}
+	return T1
+}
+
+func justBeforeThePriorHour() time.Time {
+	T1, err := time.Parse(time.RFC3339, "2016-05-19T08:59:00Z")
+	if err != nil {
+		panic("test setup error")
+	}
+	return T1
+}
+
+func justAfterThePriorHour() time.Time {
+	T1, err := time.Parse(time.RFC3339, "2016-05-19T09:01:00Z")
+	if err != nil {
+		panic("test setup error")
+	}
+	return T1
+}
+
+// returns a cronJob with some fields filled in.
+func cronJob() batch.CronJob {
+	return batch.CronJob{
+		ObjectMeta: v1.ObjectMeta{
+			Name:              "mycronjob",
+			Namespace:         "snazzycats",
+			UID:               types.UID("1a2b3c"),
+			SelfLink:          "/apis/batch/v2alpha1/namespaces/snazzycats/cronjobs/mycronjob",
+			CreationTimestamp: metav1.Time{Time: justBeforeTheHour()},
+		},
+		Spec: batch.CronJobSpec{
+			Schedule:          "* * * * ?",
+			ConcurrencyPolicy: batch.AllowConcurrent,
+			JobTemplate: batch.JobTemplateSpec{
+				ObjectMeta: v1.ObjectMeta{
+					Labels:      map[string]string{"a": "b"},
+					Annotations: map[string]string{"x": "y"},
+				},
+				Spec: jobSpec(),
+			},
+		},
+	}
+}
+
+func jobSpec() batch.JobSpec {
+	one := int32(1)
+	return batch.JobSpec{
+		Parallelism: &one,
+		Completions: &one,
+		Template: v1.PodTemplateSpec{
+			ObjectMeta: v1.ObjectMeta{
+				Labels: map[string]string{
+					"foo": "bar",
+				},
+			},
+			Spec: v1.PodSpec{
+				Containers: []v1.Container{
+					{Image: "foo/bar"},
+				},
+			},
+		},
+	}
+}
+
+func newJob(UID string) batch.Job {
+	return batch.Job{
+		ObjectMeta: v1.ObjectMeta{
+			UID:       types.UID(UID),
+			Name:      "foobar",
+			Namespace: v1.NamespaceDefault,
+			SelfLink:  "/apis/batch/v1/namespaces/snazzycats/jobs/myjob",
+		},
+		Spec: jobSpec(),
+	}
+}
+
+var (
+	shortDead  int64                   = 10
+	mediumDead int64                   = 2 * 60 * 60
+	longDead   int64                   = 1000000
+	noDead     int64                   = -12345
+	A          batch.ConcurrencyPolicy = batch.AllowConcurrent
+	f          batch.ConcurrencyPolicy = batch.ForbidConcurrent
+	R          batch.ConcurrencyPolicy = batch.ReplaceConcurrent
+	T          bool                    = true
+	F          bool                    = false
+)
+
+func TestSyncOne_RunOrNot(t *testing.T) {
+	// Check expectations on deadline parameters
+	if shortDead/60/60 >= 1 {
+		t.Errorf("shortDead should be less than one hour")
+	}
+
+	if mediumDead/60/60 < 1 || mediumDead/60/60 >= 24 {
+		t.Errorf("mediumDead should be between one hour and one day")
+	}
+
+	if longDead/60/60/24 < 10 {
+		t.Errorf("longDead should be at least ten days")
+	}
+
+	testCases := map[string]struct {
+		// sj spec
+		concurrencyPolicy batch.ConcurrencyPolicy
+		suspend           bool
+		schedule          string
+		deadline          int64
+
+		// sj status
+		ranPreviously bool
+		stillActive   bool
+
+		// environment
+		now time.Time
+
+		// expectations
+		expectCreate bool
+		expectDelete bool
+		expectActive int
+	}{
+		"never ran, not time, A":                {A, F, onTheHour, noDead, F, F, justBeforeTheHour(), F, F, 0},
+		"never ran, not time, F":                {f, F, onTheHour, noDead, F, F, justBeforeTheHour(), F, F, 0},
+		"never ran, not time, R":                {R, F, onTheHour, noDead, F, F, justBeforeTheHour(), F, F, 0},
+		"never ran, is time, A":                 {A, F, onTheHour, noDead, F, F, justAfterTheHour(), T, F, 1},
+		"never ran, is time, F":                 {f, F, onTheHour, noDead, F, F, justAfterTheHour(), T, F, 1},
+		"never ran, is time, R":                 {R, F, onTheHour, noDead, F, F, justAfterTheHour(), T, F, 1},
+		"never ran, is time, suspended":         {A, T, onTheHour, noDead, F, F, justAfterTheHour(), F, F, 0},
+		"never ran, is time, past deadline":     {A, F, onTheHour, shortDead, F, F, justAfterTheHour(), F, F, 0},
+		"never ran, is time, not past deadline": {A, F, onTheHour, longDead, F, F, justAfterTheHour(), T, F, 1},
+
+		"prev ran but done, not time, A":                {A, F, onTheHour, noDead, T, F, justBeforeTheHour(), F, F, 0},
+		"prev ran but done, not time, F":                {f, F, onTheHour, noDead, T, F, justBeforeTheHour(), F, F, 0},
+		"prev ran but done, not time, R":                {R, F, onTheHour, noDead, T, F, justBeforeTheHour(), F, F, 0},
+		"prev ran but done, is time, A":                 {A, F, onTheHour, noDead, T, F, justAfterTheHour(), T, F, 1},
+		"prev ran but done, is time, F":                 {f, F, onTheHour, noDead, T, F, justAfterTheHour(), T, F, 1},
+		"prev ran but done, is time, R":                 {R, F, onTheHour, noDead, T, F, justAfterTheHour(), T, F, 1},
+		"prev ran but done, is time, suspended":         {A, T, onTheHour, noDead, T, F, justAfterTheHour(), F, F, 0},
+		"prev ran but done, is time, past deadline":     {A, F, onTheHour, shortDead, T, F, justAfterTheHour(), F, F, 0},
+		"prev ran but done, is time, not past deadline": {A, F, onTheHour, longDead, T, F, justAfterTheHour(), T, F, 1},
+
+		"still active, not time, A":                {A, F, onTheHour, noDead, T, T, justBeforeTheHour(), F, F, 1},
+		"still active, not time, F":                {f, F, onTheHour, noDead, T, T, justBeforeTheHour(), F, F, 1},
+		"still active, not time, R":                {R, F, onTheHour, noDead, T, T, justBeforeTheHour(), F, F, 1},
+		"still active, is time, A":                 {A, F, onTheHour, noDead, T, T, justAfterTheHour(), T, F, 2},
+		"still active, is time, F":                 {f, F, onTheHour, noDead, T, T, justAfterTheHour(), F, F, 1},
+		"still active, is time, R":                 {R, F, onTheHour, noDead, T, T, justAfterTheHour(), T, T, 1},
+		"still active, is time, suspended":         {A, T, onTheHour, noDead, T, T, justAfterTheHour(), F, F, 1},
+		"still active, is time, past deadline":     {A, F, onTheHour, shortDead, T, T, justAfterTheHour(), F, F, 1},
+		"still active, is time, not past deadline": {A, F, onTheHour, longDead, T, T, justAfterTheHour(), T, F, 2},
+
+		// Controller should fail to schedule these, as there are too many missed starting times
+		// and either no deadline or a too long deadline.
+		"prev ran but done, long overdue, not past deadline, A": {A, F, onTheHour, longDead, T, F, weekAfterTheHour(), F, F, 0},
+		"prev ran but done, long overdue, not past deadline, R": {R, F, onTheHour, longDead, T, F, weekAfterTheHour(), F, F, 0},
+		"prev ran but done, long overdue, not past deadline, F": {f, F, onTheHour, longDead, T, F, weekAfterTheHour(), F, F, 0},
+		"prev ran but done, long overdue, no deadline, A":       {A, F, onTheHour, noDead, T, F, weekAfterTheHour(), F, F, 0},
+		"prev ran but done, long overdue, no deadline, R":       {R, F, onTheHour, noDead, T, F, weekAfterTheHour(), F, F, 0},
+		"prev ran but done, long overdue, no deadline, F":       {f, F, onTheHour, noDead, T, F, weekAfterTheHour(), F, F, 0},
+
+		"prev ran but done, long overdue, past medium deadline, A": {A, F, onTheHour, mediumDead, T, F, weekAfterTheHour(), T, F, 1},
+		"prev ran but done, long overdue, past short deadline, A":  {A, F, onTheHour, shortDead, T, F, weekAfterTheHour(), T, F, 1},
+
+		"prev ran but done, long overdue, past medium deadline, R": {R, F, onTheHour, mediumDead, T, F, weekAfterTheHour(), T, F, 1},
+		"prev ran but done, long overdue, past short deadline, R":  {R, F, onTheHour, shortDead, T, F, weekAfterTheHour(), T, F, 1},
+
+		"prev ran but done, long overdue, past medium deadline, F": {f, F, onTheHour, mediumDead, T, F, weekAfterTheHour(), T, F, 1},
+		"prev ran but done, long overdue, past short deadline, F":  {f, F, onTheHour, shortDead, T, F, weekAfterTheHour(), T, F, 1},
+	}
+	for name, tc := range testCases {
+		sj := cronJob()
+		sj.Spec.ConcurrencyPolicy = tc.concurrencyPolicy
+		sj.Spec.Suspend = &tc.suspend
+		sj.Spec.Schedule = tc.schedule
+		if tc.deadline != noDead {
+			sj.Spec.StartingDeadlineSeconds = &tc.deadline
+		}
+
+		var (
+			job *batch.Job
+			err error
+		)
+		js := []batch.Job{}
+		if tc.ranPreviously {
+			sj.ObjectMeta.CreationTimestamp = metav1.Time{Time: justBeforeThePriorHour()}
+			sj.Status.LastScheduleTime = &metav1.Time{Time: justAfterThePriorHour()}
+			job, err = getJobFromTemplate(&sj, sj.Status.LastScheduleTime.Time)
+			if err != nil {
+				t.Fatalf("%s: nexpected error creating a job from template: %v", name, err)
+			}
+			job.UID = "1234"
+			job.Namespace = ""
+			if tc.stillActive {
+				sj.Status.Active = []v1.ObjectReference{{UID: job.UID}}
+				js = append(js, *job)
+			}
+		} else {
+			sj.ObjectMeta.CreationTimestamp = metav1.Time{Time: justBeforeTheHour()}
+			if tc.stillActive {
+				t.Errorf("%s: test setup error: this case makes no sense", name)
+			}
+		}
+
+		jc := &fakeJobControl{Job: job}
+		sjc := &fakeSJControl{}
+		pc := &fakePodControl{}
+		recorder := record.NewFakeRecorder(10)
+
+		SyncOne(sj, js, tc.now, jc, sjc, pc, recorder)
+		expectedCreates := 0
+		if tc.expectCreate {
+			expectedCreates = 1
+		}
+		if len(jc.Jobs) != expectedCreates {
+			t.Errorf("%s: expected %d job started, actually %v", name, expectedCreates, len(jc.Jobs))
+		}
+
+		expectedDeletes := 0
+		if tc.expectDelete {
+			expectedDeletes = 1
+		}
+		if len(jc.DeleteJobName) != expectedDeletes {
+			t.Errorf("%s: expected %d job deleted, actually %v", name, expectedDeletes, len(jc.DeleteJobName))
+		}
+
+		// Status update happens once when ranging through job list, and another one if create jobs.
+		expectUpdates := 1
+		expectedEvents := 0
+		if tc.expectCreate {
+			expectedEvents++
+			expectUpdates++
+		}
+		if tc.expectDelete {
+			expectedEvents++
+		}
+		if len(recorder.Events) != expectedEvents {
+			t.Errorf("%s: expected %d event, actually %v", name, expectedEvents, len(recorder.Events))
+		}
+
+		if tc.expectActive != len(sjc.Updates[expectUpdates-1].Status.Active) {
+			t.Errorf("%s: expected Active size %d, got %d", name, tc.expectActive, len(sjc.Updates[expectUpdates-1].Status.Active))
+		}
+	}
+}
+
+// TODO: simulation where the controller randomly doesn't run, and randomly has errors starting jobs or deleting jobs,
+// but over time, all jobs run as expected (assuming Allow and no deadline).
+
+// TestSyncOne_Status tests sj.UpdateStatus in SyncOne
+func TestSyncOne_Status(t *testing.T) {
+	finishedJob := newJob("1")
+	finishedJob.Status.Conditions = append(finishedJob.Status.Conditions, batch.JobCondition{Type: batch.JobComplete, Status: v1.ConditionTrue})
+	unexpectedJob := newJob("2")
+	missingJob := newJob("3")
+
+	testCases := map[string]struct {
+		// sj spec
+		concurrencyPolicy batch.ConcurrencyPolicy
+		suspend           bool
+		schedule          string
+		deadline          int64
+
+		// sj status
+		ranPreviously  bool
+		hasFinishedJob bool
+
+		// environment
+		now              time.Time
+		hasUnexpectedJob bool
+		hasMissingJob    bool
+
+		// expectations
+		expectCreate bool
+		expectDelete bool
+	}{
+		"never ran, not time, A":                {A, F, onTheHour, noDead, F, F, justBeforeTheHour(), F, F, F, F},
+		"never ran, not time, F":                {f, F, onTheHour, noDead, F, F, justBeforeTheHour(), F, F, F, F},
+		"never ran, not time, R":                {R, F, onTheHour, noDead, F, F, justBeforeTheHour(), F, F, F, F},
+		"never ran, is time, A":                 {A, F, onTheHour, noDead, F, F, justAfterTheHour(), F, F, T, F},
+		"never ran, is time, F":                 {f, F, onTheHour, noDead, F, F, justAfterTheHour(), F, F, T, F},
+		"never ran, is time, R":                 {R, F, onTheHour, noDead, F, F, justAfterTheHour(), F, F, T, F},
+		"never ran, is time, suspended":         {A, T, onTheHour, noDead, F, F, justAfterTheHour(), F, F, F, F},
+		"never ran, is time, past deadline":     {A, F, onTheHour, shortDead, F, F, justAfterTheHour(), F, F, F, F},
+		"never ran, is time, not past deadline": {A, F, onTheHour, longDead, F, F, justAfterTheHour(), F, F, T, F},
+
+		"prev ran but done, not time, A":                                            {A, F, onTheHour, noDead, T, F, justBeforeTheHour(), F, F, F, F},
+		"prev ran but done, not time, finished job, A":                              {A, F, onTheHour, noDead, T, T, justBeforeTheHour(), F, F, F, F},
+		"prev ran but done, not time, unexpected job, A":                            {A, F, onTheHour, noDead, T, F, justBeforeTheHour(), T, F, F, F},
+		"prev ran but done, not time, missing job, A":                               {A, F, onTheHour, noDead, T, F, justBeforeTheHour(), F, T, F, F},
+		"prev ran but done, not time, missing job, unexpected job, A":               {A, F, onTheHour, noDead, T, F, justBeforeTheHour(), T, T, F, F},
+		"prev ran but done, not time, finished job, unexpected job, A":              {A, F, onTheHour, noDead, T, T, justBeforeTheHour(), T, F, F, F},
+		"prev ran but done, not time, finished job, missing job, A":                 {A, F, onTheHour, noDead, T, T, justBeforeTheHour(), F, T, F, F},
+		"prev ran but done, not time, finished job, missing job, unexpected job, A": {A, F, onTheHour, noDead, T, T, justBeforeTheHour(), T, T, F, F},
+		"prev ran but done, not time, finished job, F":                              {f, F, onTheHour, noDead, T, T, justBeforeTheHour(), F, F, F, F},
+		"prev ran but done, not time, missing job, F":                               {f, F, onTheHour, noDead, T, F, justBeforeTheHour(), F, T, F, F},
+		"prev ran but done, not time, finished job, missing job, F":                 {f, F, onTheHour, noDead, T, T, justBeforeTheHour(), F, T, F, F},
+		"prev ran but done, not time, unexpected job, R":                            {R, F, onTheHour, noDead, T, F, justBeforeTheHour(), T, F, F, F},
+
+		"prev ran but done, is time, A":                                               {A, F, onTheHour, noDead, T, F, justAfterTheHour(), F, F, T, F},
+		"prev ran but done, is time, finished job, A":                                 {A, F, onTheHour, noDead, T, T, justAfterTheHour(), F, F, T, F},
+		"prev ran but done, is time, unexpected job, A":                               {A, F, onTheHour, noDead, T, F, justAfterTheHour(), T, F, T, F},
+		"prev ran but done, is time, finished job, unexpected job, A":                 {A, F, onTheHour, noDead, T, T, justAfterTheHour(), T, F, T, F},
+		"prev ran but done, is time, F":                                               {f, F, onTheHour, noDead, T, F, justAfterTheHour(), F, F, T, F},
+		"prev ran but done, is time, finished job, F":                                 {f, F, onTheHour, noDead, T, T, justAfterTheHour(), F, F, T, F},
+		"prev ran but done, is time, unexpected job, F":                               {f, F, onTheHour, noDead, T, F, justAfterTheHour(), T, F, T, F},
+		"prev ran but done, is time, finished job, unexpected job, F":                 {f, F, onTheHour, noDead, T, T, justAfterTheHour(), T, F, T, F},
+		"prev ran but done, is time, R":                                               {R, F, onTheHour, noDead, T, F, justAfterTheHour(), F, F, T, F},
+		"prev ran but done, is time, finished job, R":                                 {R, F, onTheHour, noDead, T, T, justAfterTheHour(), F, F, T, F},
+		"prev ran but done, is time, unexpected job, R":                               {R, F, onTheHour, noDead, T, F, justAfterTheHour(), T, F, T, F},
+		"prev ran but done, is time, finished job, unexpected job, R":                 {R, F, onTheHour, noDead, T, T, justAfterTheHour(), T, F, T, F},
+		"prev ran but done, is time, suspended":                                       {A, T, onTheHour, noDead, T, F, justAfterTheHour(), F, F, F, F},
+		"prev ran but done, is time, finished job, suspended":                         {A, T, onTheHour, noDead, T, T, justAfterTheHour(), F, F, F, F},
+		"prev ran but done, is time, unexpected job, suspended":                       {A, T, onTheHour, noDead, T, F, justAfterTheHour(), T, F, F, F},
+		"prev ran but done, is time, finished job, unexpected job, suspended":         {A, T, onTheHour, noDead, T, T, justAfterTheHour(), T, F, F, F},
+		"prev ran but done, is time, past deadline":                                   {A, F, onTheHour, shortDead, T, F, justAfterTheHour(), F, F, F, F},
+		"prev ran but done, is time, finished job, past deadline":                     {A, F, onTheHour, shortDead, T, T, justAfterTheHour(), F, F, F, F},
+		"prev ran but done, is time, unexpected job, past deadline":                   {A, F, onTheHour, shortDead, T, F, justAfterTheHour(), T, F, F, F},
+		"prev ran but done, is time, finished job, unexpected job, past deadline":     {A, F, onTheHour, shortDead, T, T, justAfterTheHour(), T, F, F, F},
+		"prev ran but done, is time, not past deadline":                               {A, F, onTheHour, longDead, T, F, justAfterTheHour(), F, F, T, F},
+		"prev ran but done, is time, finished job, not past deadline":                 {A, F, onTheHour, longDead, T, T, justAfterTheHour(), F, F, T, F},
+		"prev ran but done, is time, unexpected job, not past deadline":               {A, F, onTheHour, longDead, T, F, justAfterTheHour(), T, F, T, F},
+		"prev ran but done, is time, finished job, unexpected job, not past deadline": {A, F, onTheHour, longDead, T, T, justAfterTheHour(), T, F, T, F},
+	}
+
+	for name, tc := range testCases {
+		// Setup the test
+		sj := cronJob()
+		sj.Spec.ConcurrencyPolicy = tc.concurrencyPolicy
+		sj.Spec.Suspend = &tc.suspend
+		sj.Spec.Schedule = tc.schedule
+		if tc.deadline != noDead {
+			sj.Spec.StartingDeadlineSeconds = &tc.deadline
+		}
+		if tc.ranPreviously {
+			sj.ObjectMeta.CreationTimestamp = metav1.Time{Time: justBeforeThePriorHour()}
+			sj.Status.LastScheduleTime = &metav1.Time{Time: justAfterThePriorHour()}
+		} else {
+			if tc.hasFinishedJob || tc.hasUnexpectedJob || tc.hasMissingJob {
+				t.Errorf("%s: test setup error: this case makes no sense", name)
+			}
+			sj.ObjectMeta.CreationTimestamp = metav1.Time{Time: justBeforeTheHour()}
+		}
+		jobs := []batch.Job{}
+		if tc.hasFinishedJob {
+			ref, err := getRef(&finishedJob)
+			if err != nil {
+				t.Errorf("%s: test setup error: failed to get job's ref: %v.", name, err)
+			}
+			sj.Status.Active = []v1.ObjectReference{*ref}
+			jobs = append(jobs, finishedJob)
+		}
+		if tc.hasUnexpectedJob {
+			jobs = append(jobs, unexpectedJob)
+		}
+		if tc.hasMissingJob {
+			ref, err := getRef(&missingJob)
+			if err != nil {
+				t.Errorf("%s: test setup error: failed to get job's ref: %v.", name, err)
+			}
+			sj.Status.Active = append(sj.Status.Active, *ref)
+		}
+
+		jc := &fakeJobControl{}
+		sjc := &fakeSJControl{}
+		pc := &fakePodControl{}
+		recorder := record.NewFakeRecorder(10)
+
+		// Run the code
+		SyncOne(sj, jobs, tc.now, jc, sjc, pc, recorder)
+
+		// Status update happens once when ranging through job list, and another one if create jobs.
+		expectUpdates := 1
+		// Events happens when there's unexpected / finished jobs, and upon job creation / deletion.
+		expectedEvents := 0
+		if tc.expectCreate {
+			expectUpdates++
+			expectedEvents++
+		}
+		if tc.expectDelete {
+			expectedEvents++
+		}
+		if tc.hasFinishedJob {
+			expectedEvents++
+		}
+		if tc.hasUnexpectedJob {
+			expectedEvents++
+		}
+		if tc.hasMissingJob {
+			expectedEvents++
+		}
+
+		if len(recorder.Events) != expectedEvents {
+			t.Errorf("%s: expected %d event, actually %v: %#v", name, expectedEvents, len(recorder.Events), recorder.Events)
+		}
+
+		if expectUpdates != len(sjc.Updates) {
+			t.Errorf("%s: expected %d status updates, actually %d", name, expectUpdates, len(sjc.Updates))
+		}
+
+		if tc.hasFinishedJob && inActiveList(sjc.Updates[0], finishedJob.UID) {
+			t.Errorf("%s: expected finished job removed from active list, actually active list = %#v", name, sjc.Updates[0].Status.Active)
+		}
+
+		if tc.hasUnexpectedJob && inActiveList(sjc.Updates[0], unexpectedJob.UID) {
+			t.Errorf("%s: expected unexpected job not added to active list, actually active list = %#v", name, sjc.Updates[0].Status.Active)
+		}
+
+		if tc.hasMissingJob && inActiveList(sjc.Updates[0], missingJob.UID) {
+			t.Errorf("%s: expected missing job to be removed from active list, actually active list = %#v", name, sjc.Updates[0].Status.Active)
+		}
+
+		if tc.expectCreate && !sjc.Updates[1].Status.LastScheduleTime.Time.Equal(topOfTheHour()) {
+			t.Errorf("%s: expected LastScheduleTime updated to %s, got %s", name, topOfTheHour(), sjc.Updates[1].Status.LastScheduleTime)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/cronjob/doc.go

@@ -0,0 +1,18 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package cronjob contains the controller for CronJob objects.
+package cronjob

vendor/k8s.io/kubernetes/pkg/controller/cronjob/injection.go

@@ -0,0 +1,225 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cronjob
+
+import (
+	"fmt"
+	"sync"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/kubernetes/pkg/api/v1"
+	batch "k8s.io/kubernetes/pkg/apis/batch/v2alpha1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/client/record"
+)
+
+// sjControlInterface is an interface that knows how to update CronJob status
+// created as an interface to allow testing.
+type sjControlInterface interface {
+	UpdateStatus(sj *batch.CronJob) (*batch.CronJob, error)
+}
+
+// realSJControl is the default implementation of sjControlInterface.
+type realSJControl struct {
+	KubeClient clientset.Interface
+}
+
+var _ sjControlInterface = &realSJControl{}
+
+func (c *realSJControl) UpdateStatus(sj *batch.CronJob) (*batch.CronJob, error) {
+	return c.KubeClient.BatchV2alpha1().CronJobs(sj.Namespace).UpdateStatus(sj)
+}
+
+// fakeSJControl is the default implementation of sjControlInterface.
+type fakeSJControl struct {
+	Updates []batch.CronJob
+}
+
+var _ sjControlInterface = &fakeSJControl{}
+
+func (c *fakeSJControl) UpdateStatus(sj *batch.CronJob) (*batch.CronJob, error) {
+	c.Updates = append(c.Updates, *sj)
+	return sj, nil
+}
+
+// ------------------------------------------------------------------ //
+
+// jobControlInterface is an interface that knows how to add or delete jobs
+// created as an interface to allow testing.
+type jobControlInterface interface {
+	// GetJob retrieves a job
+	GetJob(namespace, name string) (*batch.Job, error)
+	// CreateJob creates new jobs according to the spec
+	CreateJob(namespace string, job *batch.Job) (*batch.Job, error)
+	// UpdateJob updates a job
+	UpdateJob(namespace string, job *batch.Job) (*batch.Job, error)
+	// DeleteJob deletes the job identified by name.
+	// TODO: delete by UID?
+	DeleteJob(namespace string, name string) error
+}
+
+// realJobControl is the default implementation of jobControlInterface.
+type realJobControl struct {
+	KubeClient clientset.Interface
+	Recorder   record.EventRecorder
+}
+
+var _ jobControlInterface = &realJobControl{}
+
+func copyLabels(template *batch.JobTemplateSpec) labels.Set {
+	l := make(labels.Set)
+	for k, v := range template.Labels {
+		l[k] = v
+	}
+	return l
+}
+
+func copyAnnotations(template *batch.JobTemplateSpec) labels.Set {
+	a := make(labels.Set)
+	for k, v := range template.Annotations {
+		a[k] = v
+	}
+	return a
+}
+
+func (r realJobControl) GetJob(namespace, name string) (*batch.Job, error) {
+	return r.KubeClient.BatchV2alpha1().Jobs(namespace).Get(name, metav1.GetOptions{})
+}
+
+func (r realJobControl) UpdateJob(namespace string, job *batch.Job) (*batch.Job, error) {
+	return r.KubeClient.BatchV2alpha1().Jobs(namespace).Update(job)
+}
+
+func (r realJobControl) CreateJob(namespace string, job *batch.Job) (*batch.Job, error) {
+	return r.KubeClient.BatchV2alpha1().Jobs(namespace).Create(job)
+}
+
+func (r realJobControl) DeleteJob(namespace string, name string) error {
+	return r.KubeClient.BatchV2alpha1().Jobs(namespace).Delete(name, nil)
+}
+
+type fakeJobControl struct {
+	sync.Mutex
+	Job           *batch.Job
+	Jobs          []batch.Job
+	DeleteJobName []string
+	Err           error
+}
+
+var _ jobControlInterface = &fakeJobControl{}
+
+func (f *fakeJobControl) CreateJob(namespace string, job *batch.Job) (*batch.Job, error) {
+	f.Lock()
+	defer f.Unlock()
+	if f.Err != nil {
+		return nil, f.Err
+	}
+	job.SelfLink = fmt.Sprintf("/api/batch/v1/namespaces/%s/jobs/%s", namespace, job.Name)
+	f.Jobs = append(f.Jobs, *job)
+	job.UID = "test-uid"
+	return job, nil
+}
+
+func (f *fakeJobControl) GetJob(namespace, name string) (*batch.Job, error) {
+	f.Lock()
+	defer f.Unlock()
+	if f.Err != nil {
+		return nil, f.Err
+	}
+	return f.Job, nil
+}
+
+func (f *fakeJobControl) UpdateJob(namespace string, job *batch.Job) (*batch.Job, error) {
+	f.Lock()
+	defer f.Unlock()
+	if f.Err != nil {
+		return nil, f.Err
+	}
+	return job, nil
+}
+
+func (f *fakeJobControl) DeleteJob(namespace string, name string) error {
+	f.Lock()
+	defer f.Unlock()
+	if f.Err != nil {
+		return f.Err
+	}
+	f.DeleteJobName = append(f.DeleteJobName, name)
+	return nil
+}
+
+func (f *fakeJobControl) Clear() {
+	f.Lock()
+	defer f.Unlock()
+	f.DeleteJobName = []string{}
+	f.Jobs = []batch.Job{}
+	f.Err = nil
+}
+
+// ------------------------------------------------------------------ //
+
+// podControlInterface is an interface that knows how to list or delete pods
+// created as an interface to allow testing.
+type podControlInterface interface {
+	// ListPods list pods
+	ListPods(namespace string, opts v1.ListOptions) (*v1.PodList, error)
+	// DeleteJob deletes the pod identified by name.
+	// TODO: delete by UID?
+	DeletePod(namespace string, name string) error
+}
+
+// realPodControl is the default implementation of podControlInterface.
+type realPodControl struct {
+	KubeClient clientset.Interface
+	Recorder   record.EventRecorder
+}
+
+var _ podControlInterface = &realPodControl{}
+
+func (r realPodControl) ListPods(namespace string, opts v1.ListOptions) (*v1.PodList, error) {
+	return r.KubeClient.Core().Pods(namespace).List(opts)
+}
+
+func (r realPodControl) DeletePod(namespace string, name string) error {
+	return r.KubeClient.Core().Pods(namespace).Delete(name, nil)
+}
+
+type fakePodControl struct {
+	sync.Mutex
+	Pods          []v1.Pod
+	DeletePodName []string
+	Err           error
+}
+
+var _ podControlInterface = &fakePodControl{}
+
+func (f *fakePodControl) ListPods(namespace string, opts v1.ListOptions) (*v1.PodList, error) {
+	f.Lock()
+	defer f.Unlock()
+	return &v1.PodList{Items: f.Pods}, nil
+}
+
+func (f *fakePodControl) DeletePod(namespace string, name string) error {
+	f.Lock()
+	defer f.Unlock()
+	if f.Err != nil {
+		return f.Err
+	}
+	f.DeletePodName = append(f.DeletePodName, name)
+	return nil
+}

vendor/k8s.io/kubernetes/pkg/controller/cronjob/utils.go

@@ -0,0 +1,243 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cronjob
+
+import (
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/golang/glog"
+	"github.com/robfig/cron"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	batch "k8s.io/kubernetes/pkg/apis/batch/v2alpha1"
+)
+
+// Utilities for dealing with Jobs and CronJobs and time.
+
+func inActiveList(sj batch.CronJob, uid types.UID) bool {
+	for _, j := range sj.Status.Active {
+		if j.UID == uid {
+			return true
+		}
+	}
+	return false
+}
+
+func deleteFromActiveList(sj *batch.CronJob, uid types.UID) {
+	if sj == nil {
+		return
+	}
+	newActive := []v1.ObjectReference{}
+	for _, j := range sj.Status.Active {
+		if j.UID != uid {
+			newActive = append(newActive, j)
+		}
+	}
+	sj.Status.Active = newActive
+}
+
+// getParentUIDFromJob extracts UID of job's parent and whether it was found
+func getParentUIDFromJob(j batch.Job) (types.UID, bool) {
+	creatorRefJson, found := j.ObjectMeta.Annotations[v1.CreatedByAnnotation]
+	if !found {
+		glog.V(4).Infof("Job with no created-by annotation, name %s namespace %s", j.Name, j.Namespace)
+		return types.UID(""), false
+	}
+	var sr v1.SerializedReference
+	err := json.Unmarshal([]byte(creatorRefJson), &sr)
+	if err != nil {
+		glog.V(4).Infof("Job with unparsable created-by annotation, name %s namespace %s: %v", j.Name, j.Namespace, err)
+		return types.UID(""), false
+	}
+	if sr.Reference.Kind != "CronJob" {
+		glog.V(4).Infof("Job with non-CronJob parent, name %s namespace %s", j.Name, j.Namespace)
+		return types.UID(""), false
+	}
+	// Don't believe a job that claims to have a parent in a different namespace.
+	if sr.Reference.Namespace != j.Namespace {
+		glog.V(4).Infof("Alleged scheduledJob parent in different namespace (%s) from Job name %s namespace %s", sr.Reference.Namespace, j.Name, j.Namespace)
+		return types.UID(""), false
+	}
+
+	return sr.Reference.UID, true
+}
+
+// groupJobsByParent groups jobs into a map keyed by the job parent UID (e.g. scheduledJob).
+// It has no receiver, to facilitate testing.
+func groupJobsByParent(sjs []batch.CronJob, js []batch.Job) map[types.UID][]batch.Job {
+	jobsBySj := make(map[types.UID][]batch.Job)
+	for _, job := range js {
+		parentUID, found := getParentUIDFromJob(job)
+		if !found {
+			glog.Errorf("Unable to get uid from job %s in namespace %s", job.Name, job.Namespace)
+			continue
+		}
+		jobsBySj[parentUID] = append(jobsBySj[parentUID], job)
+	}
+	return jobsBySj
+}
+
+// getNextStartTimeAfter gets the latest scheduled start time that is less than "now", or an error.
+func getNextStartTimeAfter(schedule string, now time.Time) (time.Time, error) {
+	// Using robfig/cron for cron scheduled parsing and next runtime
+	// computation. Not using the entire library because:
+	// - I want to detect when we missed a runtime due to being down.
+	//   - How do I set the time such that I can detect the last known runtime?
+	// - I guess the functions could launch a go-routine to start the job and
+	// then return.
+	// How to handle concurrency control.
+	// How to detect changes to schedules or deleted schedules and then
+	// update the jobs?
+	sched, err := cron.Parse(schedule)
+	if err != nil {
+		return time.Unix(0, 0), fmt.Errorf("Unparseable schedule: %s : %s", schedule, err)
+	}
+	return sched.Next(now), nil
+}
+
+// getRecentUnmetScheduleTimes gets a slice of times (from oldest to latest) that have passed when a Job should have started but did not.
+//
+// If there are too many (>100) unstarted times, just give up and return an empty slice.
+// If there were missed times prior to the last known start time, then those are not returned.
+func getRecentUnmetScheduleTimes(sj batch.CronJob, now time.Time) ([]time.Time, error) {
+	starts := []time.Time{}
+	sched, err := cron.ParseStandard(sj.Spec.Schedule)
+	if err != nil {
+		return starts, fmt.Errorf("Unparseable schedule: %s : %s", sj.Spec.Schedule, err)
+	}
+
+	var earliestTime time.Time
+	if sj.Status.LastScheduleTime != nil {
+		earliestTime = sj.Status.LastScheduleTime.Time
+	} else {
+		// If none found, then this is either a recently created scheduledJob,
+		// or the active/completed info was somehow lost (contract for status
+		// in kubernetes says it may need to be recreated), or that we have
+		// started a job, but have not noticed it yet (distributed systems can
+		// have arbitrary delays).  In any case, use the creation time of the
+		// CronJob as last known start time.
+		earliestTime = sj.ObjectMeta.CreationTimestamp.Time
+	}
+	if sj.Spec.StartingDeadlineSeconds != nil {
+		// Controller is not going to schedule anything below this point
+		schedulingDeadline := now.Add(-time.Second * time.Duration(*sj.Spec.StartingDeadlineSeconds))
+
+		if schedulingDeadline.After(earliestTime) {
+			earliestTime = schedulingDeadline
+		}
+	}
+	if earliestTime.After(now) {
+		return []time.Time{}, nil
+	}
+
+	for t := sched.Next(earliestTime); !t.After(now); t = sched.Next(t) {
+		starts = append(starts, t)
+		// An object might miss several starts.  For example, if
+		// controller gets wedged on friday at 5:01pm when everyone has
+		// gone home, and someone comes in on tuesday AM and discovers
+		// the problem and restarts the controller, then all the hourly
+		// jobs, more than 80 of them for one hourly scheduledJob, should
+		// all start running with no further intervention (if the scheduledJob
+		// allows concurrency and late starts).
+		//
+		// However, if there is a bug somewhere, or incorrect clock
+		// on controller's server or apiservers (for setting creationTimestamp)
+		// then there could be so many missed start times (it could be off
+		// by decades or more), that it would eat up all the CPU and memory
+		// of this controller. In that case, we want to not try to list
+		// all the misseded start times.
+		//
+		// I've somewhat arbitrarily picked 100, as more than 80, but
+		// but less than "lots".
+		if len(starts) > 100 {
+			// We can't get the most recent times so just return an empty slice
+			return []time.Time{}, fmt.Errorf("Too many missed start time (> 100). Set or decrease .spec.startingDeadlineSeconds or check clock skew.")
+		}
+	}
+	return starts, nil
+}
+
+// XXX unit test this
+
+// getJobFromTemplate makes a Job from a CronJob
+func getJobFromTemplate(sj *batch.CronJob, scheduledTime time.Time) (*batch.Job, error) {
+	// TODO: consider adding the following labels:
+	// nominal-start-time=$RFC_3339_DATE_OF_INTENDED_START -- for user convenience
+	// scheduled-job-name=$SJ_NAME -- for user convenience
+	labels := copyLabels(&sj.Spec.JobTemplate)
+	annotations := copyAnnotations(&sj.Spec.JobTemplate)
+	createdByRefJson, err := makeCreatedByRefJson(sj)
+	if err != nil {
+		return nil, err
+	}
+	annotations[v1.CreatedByAnnotation] = string(createdByRefJson)
+	// We want job names for a given nominal start time to have a deterministic name to avoid the same job being created twice
+	name := fmt.Sprintf("%s-%d", sj.Name, getTimeHash(scheduledTime))
+
+	job := &batch.Job{
+		ObjectMeta: v1.ObjectMeta{
+			Labels:      labels,
+			Annotations: annotations,
+			Name:        name,
+		},
+	}
+	if err := api.Scheme.Convert(&sj.Spec.JobTemplate.Spec, &job.Spec, nil); err != nil {
+		return nil, fmt.Errorf("unable to convert job template: %v", err)
+	}
+	return job, nil
+}
+
+// Return Unix Epoch Time
+func getTimeHash(scheduledTime time.Time) int64 {
+	return scheduledTime.Unix()
+}
+
+// makeCreatedByRefJson makes a json string with an object reference for use in "created-by" annotation value
+func makeCreatedByRefJson(object runtime.Object) (string, error) {
+	createdByRef, err := v1.GetReference(object)
+	if err != nil {
+		return "", fmt.Errorf("unable to get controller reference: %v", err)
+	}
+
+	// TODO: this code was not safe previously - as soon as new code came along that switched to v2, old clients
+	//   would be broken upon reading it. This is explicitly hardcoded to v1 to guarantee predictable deployment.
+	//   We need to consistently handle this case of annotation versioning.
+	codec := api.Codecs.LegacyCodec(schema.GroupVersion{Group: v1.GroupName, Version: "v1"})
+
+	createdByRefJson, err := runtime.Encode(codec, &v1.SerializedReference{
+		Reference: *createdByRef,
+	})
+	if err != nil {
+		return "", fmt.Errorf("unable to serialize controller reference: %v", err)
+	}
+	return string(createdByRefJson), nil
+}
+
+func IsJobFinished(j *batch.Job) bool {
+	for _, c := range j.Status.Conditions {
+		if (c.Type == batch.JobComplete || c.Type == batch.JobFailed) && c.Status == v1.ConditionTrue {
+			return true
+		}
+	}
+	return false
+}

vendor/k8s.io/kubernetes/pkg/controller/cronjob/utils_test.go

@@ -0,0 +1,390 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cronjob
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/kubernetes/pkg/api/v1"
+	batch "k8s.io/kubernetes/pkg/apis/batch/v2alpha1"
+)
+
+func TestGetJobFromTemplate(t *testing.T) {
+	// getJobFromTemplate() needs to take the job template and copy the labels and annotations
+	// and other fields, and add a created-by reference.
+
+	var one int64 = 1
+	var no bool = false
+
+	sj := batch.CronJob{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "mycronjob",
+			Namespace: "snazzycats",
+			UID:       types.UID("1a2b3c"),
+			SelfLink:  "/apis/batch/v1/namespaces/snazzycats/jobs/mycronjob",
+		},
+		Spec: batch.CronJobSpec{
+			Schedule:          "* * * * ?",
+			ConcurrencyPolicy: batch.AllowConcurrent,
+			JobTemplate: batch.JobTemplateSpec{
+				ObjectMeta: v1.ObjectMeta{
+					Labels:      map[string]string{"a": "b"},
+					Annotations: map[string]string{"x": "y"},
+				},
+				Spec: batch.JobSpec{
+					ActiveDeadlineSeconds: &one,
+					ManualSelector:        &no,
+					Template: v1.PodTemplateSpec{
+						ObjectMeta: v1.ObjectMeta{
+							Labels: map[string]string{
+								"foo": "bar",
+							},
+						},
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{Image: "foo/bar"},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	var job *batch.Job
+	job, err := getJobFromTemplate(&sj, time.Time{})
+	if err != nil {
+		t.Errorf("Did not expect error: %s", err)
+	}
+	if !strings.HasPrefix(job.ObjectMeta.Name, "mycronjob-") {
+		t.Errorf("Wrong Name")
+	}
+	if len(job.ObjectMeta.Labels) != 1 {
+		t.Errorf("Wrong number of labels")
+	}
+	if len(job.ObjectMeta.Annotations) != 2 {
+		t.Errorf("Wrong number of annotations")
+	}
+	v, ok := job.ObjectMeta.Annotations[v1.CreatedByAnnotation]
+	if !ok {
+		t.Errorf("Missing created-by annotation")
+	}
+	expectedCreatedBy := `{"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"CronJob","namespace":"snazzycats","name":"mycronjob","uid":"1a2b3c","apiVersion":"batch"}}
+`
+	if len(v) != len(expectedCreatedBy) {
+		t.Errorf("Wrong length for created-by annotation, expected %v got %v", len(expectedCreatedBy), len(v))
+	}
+	if v != expectedCreatedBy {
+		t.Errorf("Wrong value for created-by annotation, expected %v got %v", expectedCreatedBy, v)
+	}
+}
+
+func TestGetParentUIDFromJob(t *testing.T) {
+	j := &batch.Job{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "foobar",
+			Namespace: v1.NamespaceDefault,
+		},
+		Spec: batch.JobSpec{
+			Selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{"foo": "bar"},
+			},
+			Template: v1.PodTemplateSpec{
+				ObjectMeta: v1.ObjectMeta{
+					Labels: map[string]string{
+						"foo": "bar",
+					},
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{Image: "foo/bar"},
+					},
+				},
+			},
+		},
+		Status: batch.JobStatus{
+			Conditions: []batch.JobCondition{{
+				Type:   batch.JobComplete,
+				Status: v1.ConditionTrue,
+			}},
+		},
+	}
+	{
+		// Case 1: No UID annotation
+		_, found := getParentUIDFromJob(*j)
+
+		if found {
+			t.Errorf("Unexpectedly found uid")
+		}
+	}
+	{
+		// Case 2: Has UID annotation
+		j.ObjectMeta.Annotations = map[string]string{v1.CreatedByAnnotation: `{"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"CronJob","namespace":"default","name":"pi","uid":"5ef034e0-1890-11e6-8935-42010af0003e","apiVersion":"extensions","resourceVersion":"427339"}}`}
+
+		expectedUID := types.UID("5ef034e0-1890-11e6-8935-42010af0003e")
+
+		uid, found := getParentUIDFromJob(*j)
+		if !found {
+			t.Errorf("Unexpectedly did not find uid")
+		} else if uid != expectedUID {
+			t.Errorf("Wrong UID: %v", uid)
+		}
+	}
+
+}
+
+func TestGroupJobsByParent(t *testing.T) {
+	uid1 := types.UID("11111111-1111-1111-1111-111111111111")
+	uid2 := types.UID("22222222-2222-2222-2222-222222222222")
+	uid3 := types.UID("33333333-3333-3333-3333-333333333333")
+	createdBy1 := map[string]string{v1.CreatedByAnnotation: `{"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"CronJob","namespace":"x","name":"pi","uid":"11111111-1111-1111-1111-111111111111","apiVersion":"extensions","resourceVersion":"111111"}}`}
+	createdBy2 := map[string]string{v1.CreatedByAnnotation: `{"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"CronJob","namespace":"x","name":"pi","uid":"22222222-2222-2222-2222-222222222222","apiVersion":"extensions","resourceVersion":"222222"}}`}
+	createdBy3 := map[string]string{v1.CreatedByAnnotation: `{"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"CronJob","namespace":"y","name":"pi","uid":"33333333-3333-3333-3333-333333333333","apiVersion":"extensions","resourceVersion":"333333"}}`}
+	noCreatedBy := map[string]string{}
+
+	{
+		// Case 1: There are no jobs and scheduledJobs
+		sjs := []batch.CronJob{}
+		js := []batch.Job{}
+		jobsBySj := groupJobsByParent(sjs, js)
+		if len(jobsBySj) != 0 {
+			t.Errorf("Wrong number of items in map")
+		}
+	}
+
+	{
+		// Case 2: there is one controller with no job.
+		sjs := []batch.CronJob{
+			{ObjectMeta: v1.ObjectMeta{Name: "e", Namespace: "x", UID: uid1}},
+		}
+		js := []batch.Job{}
+		jobsBySj := groupJobsByParent(sjs, js)
+		if len(jobsBySj) != 0 {
+			t.Errorf("Wrong number of items in map")
+		}
+	}
+
+	{
+		// Case 3: there is one controller with one job it created.
+		sjs := []batch.CronJob{
+			{ObjectMeta: v1.ObjectMeta{Name: "e", Namespace: "x", UID: uid1}},
+		}
+		js := []batch.Job{
+			{ObjectMeta: v1.ObjectMeta{Name: "a", Namespace: "x", Annotations: createdBy1}},
+		}
+		jobsBySj := groupJobsByParent(sjs, js)
+
+		if len(jobsBySj) != 1 {
+			t.Errorf("Wrong number of items in map")
+		}
+		jobList1, found := jobsBySj[uid1]
+		if !found {
+			t.Errorf("Key not found")
+		}
+		if len(jobList1) != 1 {
+			t.Errorf("Wrong number of items in map")
+		}
+	}
+
+	{
+		// Case 4: Two namespaces, one has two jobs from one controller, other has 3 jobs from two controllers.
+		// There are also two jobs with no created-by annotation.
+		js := []batch.Job{
+			{ObjectMeta: v1.ObjectMeta{Name: "a", Namespace: "x", Annotations: createdBy1}},
+			{ObjectMeta: v1.ObjectMeta{Name: "b", Namespace: "x", Annotations: createdBy2}},
+			{ObjectMeta: v1.ObjectMeta{Name: "c", Namespace: "x", Annotations: createdBy1}},
+			{ObjectMeta: v1.ObjectMeta{Name: "d", Namespace: "x", Annotations: noCreatedBy}},
+			{ObjectMeta: v1.ObjectMeta{Name: "a", Namespace: "y", Annotations: createdBy3}},
+			{ObjectMeta: v1.ObjectMeta{Name: "b", Namespace: "y", Annotations: createdBy3}},
+			{ObjectMeta: v1.ObjectMeta{Name: "d", Namespace: "y", Annotations: noCreatedBy}},
+		}
+		sjs := []batch.CronJob{
+			{ObjectMeta: v1.ObjectMeta{Name: "e", Namespace: "x", UID: uid1}},
+			{ObjectMeta: v1.ObjectMeta{Name: "f", Namespace: "x", UID: uid2}},
+			{ObjectMeta: v1.ObjectMeta{Name: "g", Namespace: "y", UID: uid3}},
+		}
+
+		jobsBySj := groupJobsByParent(sjs, js)
+
+		if len(jobsBySj) != 3 {
+			t.Errorf("Wrong number of items in map")
+		}
+		jobList1, found := jobsBySj[uid1]
+		if !found {
+			t.Errorf("Key not found")
+		}
+		if len(jobList1) != 2 {
+			t.Errorf("Wrong number of items in map")
+		}
+		jobList2, found := jobsBySj[uid2]
+		if !found {
+			t.Errorf("Key not found")
+		}
+		if len(jobList2) != 1 {
+			t.Errorf("Wrong number of items in map")
+		}
+		jobList3, found := jobsBySj[uid3]
+		if !found {
+			t.Errorf("Key not found")
+		}
+		if len(jobList3) != 2 {
+			t.Errorf("Wrong number of items in map")
+		}
+	}
+
+}
+
+func TestGetRecentUnmetScheduleTimes(t *testing.T) {
+	// schedule is hourly on the hour
+	schedule := "0 * * * ?"
+	// T1 is a scheduled start time of that schedule
+	T1, err := time.Parse(time.RFC3339, "2016-05-19T10:00:00Z")
+	if err != nil {
+		t.Errorf("test setup error: %v", err)
+	}
+	// T2 is a scheduled start time of that schedule after T1
+	T2, err := time.Parse(time.RFC3339, "2016-05-19T11:00:00Z")
+	if err != nil {
+		t.Errorf("test setup error: %v", err)
+	}
+
+	sj := batch.CronJob{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "mycronjob",
+			Namespace: v1.NamespaceDefault,
+			UID:       types.UID("1a2b3c"),
+		},
+		Spec: batch.CronJobSpec{
+			Schedule:          schedule,
+			ConcurrencyPolicy: batch.AllowConcurrent,
+			JobTemplate:       batch.JobTemplateSpec{},
+		},
+	}
+	{
+		// Case 1: no known start times, and none needed yet.
+		// Creation time is before T1.
+		sj.ObjectMeta.CreationTimestamp = metav1.Time{Time: T1.Add(-10 * time.Minute)}
+		// Current time is more than creation time, but less than T1.
+		now := T1.Add(-7 * time.Minute)
+		times, err := getRecentUnmetScheduleTimes(sj, now)
+		if err != nil {
+			t.Errorf("unexpected error: %v", err)
+		}
+		if len(times) != 0 {
+			t.Errorf("expected no start times, got:  %v", times)
+		}
+	}
+	{
+		// Case 2: no known start times, and one needed.
+		// Creation time is before T1.
+		sj.ObjectMeta.CreationTimestamp = metav1.Time{Time: T1.Add(-10 * time.Minute)}
+		// Current time is after T1
+		now := T1.Add(2 * time.Second)
+		times, err := getRecentUnmetScheduleTimes(sj, now)
+		if err != nil {
+			t.Errorf("unexpected error: %v", err)
+		}
+		if len(times) != 1 {
+			t.Errorf("expected 1 start time, got: %v", times)
+		} else if !times[0].Equal(T1) {
+			t.Errorf("expected: %v, got: %v", T1, times[0])
+		}
+	}
+	{
+		// Case 3: known LastScheduleTime, no start needed.
+		// Creation time is before T1.
+		sj.ObjectMeta.CreationTimestamp = metav1.Time{Time: T1.Add(-10 * time.Minute)}
+		// Status shows a start at the expected time.
+		sj.Status.LastScheduleTime = &metav1.Time{Time: T1}
+		// Current time is after T1
+		now := T1.Add(2 * time.Minute)
+		times, err := getRecentUnmetScheduleTimes(sj, now)
+		if err != nil {
+			t.Errorf("unexpected error: %v", err)
+		}
+		if len(times) != 0 {
+			t.Errorf("expected 0 start times, got: , got: %v", times)
+		}
+	}
+	{
+		// Case 4: known LastScheduleTime, a start needed
+		// Creation time is before T1.
+		sj.ObjectMeta.CreationTimestamp = metav1.Time{Time: T1.Add(-10 * time.Minute)}
+		// Status shows a start at the expected time.
+		sj.Status.LastScheduleTime = &metav1.Time{Time: T1}
+		// Current time is after T1 and after T2
+		now := T2.Add(5 * time.Minute)
+		times, err := getRecentUnmetScheduleTimes(sj, now)
+		if err != nil {
+			t.Errorf("unexpected error: %v", err)
+		}
+		if len(times) != 1 {
+			t.Errorf("expected 2 start times, got: , got: %v", times)
+		} else if !times[0].Equal(T2) {
+			t.Errorf("expected: %v, got: %v", T1, times[0])
+		}
+	}
+	{
+		// Case 5: known LastScheduleTime, two starts needed
+		sj.ObjectMeta.CreationTimestamp = metav1.Time{Time: T1.Add(-2 * time.Hour)}
+		sj.Status.LastScheduleTime = &metav1.Time{Time: T1.Add(-1 * time.Hour)}
+		// Current time is after T1 and after T2
+		now := T2.Add(5 * time.Minute)
+		times, err := getRecentUnmetScheduleTimes(sj, now)
+		if err != nil {
+			t.Errorf("unexpected error: %v", err)
+		}
+		if len(times) != 2 {
+			t.Errorf("expected 2 start times, got: , got: %v", times)
+		} else {
+			if !times[0].Equal(T1) {
+				t.Errorf("expected: %v, got: %v", T1, times[0])
+			}
+			if !times[1].Equal(T2) {
+				t.Errorf("expected: %v, got: %v", T2, times[1])
+			}
+		}
+	}
+	{
+		// Case 6: now is way way ahead of last start time, and there is no deadline.
+		sj.ObjectMeta.CreationTimestamp = metav1.Time{Time: T1.Add(-2 * time.Hour)}
+		sj.Status.LastScheduleTime = &metav1.Time{Time: T1.Add(-1 * time.Hour)}
+		now := T2.Add(10 * 24 * time.Hour)
+		_, err := getRecentUnmetScheduleTimes(sj, now)
+		if err == nil {
+			t.Errorf("unexpected lack of error")
+		}
+	}
+	{
+		// Case 7: now is way way ahead of last start time, but there is a short deadline.
+		sj.ObjectMeta.CreationTimestamp = metav1.Time{Time: T1.Add(-2 * time.Hour)}
+		sj.Status.LastScheduleTime = &metav1.Time{Time: T1.Add(-1 * time.Hour)}
+		now := T2.Add(10 * 24 * time.Hour)
+		// Deadline is short
+		deadline := int64(2 * 60 * 60)
+		sj.Spec.StartingDeadlineSeconds = &deadline
+		_, err := getRecentUnmetScheduleTimes(sj, now)
+		if err != nil {
+			t.Errorf("unexpected error")
+		}
+	}
+
+}

vendor/k8s.io/kubernetes/pkg/controller/daemon/BUILD

@@ -0,0 +1,75 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "daemoncontroller.go",
+        "doc.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/extensions/v1beta1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/core/v1:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/extensions/v1beta1:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/util/metrics:go_default_library",
+        "//pkg/util/workqueue:go_default_library",
+        "//plugin/pkg/scheduler/algorithm/predicates:go_default_library",
+        "//plugin/pkg/scheduler/schedulercache:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/labels",
+        "//vendor:k8s.io/apimachinery/pkg/util/errors",
+        "//vendor:k8s.io/apimachinery/pkg/util/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["daemoncontroller_test.go"],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/resource:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/extensions/v1beta1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset/fake:go_default_library",
+        "//pkg/client/testing/core:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/securitycontext:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/daemon/OWNERS

@@ -0,0 +1,4 @@
+reviewers:
+- mikedanese
+- kargakis
+- lukaszo

vendor/k8s.io/kubernetes/pkg/controller/daemon/daemoncontroller.go

@@ -0,0 +1,811 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package daemon
+
+import (
+	"fmt"
+	"reflect"
+	"sort"
+	"sync"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	v1core "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/core/v1"
+	unversionedextensions "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/util/metrics"
+	"k8s.io/kubernetes/pkg/util/workqueue"
+	"k8s.io/kubernetes/plugin/pkg/scheduler/algorithm/predicates"
+	"k8s.io/kubernetes/plugin/pkg/scheduler/schedulercache"
+
+	"github.com/golang/glog"
+)
+
+const (
+	// Daemon sets will periodically check that their daemon pods are running as expected.
+	FullDaemonSetResyncPeriod = 30 * time.Second // TODO: Figure out if this time seems reasonable.
+
+	// Realistic value of the burstReplica field for the replication manager based off
+	// performance requirements for kubernetes 1.0.
+	BurstReplicas = 500
+
+	// If sending a status upate to API server fails, we retry a finite number of times.
+	StatusUpdateRetries = 1
+)
+
+// DaemonSetsController is responsible for synchronizing DaemonSet objects stored
+// in the system with actual running pods.
+type DaemonSetsController struct {
+	kubeClient    clientset.Interface
+	eventRecorder record.EventRecorder
+	podControl    controller.PodControlInterface
+
+	// An dsc is temporarily suspended after creating/deleting these many replicas.
+	// It resumes normal action after observing the watch events for them.
+	burstReplicas int
+
+	// To allow injection of syncDaemonSet for testing.
+	syncHandler func(dsKey string) error
+	// A TTLCache of pod creates/deletes each ds expects to see
+	expectations controller.ControllerExpectationsInterface
+	// A store of daemon sets
+	dsStore *cache.StoreToDaemonSetLister
+	// A store of pods
+	podStore *cache.StoreToPodLister
+	// A store of nodes
+	nodeStore *cache.StoreToNodeLister
+	// dsStoreSynced returns true if the daemonset store has been synced at least once.
+	// Added as a member to the struct to allow injection for testing.
+	dsStoreSynced cache.InformerSynced
+	// podStoreSynced returns true if the pod store has been synced at least once.
+	// Added as a member to the struct to allow injection for testing.
+	podStoreSynced cache.InformerSynced
+	// nodeStoreSynced returns true if the node store has been synced at least once.
+	// Added as a member to the struct to allow injection for testing.
+	nodeStoreSynced cache.InformerSynced
+
+	lookupCache *controller.MatchingCache
+
+	// DaemonSet keys that need to be synced.
+	queue workqueue.RateLimitingInterface
+}
+
+func NewDaemonSetsController(daemonSetInformer informers.DaemonSetInformer, podInformer informers.PodInformer, nodeInformer informers.NodeInformer, kubeClient clientset.Interface, lookupCacheSize int) *DaemonSetsController {
+	eventBroadcaster := record.NewBroadcaster()
+	eventBroadcaster.StartLogging(glog.Infof)
+	// TODO: remove the wrapper when every clients have moved to use the clientset.
+	eventBroadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: kubeClient.Core().Events("")})
+
+	if kubeClient != nil && kubeClient.Core().RESTClient().GetRateLimiter() != nil {
+		metrics.RegisterMetricAndTrackRateLimiterUsage("daemon_controller", kubeClient.Core().RESTClient().GetRateLimiter())
+	}
+	dsc := &DaemonSetsController{
+		kubeClient:    kubeClient,
+		eventRecorder: eventBroadcaster.NewRecorder(v1.EventSource{Component: "daemonset-controller"}),
+		podControl: controller.RealPodControl{
+			KubeClient: kubeClient,
+			Recorder:   eventBroadcaster.NewRecorder(v1.EventSource{Component: "daemon-set"}),
+		},
+		burstReplicas: BurstReplicas,
+		expectations:  controller.NewControllerExpectations(),
+		queue:         workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "daemonset"),
+	}
+
+	daemonSetInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc: func(obj interface{}) {
+			ds := obj.(*extensions.DaemonSet)
+			glog.V(4).Infof("Adding daemon set %s", ds.Name)
+			dsc.enqueueDaemonSet(ds)
+		},
+		UpdateFunc: func(old, cur interface{}) {
+			oldDS := old.(*extensions.DaemonSet)
+			curDS := cur.(*extensions.DaemonSet)
+			// We should invalidate the whole lookup cache if a DS's selector has been updated.
+			//
+			// Imagine that you have two RSs:
+			// * old DS1
+			// * new DS2
+			// You also have a pod that is attached to DS2 (because it doesn't match DS1 selector).
+			// Now imagine that you are changing DS1 selector so that it is now matching that pod,
+			// in such case we must invalidate the whole cache so that pod could be adopted by DS1
+			//
+			// This makes the lookup cache less helpful, but selector update does not happen often,
+			// so it's not a big problem
+			if !reflect.DeepEqual(oldDS.Spec.Selector, curDS.Spec.Selector) {
+				dsc.lookupCache.InvalidateAll()
+			}
+
+			glog.V(4).Infof("Updating daemon set %s", oldDS.Name)
+			dsc.enqueueDaemonSet(curDS)
+		},
+		DeleteFunc: dsc.deleteDaemonset,
+	})
+	dsc.dsStore = daemonSetInformer.Lister()
+	dsc.dsStoreSynced = daemonSetInformer.Informer().HasSynced
+
+	// Watch for creation/deletion of pods. The reason we watch is that we don't want a daemon set to create/delete
+	// more pods until all the effects (expectations) of a daemon set's create/delete have been observed.
+	podInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    dsc.addPod,
+		UpdateFunc: dsc.updatePod,
+		DeleteFunc: dsc.deletePod,
+	})
+	dsc.podStore = podInformer.Lister()
+	dsc.podStoreSynced = podInformer.Informer().HasSynced
+
+	nodeInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    dsc.addNode,
+		UpdateFunc: dsc.updateNode,
+	},
+	)
+	dsc.nodeStoreSynced = nodeInformer.Informer().HasSynced
+	dsc.nodeStore = nodeInformer.Lister()
+
+	dsc.syncHandler = dsc.syncDaemonSet
+	dsc.lookupCache = controller.NewMatchingCache(lookupCacheSize)
+	return dsc
+}
+
+func (dsc *DaemonSetsController) deleteDaemonset(obj interface{}) {
+	ds, ok := obj.(*extensions.DaemonSet)
+	if !ok {
+		tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+		if !ok {
+			glog.Errorf("Couldn't get object from tombstone %#v", obj)
+			return
+		}
+		ds, ok = tombstone.Obj.(*extensions.DaemonSet)
+		if !ok {
+			glog.Errorf("Tombstone contained object that is not a DaemonSet %#v", obj)
+			return
+		}
+	}
+	glog.V(4).Infof("Deleting daemon set %s", ds.Name)
+	dsc.enqueueDaemonSet(ds)
+}
+
+// Run begins watching and syncing daemon sets.
+func (dsc *DaemonSetsController) Run(workers int, stopCh <-chan struct{}) {
+	defer utilruntime.HandleCrash()
+	defer dsc.queue.ShutDown()
+
+	glog.Infof("Starting Daemon Sets controller manager")
+
+	if !cache.WaitForCacheSync(stopCh, dsc.podStoreSynced, dsc.nodeStoreSynced, dsc.dsStoreSynced) {
+		return
+	}
+
+	for i := 0; i < workers; i++ {
+		go wait.Until(dsc.runWorker, time.Second, stopCh)
+	}
+
+	<-stopCh
+	glog.Infof("Shutting down Daemon Set Controller")
+}
+
+func (dsc *DaemonSetsController) runWorker() {
+	for dsc.processNextWorkItem() {
+	}
+}
+
+// processNextWorkItem deals with one key off the queue.  It returns false when it's time to quit.
+func (dsc *DaemonSetsController) processNextWorkItem() bool {
+	dsKey, quit := dsc.queue.Get()
+	if quit {
+		return false
+	}
+	defer dsc.queue.Done(dsKey)
+
+	err := dsc.syncHandler(dsKey.(string))
+	if err == nil {
+		dsc.queue.Forget(dsKey)
+		return true
+	}
+
+	utilruntime.HandleError(fmt.Errorf("%v failed with : %v", dsKey, err))
+	dsc.queue.AddRateLimited(dsKey)
+
+	return true
+}
+
+func (dsc *DaemonSetsController) enqueueDaemonSet(ds *extensions.DaemonSet) {
+	key, err := controller.KeyFunc(ds)
+	if err != nil {
+		glog.Errorf("Couldn't get key for object %#v: %v", ds, err)
+		return
+	}
+
+	// TODO: Handle overlapping controllers better. See comment in ReplicationManager.
+	dsc.queue.Add(key)
+}
+
+func (dsc *DaemonSetsController) getPodDaemonSet(pod *v1.Pod) *extensions.DaemonSet {
+	// look up in the cache, if cached and the cache is valid, just return cached value
+	if obj, cached := dsc.lookupCache.GetMatchingObject(pod); cached {
+		ds, ok := obj.(*extensions.DaemonSet)
+		if !ok {
+			// This should not happen
+			glog.Errorf("lookup cache does not retuen a ReplicationController object")
+			return nil
+		}
+		if dsc.isCacheValid(pod, ds) {
+			return ds
+		}
+	}
+	sets, err := dsc.dsStore.GetPodDaemonSets(pod)
+	if err != nil {
+		glog.V(4).Infof("No daemon sets found for pod %v, daemon set controller will avoid syncing", pod.Name)
+		return nil
+	}
+	if len(sets) > 1 {
+		// More than two items in this list indicates user error. If two daemon
+		// sets overlap, sort by creation timestamp, subsort by name, then pick
+		// the first.
+		glog.Errorf("user error! more than one daemon is selecting pods with labels: %+v", pod.Labels)
+		sort.Sort(byCreationTimestamp(sets))
+	}
+
+	// update lookup cache
+	dsc.lookupCache.Update(pod, &sets[0])
+
+	return &sets[0]
+}
+
+// isCacheValid check if the cache is valid
+func (dsc *DaemonSetsController) isCacheValid(pod *v1.Pod, cachedDS *extensions.DaemonSet) bool {
+	_, exists, err := dsc.dsStore.Get(cachedDS)
+	// ds has been deleted or updated, cache is invalid
+	if err != nil || !exists || !isDaemonSetMatch(pod, cachedDS) {
+		return false
+	}
+	return true
+}
+
+// isDaemonSetMatch take a Pod and DaemonSet, return whether the Pod and DaemonSet are matching
+// TODO(mqliang): This logic is a copy from GetPodDaemonSets(), remove the duplication
+func isDaemonSetMatch(pod *v1.Pod, ds *extensions.DaemonSet) bool {
+	if ds.Namespace != pod.Namespace {
+		return false
+	}
+	selector, err := metav1.LabelSelectorAsSelector(ds.Spec.Selector)
+	if err != nil {
+		err = fmt.Errorf("invalid selector: %v", err)
+		return false
+	}
+
+	// If a ReplicaSet with a nil or empty selector creeps in, it should match nothing, not everything.
+	if selector.Empty() || !selector.Matches(labels.Set(pod.Labels)) {
+		return false
+	}
+	return true
+}
+
+func (dsc *DaemonSetsController) addPod(obj interface{}) {
+	pod := obj.(*v1.Pod)
+	glog.V(4).Infof("Pod %s added.", pod.Name)
+	if ds := dsc.getPodDaemonSet(pod); ds != nil {
+		dsKey, err := controller.KeyFunc(ds)
+		if err != nil {
+			glog.Errorf("Couldn't get key for object %#v: %v", ds, err)
+			return
+		}
+		dsc.expectations.CreationObserved(dsKey)
+		dsc.enqueueDaemonSet(ds)
+	}
+}
+
+// When a pod is updated, figure out what sets manage it and wake them
+// up. If the labels of the pod have changed we need to awaken both the old
+// and new set. old and cur must be *v1.Pod types.
+func (dsc *DaemonSetsController) updatePod(old, cur interface{}) {
+	curPod := cur.(*v1.Pod)
+	oldPod := old.(*v1.Pod)
+	if curPod.ResourceVersion == oldPod.ResourceVersion {
+		// Periodic resync will send update events for all known pods.
+		// Two different versions of the same pod will always have different RVs.
+		return
+	}
+	glog.V(4).Infof("Pod %s updated.", curPod.Name)
+	if curDS := dsc.getPodDaemonSet(curPod); curDS != nil {
+		dsc.enqueueDaemonSet(curDS)
+	}
+	// If the labels have not changed, then the daemon set responsible for
+	// the pod is the same as it was before. In that case we have enqueued the daemon
+	// set above, and do not have to enqueue the set again.
+	if !reflect.DeepEqual(curPod.Labels, oldPod.Labels) {
+		// It's ok if both oldDS and curDS are the same, because curDS will set
+		// the expectations on its run so oldDS will have no effect.
+		if oldDS := dsc.getPodDaemonSet(oldPod); oldDS != nil {
+			dsc.enqueueDaemonSet(oldDS)
+		}
+	}
+}
+
+func (dsc *DaemonSetsController) deletePod(obj interface{}) {
+	pod, ok := obj.(*v1.Pod)
+	// When a delete is dropped, the relist will notice a pod in the store not
+	// in the list, leading to the insertion of a tombstone object which contains
+	// the deleted key/value. Note that this value might be stale. If the pod
+	// changed labels the new daemonset will not be woken up till the periodic
+	// resync.
+	if !ok {
+		tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+		if !ok {
+			glog.Errorf("Couldn't get object from tombstone %#v", obj)
+			return
+		}
+		pod, ok = tombstone.Obj.(*v1.Pod)
+		if !ok {
+			glog.Errorf("Tombstone contained object that is not a pod %#v", obj)
+			return
+		}
+	}
+	glog.V(4).Infof("Pod %s deleted.", pod.Name)
+	if ds := dsc.getPodDaemonSet(pod); ds != nil {
+		dsKey, err := controller.KeyFunc(ds)
+		if err != nil {
+			glog.Errorf("Couldn't get key for object %#v: %v", ds, err)
+			return
+		}
+		dsc.expectations.DeletionObserved(dsKey)
+		dsc.enqueueDaemonSet(ds)
+	}
+}
+
+func (dsc *DaemonSetsController) addNode(obj interface{}) {
+	// TODO: it'd be nice to pass a hint with these enqueues, so that each ds would only examine the added node (unless it has other work to do, too).
+	dsList, err := dsc.dsStore.List()
+	if err != nil {
+		glog.V(4).Infof("Error enqueueing daemon sets: %v", err)
+		return
+	}
+	node := obj.(*v1.Node)
+	for i := range dsList.Items {
+		ds := &dsList.Items[i]
+		_, shouldSchedule, _, err := dsc.nodeShouldRunDaemonPod(node, ds)
+		if err != nil {
+			continue
+		}
+		if shouldSchedule {
+			dsc.enqueueDaemonSet(ds)
+		}
+	}
+}
+
+func (dsc *DaemonSetsController) updateNode(old, cur interface{}) {
+	oldNode := old.(*v1.Node)
+	curNode := cur.(*v1.Node)
+	if reflect.DeepEqual(oldNode.Labels, curNode.Labels) {
+		// If node labels didn't change, we can ignore this update.
+		return
+	}
+	dsList, err := dsc.dsStore.List()
+	if err != nil {
+		glog.V(4).Infof("Error enqueueing daemon sets: %v", err)
+		return
+	}
+	// TODO: it'd be nice to pass a hint with these enqueues, so that each ds would only examine the added node (unless it has other work to do, too).
+	for i := range dsList.Items {
+		ds := &dsList.Items[i]
+		_, oldShouldSchedule, oldShouldContinueRunning, err := dsc.nodeShouldRunDaemonPod(oldNode, ds)
+		if err != nil {
+			continue
+		}
+		_, currentShouldSchedule, currentShouldContinueRunning, err := dsc.nodeShouldRunDaemonPod(curNode, ds)
+		if err != nil {
+			continue
+		}
+		if (oldShouldSchedule != currentShouldSchedule) || (oldShouldContinueRunning != currentShouldContinueRunning) {
+			dsc.enqueueDaemonSet(ds)
+		}
+	}
+}
+
+// getNodesToDaemonSetPods returns a map from nodes to daemon pods (corresponding to ds) running on the nodes.
+func (dsc *DaemonSetsController) getNodesToDaemonPods(ds *extensions.DaemonSet) (map[string][]*v1.Pod, error) {
+	nodeToDaemonPods := make(map[string][]*v1.Pod)
+	selector, err := metav1.LabelSelectorAsSelector(ds.Spec.Selector)
+	if err != nil {
+		return nil, err
+	}
+	daemonPods, err := dsc.podStore.Pods(ds.Namespace).List(selector)
+	if err != nil {
+		return nodeToDaemonPods, err
+	}
+	for i := range daemonPods {
+		// TODO: Do we need to copy here?
+		daemonPod := &(*daemonPods[i])
+		nodeName := daemonPod.Spec.NodeName
+		nodeToDaemonPods[nodeName] = append(nodeToDaemonPods[nodeName], daemonPod)
+	}
+	return nodeToDaemonPods, nil
+}
+
+func (dsc *DaemonSetsController) manage(ds *extensions.DaemonSet) error {
+	// Find out which nodes are running the daemon pods selected by ds.
+	nodeToDaemonPods, err := dsc.getNodesToDaemonPods(ds)
+	if err != nil {
+		return fmt.Errorf("error getting node to daemon pod mapping for daemon set %#v: %v", ds, err)
+	}
+
+	// For each node, if the node is running the daemon pod but isn't supposed to, kill the daemon
+	// pod. If the node is supposed to run the daemon pod, but isn't, create the daemon pod on the node.
+	nodeList, err := dsc.nodeStore.List()
+	if err != nil {
+		return fmt.Errorf("couldn't get list of nodes when syncing daemon set %#v: %v", ds, err)
+	}
+	var nodesNeedingDaemonPods, podsToDelete []string
+	for _, node := range nodeList.Items {
+		_, shouldSchedule, shouldContinueRunning, err := dsc.nodeShouldRunDaemonPod(&node, ds)
+		if err != nil {
+			continue
+		}
+
+		daemonPods, isRunning := nodeToDaemonPods[node.Name]
+
+		switch {
+		case shouldSchedule && !isRunning:
+			// If daemon pod is supposed to be running on node, but isn't, create daemon pod.
+			nodesNeedingDaemonPods = append(nodesNeedingDaemonPods, node.Name)
+		case shouldContinueRunning && len(daemonPods) > 1:
+			// If daemon pod is supposed to be running on node, but more than 1 daemon pod is running, delete the excess daemon pods.
+			// Sort the daemon pods by creation time, so the the oldest is preserved.
+			sort.Sort(podByCreationTimestamp(daemonPods))
+			for i := 1; i < len(daemonPods); i++ {
+				podsToDelete = append(podsToDelete, daemonPods[i].Name)
+			}
+		case !shouldContinueRunning && isRunning:
+			// If daemon pod isn't supposed to run on node, but it is, delete all daemon pods on node.
+			for i := range daemonPods {
+				podsToDelete = append(podsToDelete, daemonPods[i].Name)
+			}
+		}
+	}
+
+	// We need to set expectations before creating/deleting pods to avoid race conditions.
+	dsKey, err := controller.KeyFunc(ds)
+	if err != nil {
+		return fmt.Errorf("couldn't get key for object %#v: %v", ds, err)
+	}
+
+	createDiff := len(nodesNeedingDaemonPods)
+	deleteDiff := len(podsToDelete)
+
+	if createDiff > dsc.burstReplicas {
+		createDiff = dsc.burstReplicas
+	}
+	if deleteDiff > dsc.burstReplicas {
+		deleteDiff = dsc.burstReplicas
+	}
+
+	dsc.expectations.SetExpectations(dsKey, createDiff, deleteDiff)
+
+	// error channel to communicate back failures.  make the buffer big enough to avoid any blocking
+	errCh := make(chan error, createDiff+deleteDiff)
+
+	glog.V(4).Infof("Nodes needing daemon pods for daemon set %s: %+v, creating %d", ds.Name, nodesNeedingDaemonPods, createDiff)
+	createWait := sync.WaitGroup{}
+	createWait.Add(createDiff)
+	for i := 0; i < createDiff; i++ {
+		go func(ix int) {
+			defer createWait.Done()
+			if err := dsc.podControl.CreatePodsOnNode(nodesNeedingDaemonPods[ix], ds.Namespace, &ds.Spec.Template, ds); err != nil {
+				glog.V(2).Infof("Failed creation, decrementing expectations for set %q/%q", ds.Namespace, ds.Name)
+				dsc.expectations.CreationObserved(dsKey)
+				errCh <- err
+				utilruntime.HandleError(err)
+			}
+		}(i)
+	}
+	createWait.Wait()
+
+	glog.V(4).Infof("Pods to delete for daemon set %s: %+v, deleting %d", ds.Name, podsToDelete, deleteDiff)
+	deleteWait := sync.WaitGroup{}
+	deleteWait.Add(deleteDiff)
+	for i := 0; i < deleteDiff; i++ {
+		go func(ix int) {
+			defer deleteWait.Done()
+			if err := dsc.podControl.DeletePod(ds.Namespace, podsToDelete[ix], ds); err != nil {
+				glog.V(2).Infof("Failed deletion, decrementing expectations for set %q/%q", ds.Namespace, ds.Name)
+				dsc.expectations.DeletionObserved(dsKey)
+				errCh <- err
+				utilruntime.HandleError(err)
+			}
+		}(i)
+	}
+	deleteWait.Wait()
+
+	// collect errors if any for proper reporting/retry logic in the controller
+	errors := []error{}
+	close(errCh)
+	for err := range errCh {
+		errors = append(errors, err)
+	}
+	return utilerrors.NewAggregate(errors)
+}
+
+func storeDaemonSetStatus(dsClient unversionedextensions.DaemonSetInterface, ds *extensions.DaemonSet, desiredNumberScheduled, currentNumberScheduled, numberMisscheduled, numberReady int) error {
+	if int(ds.Status.DesiredNumberScheduled) == desiredNumberScheduled &&
+		int(ds.Status.CurrentNumberScheduled) == currentNumberScheduled &&
+		int(ds.Status.NumberMisscheduled) == numberMisscheduled &&
+		int(ds.Status.NumberReady) == numberReady &&
+		ds.Status.ObservedGeneration >= ds.Generation {
+		return nil
+	}
+
+	clone, err := api.Scheme.DeepCopy(ds)
+	if err != nil {
+		return err
+	}
+
+	toUpdate := clone.(*extensions.DaemonSet)
+
+	var updateErr, getErr error
+	for i := 0; i < StatusUpdateRetries; i++ {
+		toUpdate.Status.ObservedGeneration = ds.Generation
+		toUpdate.Status.DesiredNumberScheduled = int32(desiredNumberScheduled)
+		toUpdate.Status.CurrentNumberScheduled = int32(currentNumberScheduled)
+		toUpdate.Status.NumberMisscheduled = int32(numberMisscheduled)
+		toUpdate.Status.NumberReady = int32(numberReady)
+
+		if _, updateErr = dsClient.UpdateStatus(toUpdate); updateErr == nil {
+			return nil
+		}
+
+		// Update the set with the latest resource version for the next poll
+		if toUpdate, getErr = dsClient.Get(ds.Name, metav1.GetOptions{}); getErr != nil {
+			// If the GET fails we can't trust status.Replicas anymore. This error
+			// is bound to be more interesting than the update failure.
+			return getErr
+		}
+	}
+	return updateErr
+}
+
+func (dsc *DaemonSetsController) updateDaemonSetStatus(ds *extensions.DaemonSet) error {
+	glog.V(4).Infof("Updating daemon set status")
+	nodeToDaemonPods, err := dsc.getNodesToDaemonPods(ds)
+	if err != nil {
+		return fmt.Errorf("error getting node to daemon pod mapping for daemon set %#v: %v", ds, err)
+	}
+
+	nodeList, err := dsc.nodeStore.List()
+	if err != nil {
+		return fmt.Errorf("couldn't get list of nodes when updating daemon set %#v: %v", ds, err)
+	}
+
+	var desiredNumberScheduled, currentNumberScheduled, numberMisscheduled, numberReady int
+	for _, node := range nodeList.Items {
+		wantToRun, _, _, err := dsc.nodeShouldRunDaemonPod(&node, ds)
+		if err != nil {
+			return err
+		}
+
+		scheduled := len(nodeToDaemonPods[node.Name]) > 0
+
+		if wantToRun {
+			desiredNumberScheduled++
+			if scheduled {
+				currentNumberScheduled++
+				// Sort the daemon pods by creation time, so the the oldest is first.
+				daemonPods, _ := nodeToDaemonPods[node.Name]
+				sort.Sort(podByCreationTimestamp(daemonPods))
+				if v1.IsPodReady(daemonPods[0]) {
+					numberReady++
+				}
+			}
+		} else {
+			if scheduled {
+				numberMisscheduled++
+			}
+		}
+	}
+
+	err = storeDaemonSetStatus(dsc.kubeClient.Extensions().DaemonSets(ds.Namespace), ds, desiredNumberScheduled, currentNumberScheduled, numberMisscheduled, numberReady)
+	if err != nil {
+		return fmt.Errorf("error storing status for daemon set %#v: %v", ds, err)
+	}
+
+	return nil
+}
+
+func (dsc *DaemonSetsController) syncDaemonSet(key string) error {
+	startTime := time.Now()
+	defer func() {
+		glog.V(4).Infof("Finished syncing daemon set %q (%v)", key, time.Now().Sub(startTime))
+	}()
+
+	obj, exists, err := dsc.dsStore.Store.GetByKey(key)
+	if err != nil {
+		return fmt.Errorf("unable to retrieve ds %v from store: %v", key, err)
+	}
+	if !exists {
+		glog.V(3).Infof("daemon set has been deleted %v", key)
+		dsc.expectations.DeleteExpectations(key)
+		return nil
+	}
+	ds := obj.(*extensions.DaemonSet)
+
+	everything := metav1.LabelSelector{}
+	if reflect.DeepEqual(ds.Spec.Selector, &everything) {
+		dsc.eventRecorder.Eventf(ds, v1.EventTypeWarning, "SelectingAll", "This daemon set is selecting all pods. A non-empty selector is required.")
+		return nil
+	}
+
+	// Don't process a daemon set until all its creations and deletions have been processed.
+	// For example if daemon set foo asked for 3 new daemon pods in the previous call to manage,
+	// then we do not want to call manage on foo until the daemon pods have been created.
+	dsKey, err := controller.KeyFunc(ds)
+	if err != nil {
+		return fmt.Errorf("couldn't get key for object %#v: %v", ds, err)
+	}
+	dsNeedsSync := dsc.expectations.SatisfiedExpectations(dsKey)
+	if dsNeedsSync && ds.DeletionTimestamp == nil {
+		if err := dsc.manage(ds); err != nil {
+			return err
+		}
+	}
+
+	return dsc.updateDaemonSetStatus(ds)
+}
+
+// nodeShouldRunDaemonPod checks a set of preconditions against a (node,daemonset) and returns a
+// summary. Returned booleans are:
+// * wantToRun:
+//     Returns true when a user would expect a pod to run on this node and ignores conditions
+//     such as OutOfDisk or insufficent resource that would cause a daemonset pod not to schedule.
+//     This is primarily used to populate daemonset status.
+// * shouldSchedule:
+//     Returns true when a daemonset should be scheduled to a node if a daemonset pod is not already
+//     running on that node.
+// * shouldContinueRunning:
+//     Returns true when a daemonset should continue running on a node if a daemonset pod is already
+//     running on that node.
+func (dsc *DaemonSetsController) nodeShouldRunDaemonPod(node *v1.Node, ds *extensions.DaemonSet) (wantToRun, shouldSchedule, shouldContinueRunning bool, err error) {
+	// Because these bools require an && of all their required conditions, we start
+	// with all bools set to true and set a bool to false if a condition is not met.
+	// A bool should probably not be set to true after this line.
+	wantToRun, shouldSchedule, shouldContinueRunning = true, true, true
+	// If the daemon set specifies a node name, check that it matches with node.Name.
+	if !(ds.Spec.Template.Spec.NodeName == "" || ds.Spec.Template.Spec.NodeName == node.Name) {
+		return false, false, false, nil
+	}
+
+	// TODO: Move it to the predicates
+	for _, c := range node.Status.Conditions {
+		if c.Type == v1.NodeOutOfDisk && c.Status == v1.ConditionTrue {
+			// the kubelet will evict this pod if it needs to. Let kubelet
+			// decide whether to continue running this pod so leave shouldContinueRunning
+			// set to true
+			shouldSchedule = false
+		}
+	}
+
+	newPod := &v1.Pod{Spec: ds.Spec.Template.Spec, ObjectMeta: ds.Spec.Template.ObjectMeta}
+	newPod.Namespace = ds.Namespace
+	newPod.Spec.NodeName = node.Name
+
+	pods := []*v1.Pod{}
+
+	for _, m := range dsc.podStore.Indexer.List() {
+		pod := m.(*v1.Pod)
+		if pod.Spec.NodeName != node.Name {
+			continue
+		}
+		if pod.Status.Phase == v1.PodSucceeded || pod.Status.Phase == v1.PodFailed {
+			continue
+		}
+		// ignore pods that belong to the daemonset when taking into account whether
+		// a daemonset should bind to a node.
+		if pds := dsc.getPodDaemonSet(pod); pds != nil && ds.Name == pds.Name {
+			continue
+		}
+		pods = append(pods, pod)
+	}
+
+	nodeInfo := schedulercache.NewNodeInfo(pods...)
+	nodeInfo.SetNode(node)
+	_, reasons, err := predicates.GeneralPredicates(newPod, nil, nodeInfo)
+	if err != nil {
+		glog.Warningf("GeneralPredicates failed on ds '%s/%s' due to unexpected error: %v", ds.ObjectMeta.Namespace, ds.ObjectMeta.Name, err)
+		return false, false, false, err
+	}
+	for _, r := range reasons {
+		glog.V(4).Infof("GeneralPredicates failed on ds '%s/%s' for reason: %v", ds.ObjectMeta.Namespace, ds.ObjectMeta.Name, r.GetReason())
+		switch reason := r.(type) {
+		case *predicates.InsufficientResourceError:
+			dsc.eventRecorder.Eventf(ds, v1.EventTypeNormal, "FailedPlacement", "failed to place pod on %q: %s", node.ObjectMeta.Name, reason.Error())
+			shouldSchedule = false
+		case *predicates.PredicateFailureError:
+			var emitEvent bool
+			// we try to partition predicates into two partitions here: intentional on the part of the operator and not.
+			switch reason {
+			// intentional
+			case
+				predicates.ErrNodeSelectorNotMatch,
+				predicates.ErrPodNotMatchHostName,
+				predicates.ErrNodeLabelPresenceViolated,
+				// this one is probably intentional since it's a workaround for not having
+				// pod hard anti affinity.
+				predicates.ErrPodNotFitsHostPorts:
+				wantToRun, shouldSchedule, shouldContinueRunning = false, false, false
+			// unintentional
+			case
+				predicates.ErrDiskConflict,
+				predicates.ErrVolumeZoneConflict,
+				predicates.ErrMaxVolumeCountExceeded,
+				predicates.ErrNodeUnderMemoryPressure,
+				predicates.ErrNodeUnderDiskPressure:
+				// wantToRun and shouldContinueRunning are likely true here. They are
+				// absolutely true at the time of writing the comment. See first comment
+				// of this method.
+				shouldSchedule = false
+				emitEvent = true
+			// unexpected
+			case
+				predicates.ErrPodAffinityNotMatch,
+				predicates.ErrServiceAffinityViolated,
+				predicates.ErrTaintsTolerationsNotMatch:
+				return false, false, false, fmt.Errorf("unexpected reason: GeneralPredicates should not return reason %s", reason.GetReason())
+			default:
+				glog.V(4).Infof("unknownd predicate failure reason: %s", reason.GetReason())
+				wantToRun, shouldSchedule, shouldContinueRunning = false, false, false
+				emitEvent = true
+			}
+			if emitEvent {
+				dsc.eventRecorder.Eventf(ds, v1.EventTypeNormal, "FailedPlacement", "failed to place pod on %q: %s", node.ObjectMeta.Name, reason.GetReason())
+			}
+		}
+	}
+	return
+}
+
+// byCreationTimestamp sorts a list by creation timestamp, using their names as a tie breaker.
+type byCreationTimestamp []extensions.DaemonSet
+
+func (o byCreationTimestamp) Len() int      { return len(o) }
+func (o byCreationTimestamp) Swap(i, j int) { o[i], o[j] = o[j], o[i] }
+
+func (o byCreationTimestamp) Less(i, j int) bool {
+	if o[i].CreationTimestamp.Equal(o[j].CreationTimestamp) {
+		return o[i].Name < o[j].Name
+	}
+	return o[i].CreationTimestamp.Before(o[j].CreationTimestamp)
+}
+
+type podByCreationTimestamp []*v1.Pod
+
+func (o podByCreationTimestamp) Len() int      { return len(o) }
+func (o podByCreationTimestamp) Swap(i, j int) { o[i], o[j] = o[j], o[i] }
+
+func (o podByCreationTimestamp) Less(i, j int) bool {
+	if o[i].CreationTimestamp.Equal(o[j].CreationTimestamp) {
+		return o[i].Name < o[j].Name
+	}
+	return o[i].CreationTimestamp.Before(o[j].CreationTimestamp)
+}

vendor/k8s.io/kubernetes/pkg/controller/daemon/daemoncontroller_test.go

@@ -0,0 +1,769 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package daemon
+
+import (
+	"fmt"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/pkg/api/v1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/fake"
+	"k8s.io/kubernetes/pkg/client/testing/core"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/securitycontext"
+)
+
+var (
+	simpleDaemonSetLabel  = map[string]string{"name": "simple-daemon", "type": "production"}
+	simpleDaemonSetLabel2 = map[string]string{"name": "simple-daemon", "type": "test"}
+	simpleNodeLabel       = map[string]string{"color": "blue", "speed": "fast"}
+	simpleNodeLabel2      = map[string]string{"color": "red", "speed": "fast"}
+	alwaysReady           = func() bool { return true }
+)
+
+func getKey(ds *extensions.DaemonSet, t *testing.T) string {
+	if key, err := controller.KeyFunc(ds); err != nil {
+		t.Errorf("Unexpected error getting key for ds %v: %v", ds.Name, err)
+		return ""
+	} else {
+		return key
+	}
+}
+
+func newDaemonSet(name string) *extensions.DaemonSet {
+	return &extensions.DaemonSet{
+		TypeMeta: metav1.TypeMeta{APIVersion: testapi.Extensions.GroupVersion().String()},
+		ObjectMeta: v1.ObjectMeta{
+			Name:      name,
+			Namespace: v1.NamespaceDefault,
+		},
+		Spec: extensions.DaemonSetSpec{
+			Selector: &metav1.LabelSelector{MatchLabels: simpleDaemonSetLabel},
+			Template: v1.PodTemplateSpec{
+				ObjectMeta: v1.ObjectMeta{
+					Labels: simpleDaemonSetLabel,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{
+							Image: "foo/bar",
+							TerminationMessagePath: v1.TerminationMessagePathDefault,
+							ImagePullPolicy:        v1.PullIfNotPresent,
+							SecurityContext:        securitycontext.ValidSecurityContextWithContainerDefaults(),
+						},
+					},
+					DNSPolicy: v1.DNSDefault,
+				},
+			},
+		},
+	}
+}
+
+func newNode(name string, label map[string]string) *v1.Node {
+	return &v1.Node{
+		TypeMeta: metav1.TypeMeta{APIVersion: api.Registry.GroupOrDie(v1.GroupName).GroupVersion.String()},
+		ObjectMeta: v1.ObjectMeta{
+			Name:      name,
+			Labels:    label,
+			Namespace: v1.NamespaceDefault,
+		},
+		Status: v1.NodeStatus{
+			Conditions: []v1.NodeCondition{
+				{Type: v1.NodeReady, Status: v1.ConditionTrue},
+			},
+			Allocatable: v1.ResourceList{
+				v1.ResourcePods: resource.MustParse("100"),
+			},
+		},
+	}
+}
+
+func addNodes(nodeStore cache.Store, startIndex, numNodes int, label map[string]string) {
+	for i := startIndex; i < startIndex+numNodes; i++ {
+		nodeStore.Add(newNode(fmt.Sprintf("node-%d", i), label))
+	}
+}
+
+func newPod(podName string, nodeName string, label map[string]string) *v1.Pod {
+	pod := &v1.Pod{
+		TypeMeta: metav1.TypeMeta{APIVersion: api.Registry.GroupOrDie(v1.GroupName).GroupVersion.String()},
+		ObjectMeta: v1.ObjectMeta{
+			GenerateName: podName,
+			Labels:       label,
+			Namespace:    v1.NamespaceDefault,
+		},
+		Spec: v1.PodSpec{
+			NodeName: nodeName,
+			Containers: []v1.Container{
+				{
+					Image: "foo/bar",
+					TerminationMessagePath: v1.TerminationMessagePathDefault,
+					ImagePullPolicy:        v1.PullIfNotPresent,
+					SecurityContext:        securitycontext.ValidSecurityContextWithContainerDefaults(),
+				},
+			},
+			DNSPolicy: v1.DNSDefault,
+		},
+	}
+	v1.GenerateName(v1.SimpleNameGenerator, &pod.ObjectMeta)
+	return pod
+}
+
+func addPods(podStore cache.Store, nodeName string, label map[string]string, number int) {
+	for i := 0; i < number; i++ {
+		podStore.Add(newPod(fmt.Sprintf("%s-", nodeName), nodeName, label))
+	}
+}
+
+func newTestController(initialObjects ...runtime.Object) (*DaemonSetsController, *controller.FakePodControl, *fake.Clientset) {
+	clientset := fake.NewSimpleClientset(initialObjects...)
+	informerFactory := informers.NewSharedInformerFactory(clientset, nil, controller.NoResyncPeriodFunc())
+
+	manager := NewDaemonSetsController(informerFactory.DaemonSets(), informerFactory.Pods(), informerFactory.Nodes(), clientset, 0)
+
+	manager.podStoreSynced = alwaysReady
+	manager.nodeStoreSynced = alwaysReady
+	manager.dsStoreSynced = alwaysReady
+	podControl := &controller.FakePodControl{}
+	manager.podControl = podControl
+	return manager, podControl, clientset
+}
+
+func validateSyncDaemonSets(t *testing.T, fakePodControl *controller.FakePodControl, expectedCreates, expectedDeletes int) {
+	if len(fakePodControl.Templates) != expectedCreates {
+		t.Errorf("Unexpected number of creates.  Expected %d, saw %d\n", expectedCreates, len(fakePodControl.Templates))
+	}
+	if len(fakePodControl.DeletePodName) != expectedDeletes {
+		t.Errorf("Unexpected number of deletes.  Expected %d, saw %d\n", expectedDeletes, len(fakePodControl.DeletePodName))
+	}
+}
+
+func syncAndValidateDaemonSets(t *testing.T, manager *DaemonSetsController, ds *extensions.DaemonSet, podControl *controller.FakePodControl, expectedCreates, expectedDeletes int) {
+	key, err := controller.KeyFunc(ds)
+	if err != nil {
+		t.Errorf("Could not get key for daemon.")
+	}
+	manager.syncHandler(key)
+	validateSyncDaemonSets(t, podControl, expectedCreates, expectedDeletes)
+}
+
+func TestDeleteFinalStateUnknown(t *testing.T) {
+	manager, _, _ := newTestController()
+	addNodes(manager.nodeStore.Store, 0, 1, nil)
+	ds := newDaemonSet("foo")
+	// DeletedFinalStateUnknown should queue the embedded DS if found.
+	manager.deleteDaemonset(cache.DeletedFinalStateUnknown{Key: "foo", Obj: ds})
+	enqueuedKey, _ := manager.queue.Get()
+	if enqueuedKey.(string) != "default/foo" {
+		t.Errorf("expected delete of DeletedFinalStateUnknown to enqueue the daemonset but found: %#v", enqueuedKey)
+	}
+}
+
+// DaemonSets without node selectors should launch pods on every node.
+func TestSimpleDaemonSetLaunchesPods(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	addNodes(manager.nodeStore.Store, 0, 5, nil)
+	ds := newDaemonSet("foo")
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 5, 0)
+}
+
+// DaemonSets should do nothing if there aren't any nodes
+func TestNoNodesDoesNothing(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	ds := newDaemonSet("foo")
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 0, 0)
+}
+
+// DaemonSets without node selectors should launch on a single node in a
+// single node cluster.
+func TestOneNodeDaemonLaunchesPod(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	manager.nodeStore.Add(newNode("only-node", nil))
+	ds := newDaemonSet("foo")
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 1, 0)
+}
+
+// DaemonSets should place onto NotReady nodes
+func TestNotReadNodeDaemonDoesNotLaunchPod(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	node := newNode("not-ready", nil)
+	node.Status.Conditions = []v1.NodeCondition{
+		{Type: v1.NodeReady, Status: v1.ConditionFalse},
+	}
+	manager.nodeStore.Add(node)
+	ds := newDaemonSet("foo")
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 1, 0)
+}
+
+// DaemonSets should not place onto OutOfDisk nodes
+func TestOutOfDiskNodeDaemonDoesNotLaunchPod(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	node := newNode("not-enough-disk", nil)
+	node.Status.Conditions = []v1.NodeCondition{{Type: v1.NodeOutOfDisk, Status: v1.ConditionTrue}}
+	manager.nodeStore.Add(node)
+	ds := newDaemonSet("foo")
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 0, 0)
+}
+
+func resourcePodSpec(nodeName, memory, cpu string) v1.PodSpec {
+	return v1.PodSpec{
+		NodeName: nodeName,
+		Containers: []v1.Container{{
+			Resources: v1.ResourceRequirements{
+				Requests: allocatableResources(memory, cpu),
+			},
+		}},
+	}
+}
+
+func allocatableResources(memory, cpu string) v1.ResourceList {
+	return v1.ResourceList{
+		v1.ResourceMemory: resource.MustParse(memory),
+		v1.ResourceCPU:    resource.MustParse(cpu),
+		v1.ResourcePods:   resource.MustParse("100"),
+	}
+}
+
+// DaemonSets should not place onto nodes with insufficient free resource
+func TestInsufficentCapacityNodeDaemonDoesNotLaunchPod(t *testing.T) {
+	podSpec := resourcePodSpec("too-much-mem", "75M", "75m")
+	manager, podControl, _ := newTestController()
+	node := newNode("too-much-mem", nil)
+	node.Status.Allocatable = allocatableResources("100M", "200m")
+	manager.nodeStore.Add(node)
+	manager.podStore.Indexer.Add(&v1.Pod{
+		Spec: podSpec,
+	})
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec = podSpec
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 0, 0)
+}
+
+// DaemonSets should not unschedule a daemonset pod from a node with insufficient free resource
+func TestInsufficentCapacityNodeDaemonDoesNotUnscheduleRunningPod(t *testing.T) {
+	podSpec := resourcePodSpec("too-much-mem", "75M", "75m")
+	podSpec.NodeName = "too-much-mem"
+	manager, podControl, _ := newTestController()
+	node := newNode("too-much-mem", nil)
+	node.Status.Allocatable = allocatableResources("100M", "200m")
+	manager.nodeStore.Add(node)
+	manager.podStore.Indexer.Add(&v1.Pod{
+		Spec: podSpec,
+	})
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec = podSpec
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 0, 0)
+}
+
+func TestSufficentCapacityWithTerminatedPodsDaemonLaunchesPod(t *testing.T) {
+	podSpec := resourcePodSpec("too-much-mem", "75M", "75m")
+	manager, podControl, _ := newTestController()
+	node := newNode("too-much-mem", nil)
+	node.Status.Allocatable = allocatableResources("100M", "200m")
+	manager.nodeStore.Add(node)
+	manager.podStore.Indexer.Add(&v1.Pod{
+		Spec:   podSpec,
+		Status: v1.PodStatus{Phase: v1.PodSucceeded},
+	})
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec = podSpec
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 1, 0)
+}
+
+// DaemonSets should place onto nodes with sufficient free resource
+func TestSufficentCapacityNodeDaemonLaunchesPod(t *testing.T) {
+	podSpec := resourcePodSpec("not-too-much-mem", "75M", "75m")
+	manager, podControl, _ := newTestController()
+	node := newNode("not-too-much-mem", nil)
+	node.Status.Allocatable = allocatableResources("200M", "200m")
+	manager.nodeStore.Add(node)
+	manager.podStore.Indexer.Add(&v1.Pod{
+		Spec: podSpec,
+	})
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec = podSpec
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 1, 0)
+}
+
+// DaemonSets not take any actions when being deleted
+func TestDontDoAnythingIfBeingDeleted(t *testing.T) {
+	podSpec := resourcePodSpec("not-too-much-mem", "75M", "75m")
+	manager, podControl, _ := newTestController()
+	node := newNode("not-too-much-mem", nil)
+	node.Status.Allocatable = allocatableResources("200M", "200m")
+	manager.nodeStore.Add(node)
+	manager.podStore.Indexer.Add(&v1.Pod{
+		Spec: podSpec,
+	})
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec = podSpec
+	now := metav1.Now()
+	ds.DeletionTimestamp = &now
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 0, 0)
+}
+
+// DaemonSets should not place onto nodes that would cause port conflicts
+func TestPortConflictNodeDaemonDoesNotLaunchPod(t *testing.T) {
+	podSpec := v1.PodSpec{
+		NodeName: "port-conflict",
+		Containers: []v1.Container{{
+			Ports: []v1.ContainerPort{{
+				HostPort: 666,
+			}},
+		}},
+	}
+	manager, podControl, _ := newTestController()
+	node := newNode("port-conflict", nil)
+	manager.nodeStore.Add(node)
+	manager.podStore.Indexer.Add(&v1.Pod{
+		Spec: podSpec,
+	})
+
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec = podSpec
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 0, 0)
+}
+
+// Test that if the node is already scheduled with a pod using a host port
+// but belonging to the same daemonset, we don't delete that pod
+//
+// Issue: https://github.com/kubernetes/kubernetes/issues/22309
+func TestPortConflictWithSameDaemonPodDoesNotDeletePod(t *testing.T) {
+	podSpec := v1.PodSpec{
+		NodeName: "port-conflict",
+		Containers: []v1.Container{{
+			Ports: []v1.ContainerPort{{
+				HostPort: 666,
+			}},
+		}},
+	}
+	manager, podControl, _ := newTestController()
+	node := newNode("port-conflict", nil)
+	manager.nodeStore.Add(node)
+	manager.podStore.Indexer.Add(&v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Labels:    simpleDaemonSetLabel,
+			Namespace: v1.NamespaceDefault,
+		},
+		Spec: podSpec,
+	})
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec = podSpec
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 0, 0)
+}
+
+// DaemonSets should place onto nodes that would not cause port conflicts
+func TestNoPortConflictNodeDaemonLaunchesPod(t *testing.T) {
+	podSpec1 := v1.PodSpec{
+		NodeName: "no-port-conflict",
+		Containers: []v1.Container{{
+			Ports: []v1.ContainerPort{{
+				HostPort: 6661,
+			}},
+		}},
+	}
+	podSpec2 := v1.PodSpec{
+		NodeName: "no-port-conflict",
+		Containers: []v1.Container{{
+			Ports: []v1.ContainerPort{{
+				HostPort: 6662,
+			}},
+		}},
+	}
+	manager, podControl, _ := newTestController()
+	node := newNode("no-port-conflict", nil)
+	manager.nodeStore.Add(node)
+	manager.podStore.Indexer.Add(&v1.Pod{
+		Spec: podSpec1,
+	})
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec = podSpec2
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 1, 0)
+}
+
+// DaemonSetController should not sync DaemonSets with empty pod selectors.
+//
+// issue https://github.com/kubernetes/kubernetes/pull/23223
+func TestPodIsNotDeletedByDaemonsetWithEmptyLabelSelector(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	manager.nodeStore.Store.Add(newNode("node1", nil))
+	// Create pod not controlled by a daemonset.
+	manager.podStore.Indexer.Add(&v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Labels:    map[string]string{"bang": "boom"},
+			Namespace: v1.NamespaceDefault,
+		},
+		Spec: v1.PodSpec{
+			NodeName: "node1",
+		},
+	})
+
+	// Create a misconfigured DaemonSet. An empty pod selector is invalid but could happen
+	// if we upgrade and make a backwards incompatible change.
+	//
+	// The node selector matches no nodes which mimics the behavior of kubectl delete.
+	//
+	// The DaemonSet should not schedule pods and should not delete scheduled pods in
+	// this case even though it's empty pod selector matches all pods. The DaemonSetController
+	// should detect this misconfiguration and choose not to sync the DaemonSet. We should
+	// not observe a deletion of the pod on node1.
+	ds := newDaemonSet("foo")
+	ls := metav1.LabelSelector{}
+	ds.Spec.Selector = &ls
+	ds.Spec.Template.Spec.NodeSelector = map[string]string{"foo": "bar"}
+	manager.dsStore.Add(ds)
+
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 0, 0)
+}
+
+// Controller should not create pods on nodes which have daemon pods, and should remove excess pods from nodes that have extra pods.
+func TestDealsWithExistingPods(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	addNodes(manager.nodeStore.Store, 0, 5, nil)
+	addPods(manager.podStore.Indexer, "node-1", simpleDaemonSetLabel, 1)
+	addPods(manager.podStore.Indexer, "node-2", simpleDaemonSetLabel, 2)
+	addPods(manager.podStore.Indexer, "node-3", simpleDaemonSetLabel, 5)
+	addPods(manager.podStore.Indexer, "node-4", simpleDaemonSetLabel2, 2)
+	ds := newDaemonSet("foo")
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 2, 5)
+}
+
+// Daemon with node selector should launch pods on nodes matching selector.
+func TestSelectorDaemonLaunchesPods(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	addNodes(manager.nodeStore.Store, 0, 4, nil)
+	addNodes(manager.nodeStore.Store, 4, 3, simpleNodeLabel)
+	daemon := newDaemonSet("foo")
+	daemon.Spec.Template.Spec.NodeSelector = simpleNodeLabel
+	manager.dsStore.Add(daemon)
+	syncAndValidateDaemonSets(t, manager, daemon, podControl, 3, 0)
+}
+
+// Daemon with node selector should delete pods from nodes that do not satisfy selector.
+func TestSelectorDaemonDeletesUnselectedPods(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	addNodes(manager.nodeStore.Store, 0, 5, nil)
+	addNodes(manager.nodeStore.Store, 5, 5, simpleNodeLabel)
+	addPods(manager.podStore.Indexer, "node-0", simpleDaemonSetLabel2, 2)
+	addPods(manager.podStore.Indexer, "node-1", simpleDaemonSetLabel, 3)
+	addPods(manager.podStore.Indexer, "node-1", simpleDaemonSetLabel2, 1)
+	addPods(manager.podStore.Indexer, "node-4", simpleDaemonSetLabel, 1)
+	daemon := newDaemonSet("foo")
+	daemon.Spec.Template.Spec.NodeSelector = simpleNodeLabel
+	manager.dsStore.Add(daemon)
+	syncAndValidateDaemonSets(t, manager, daemon, podControl, 5, 4)
+}
+
+// DaemonSet with node selector should launch pods on nodes matching selector, but also deal with existing pods on nodes.
+func TestSelectorDaemonDealsWithExistingPods(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	addNodes(manager.nodeStore.Store, 0, 5, nil)
+	addNodes(manager.nodeStore.Store, 5, 5, simpleNodeLabel)
+	addPods(manager.podStore.Indexer, "node-0", simpleDaemonSetLabel, 1)
+	addPods(manager.podStore.Indexer, "node-1", simpleDaemonSetLabel, 3)
+	addPods(manager.podStore.Indexer, "node-1", simpleDaemonSetLabel2, 2)
+	addPods(manager.podStore.Indexer, "node-2", simpleDaemonSetLabel, 4)
+	addPods(manager.podStore.Indexer, "node-6", simpleDaemonSetLabel, 13)
+	addPods(manager.podStore.Indexer, "node-7", simpleDaemonSetLabel2, 4)
+	addPods(manager.podStore.Indexer, "node-9", simpleDaemonSetLabel, 1)
+	addPods(manager.podStore.Indexer, "node-9", simpleDaemonSetLabel2, 1)
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec.NodeSelector = simpleNodeLabel
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 3, 20)
+}
+
+// DaemonSet with node selector which does not match any node labels should not launch pods.
+func TestBadSelectorDaemonDoesNothing(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	addNodes(manager.nodeStore.Store, 0, 4, nil)
+	addNodes(manager.nodeStore.Store, 4, 3, simpleNodeLabel)
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec.NodeSelector = simpleNodeLabel2
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 0, 0)
+}
+
+// DaemonSet with node name should launch pod on node with corresponding name.
+func TestNameDaemonSetLaunchesPods(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	addNodes(manager.nodeStore.Store, 0, 5, nil)
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec.NodeName = "node-0"
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 1, 0)
+}
+
+// DaemonSet with node name that does not exist should not launch pods.
+func TestBadNameDaemonSetDoesNothing(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	addNodes(manager.nodeStore.Store, 0, 5, nil)
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec.NodeName = "node-10"
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 0, 0)
+}
+
+// DaemonSet with node selector, and node name, matching a node, should launch a pod on the node.
+func TestNameAndSelectorDaemonSetLaunchesPods(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	addNodes(manager.nodeStore.Store, 0, 4, nil)
+	addNodes(manager.nodeStore.Store, 4, 3, simpleNodeLabel)
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec.NodeSelector = simpleNodeLabel
+	ds.Spec.Template.Spec.NodeName = "node-6"
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 1, 0)
+}
+
+// DaemonSet with node selector that matches some nodes, and node name that matches a different node, should do nothing.
+func TestInconsistentNameSelectorDaemonSetDoesNothing(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	addNodes(manager.nodeStore.Store, 0, 4, nil)
+	addNodes(manager.nodeStore.Store, 4, 3, simpleNodeLabel)
+	ds := newDaemonSet("foo")
+	ds.Spec.Template.Spec.NodeSelector = simpleNodeLabel
+	ds.Spec.Template.Spec.NodeName = "node-0"
+	manager.dsStore.Add(ds)
+	syncAndValidateDaemonSets(t, manager, ds, podControl, 0, 0)
+}
+
+// Daemon with node affinity should launch pods on nodes matching affinity.
+func TestNodeAffinityDaemonLaunchesPods(t *testing.T) {
+	manager, podControl, _ := newTestController()
+	addNodes(manager.nodeStore.Store, 0, 4, nil)
+	addNodes(manager.nodeStore.Store, 4, 3, simpleNodeLabel)
+	daemon := newDaemonSet("foo")
+	daemon.Spec.Template.Spec.Affinity = &v1.Affinity{
+		NodeAffinity: &v1.NodeAffinity{
+			RequiredDuringSchedulingIgnoredDuringExecution: &v1.NodeSelector{
+				NodeSelectorTerms: []v1.NodeSelectorTerm{
+					{
+						MatchExpressions: []v1.NodeSelectorRequirement{
+							{
+								Key:      "color",
+								Operator: v1.NodeSelectorOpIn,
+								Values:   []string{simpleNodeLabel["color"]},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	manager.dsStore.Add(daemon)
+	syncAndValidateDaemonSets(t, manager, daemon, podControl, 3, 0)
+}
+
+func TestNumberReadyStatus(t *testing.T) {
+	daemon := newDaemonSet("foo")
+	manager, podControl, clientset := newTestController()
+	var updated *extensions.DaemonSet
+	clientset.PrependReactor("update", "daemonsets", func(action core.Action) (handled bool, ret runtime.Object, err error) {
+		if action.GetSubresource() != "status" {
+			return false, nil, nil
+		}
+		if u, ok := action.(core.UpdateAction); ok {
+			updated = u.GetObject().(*extensions.DaemonSet)
+		}
+		return false, nil, nil
+	})
+	addNodes(manager.nodeStore.Store, 0, 2, simpleNodeLabel)
+	addPods(manager.podStore.Indexer, "node-0", simpleDaemonSetLabel, 1)
+	addPods(manager.podStore.Indexer, "node-1", simpleDaemonSetLabel, 1)
+	manager.dsStore.Add(daemon)
+
+	syncAndValidateDaemonSets(t, manager, daemon, podControl, 0, 0)
+	if updated.Status.NumberReady != 0 {
+		t.Errorf("Wrong daemon %s status: %v", updated.Name, updated.Status)
+	}
+
+	selector, _ := metav1.LabelSelectorAsSelector(daemon.Spec.Selector)
+	daemonPods, _ := manager.podStore.Pods(daemon.Namespace).List(selector)
+	for _, pod := range daemonPods {
+		condition := v1.PodCondition{Type: v1.PodReady, Status: v1.ConditionTrue}
+		pod.Status.Conditions = append(pod.Status.Conditions, condition)
+	}
+
+	syncAndValidateDaemonSets(t, manager, daemon, podControl, 0, 0)
+	if updated.Status.NumberReady != 2 {
+		t.Errorf("Wrong daemon %s status: %v", updated.Name, updated.Status)
+	}
+}
+
+func TestObservedGeneration(t *testing.T) {
+	daemon := newDaemonSet("foo")
+	daemon.Generation = 1
+	manager, podControl, clientset := newTestController()
+	var updated *extensions.DaemonSet
+	clientset.PrependReactor("update", "daemonsets", func(action core.Action) (handled bool, ret runtime.Object, err error) {
+		if action.GetSubresource() != "status" {
+			return false, nil, nil
+		}
+		if u, ok := action.(core.UpdateAction); ok {
+			updated = u.GetObject().(*extensions.DaemonSet)
+		}
+		return false, nil, nil
+	})
+
+	addNodes(manager.nodeStore.Store, 0, 1, simpleNodeLabel)
+	addPods(manager.podStore.Indexer, "node-0", simpleDaemonSetLabel, 1)
+	manager.dsStore.Add(daemon)
+
+	syncAndValidateDaemonSets(t, manager, daemon, podControl, 0, 0)
+	if updated.Status.ObservedGeneration != daemon.Generation {
+		t.Errorf("Wrong ObservedGeneration for daemon %s in status. Expected %d, got %d", updated.Name, daemon.Generation, updated.Status.ObservedGeneration)
+	}
+}
+
+func TestNodeShouldRunDaemonPod(t *testing.T) {
+	cases := []struct {
+		podsOnNode                                       []*v1.Pod
+		ds                                               *extensions.DaemonSet
+		wantToRun, shouldSchedule, shouldContinueRunning bool
+		err                                              error
+	}{
+		{
+			ds: &extensions.DaemonSet{
+				Spec: extensions.DaemonSetSpec{
+					Selector: &metav1.LabelSelector{MatchLabels: simpleDaemonSetLabel},
+					Template: v1.PodTemplateSpec{
+						ObjectMeta: v1.ObjectMeta{
+							Labels: simpleDaemonSetLabel,
+						},
+						Spec: resourcePodSpec("", "50M", "0.5"),
+					},
+				},
+			},
+			wantToRun:             true,
+			shouldSchedule:        true,
+			shouldContinueRunning: true,
+		},
+		{
+			ds: &extensions.DaemonSet{
+				Spec: extensions.DaemonSetSpec{
+					Selector: &metav1.LabelSelector{MatchLabels: simpleDaemonSetLabel},
+					Template: v1.PodTemplateSpec{
+						ObjectMeta: v1.ObjectMeta{
+							Labels: simpleDaemonSetLabel,
+						},
+						Spec: resourcePodSpec("", "200M", "0.5"),
+					},
+				},
+			},
+			wantToRun:             true,
+			shouldSchedule:        false,
+			shouldContinueRunning: true,
+		},
+		{
+			ds: &extensions.DaemonSet{
+				Spec: extensions.DaemonSetSpec{
+					Selector: &metav1.LabelSelector{MatchLabels: simpleDaemonSetLabel},
+					Template: v1.PodTemplateSpec{
+						ObjectMeta: v1.ObjectMeta{
+							Labels: simpleDaemonSetLabel,
+						},
+						Spec: resourcePodSpec("other-node", "50M", "0.5"),
+					},
+				},
+			},
+			wantToRun:             false,
+			shouldSchedule:        false,
+			shouldContinueRunning: false,
+		},
+		{
+			podsOnNode: []*v1.Pod{
+				{
+					Spec: v1.PodSpec{
+						Containers: []v1.Container{{
+							Ports: []v1.ContainerPort{{
+								HostPort: 666,
+							}},
+						}},
+					},
+				},
+			},
+			ds: &extensions.DaemonSet{
+				Spec: extensions.DaemonSetSpec{
+					Selector: &metav1.LabelSelector{MatchLabels: simpleDaemonSetLabel},
+					Template: v1.PodTemplateSpec{
+						ObjectMeta: v1.ObjectMeta{
+							Labels: simpleDaemonSetLabel,
+						},
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{{
+								Ports: []v1.ContainerPort{{
+									HostPort: 666,
+								}},
+							}},
+						},
+					},
+				},
+			},
+			wantToRun:             false,
+			shouldSchedule:        false,
+			shouldContinueRunning: false,
+		},
+	}
+
+	for i, c := range cases {
+		node := newNode("test-node", nil)
+		node.Status.Allocatable = allocatableResources("100M", "1")
+		manager, _, _ := newTestController()
+		manager.nodeStore.Store.Add(node)
+		for _, p := range c.podsOnNode {
+			manager.podStore.Indexer.Add(p)
+			p.Spec.NodeName = "test-node"
+		}
+		wantToRun, shouldSchedule, shouldContinueRunning, err := manager.nodeShouldRunDaemonPod(node, c.ds)
+
+		if wantToRun != c.wantToRun {
+			t.Errorf("[%v] expected wantToRun: %v, got: %v", i, c.wantToRun, wantToRun)
+		}
+		if shouldSchedule != c.shouldSchedule {
+			t.Errorf("[%v] expected shouldSchedule: %v, got: %v", i, c.shouldSchedule, shouldSchedule)
+		}
+		if shouldContinueRunning != c.shouldContinueRunning {
+			t.Errorf("[%v] expected shouldContinueRunning: %v, got: %v", i, c.shouldContinueRunning, shouldContinueRunning)
+		}
+		if err != c.err {
+			t.Errorf("[%v] expected err: %v, got: %v", i, c.err, err)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/daemon/doc.go

@@ -0,0 +1,19 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package daemon contains logic for watching and synchronizing
+// daemons.
+package daemon // import "k8s.io/kubernetes/pkg/controller/daemon"

vendor/k8s.io/kubernetes/pkg/controller/deployment/BUILD

@@ -0,0 +1,90 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "deployment_controller.go",
+        "progress.go",
+        "recreate.go",
+        "rollback.go",
+        "rolling.go",
+        "sync.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/extensions/v1beta1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/core/v1:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/deployment/util:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/util/integer:go_default_library",
+        "//pkg/util/labels:go_default_library",
+        "//pkg/util/metrics:go_default_library",
+        "//pkg/util/workqueue:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/api/errors",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/labels",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/util/errors",
+        "//vendor:k8s.io/apimachinery/pkg/util/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "deployment_controller_test.go",
+        "recreate_test.go",
+        "rolling_test.go",
+        "sync_test.go",
+    ],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/extensions/v1beta1:go_default_library",
+        "//pkg/client/clientset_generated/clientset/fake:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/client/testing/core:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/deployment/util:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/util/intstr:go_default_library",
+        "//pkg/util/uuid:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//pkg/controller/deployment/util:all-srcs",
+    ],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/deployment/OWNERS

@@ -0,0 +1,5 @@
+reviewers:
+- janetkuo
+- nikhiljindal
+- kargakis
+- mfojtik

vendor/k8s.io/kubernetes/pkg/controller/deployment/deployment_controller.go

@@ -0,0 +1,769 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package deployment contains all the logic for handling Kubernetes Deployments.
+// It implements a set of strategies (rolling, recreate) for deploying an application,
+// the means to rollback to previous versions, proportional scaling for mitigating
+// risk, cleanup policy, and other useful features of Deployments.
+package deployment
+
+import (
+	"fmt"
+	"reflect"
+	"sort"
+	"time"
+
+	"github.com/golang/glog"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	v1core "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/core/v1"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/controller/deployment/util"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/util/metrics"
+	"k8s.io/kubernetes/pkg/util/workqueue"
+)
+
+const (
+	// FullDeploymentResyncPeriod means we'll attempt to recompute the required replicas
+	// of all deployments.
+	// This recomputation happens based on contents in the local caches.
+	FullDeploymentResyncPeriod = 30 * time.Second
+	// We must avoid creating new replica set / counting pods until the replica set / pods store has synced.
+	// If it hasn't synced, to avoid a hot loop, we'll wait this long between checks.
+	StoreSyncedPollPeriod = 100 * time.Millisecond
+	// MaxRetries is the number of times a deployment will be retried before it is dropped out of the queue.
+	MaxRetries = 5
+)
+
+func getDeploymentKind() schema.GroupVersionKind {
+	return extensions.SchemeGroupVersion.WithKind("Deployment")
+}
+
+// DeploymentController is responsible for synchronizing Deployment objects stored
+// in the system with actual running replica sets and pods.
+type DeploymentController struct {
+	rsControl     controller.RSControlInterface
+	client        clientset.Interface
+	eventRecorder record.EventRecorder
+
+	// To allow injection of syncDeployment for testing.
+	syncHandler func(dKey string) error
+	// used for unit testing
+	enqueueDeployment func(deployment *extensions.Deployment)
+
+	// A store of deployments, populated by the dController
+	dLister *cache.StoreToDeploymentLister
+	// A store of ReplicaSets, populated by the rsController
+	rsLister *cache.StoreToReplicaSetLister
+	// A store of pods, populated by the podController
+	podLister *cache.StoreToPodLister
+
+	// dListerSynced returns true if the Deployment store has been synced at least once.
+	// Added as a member to the struct to allow injection for testing.
+	dListerSynced cache.InformerSynced
+	// rsListerSynced returns true if the ReplicaSet store has been synced at least once.
+	// Added as a member to the struct to allow injection for testing.
+	rsListerSynced cache.InformerSynced
+	// podListerSynced returns true if the pod store has been synced at least once.
+	// Added as a member to the struct to allow injection for testing.
+	podListerSynced cache.InformerSynced
+
+	// Deployments that need to be synced
+	queue workqueue.RateLimitingInterface
+	// Deployments that need to be checked for progress.
+	progressQueue workqueue.RateLimitingInterface
+}
+
+// NewDeploymentController creates a new DeploymentController.
+func NewDeploymentController(dInformer informers.DeploymentInformer, rsInformer informers.ReplicaSetInformer, podInformer informers.PodInformer, client clientset.Interface) *DeploymentController {
+	eventBroadcaster := record.NewBroadcaster()
+	eventBroadcaster.StartLogging(glog.Infof)
+	// TODO: remove the wrapper when every clients have moved to use the clientset.
+	eventBroadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: client.Core().Events("")})
+
+	if client != nil && client.Core().RESTClient().GetRateLimiter() != nil {
+		metrics.RegisterMetricAndTrackRateLimiterUsage("deployment_controller", client.Core().RESTClient().GetRateLimiter())
+	}
+	dc := &DeploymentController{
+		client:        client,
+		eventRecorder: eventBroadcaster.NewRecorder(v1.EventSource{Component: "deployment-controller"}),
+		queue:         workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "deployment"),
+		progressQueue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "progress-check"),
+	}
+	dc.rsControl = controller.RealRSControl{
+		KubeClient: client,
+		Recorder:   dc.eventRecorder,
+	}
+
+	dInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    dc.addDeployment,
+		UpdateFunc: dc.updateDeployment,
+		// This will enter the sync loop and no-op, because the deployment has been deleted from the store.
+		DeleteFunc: dc.deleteDeployment,
+	})
+	rsInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    dc.addReplicaSet,
+		UpdateFunc: dc.updateReplicaSet,
+		DeleteFunc: dc.deleteReplicaSet,
+	})
+	podInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		DeleteFunc: dc.deletePod,
+	})
+
+	dc.syncHandler = dc.syncDeployment
+	dc.enqueueDeployment = dc.enqueue
+
+	dc.dLister = dInformer.Lister()
+	dc.rsLister = rsInformer.Lister()
+	dc.podLister = podInformer.Lister()
+	dc.dListerSynced = dInformer.Informer().HasSynced
+	dc.rsListerSynced = dInformer.Informer().HasSynced
+	dc.podListerSynced = dInformer.Informer().HasSynced
+	return dc
+}
+
+// Run begins watching and syncing.
+func (dc *DeploymentController) Run(workers int, stopCh <-chan struct{}) {
+	defer utilruntime.HandleCrash()
+	defer dc.queue.ShutDown()
+	defer dc.progressQueue.ShutDown()
+
+	glog.Infof("Starting deployment controller")
+
+	if !cache.WaitForCacheSync(stopCh, dc.dListerSynced, dc.rsListerSynced, dc.podListerSynced) {
+		return
+	}
+
+	for i := 0; i < workers; i++ {
+		go wait.Until(dc.worker, time.Second, stopCh)
+	}
+	go wait.Until(dc.progressWorker, time.Second, stopCh)
+
+	<-stopCh
+	glog.Infof("Shutting down deployment controller")
+}
+
+func (dc *DeploymentController) addDeployment(obj interface{}) {
+	d := obj.(*extensions.Deployment)
+	glog.V(4).Infof("Adding deployment %s", d.Name)
+	dc.enqueueDeployment(d)
+}
+
+func (dc *DeploymentController) updateDeployment(old, cur interface{}) {
+	oldD := old.(*extensions.Deployment)
+	curD := cur.(*extensions.Deployment)
+	glog.V(4).Infof("Updating deployment %s", oldD.Name)
+	dc.enqueueDeployment(curD)
+	// If the selector of the current deployment just changed, we need to requeue any old
+	// overlapping deployments. If the new selector steps on another deployment, the current
+	// deployment will get denied during the resync loop.
+	if !reflect.DeepEqual(curD.Spec.Selector, oldD.Spec.Selector) {
+		deployments, err := dc.dLister.Deployments(curD.Namespace).List(labels.Everything())
+		if err != nil {
+			utilruntime.HandleError(fmt.Errorf("error listing deployments in namespace %s: %v", curD.Namespace, err))
+			return
+		}
+		// Trigger cleanup of any old overlapping deployments; we don't care about any error
+		// returned here.
+		for i := range deployments {
+			otherD := deployments[i]
+
+			oldOverlaps, oldErr := util.OverlapsWith(oldD, otherD)
+			curOverlaps, curErr := util.OverlapsWith(curD, otherD)
+			// Enqueue otherD so it gets cleaned up
+			if oldErr == nil && curErr == nil && oldOverlaps && !curOverlaps {
+				dc.enqueueDeployment(otherD)
+			}
+		}
+	}
+}
+
+func (dc *DeploymentController) deleteDeployment(obj interface{}) {
+	d, ok := obj.(*extensions.Deployment)
+	if !ok {
+		tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+		if !ok {
+			utilruntime.HandleError(fmt.Errorf("Couldn't get object from tombstone %#v", obj))
+			return
+		}
+		d, ok = tombstone.Obj.(*extensions.Deployment)
+		if !ok {
+			utilruntime.HandleError(fmt.Errorf("Tombstone contained object that is not a Deployment %#v", obj))
+			return
+		}
+	}
+	glog.V(4).Infof("Deleting deployment %s", d.Name)
+	dc.enqueueDeployment(d)
+	deployments, err := dc.dLister.Deployments(d.Namespace).List(labels.Everything())
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("error listing deployments in namespace %s: %v", d.Namespace, err))
+		return
+	}
+	// Trigger cleanup of any old overlapping deployments; we don't care about any error
+	// returned here.
+	for i := range deployments {
+		otherD := deployments[i]
+
+		overlaps, err := util.OverlapsWith(d, otherD)
+		// Enqueue otherD so it gets cleaned up
+		if err == nil && overlaps {
+			dc.enqueueDeployment(otherD)
+		}
+	}
+}
+
+// addReplicaSet enqueues the deployment that manages a ReplicaSet when the ReplicaSet is created.
+func (dc *DeploymentController) addReplicaSet(obj interface{}) {
+	rs := obj.(*extensions.ReplicaSet)
+	glog.V(4).Infof("ReplicaSet %s added.", rs.Name)
+	if d := dc.getDeploymentForReplicaSet(rs); d != nil {
+		dc.enqueueDeployment(d)
+	}
+}
+
+// getDeploymentForReplicaSet returns the deployment managing the given ReplicaSet.
+func (dc *DeploymentController) getDeploymentForReplicaSet(rs *extensions.ReplicaSet) *extensions.Deployment {
+	deployments, err := dc.dLister.GetDeploymentsForReplicaSet(rs)
+	if err != nil || len(deployments) == 0 {
+		glog.V(4).Infof("Error: %v. No deployment found for ReplicaSet %v, deployment controller will avoid syncing.", err, rs.Name)
+		return nil
+	}
+	// Because all ReplicaSet's belonging to a deployment should have a unique label key,
+	// there should never be more than one deployment returned by the above method.
+	// If that happens we should probably dynamically repair the situation by ultimately
+	// trying to clean up one of the controllers, for now we just return the older one
+	if len(deployments) > 1 {
+		sort.Sort(util.BySelectorLastUpdateTime(deployments))
+		glog.V(4).Infof("user error! more than one deployment is selecting replica set %s/%s with labels: %#v, returning %s/%s",
+			rs.Namespace, rs.Name, rs.Labels, deployments[0].Namespace, deployments[0].Name)
+	}
+	return deployments[0]
+}
+
+// updateReplicaSet figures out what deployment(s) manage a ReplicaSet when the ReplicaSet
+// is updated and wake them up. If the anything of the ReplicaSets have changed, we need to
+// awaken both the old and new deployments. old and cur must be *extensions.ReplicaSet
+// types.
+func (dc *DeploymentController) updateReplicaSet(old, cur interface{}) {
+	curRS := cur.(*extensions.ReplicaSet)
+	oldRS := old.(*extensions.ReplicaSet)
+	if curRS.ResourceVersion == oldRS.ResourceVersion {
+		// Periodic resync will send update events for all known replica sets.
+		// Two different versions of the same replica set will always have different RVs.
+		return
+	}
+	// TODO: Write a unittest for this case
+	glog.V(4).Infof("ReplicaSet %s updated.", curRS.Name)
+	if d := dc.getDeploymentForReplicaSet(curRS); d != nil {
+		dc.enqueueDeployment(d)
+	}
+	// A number of things could affect the old deployment: labels changing,
+	// pod template changing, etc.
+	if !api.Semantic.DeepEqual(oldRS, curRS) {
+		if oldD := dc.getDeploymentForReplicaSet(oldRS); oldD != nil {
+			dc.enqueueDeployment(oldD)
+		}
+	}
+}
+
+// deleteReplicaSet enqueues the deployment that manages a ReplicaSet when
+// the ReplicaSet is deleted. obj could be an *extensions.ReplicaSet, or
+// a DeletionFinalStateUnknown marker item.
+func (dc *DeploymentController) deleteReplicaSet(obj interface{}) {
+	rs, ok := obj.(*extensions.ReplicaSet)
+
+	// When a delete is dropped, the relist will notice a pod in the store not
+	// in the list, leading to the insertion of a tombstone object which contains
+	// the deleted key/value. Note that this value might be stale. If the ReplicaSet
+	// changed labels the new deployment will not be woken up till the periodic resync.
+	if !ok {
+		tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+		if !ok {
+			utilruntime.HandleError(fmt.Errorf("Couldn't get object from tombstone %#v, could take up to %v before a deployment recreates/updates replicasets", obj, FullDeploymentResyncPeriod))
+			return
+		}
+		rs, ok = tombstone.Obj.(*extensions.ReplicaSet)
+		if !ok {
+			utilruntime.HandleError(fmt.Errorf("Tombstone contained object that is not a ReplicaSet %#v, could take up to %v before a deployment recreates/updates replicasets", obj, FullDeploymentResyncPeriod))
+			return
+		}
+	}
+	glog.V(4).Infof("ReplicaSet %s deleted.", rs.Name)
+	if d := dc.getDeploymentForReplicaSet(rs); d != nil {
+		dc.enqueueDeployment(d)
+	}
+}
+
+// deletePod will enqueue a Recreate Deployment once all of its pods have stopped running.
+func (dc *DeploymentController) deletePod(obj interface{}) {
+	pod, ok := obj.(*v1.Pod)
+
+	// When a delete is dropped, the relist will notice a pod in the store not
+	// in the list, leading to the insertion of a tombstone object which contains
+	// the deleted key/value. Note that this value might be stale. If the Pod
+	// changed labels the new deployment will not be woken up till the periodic resync.
+	if !ok {
+		tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+		if !ok {
+			utilruntime.HandleError(fmt.Errorf("Couldn't get object from tombstone %#v, could take up to %v before a deployment recreates/updates pod", obj, FullDeploymentResyncPeriod))
+			return
+		}
+		pod, ok = tombstone.Obj.(*v1.Pod)
+		if !ok {
+			utilruntime.HandleError(fmt.Errorf("Tombstone contained object that is not a pod %#v, could take up to %v before a deployment recreates/updates pods", obj, FullDeploymentResyncPeriod))
+			return
+		}
+	}
+	if d := dc.getDeploymentForPod(pod); d != nil && d.Spec.Strategy.Type == extensions.RecreateDeploymentStrategyType {
+		podList, err := dc.listPods(d)
+		if err == nil && len(podList.Items) == 0 {
+			dc.enqueueDeployment(d)
+		}
+	}
+}
+
+func (dc *DeploymentController) enqueue(deployment *extensions.Deployment) {
+	key, err := controller.KeyFunc(deployment)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("Couldn't get key for object %#v: %v", deployment, err))
+		return
+	}
+
+	dc.queue.Add(key)
+}
+
+// checkProgressAfter will enqueue a deployment after the provided amount of time in a secondary queue.
+// Once the deployment is popped out of the secondary queue, it is checked for progress and requeued
+// back to the main queue iff it has failed progressing.
+func (dc *DeploymentController) checkProgressAfter(deployment *extensions.Deployment, after time.Duration) {
+	key, err := controller.KeyFunc(deployment)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("Couldn't get key for object %#v: %v", deployment, err))
+		return
+	}
+
+	dc.progressQueue.AddAfter(key, after)
+}
+
+// getDeploymentForPod returns the deployment managing the given Pod.
+func (dc *DeploymentController) getDeploymentForPod(pod *v1.Pod) *extensions.Deployment {
+	// Find the owning replica set
+	var rs *extensions.ReplicaSet
+	var err error
+	// Look at the owner reference
+	controllerRef := controller.GetControllerOf(&pod.ObjectMeta)
+	if controllerRef != nil {
+		// Not a pod owned by a replica set.
+		if controllerRef.Kind != extensions.SchemeGroupVersion.WithKind("ReplicaSet").Kind {
+			return nil
+		}
+		rs, err = dc.rsLister.ReplicaSets(pod.Namespace).Get(controllerRef.Name)
+		if err != nil {
+			glog.V(4).Infof("Cannot get replicaset %q for pod %q: %v", controllerRef.Name, pod.Name, err)
+			return nil
+		}
+	} else {
+		// Fallback to listing replica sets.
+		rss, err := dc.rsLister.GetPodReplicaSets(pod)
+		if err != nil {
+			glog.V(4).Infof("Cannot list replica sets for pod %q: %v", pod.Name, err)
+			return nil
+		}
+		// TODO: Handle multiple replica sets gracefully
+		// For now we return the oldest replica set.
+		if len(rss) > 1 {
+			utilruntime.HandleError(fmt.Errorf("more than one ReplicaSet is selecting pod %q with labels: %+v", pod.Name, pod.Labels))
+			sort.Sort(controller.ReplicaSetsByCreationTimestamp(rss))
+		}
+		rs = rss[0]
+	}
+
+	return dc.getDeploymentForReplicaSet(rs)
+}
+
+// worker runs a worker thread that just dequeues items, processes them, and marks them done.
+// It enforces that the syncHandler is never invoked concurrently with the same key.
+func (dc *DeploymentController) worker() {
+	for dc.processNextWorkItem() {
+	}
+}
+
+func (dc *DeploymentController) processNextWorkItem() bool {
+	key, quit := dc.queue.Get()
+	if quit {
+		return false
+	}
+	defer dc.queue.Done(key)
+
+	err := dc.syncHandler(key.(string))
+	dc.handleErr(err, key)
+
+	return true
+}
+
+func (dc *DeploymentController) handleErr(err error, key interface{}) {
+	if err == nil {
+		dc.queue.Forget(key)
+		return
+	}
+
+	if dc.queue.NumRequeues(key) < MaxRetries {
+		glog.V(2).Infof("Error syncing deployment %v: %v", key, err)
+		dc.queue.AddRateLimited(key)
+		return
+	}
+
+	utilruntime.HandleError(err)
+	glog.V(2).Infof("Dropping deployment %q out of the queue: %v", key, err)
+	dc.queue.Forget(key)
+}
+
+// classifyReplicaSets uses NewReplicaSetControllerRefManager to classify ReplicaSets
+// and adopts them if their labels match the Deployment but are missing the reference.
+// It also removes the controllerRef for ReplicaSets, whose labels no longer matches
+// the deployment.
+func (dc *DeploymentController) classifyReplicaSets(deployment *extensions.Deployment) error {
+	rsList, err := dc.rsLister.ReplicaSets(deployment.Namespace).List(labels.Everything())
+	if err != nil {
+		return err
+	}
+
+	deploymentSelector, err := metav1.LabelSelectorAsSelector(deployment.Spec.Selector)
+	if err != nil {
+		return fmt.Errorf("deployment %s/%s has invalid label selector: %v", deployment.Namespace, deployment.Name, err)
+	}
+	cm := controller.NewReplicaSetControllerRefManager(dc.rsControl, deployment.ObjectMeta, deploymentSelector, getDeploymentKind())
+	matchesAndControlled, matchesNeedsController, controlledDoesNotMatch := cm.Classify(rsList)
+	// Adopt replica sets only if this deployment is not going to be deleted.
+	if deployment.DeletionTimestamp == nil {
+		for _, replicaSet := range matchesNeedsController {
+			err := cm.AdoptReplicaSet(replicaSet)
+			// continue to next RS if adoption fails.
+			if err != nil {
+				// If the RS no longer exists, don't even log the error.
+				if !errors.IsNotFound(err) {
+					utilruntime.HandleError(err)
+				}
+			} else {
+				matchesAndControlled = append(matchesAndControlled, replicaSet)
+			}
+		}
+	}
+	// remove the controllerRef for the RS that no longer have matching labels
+	var errlist []error
+	for _, replicaSet := range controlledDoesNotMatch {
+		err := cm.ReleaseReplicaSet(replicaSet)
+		if err != nil {
+			errlist = append(errlist, err)
+		}
+	}
+	return utilerrors.NewAggregate(errlist)
+}
+
+// syncDeployment will sync the deployment with the given key.
+// This function is not meant to be invoked concurrently with the same key.
+func (dc *DeploymentController) syncDeployment(key string) error {
+	startTime := time.Now()
+	glog.V(4).Infof("Started syncing deployment %q (%v)", key, startTime)
+	defer func() {
+		glog.V(4).Infof("Finished syncing deployment %q (%v)", key, time.Now().Sub(startTime))
+	}()
+
+	obj, exists, err := dc.dLister.Indexer.GetByKey(key)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("Unable to retrieve deployment %v from store: %v", key, err))
+		return err
+	}
+	if !exists {
+		glog.Infof("Deployment has been deleted %v", key)
+		return nil
+	}
+
+	deployment := obj.(*extensions.Deployment)
+	// Deep-copy otherwise we are mutating our cache.
+	// TODO: Deep-copy only when needed.
+	d, err := util.DeploymentDeepCopy(deployment)
+	if err != nil {
+		return err
+	}
+
+	everything := metav1.LabelSelector{}
+	if reflect.DeepEqual(d.Spec.Selector, &everything) {
+		dc.eventRecorder.Eventf(d, v1.EventTypeWarning, "SelectingAll", "This deployment is selecting all pods. A non-empty selector is required.")
+		if d.Status.ObservedGeneration < d.Generation {
+			d.Status.ObservedGeneration = d.Generation
+			dc.client.Extensions().Deployments(d.Namespace).UpdateStatus(d)
+		}
+		return nil
+	}
+
+	deployments, err := dc.dLister.Deployments(d.Namespace).List(labels.Everything())
+	if err != nil {
+		return fmt.Errorf("error listing deployments in namespace %s: %v", d.Namespace, err)
+	}
+
+	// Handle overlapping deployments by deterministically avoid syncing deployments that fight over ReplicaSets.
+	overlaps, err := dc.handleOverlap(d, deployments)
+	if err != nil {
+		if overlaps {
+			// Emit an event and return a nil error for overlapping deployments so we won't resync them again.
+			dc.eventRecorder.Eventf(d, v1.EventTypeWarning, "SelectorOverlap", err.Error())
+			return nil
+		}
+		// For any other failure, we should retry the deployment.
+		return err
+	}
+
+	if d.DeletionTimestamp != nil {
+		return dc.syncStatusOnly(d)
+	}
+
+	err = dc.classifyReplicaSets(deployment)
+	if err != nil {
+		return err
+	}
+
+	// Update deployment conditions with an Unknown condition when pausing/resuming
+	// a deployment. In this way, we can be sure that we won't timeout when a user
+	// resumes a Deployment with a set progressDeadlineSeconds.
+	if err = dc.checkPausedConditions(d); err != nil {
+		return err
+	}
+
+	_, err = dc.hasFailed(d)
+	if err != nil {
+		return err
+	}
+	// TODO: Automatically rollback here if we failed above. Locate the last complete
+	// revision and populate the rollback spec with it.
+	// See https://github.com/kubernetes/kubernetes/issues/23211.
+
+	if d.Spec.Paused {
+		return dc.sync(d)
+	}
+
+	if d.Spec.RollbackTo != nil {
+		revision := d.Spec.RollbackTo.Revision
+		if d, err = dc.rollback(d, &revision); err != nil {
+			return err
+		}
+	}
+
+	scalingEvent, err := dc.isScalingEvent(d)
+	if err != nil {
+		return err
+	}
+	if scalingEvent {
+		return dc.sync(d)
+	}
+
+	switch d.Spec.Strategy.Type {
+	case extensions.RecreateDeploymentStrategyType:
+		return dc.rolloutRecreate(d)
+	case extensions.RollingUpdateDeploymentStrategyType:
+		return dc.rolloutRolling(d)
+	}
+	return fmt.Errorf("unexpected deployment strategy type: %s", d.Spec.Strategy.Type)
+}
+
+// handleOverlap will avoid syncing the newer overlapping ones (only sync the oldest one). New/old is
+// determined by when the deployment's selector is last updated.
+func (dc *DeploymentController) handleOverlap(d *extensions.Deployment, deployments []*extensions.Deployment) (bool, error) {
+	overlapping := false
+	var errs []error
+
+	for i := range deployments {
+		otherD := deployments[i]
+
+		if d.Name == otherD.Name {
+			continue
+		}
+
+		// Error is already checked during validation
+		foundOverlaps, _ := util.OverlapsWith(d, otherD)
+
+		// If the otherD deployment overlaps with the current we need to identify which one
+		// holds the set longer and mark the other as overlapping. Requeue the overlapping
+		// deployments if this one has been marked deleted, we only update its status as long
+		// as it is not actually deleted.
+		if foundOverlaps && d.DeletionTimestamp == nil {
+			overlapping = true
+			// Look at the overlapping annotation in both deployments. If one of them has it and points
+			// to the other one then we don't need to compare their timestamps.
+			otherOverlapsWith := otherD.Annotations[util.OverlapAnnotation]
+			currentOverlapsWith := d.Annotations[util.OverlapAnnotation]
+			// The other deployment is already marked as overlapping with the current one.
+			if otherOverlapsWith == d.Name {
+				var err error
+				if d, err = dc.clearDeploymentOverlap(d, otherD.Name); err != nil {
+					errs = append(errs, err)
+				}
+				continue
+			}
+
+			otherCopy, err := util.DeploymentDeepCopy(otherD)
+			if err != nil {
+				return false, err
+			}
+
+			// Skip syncing this one if older overlapping one is found.
+			if currentOverlapsWith == otherCopy.Name || util.SelectorUpdatedBefore(otherCopy, d) {
+				if _, err = dc.markDeploymentOverlap(d, otherCopy.Name); err != nil {
+					return false, err
+				}
+				if _, err = dc.clearDeploymentOverlap(otherCopy, d.Name); err != nil {
+					return false, err
+				}
+				return true, fmt.Errorf("deployment %s/%s has overlapping selector with an older deployment %s/%s, skip syncing it", d.Namespace, d.Name, otherCopy.Namespace, otherCopy.Name)
+			}
+
+			// TODO: We need to support annotations in deployments that overlap with multiple other
+			// deployments.
+			if _, err = dc.markDeploymentOverlap(otherCopy, d.Name); err != nil {
+				errs = append(errs, err)
+			}
+			// This is going to get some deployments into update hotlooping if we remove the overlapping
+			// annotation unconditionally.
+			//
+			// Scenario:
+			// --> Deployment foo with label selector A=A is created.
+			// --> Deployment bar with label selector A=A,B=B is created. Marked as overlapping since it
+			//     overlaps with foo.
+			// --> Deployment baz with label selector B=B is created. Marked as overlapping, since it
+			//     overlaps with bar, bar overlapping annotation is cleaned up. Next sync loop marks bar
+			//     as overlapping and it gets in an update hotloop.
+			if d, err = dc.clearDeploymentOverlap(d, otherCopy.Name); err != nil {
+				errs = append(errs, err)
+			}
+			continue
+		}
+
+		// If the otherD deployment does not overlap with the current deployment *anymore*
+		// we need to cleanup otherD from the overlapping annotation so it can be synced by
+		// the deployment controller.
+		dName, hasOverlappingAnnotation := otherD.Annotations[util.OverlapAnnotation]
+		if hasOverlappingAnnotation && dName == d.Name {
+			otherCopy, err := util.DeploymentDeepCopy(otherD)
+			if err != nil {
+				return false, err
+			}
+			if _, err = dc.clearDeploymentOverlap(otherCopy, d.Name); err != nil {
+				errs = append(errs, err)
+			}
+		}
+	}
+
+	if !overlapping {
+		var err error
+		if d, err = dc.clearDeploymentOverlap(d, ""); err != nil {
+			errs = append(errs, err)
+		}
+	}
+
+	return false, utilerrors.NewAggregate(errs)
+}
+
+func (dc *DeploymentController) markDeploymentOverlap(deployment *extensions.Deployment, withDeployment string) (*extensions.Deployment, error) {
+	if deployment.Annotations[util.OverlapAnnotation] == withDeployment && deployment.Status.ObservedGeneration >= deployment.Generation {
+		return deployment, nil
+	}
+	if deployment.Annotations == nil {
+		deployment.Annotations = make(map[string]string)
+	}
+	// Update observedGeneration for overlapping deployments so that their deletion won't be blocked.
+	deployment.Status.ObservedGeneration = deployment.Generation
+	deployment.Annotations[util.OverlapAnnotation] = withDeployment
+	return dc.client.Extensions().Deployments(deployment.Namespace).UpdateStatus(deployment)
+}
+
+func (dc *DeploymentController) clearDeploymentOverlap(deployment *extensions.Deployment, otherName string) (*extensions.Deployment, error) {
+	overlapsWith := deployment.Annotations[util.OverlapAnnotation]
+	if len(overlapsWith) == 0 {
+		return deployment, nil
+	}
+	// This is not the deployment found in the annotation - do not remove the annotation.
+	if len(otherName) > 0 && otherName != overlapsWith {
+		return deployment, nil
+	}
+	delete(deployment.Annotations, util.OverlapAnnotation)
+	return dc.client.Extensions().Deployments(deployment.Namespace).UpdateStatus(deployment)
+}
+
+// progressWorker runs a worker thread that pops items out of a secondary queue, checks if they
+// have failed progressing and if so it adds them back to the main queue.
+func (dc *DeploymentController) progressWorker() {
+	for dc.checkNextItemForProgress() {
+	}
+}
+
+// checkNextItemForProgress checks if a deployment has failed progressing and if so it adds it back
+// to the main queue.
+func (dc *DeploymentController) checkNextItemForProgress() bool {
+	key, quit := dc.progressQueue.Get()
+	if quit {
+		return false
+	}
+	defer dc.progressQueue.Done(key)
+
+	needsResync, err := dc.checkForProgress(key.(string))
+	if err != nil {
+		utilruntime.HandleError(err)
+	}
+	if err == nil && needsResync {
+		dc.queue.AddRateLimited(key)
+	}
+	dc.progressQueue.Forget(key)
+	return true
+}
+
+// checkForProgress checks the progress for the provided deployment. Meant to be called
+// by the progressWorker and work on items synced in a secondary queue.
+func (dc *DeploymentController) checkForProgress(key string) (bool, error) {
+	obj, exists, err := dc.dLister.Indexer.GetByKey(key)
+	if err != nil {
+		glog.V(2).Infof("Cannot retrieve deployment %q found in the secondary queue: %#v", key, err)
+		return false, err
+	}
+	if !exists {
+		return false, nil
+	}
+	deployment := obj.(*extensions.Deployment)
+	cond := util.GetDeploymentCondition(deployment.Status, extensions.DeploymentProgressing)
+	// Already marked with a terminal reason - no need to add it back to the main queue.
+	if cond != nil && (cond.Reason == util.TimedOutReason || cond.Reason == util.NewRSAvailableReason) {
+		return false, nil
+	}
+	// Deep-copy otherwise we may mutate our cache.
+	// TODO: Remove deep-copying from here. This worker does not need to sync the annotations
+	// in the deployment.
+	d, err := util.DeploymentDeepCopy(deployment)
+	if err != nil {
+		return false, err
+	}
+	return dc.hasFailed(d)
+}

vendor/k8s.io/kubernetes/pkg/controller/deployment/deployment_controller_test.go

@@ -0,0 +1,567 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deployment
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/fake"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/client/testing/core"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/controller/deployment/util"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/util/intstr"
+	"k8s.io/kubernetes/pkg/util/uuid"
+)
+
+var (
+	alwaysReady = func() bool { return true }
+	noTimestamp = metav1.Time{}
+)
+
+func rs(name string, replicas int, selector map[string]string, timestamp metav1.Time) *extensions.ReplicaSet {
+	return &extensions.ReplicaSet{
+		ObjectMeta: v1.ObjectMeta{
+			Name:              name,
+			CreationTimestamp: timestamp,
+			Namespace:         v1.NamespaceDefault,
+		},
+		Spec: extensions.ReplicaSetSpec{
+			Replicas: func() *int32 { i := int32(replicas); return &i }(),
+			Selector: &metav1.LabelSelector{MatchLabels: selector},
+			Template: v1.PodTemplateSpec{},
+		},
+	}
+}
+
+func newRSWithStatus(name string, specReplicas, statusReplicas int, selector map[string]string) *extensions.ReplicaSet {
+	rs := rs(name, specReplicas, selector, noTimestamp)
+	rs.Status = extensions.ReplicaSetStatus{
+		Replicas: int32(statusReplicas),
+	}
+	return rs
+}
+
+func newDeployment(name string, replicas int, revisionHistoryLimit *int32, maxSurge, maxUnavailable *intstr.IntOrString, selector map[string]string) *extensions.Deployment {
+	d := extensions.Deployment{
+		TypeMeta: metav1.TypeMeta{APIVersion: api.Registry.GroupOrDie(extensions.GroupName).GroupVersion.String()},
+		ObjectMeta: v1.ObjectMeta{
+			UID:         uuid.NewUUID(),
+			Name:        name,
+			Namespace:   v1.NamespaceDefault,
+			Annotations: make(map[string]string),
+		},
+		Spec: extensions.DeploymentSpec{
+			Strategy: extensions.DeploymentStrategy{
+				Type: extensions.RollingUpdateDeploymentStrategyType,
+				RollingUpdate: &extensions.RollingUpdateDeployment{
+					MaxUnavailable: func() *intstr.IntOrString { i := intstr.FromInt(0); return &i }(),
+					MaxSurge:       func() *intstr.IntOrString { i := intstr.FromInt(0); return &i }(),
+				},
+			},
+			Replicas: func() *int32 { i := int32(replicas); return &i }(),
+			Selector: &metav1.LabelSelector{MatchLabels: selector},
+			Template: v1.PodTemplateSpec{
+				ObjectMeta: v1.ObjectMeta{
+					Labels: selector,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{
+							Image: "foo/bar",
+						},
+					},
+				},
+			},
+			RevisionHistoryLimit: revisionHistoryLimit,
+		},
+	}
+	if maxSurge != nil {
+		d.Spec.Strategy.RollingUpdate.MaxSurge = maxSurge
+	}
+	if maxUnavailable != nil {
+		d.Spec.Strategy.RollingUpdate.MaxUnavailable = maxUnavailable
+	}
+	return &d
+}
+
+func newReplicaSet(d *extensions.Deployment, name string, replicas int) *extensions.ReplicaSet {
+	return &extensions.ReplicaSet{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      name,
+			Namespace: v1.NamespaceDefault,
+			Labels:    d.Spec.Selector.MatchLabels,
+		},
+		Spec: extensions.ReplicaSetSpec{
+			Selector: d.Spec.Selector,
+			Replicas: func() *int32 { i := int32(replicas); return &i }(),
+			Template: d.Spec.Template,
+		},
+	}
+}
+
+func getKey(d *extensions.Deployment, t *testing.T) string {
+	if key, err := controller.KeyFunc(d); err != nil {
+		t.Errorf("Unexpected error getting key for deployment %v: %v", d.Name, err)
+		return ""
+	} else {
+		return key
+	}
+}
+
+type fixture struct {
+	t *testing.T
+
+	client *fake.Clientset
+	// Objects to put in the store.
+	dLister   []*extensions.Deployment
+	rsLister  []*extensions.ReplicaSet
+	podLister []*v1.Pod
+
+	// Actions expected to happen on the client. Objects from here are also
+	// preloaded into NewSimpleFake.
+	actions []core.Action
+	objects []runtime.Object
+}
+
+func (f *fixture) expectUpdateDeploymentStatusAction(d *extensions.Deployment) {
+	action := core.NewUpdateAction(schema.GroupVersionResource{Resource: "deployments"}, d.Namespace, d)
+	action.Subresource = "status"
+	f.actions = append(f.actions, action)
+}
+
+func (f *fixture) expectCreateRSAction(rs *extensions.ReplicaSet) {
+	f.actions = append(f.actions, core.NewCreateAction(schema.GroupVersionResource{Resource: "replicasets"}, rs.Namespace, rs))
+}
+
+func newFixture(t *testing.T) *fixture {
+	f := &fixture{}
+	f.t = t
+	f.objects = []runtime.Object{}
+	return f
+}
+
+func (f *fixture) newController() (*DeploymentController, informers.SharedInformerFactory) {
+	f.client = fake.NewSimpleClientset(f.objects...)
+	informers := informers.NewSharedInformerFactory(f.client, nil, controller.NoResyncPeriodFunc())
+	c := NewDeploymentController(informers.Deployments(), informers.ReplicaSets(), informers.Pods(), f.client)
+	c.eventRecorder = &record.FakeRecorder{}
+	c.dListerSynced = alwaysReady
+	c.rsListerSynced = alwaysReady
+	c.podListerSynced = alwaysReady
+	for _, d := range f.dLister {
+		c.dLister.Indexer.Add(d)
+	}
+	for _, rs := range f.rsLister {
+		c.rsLister.Indexer.Add(rs)
+	}
+	for _, pod := range f.podLister {
+		c.podLister.Indexer.Add(pod)
+	}
+	return c, informers
+}
+
+func (f *fixture) run(deploymentName string) {
+	c, informers := f.newController()
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+	informers.Start(stopCh)
+
+	err := c.syncDeployment(deploymentName)
+	if err != nil {
+		f.t.Errorf("error syncing deployment: %v", err)
+	}
+
+	actions := filterInformerActions(f.client.Actions())
+	for i, action := range actions {
+		if len(f.actions) < i+1 {
+			f.t.Errorf("%d unexpected actions: %+v", len(actions)-len(f.actions), actions[i:])
+			break
+		}
+
+		expectedAction := f.actions[i]
+		if !expectedAction.Matches(action.GetVerb(), action.GetResource().Resource) {
+			f.t.Errorf("Expected\n\t%#v\ngot\n\t%#v", expectedAction, action)
+			continue
+		}
+	}
+
+	if len(f.actions) > len(actions) {
+		f.t.Errorf("%d additional expected actions:%+v", len(f.actions)-len(actions), f.actions[len(actions):])
+	}
+}
+
+func TestSyncDeploymentCreatesReplicaSet(t *testing.T) {
+	f := newFixture(t)
+
+	d := newDeployment("foo", 1, nil, nil, nil, map[string]string{"foo": "bar"})
+	f.dLister = append(f.dLister, d)
+	f.objects = append(f.objects, d)
+
+	rs := newReplicaSet(d, "deploymentrs-4186632231", 1)
+
+	f.expectCreateRSAction(rs)
+	f.expectUpdateDeploymentStatusAction(d)
+	f.expectUpdateDeploymentStatusAction(d)
+
+	f.run(getKey(d, t))
+}
+
+func TestSyncDeploymentDontDoAnythingDuringDeletion(t *testing.T) {
+	f := newFixture(t)
+
+	d := newDeployment("foo", 1, nil, nil, nil, map[string]string{"foo": "bar"})
+	now := metav1.Now()
+	d.DeletionTimestamp = &now
+	f.dLister = append(f.dLister, d)
+	f.objects = append(f.objects, d)
+
+	f.expectUpdateDeploymentStatusAction(d)
+	f.run(getKey(d, t))
+}
+
+// issue: https://github.com/kubernetes/kubernetes/issues/23218
+func TestDeploymentController_dontSyncDeploymentsWithEmptyPodSelector(t *testing.T) {
+	fake := &fake.Clientset{}
+	informers := informers.NewSharedInformerFactory(fake, nil, controller.NoResyncPeriodFunc())
+	controller := NewDeploymentController(informers.Deployments(), informers.ReplicaSets(), informers.Pods(), fake)
+	controller.eventRecorder = &record.FakeRecorder{}
+	controller.dListerSynced = alwaysReady
+	controller.rsListerSynced = alwaysReady
+	controller.podListerSynced = alwaysReady
+
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+	informers.Start(stopCh)
+
+	d := newDeployment("foo", 1, nil, nil, nil, map[string]string{"foo": "bar"})
+	empty := metav1.LabelSelector{}
+	d.Spec.Selector = &empty
+	controller.dLister.Indexer.Add(d)
+	// We expect the deployment controller to not take action here since it's configuration
+	// is invalid, even though no replicasets exist that match it's selector.
+	controller.syncDeployment(fmt.Sprintf("%s/%s", d.ObjectMeta.Namespace, d.ObjectMeta.Name))
+
+	filteredActions := filterInformerActions(fake.Actions())
+	if len(filteredActions) == 0 {
+		return
+	}
+	for _, action := range filteredActions {
+		t.Logf("unexpected action: %#v", action)
+	}
+	t.Errorf("expected deployment controller to not take action")
+}
+
+func filterInformerActions(actions []core.Action) []core.Action {
+	ret := []core.Action{}
+	for _, action := range actions {
+		if len(action.GetNamespace()) == 0 &&
+			(action.Matches("list", "pods") ||
+				action.Matches("list", "deployments") ||
+				action.Matches("list", "replicasets") ||
+				action.Matches("watch", "pods") ||
+				action.Matches("watch", "deployments") ||
+				action.Matches("watch", "replicasets")) {
+			continue
+		}
+		ret = append(ret, action)
+	}
+
+	return ret
+}
+
+// TestOverlappingDeployment ensures that an overlapping deployment will not be synced by
+// the controller.
+func TestOverlappingDeployment(t *testing.T) {
+	f := newFixture(t)
+	now := metav1.Now()
+	later := metav1.Time{Time: now.Add(time.Minute)}
+
+	foo := newDeployment("foo", 1, nil, nil, nil, map[string]string{"foo": "bar"})
+	foo.CreationTimestamp = now
+	bar := newDeployment("bar", 1, nil, nil, nil, map[string]string{"foo": "bar", "app": "baz"})
+	bar.CreationTimestamp = later
+
+	f.dLister = append(f.dLister, foo, bar)
+	f.objects = append(f.objects, foo, bar)
+
+	f.expectUpdateDeploymentStatusAction(bar)
+	f.run(getKey(bar, t))
+
+	for _, a := range filterInformerActions(f.client.Actions()) {
+		action, ok := a.(core.UpdateAction)
+		if !ok {
+			continue
+		}
+		d, ok := action.GetObject().(*extensions.Deployment)
+		if !ok {
+			continue
+		}
+		if d.Name == "bar" && d.Annotations[util.OverlapAnnotation] != "foo" {
+			t.Errorf("annotations weren't updated for the overlapping deployment: %v", d.Annotations)
+		}
+	}
+}
+
+// TestSyncOverlappedDeployment ensures that from two overlapping deployments, the older
+// one will be synced and the newer will be marked as overlapping. Note that in reality it's
+// not always the older deployment that is the one that works vs the rest but the one which
+// has the selector unchanged for longer time.
+func TestSyncOverlappedDeployment(t *testing.T) {
+	f := newFixture(t)
+	now := metav1.Now()
+	later := metav1.Time{Time: now.Add(time.Minute)}
+
+	foo := newDeployment("foo", 1, nil, nil, nil, map[string]string{"foo": "bar"})
+	foo.CreationTimestamp = now
+	bar := newDeployment("bar", 1, nil, nil, nil, map[string]string{"foo": "bar", "app": "baz"})
+	bar.CreationTimestamp = later
+
+	f.dLister = append(f.dLister, foo, bar)
+	f.objects = append(f.objects, foo, bar)
+
+	f.expectUpdateDeploymentStatusAction(bar)
+	f.expectCreateRSAction(newReplicaSet(foo, "foo-rs", 1))
+	f.expectUpdateDeploymentStatusAction(foo)
+	f.expectUpdateDeploymentStatusAction(foo)
+	f.run(getKey(foo, t))
+
+	for _, a := range filterInformerActions(f.client.Actions()) {
+		action, ok := a.(core.UpdateAction)
+		if !ok {
+			continue
+		}
+		d, ok := action.GetObject().(*extensions.Deployment)
+		if !ok {
+			continue
+		}
+		if d.Name == "bar" && d.Annotations[util.OverlapAnnotation] != "foo" {
+			t.Errorf("annotations weren't updated for the overlapping deployment: %v", d.Annotations)
+		}
+	}
+}
+
+// TestSelectorUpdate ensures that from two overlapping deployments, the one that is working won't
+// be marked as overlapping if its selector is updated but still overlaps with the other one.
+func TestSelectorUpdate(t *testing.T) {
+	f := newFixture(t)
+	now := metav1.Now()
+	later := metav1.Time{Time: now.Add(time.Minute)}
+	selectorUpdated := metav1.Time{Time: later.Add(time.Minute)}
+
+	foo := newDeployment("foo", 1, nil, nil, nil, map[string]string{"foo": "bar"})
+	foo.CreationTimestamp = now
+	foo.Annotations = map[string]string{util.SelectorUpdateAnnotation: selectorUpdated.Format(time.RFC3339)}
+	bar := newDeployment("bar", 1, nil, nil, nil, map[string]string{"foo": "bar", "app": "baz"})
+	bar.CreationTimestamp = later
+	bar.Annotations = map[string]string{util.OverlapAnnotation: "foo"}
+
+	f.dLister = append(f.dLister, foo, bar)
+	f.objects = append(f.objects, foo, bar)
+
+	f.expectCreateRSAction(newReplicaSet(foo, "foo-rs", 1))
+	f.expectUpdateDeploymentStatusAction(foo)
+	f.expectUpdateDeploymentStatusAction(foo)
+	f.run(getKey(foo, t))
+
+	for _, a := range filterInformerActions(f.client.Actions()) {
+		action, ok := a.(core.UpdateAction)
+		if !ok {
+			continue
+		}
+		d, ok := action.GetObject().(*extensions.Deployment)
+		if !ok {
+			continue
+		}
+
+		if d.Name == "foo" && len(d.Annotations[util.OverlapAnnotation]) > 0 {
+			t.Errorf("deployment %q should not have the overlapping annotation", d.Name)
+		}
+		if d.Name == "bar" && len(d.Annotations[util.OverlapAnnotation]) == 0 {
+			t.Errorf("deployment %q should have the overlapping annotation", d.Name)
+		}
+	}
+}
+
+// TestDeletedDeploymentShouldCleanupOverlaps ensures that the deletion of a deployment
+// will cleanup any deployments that overlap with it.
+func TestDeletedDeploymentShouldCleanupOverlaps(t *testing.T) {
+	f := newFixture(t)
+	now := metav1.Now()
+	earlier := metav1.Time{Time: now.Add(-time.Minute)}
+	later := metav1.Time{Time: now.Add(time.Minute)}
+
+	foo := newDeployment("foo", 1, nil, nil, nil, map[string]string{"foo": "bar"})
+	foo.CreationTimestamp = earlier
+	foo.DeletionTimestamp = &now
+	bar := newDeployment("bar", 1, nil, nil, nil, map[string]string{"foo": "bar"})
+	bar.CreationTimestamp = later
+	bar.Annotations = map[string]string{util.OverlapAnnotation: "foo"}
+
+	f.dLister = append(f.dLister, foo, bar)
+	f.objects = append(f.objects, foo, bar)
+
+	f.expectUpdateDeploymentStatusAction(bar)
+	f.expectUpdateDeploymentStatusAction(foo)
+	f.run(getKey(foo, t))
+
+	for _, a := range filterInformerActions(f.client.Actions()) {
+		action, ok := a.(core.UpdateAction)
+		if !ok {
+			continue
+		}
+		d := action.GetObject().(*extensions.Deployment)
+		if d.Name != "bar" {
+			continue
+		}
+
+		if len(d.Annotations[util.OverlapAnnotation]) > 0 {
+			t.Errorf("annotations weren't cleaned up for the overlapping deployment: %v", d.Annotations)
+		}
+	}
+}
+
+// TestDeletedDeploymentShouldNotCleanupOtherOverlaps ensures that the deletion of
+// a deployment will not cleanup deployments that overlap with another deployment.
+func TestDeletedDeploymentShouldNotCleanupOtherOverlaps(t *testing.T) {
+	f := newFixture(t)
+	now := metav1.Now()
+	earlier := metav1.Time{Time: now.Add(-time.Minute)}
+	later := metav1.Time{Time: now.Add(time.Minute)}
+
+	foo := newDeployment("foo", 1, nil, nil, nil, map[string]string{"foo": "bar"})
+	foo.CreationTimestamp = earlier
+	foo.DeletionTimestamp = &now
+	bar := newDeployment("bar", 1, nil, nil, nil, map[string]string{"bla": "bla"})
+	bar.CreationTimestamp = later
+	// Notice this deployment is overlapping with another deployment
+	bar.Annotations = map[string]string{util.OverlapAnnotation: "baz"}
+
+	f.dLister = append(f.dLister, foo, bar)
+	f.objects = append(f.objects, foo, bar)
+
+	f.expectUpdateDeploymentStatusAction(foo)
+	f.run(getKey(foo, t))
+
+	for _, a := range filterInformerActions(f.client.Actions()) {
+		action, ok := a.(core.UpdateAction)
+		if !ok {
+			continue
+		}
+		d := action.GetObject().(*extensions.Deployment)
+		if d.Name != "bar" {
+			continue
+		}
+
+		if len(d.Annotations[util.OverlapAnnotation]) == 0 {
+			t.Errorf("overlapping annotation should not be cleaned up for bar: %v", d.Annotations)
+		}
+	}
+}
+
+// TestPodDeletionEnqueuesRecreateDeployment ensures that the deletion of a pod
+// will requeue a Recreate deployment iff there is no other pod returned from the
+// client.
+func TestPodDeletionEnqueuesRecreateDeployment(t *testing.T) {
+	f := newFixture(t)
+
+	foo := newDeployment("foo", 1, nil, nil, nil, map[string]string{"foo": "bar"})
+	foo.Spec.Strategy.Type = extensions.RecreateDeploymentStrategyType
+	rs := newReplicaSet(foo, "foo-1", 1)
+	pod := generatePodFromRS(rs)
+
+	f.dLister = append(f.dLister, foo)
+	f.rsLister = append(f.rsLister, rs)
+	f.objects = append(f.objects, foo, rs)
+
+	c, informers := f.newController()
+	enqueued := false
+	c.enqueueDeployment = func(d *extensions.Deployment) {
+		if d.Name == "foo" {
+			enqueued = true
+		}
+	}
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+	informers.Start(stopCh)
+
+	c.deletePod(pod)
+
+	if !enqueued {
+		t.Errorf("expected deployment %q to be queued after pod deletion", foo.Name)
+	}
+}
+
+// TestPodDeletionDoesntEnqueueRecreateDeployment ensures that the deletion of a pod
+// will not requeue a Recreate deployment iff there are other pods returned from the
+// client.
+func TestPodDeletionDoesntEnqueueRecreateDeployment(t *testing.T) {
+	f := newFixture(t)
+
+	foo := newDeployment("foo", 1, nil, nil, nil, map[string]string{"foo": "bar"})
+	foo.Spec.Strategy.Type = extensions.RecreateDeploymentStrategyType
+	rs := newReplicaSet(foo, "foo-1", 1)
+	pod := generatePodFromRS(rs)
+
+	f.dLister = append(f.dLister, foo)
+	f.rsLister = append(f.rsLister, rs)
+	// Let's pretend this is a different pod. The gist is that the pod lister needs to
+	// return a non-empty list.
+	f.podLister = append(f.podLister, pod)
+
+	c, informers := f.newController()
+	enqueued := false
+	c.enqueueDeployment = func(d *extensions.Deployment) {
+		if d.Name == "foo" {
+			enqueued = true
+		}
+	}
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+	informers.Start(stopCh)
+
+	c.deletePod(pod)
+
+	if enqueued {
+		t.Errorf("expected deployment %q not to be queued after pod deletion", foo.Name)
+	}
+}
+
+// generatePodFromRS creates a pod, with the input ReplicaSet's selector and its template
+func generatePodFromRS(rs *extensions.ReplicaSet) *v1.Pod {
+	trueVar := true
+	return &v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      rs.Name + "-pod",
+			Namespace: rs.Namespace,
+			Labels:    rs.Spec.Selector.MatchLabels,
+			OwnerReferences: []metav1.OwnerReference{
+				{UID: rs.UID, APIVersion: "v1beta1", Kind: "ReplicaSet", Name: rs.Name, Controller: &trueVar},
+			},
+		},
+		Spec: rs.Spec.Template.Spec,
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/deployment/progress.go

@@ -0,0 +1,205 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deployment
+
+import (
+	"fmt"
+	"reflect"
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/kubernetes/pkg/api/v1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/controller/deployment/util"
+)
+
+// hasFailed determines if a deployment has failed or not by estimating its progress.
+// Progress for a deployment is considered when a new replica set is created or adopted,
+// and when new pods scale up or old pods scale down. Progress is not estimated for paused
+// deployments or when users don't really care about it ie. progressDeadlineSeconds is not
+// specified.
+func (dc *DeploymentController) hasFailed(d *extensions.Deployment) (bool, error) {
+	if d.Spec.ProgressDeadlineSeconds == nil || d.Spec.RollbackTo != nil || d.Spec.Paused {
+		return false, nil
+	}
+
+	newRS, oldRSs, err := dc.getAllReplicaSetsAndSyncRevision(d, false)
+	if err != nil {
+		return false, err
+	}
+
+	// There is a template change so we don't need to check for any progress right now.
+	if newRS == nil {
+		return false, nil
+	}
+
+	// Look at the status of the deployment - if there is already a NewRSAvailableReason
+	// then we don't need to estimate any progress. This is needed in order to avoid
+	// estimating progress for scaling events after a rollout has finished.
+	cond := util.GetDeploymentCondition(d.Status, extensions.DeploymentProgressing)
+	if cond != nil && cond.Reason == util.NewRSAvailableReason {
+		return false, nil
+	}
+
+	// TODO: Look for permanent failures here.
+	// See https://github.com/kubernetes/kubernetes/issues/18568
+
+	allRSs := append(oldRSs, newRS)
+	newStatus := calculateStatus(allRSs, newRS, d)
+
+	// If the deployment is complete or it is progressing, there is no need to check if it
+	// has timed out.
+	if util.DeploymentComplete(d, &newStatus) || util.DeploymentProgressing(d, &newStatus) {
+		return false, nil
+	}
+
+	// Check if the deployment has timed out.
+	return util.DeploymentTimedOut(d, &newStatus), nil
+}
+
+// syncRolloutStatus updates the status of a deployment during a rollout. There are
+// cases this helper will run that cannot be prevented from the scaling detection,
+// for example a resync of the deployment after it was scaled up. In those cases,
+// we shouldn't try to estimate any progress.
+func (dc *DeploymentController) syncRolloutStatus(allRSs []*extensions.ReplicaSet, newRS *extensions.ReplicaSet, d *extensions.Deployment) error {
+	newStatus := calculateStatus(allRSs, newRS, d)
+
+	// If there is no progressDeadlineSeconds set, remove any Progressing condition.
+	if d.Spec.ProgressDeadlineSeconds == nil {
+		util.RemoveDeploymentCondition(&newStatus, extensions.DeploymentProgressing)
+	}
+
+	// If there is only one replica set that is active then that means we are not running
+	// a new rollout and this is a resync where we don't need to estimate any progress.
+	// In such a case, we should simply not estimate any progress for this deployment.
+	currentCond := util.GetDeploymentCondition(d.Status, extensions.DeploymentProgressing)
+	isCompleteDeployment := newStatus.Replicas == newStatus.UpdatedReplicas && currentCond != nil && currentCond.Reason == util.NewRSAvailableReason
+	// Check for progress only if there is a progress deadline set and the latest rollout
+	// hasn't completed yet.
+	if d.Spec.ProgressDeadlineSeconds != nil && !isCompleteDeployment {
+		switch {
+		case util.DeploymentComplete(d, &newStatus):
+			// Update the deployment conditions with a message for the new replica set that
+			// was successfully deployed. If the condition already exists, we ignore this update.
+			msg := fmt.Sprintf("ReplicaSet %q has successfully progressed.", newRS.Name)
+			condition := util.NewDeploymentCondition(extensions.DeploymentProgressing, v1.ConditionTrue, util.NewRSAvailableReason, msg)
+			util.SetDeploymentCondition(&newStatus, *condition)
+
+		case util.DeploymentProgressing(d, &newStatus):
+			// If there is any progress made, continue by not checking if the deployment failed. This
+			// behavior emulates the rolling updater progressDeadline check.
+			msg := fmt.Sprintf("Deployment %q is progressing.", d.Name)
+			if newRS != nil {
+				msg = fmt.Sprintf("ReplicaSet %q is progressing.", newRS.Name)
+			}
+			condition := util.NewDeploymentCondition(extensions.DeploymentProgressing, v1.ConditionTrue, util.ReplicaSetUpdatedReason, msg)
+			// Update the current Progressing condition or add a new one if it doesn't exist.
+			// If a Progressing condition with status=true already exists, we should update
+			// everything but lastTransitionTime. SetDeploymentCondition already does that but
+			// it also is not updating conditions when the reason of the new condition is the
+			// same as the old. The Progressing condition is a special case because we want to
+			// update with the same reason and change just lastUpdateTime iff we notice any
+			// progress. That's why we handle it here.
+			if currentCond != nil {
+				if currentCond.Status == v1.ConditionTrue {
+					condition.LastTransitionTime = currentCond.LastTransitionTime
+				}
+				util.RemoveDeploymentCondition(&newStatus, extensions.DeploymentProgressing)
+			}
+			util.SetDeploymentCondition(&newStatus, *condition)
+
+		case util.DeploymentTimedOut(d, &newStatus):
+			// Update the deployment with a timeout condition. If the condition already exists,
+			// we ignore this update.
+			msg := fmt.Sprintf("Deployment %q has timed out progressing.", d.Name)
+			if newRS != nil {
+				msg = fmt.Sprintf("ReplicaSet %q has timed out progressing.", newRS.Name)
+			}
+			condition := util.NewDeploymentCondition(extensions.DeploymentProgressing, v1.ConditionFalse, util.TimedOutReason, msg)
+			util.SetDeploymentCondition(&newStatus, *condition)
+		}
+	}
+
+	// Move failure conditions of all replica sets in deployment conditions. For now,
+	// only one failure condition is returned from getReplicaFailures.
+	if replicaFailureCond := dc.getReplicaFailures(allRSs, newRS); len(replicaFailureCond) > 0 {
+		// There will be only one ReplicaFailure condition on the replica set.
+		util.SetDeploymentCondition(&newStatus, replicaFailureCond[0])
+	} else {
+		util.RemoveDeploymentCondition(&newStatus, extensions.DeploymentReplicaFailure)
+	}
+
+	// Do not update if there is nothing new to add.
+	if reflect.DeepEqual(d.Status, newStatus) {
+		// If there is no sign of progress at this point then there is a high chance that the
+		// deployment is stuck. We should resync this deployment at some point[1] in the future
+		// and check if it has timed out. We definitely need this, otherwise we depend on the
+		// controller resync interval. See https://github.com/kubernetes/kubernetes/issues/34458.
+		//
+		// [1] time.Now() + progressDeadlineSeconds - lastUpdateTime (of the Progressing condition).
+		if d.Spec.ProgressDeadlineSeconds != nil &&
+			!util.DeploymentComplete(d, &newStatus) &&
+			!util.DeploymentTimedOut(d, &newStatus) &&
+			currentCond != nil {
+
+			after := time.Now().Add(time.Duration(*d.Spec.ProgressDeadlineSeconds) * time.Second).Sub(currentCond.LastUpdateTime.Time)
+			glog.V(4).Infof("Queueing up deployment %q for a progress check after %ds", d.Name, int(after.Seconds()))
+			dc.checkProgressAfter(d, after)
+		}
+		return nil
+	}
+
+	newDeployment := d
+	newDeployment.Status = newStatus
+	_, err := dc.client.Extensions().Deployments(newDeployment.Namespace).UpdateStatus(newDeployment)
+	return err
+}
+
+// getReplicaFailures will convert replica failure conditions from replica sets
+// to deployment conditions.
+func (dc *DeploymentController) getReplicaFailures(allRSs []*extensions.ReplicaSet, newRS *extensions.ReplicaSet) []extensions.DeploymentCondition {
+	var conditions []extensions.DeploymentCondition
+	if newRS != nil {
+		for _, c := range newRS.Status.Conditions {
+			if c.Type != extensions.ReplicaSetReplicaFailure {
+				continue
+			}
+			conditions = append(conditions, util.ReplicaSetToDeploymentCondition(c))
+		}
+	}
+
+	// Return failures for the new replica set over failures from old replica sets.
+	if len(conditions) > 0 {
+		return conditions
+	}
+
+	for i := range allRSs {
+		rs := allRSs[i]
+		if rs == nil {
+			continue
+		}
+
+		for _, c := range rs.Status.Conditions {
+			if c.Type != extensions.ReplicaSetReplicaFailure {
+				continue
+			}
+			conditions = append(conditions, util.ReplicaSetToDeploymentCondition(c))
+		}
+	}
+	return conditions
+}

vendor/k8s.io/kubernetes/pkg/controller/deployment/recreate.go

@@ -0,0 +1,107 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deployment
+
+import (
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/controller"
+)
+
+// rolloutRecreate implements the logic for recreating a replica set.
+func (dc *DeploymentController) rolloutRecreate(deployment *extensions.Deployment) error {
+	// Don't create a new RS if not already existed, so that we avoid scaling up before scaling down
+	newRS, oldRSs, err := dc.getAllReplicaSetsAndSyncRevision(deployment, false)
+	if err != nil {
+		return err
+	}
+	allRSs := append(oldRSs, newRS)
+	activeOldRSs := controller.FilterActiveReplicaSets(oldRSs)
+
+	// scale down old replica sets
+	scaledDown, err := dc.scaleDownOldReplicaSetsForRecreate(activeOldRSs, deployment)
+	if err != nil {
+		return err
+	}
+	if scaledDown {
+		// Update DeploymentStatus
+		return dc.syncRolloutStatus(allRSs, newRS, deployment)
+	}
+
+	newStatus := calculateStatus(allRSs, newRS, deployment)
+	// Do not process a deployment when it has old pods running.
+	if newStatus.UpdatedReplicas == 0 {
+		podList, err := dc.listPods(deployment)
+		if err != nil {
+			return err
+		}
+		if len(podList.Items) > 0 {
+			return dc.syncRolloutStatus(allRSs, newRS, deployment)
+		}
+	}
+
+	// If we need to create a new RS, create it now
+	// TODO: Create a new RS without re-listing all RSs.
+	if newRS == nil {
+		newRS, oldRSs, err = dc.getAllReplicaSetsAndSyncRevision(deployment, true)
+		if err != nil {
+			return err
+		}
+		allRSs = append(oldRSs, newRS)
+	}
+
+	// scale up new replica set
+	scaledUp, err := dc.scaleUpNewReplicaSetForRecreate(newRS, deployment)
+	if err != nil {
+		return err
+	}
+	if scaledUp {
+		// Update DeploymentStatus
+		return dc.syncRolloutStatus(allRSs, newRS, deployment)
+	}
+
+	dc.cleanupDeployment(oldRSs, deployment)
+
+	// Sync deployment status
+	return dc.syncRolloutStatus(allRSs, newRS, deployment)
+}
+
+// scaleDownOldReplicaSetsForRecreate scales down old replica sets when deployment strategy is "Recreate"
+func (dc *DeploymentController) scaleDownOldReplicaSetsForRecreate(oldRSs []*extensions.ReplicaSet, deployment *extensions.Deployment) (bool, error) {
+	scaled := false
+	for i := range oldRSs {
+		rs := oldRSs[i]
+		// Scaling not required.
+		if *(rs.Spec.Replicas) == 0 {
+			continue
+		}
+		scaledRS, updatedRS, err := dc.scaleReplicaSetAndRecordEvent(rs, 0, deployment)
+		if err != nil {
+			return false, err
+		}
+		if scaledRS {
+			oldRSs[i] = updatedRS
+			scaled = true
+		}
+	}
+	return scaled, nil
+}
+
+// scaleUpNewReplicaSetForRecreate scales up new replica set when deployment strategy is "Recreate"
+func (dc *DeploymentController) scaleUpNewReplicaSetForRecreate(newRS *extensions.ReplicaSet, deployment *extensions.Deployment) (bool, error) {
+	scaled, _, err := dc.scaleReplicaSetAndRecordEvent(newRS, *(deployment.Spec.Replicas), deployment)
+	return scaled, err
+}

vendor/k8s.io/kubernetes/pkg/controller/deployment/recreate_test.go

@@ -0,0 +1,82 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deployment
+
+import (
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/kubernetes/pkg/api"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/fake"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/controller/informers"
+)
+
+func TestScaleDownOldReplicaSets(t *testing.T) {
+	tests := []struct {
+		oldRSSizes []int
+		d          *extensions.Deployment
+	}{
+		{
+			oldRSSizes: []int{3},
+			d:          newDeployment("foo", 3, nil, nil, nil, map[string]string{"foo": "bar"}),
+		},
+	}
+
+	for i := range tests {
+		t.Logf("running scenario %d", i)
+		test := tests[i]
+
+		var oldRSs []*extensions.ReplicaSet
+		var expected []runtime.Object
+
+		for n, size := range test.oldRSSizes {
+			rs := newReplicaSet(test.d, fmt.Sprintf("%s-%d", test.d.Name, n), size)
+			oldRSs = append(oldRSs, rs)
+
+			objCopy, err := api.Scheme.Copy(rs)
+			if err != nil {
+				t.Errorf("unexpected error while deep-copying: %v", err)
+				continue
+			}
+			rsCopy := objCopy.(*extensions.ReplicaSet)
+
+			zero := int32(0)
+			rsCopy.Spec.Replicas = &zero
+			expected = append(expected, rsCopy)
+
+			if *(oldRSs[n].Spec.Replicas) == *(expected[n].(*extensions.ReplicaSet).Spec.Replicas) {
+				t.Errorf("broken test - original and expected RS have the same size")
+			}
+		}
+
+		kc := fake.NewSimpleClientset(expected...)
+		informers := informers.NewSharedInformerFactory(kc, nil, controller.NoResyncPeriodFunc())
+		c := NewDeploymentController(informers.Deployments(), informers.ReplicaSets(), informers.Pods(), kc)
+
+		c.scaleDownOldReplicaSetsForRecreate(oldRSs, test.d)
+		for j := range oldRSs {
+			rs := oldRSs[j]
+
+			if *rs.Spec.Replicas != 0 {
+				t.Errorf("rs %q has non-zero replicas", rs.Name)
+			}
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/deployment/rollback.go

@@ -0,0 +1,105 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deployment
+
+import (
+	"fmt"
+
+	"github.com/golang/glog"
+	"k8s.io/kubernetes/pkg/api/v1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	deploymentutil "k8s.io/kubernetes/pkg/controller/deployment/util"
+)
+
+// Rolling back to a revision; no-op if the toRevision is deployment's current revision
+func (dc *DeploymentController) rollback(deployment *extensions.Deployment, toRevision *int64) (*extensions.Deployment, error) {
+	newRS, allOldRSs, err := dc.getAllReplicaSetsAndSyncRevision(deployment, true)
+	if err != nil {
+		return nil, err
+	}
+	allRSs := append(allOldRSs, newRS)
+	// If rollback revision is 0, rollback to the last revision
+	if *toRevision == 0 {
+		if *toRevision = deploymentutil.LastRevision(allRSs); *toRevision == 0 {
+			// If we still can't find the last revision, gives up rollback
+			dc.emitRollbackWarningEvent(deployment, deploymentutil.RollbackRevisionNotFound, "Unable to find last revision.")
+			// Gives up rollback
+			return dc.updateDeploymentAndClearRollbackTo(deployment)
+		}
+	}
+	for _, rs := range allRSs {
+		v, err := deploymentutil.Revision(rs)
+		if err != nil {
+			glog.V(4).Infof("Unable to extract revision from deployment's replica set %q: %v", rs.Name, err)
+			continue
+		}
+		if v == *toRevision {
+			glog.V(4).Infof("Found replica set %q with desired revision %d", rs.Name, v)
+			// rollback by copying podTemplate.Spec from the replica set
+			// revision number will be incremented during the next getAllReplicaSetsAndSyncRevision call
+			// no-op if the the spec matches current deployment's podTemplate.Spec
+			deployment, performedRollback, err := dc.rollbackToTemplate(deployment, rs)
+			if performedRollback && err == nil {
+				dc.emitRollbackNormalEvent(deployment, fmt.Sprintf("Rolled back deployment %q to revision %d", deployment.Name, *toRevision))
+			}
+			return deployment, err
+		}
+	}
+	dc.emitRollbackWarningEvent(deployment, deploymentutil.RollbackRevisionNotFound, "Unable to find the revision to rollback to.")
+	// Gives up rollback
+	return dc.updateDeploymentAndClearRollbackTo(deployment)
+}
+
+func (dc *DeploymentController) rollbackToTemplate(deployment *extensions.Deployment, rs *extensions.ReplicaSet) (d *extensions.Deployment, performedRollback bool, err error) {
+	if !deploymentutil.EqualIgnoreHash(deployment.Spec.Template, rs.Spec.Template) {
+		glog.Infof("Rolling back deployment %s to template spec %+v", deployment.Name, rs.Spec.Template.Spec)
+		deploymentutil.SetFromReplicaSetTemplate(deployment, rs.Spec.Template)
+		// set RS (the old RS we'll rolling back to) annotations back to the deployment;
+		// otherwise, the deployment's current annotations (should be the same as current new RS) will be copied to the RS after the rollback.
+		//
+		// For example,
+		// A Deployment has old RS1 with annotation {change-cause:create}, and new RS2 {change-cause:edit}.
+		// Note that both annotations are copied from Deployment, and the Deployment should be annotated {change-cause:edit} as well.
+		// Now, rollback Deployment to RS1, we should update Deployment's pod-template and also copy annotation from RS1.
+		// Deployment is now annotated {change-cause:create}, and we have new RS1 {change-cause:create}, old RS2 {change-cause:edit}.
+		//
+		// If we don't copy the annotations back from RS to deployment on rollback, the Deployment will stay as {change-cause:edit},
+		// and new RS1 becomes {change-cause:edit} (copied from deployment after rollback), old RS2 {change-cause:edit}, which is not correct.
+		deploymentutil.SetDeploymentAnnotationsTo(deployment, rs)
+		performedRollback = true
+	} else {
+		glog.V(4).Infof("Rolling back to a revision that contains the same template as current deployment %s, skipping rollback...", deployment.Name)
+		dc.emitRollbackWarningEvent(deployment, deploymentutil.RollbackTemplateUnchanged, fmt.Sprintf("The rollback revision contains the same template as current deployment %q", deployment.Name))
+	}
+	d, err = dc.updateDeploymentAndClearRollbackTo(deployment)
+	return
+}
+
+func (dc *DeploymentController) emitRollbackWarningEvent(deployment *extensions.Deployment, reason, message string) {
+	dc.eventRecorder.Eventf(deployment, v1.EventTypeWarning, reason, message)
+}
+
+func (dc *DeploymentController) emitRollbackNormalEvent(deployment *extensions.Deployment, message string) {
+	dc.eventRecorder.Eventf(deployment, v1.EventTypeNormal, deploymentutil.RollbackDone, message)
+}
+
+// updateDeploymentAndClearRollbackTo sets .spec.rollbackTo to nil and update the input deployment
+func (dc *DeploymentController) updateDeploymentAndClearRollbackTo(deployment *extensions.Deployment) (*extensions.Deployment, error) {
+	glog.V(4).Infof("Cleans up rollbackTo of deployment %s", deployment.Name)
+	deployment.Spec.RollbackTo = nil
+	return dc.client.Extensions().Deployments(deployment.ObjectMeta.Namespace).Update(deployment)
+}

vendor/k8s.io/kubernetes/pkg/controller/deployment/rolling.go

@@ -0,0 +1,229 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deployment
+
+import (
+	"fmt"
+	"sort"
+
+	"github.com/golang/glog"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/controller"
+	deploymentutil "k8s.io/kubernetes/pkg/controller/deployment/util"
+	"k8s.io/kubernetes/pkg/util/integer"
+)
+
+// rolloutRolling implements the logic for rolling a new replica set.
+func (dc *DeploymentController) rolloutRolling(deployment *extensions.Deployment) error {
+	newRS, oldRSs, err := dc.getAllReplicaSetsAndSyncRevision(deployment, true)
+	if err != nil {
+		return err
+	}
+	allRSs := append(oldRSs, newRS)
+
+	// Scale up, if we can.
+	scaledUp, err := dc.reconcileNewReplicaSet(allRSs, newRS, deployment)
+	if err != nil {
+		return err
+	}
+	if scaledUp {
+		// Update DeploymentStatus
+		return dc.syncRolloutStatus(allRSs, newRS, deployment)
+	}
+
+	// Scale down, if we can.
+	scaledDown, err := dc.reconcileOldReplicaSets(allRSs, controller.FilterActiveReplicaSets(oldRSs), newRS, deployment)
+	if err != nil {
+		return err
+	}
+	if scaledDown {
+		// Update DeploymentStatus
+		return dc.syncRolloutStatus(allRSs, newRS, deployment)
+	}
+
+	dc.cleanupDeployment(oldRSs, deployment)
+
+	// Sync deployment status
+	return dc.syncRolloutStatus(allRSs, newRS, deployment)
+}
+
+func (dc *DeploymentController) reconcileNewReplicaSet(allRSs []*extensions.ReplicaSet, newRS *extensions.ReplicaSet, deployment *extensions.Deployment) (bool, error) {
+	if *(newRS.Spec.Replicas) == *(deployment.Spec.Replicas) {
+		// Scaling not required.
+		return false, nil
+	}
+	if *(newRS.Spec.Replicas) > *(deployment.Spec.Replicas) {
+		// Scale down.
+		scaled, _, err := dc.scaleReplicaSetAndRecordEvent(newRS, *(deployment.Spec.Replicas), deployment)
+		return scaled, err
+	}
+	newReplicasCount, err := deploymentutil.NewRSNewReplicas(deployment, allRSs, newRS)
+	if err != nil {
+		return false, err
+	}
+	scaled, _, err := dc.scaleReplicaSetAndRecordEvent(newRS, newReplicasCount, deployment)
+	return scaled, err
+}
+
+func (dc *DeploymentController) reconcileOldReplicaSets(allRSs []*extensions.ReplicaSet, oldRSs []*extensions.ReplicaSet, newRS *extensions.ReplicaSet, deployment *extensions.Deployment) (bool, error) {
+	oldPodsCount := deploymentutil.GetReplicaCountForReplicaSets(oldRSs)
+	if oldPodsCount == 0 {
+		// Can't scale down further
+		return false, nil
+	}
+
+	allPodsCount := deploymentutil.GetReplicaCountForReplicaSets(allRSs)
+	glog.V(4).Infof("New replica set %s/%s has %d available pods.", newRS.Namespace, newRS.Name, newRS.Status.AvailableReplicas)
+	maxUnavailable := deploymentutil.MaxUnavailable(*deployment)
+
+	// Check if we can scale down. We can scale down in the following 2 cases:
+	// * Some old replica sets have unhealthy replicas, we could safely scale down those unhealthy replicas since that won't further
+	//  increase unavailability.
+	// * New replica set has scaled up and it's replicas becomes ready, then we can scale down old replica sets in a further step.
+	//
+	// maxScaledDown := allPodsCount - minAvailable - newReplicaSetPodsUnavailable
+	// take into account not only maxUnavailable and any surge pods that have been created, but also unavailable pods from
+	// the newRS, so that the unavailable pods from the newRS would not make us scale down old replica sets in a further
+	// step(that will increase unavailability).
+	//
+	// Concrete example:
+	//
+	// * 10 replicas
+	// * 2 maxUnavailable (absolute number, not percent)
+	// * 3 maxSurge (absolute number, not percent)
+	//
+	// case 1:
+	// * Deployment is updated, newRS is created with 3 replicas, oldRS is scaled down to 8, and newRS is scaled up to 5.
+	// * The new replica set pods crashloop and never become available.
+	// * allPodsCount is 13. minAvailable is 8. newRSPodsUnavailable is 5.
+	// * A node fails and causes one of the oldRS pods to become unavailable. However, 13 - 8 - 5 = 0, so the oldRS won't be scaled down.
+	// * The user notices the crashloop and does kubectl rollout undo to rollback.
+	// * newRSPodsUnavailable is 1, since we rolled back to the good replica set, so maxScaledDown = 13 - 8 - 1 = 4. 4 of the crashlooping pods will be scaled down.
+	// * The total number of pods will then be 9 and the newRS can be scaled up to 10.
+	//
+	// case 2:
+	// Same example, but pushing a new pod template instead of rolling back (aka "roll over"):
+	// * The new replica set created must start with 0 replicas because allPodsCount is already at 13.
+	// * However, newRSPodsUnavailable would also be 0, so the 2 old replica sets could be scaled down by 5 (13 - 8 - 0), which would then
+	// allow the new replica set to be scaled up by 5.
+	minAvailable := *(deployment.Spec.Replicas) - maxUnavailable
+	newRSUnavailablePodCount := *(newRS.Spec.Replicas) - newRS.Status.AvailableReplicas
+	maxScaledDown := allPodsCount - minAvailable - newRSUnavailablePodCount
+	if maxScaledDown <= 0 {
+		return false, nil
+	}
+
+	// Clean up unhealthy replicas first, otherwise unhealthy replicas will block deployment
+	// and cause timeout. See https://github.com/kubernetes/kubernetes/issues/16737
+	oldRSs, cleanupCount, err := dc.cleanupUnhealthyReplicas(oldRSs, deployment, maxScaledDown)
+	if err != nil {
+		return false, nil
+	}
+	glog.V(4).Infof("Cleaned up unhealthy replicas from old RSes by %d", cleanupCount)
+
+	// Scale down old replica sets, need check maxUnavailable to ensure we can scale down
+	allRSs = append(oldRSs, newRS)
+	scaledDownCount, err := dc.scaleDownOldReplicaSetsForRollingUpdate(allRSs, oldRSs, deployment)
+	if err != nil {
+		return false, nil
+	}
+	glog.V(4).Infof("Scaled down old RSes of deployment %s by %d", deployment.Name, scaledDownCount)
+
+	totalScaledDown := cleanupCount + scaledDownCount
+	return totalScaledDown > 0, nil
+}
+
+// cleanupUnhealthyReplicas will scale down old replica sets with unhealthy replicas, so that all unhealthy replicas will be deleted.
+func (dc *DeploymentController) cleanupUnhealthyReplicas(oldRSs []*extensions.ReplicaSet, deployment *extensions.Deployment, maxCleanupCount int32) ([]*extensions.ReplicaSet, int32, error) {
+	sort.Sort(controller.ReplicaSetsByCreationTimestamp(oldRSs))
+	// Safely scale down all old replica sets with unhealthy replicas. Replica set will sort the pods in the order
+	// such that not-ready < ready, unscheduled < scheduled, and pending < running. This ensures that unhealthy replicas will
+	// been deleted first and won't increase unavailability.
+	totalScaledDown := int32(0)
+	for i, targetRS := range oldRSs {
+		if totalScaledDown >= maxCleanupCount {
+			break
+		}
+		if *(targetRS.Spec.Replicas) == 0 {
+			// cannot scale down this replica set.
+			continue
+		}
+		glog.V(4).Infof("Found %d available pods in old RS %s/%s", targetRS.Status.AvailableReplicas, targetRS.Namespace, targetRS.Name)
+		if *(targetRS.Spec.Replicas) == targetRS.Status.AvailableReplicas {
+			// no unhealthy replicas found, no scaling required.
+			continue
+		}
+
+		scaledDownCount := int32(integer.IntMin(int(maxCleanupCount-totalScaledDown), int(*(targetRS.Spec.Replicas)-targetRS.Status.AvailableReplicas)))
+		newReplicasCount := *(targetRS.Spec.Replicas) - scaledDownCount
+		if newReplicasCount > *(targetRS.Spec.Replicas) {
+			return nil, 0, fmt.Errorf("when cleaning up unhealthy replicas, got invalid request to scale down %s/%s %d -> %d", targetRS.Namespace, targetRS.Name, *(targetRS.Spec.Replicas), newReplicasCount)
+		}
+		_, updatedOldRS, err := dc.scaleReplicaSetAndRecordEvent(targetRS, newReplicasCount, deployment)
+		if err != nil {
+			return nil, totalScaledDown, err
+		}
+		totalScaledDown += scaledDownCount
+		oldRSs[i] = updatedOldRS
+	}
+	return oldRSs, totalScaledDown, nil
+}
+
+// scaleDownOldReplicaSetsForRollingUpdate scales down old replica sets when deployment strategy is "RollingUpdate".
+// Need check maxUnavailable to ensure availability
+func (dc *DeploymentController) scaleDownOldReplicaSetsForRollingUpdate(allRSs []*extensions.ReplicaSet, oldRSs []*extensions.ReplicaSet, deployment *extensions.Deployment) (int32, error) {
+	maxUnavailable := deploymentutil.MaxUnavailable(*deployment)
+
+	// Check if we can scale down.
+	minAvailable := *(deployment.Spec.Replicas) - maxUnavailable
+	// Find the number of available pods.
+	availablePodCount := deploymentutil.GetAvailableReplicaCountForReplicaSets(allRSs)
+	if availablePodCount <= minAvailable {
+		// Cannot scale down.
+		return 0, nil
+	}
+	glog.V(4).Infof("Found %d available pods in deployment %s, scaling down old RSes", availablePodCount, deployment.Name)
+
+	sort.Sort(controller.ReplicaSetsByCreationTimestamp(oldRSs))
+
+	totalScaledDown := int32(0)
+	totalScaleDownCount := availablePodCount - minAvailable
+	for _, targetRS := range oldRSs {
+		if totalScaledDown >= totalScaleDownCount {
+			// No further scaling required.
+			break
+		}
+		if *(targetRS.Spec.Replicas) == 0 {
+			// cannot scale down this ReplicaSet.
+			continue
+		}
+		// Scale down.
+		scaleDownCount := int32(integer.IntMin(int(*(targetRS.Spec.Replicas)), int(totalScaleDownCount-totalScaledDown)))
+		newReplicasCount := *(targetRS.Spec.Replicas) - scaleDownCount
+		if newReplicasCount > *(targetRS.Spec.Replicas) {
+			return 0, fmt.Errorf("when scaling down old RS, got invalid request to scale down %s/%s %d -> %d", targetRS.Namespace, targetRS.Name, *(targetRS.Spec.Replicas), newReplicasCount)
+		}
+		_, _, err := dc.scaleReplicaSetAndRecordEvent(targetRS, newReplicasCount, deployment)
+		if err != nil {
+			return totalScaledDown, err
+		}
+
+		totalScaledDown += scaleDownCount
+	}
+
+	return totalScaledDown, nil
+}

vendor/k8s.io/kubernetes/pkg/controller/deployment/rolling_test.go

@@ -0,0 +1,379 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deployment
+
+import (
+	"testing"
+
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/fake"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/client/testing/core"
+	"k8s.io/kubernetes/pkg/util/intstr"
+)
+
+func TestDeploymentController_reconcileNewReplicaSet(t *testing.T) {
+	tests := []struct {
+		deploymentReplicas  int
+		maxSurge            intstr.IntOrString
+		oldReplicas         int
+		newReplicas         int
+		scaleExpected       bool
+		expectedNewReplicas int
+	}{
+		{
+			// Should not scale up.
+			deploymentReplicas: 10,
+			maxSurge:           intstr.FromInt(0),
+			oldReplicas:        10,
+			newReplicas:        0,
+			scaleExpected:      false,
+		},
+		{
+			deploymentReplicas:  10,
+			maxSurge:            intstr.FromInt(2),
+			oldReplicas:         10,
+			newReplicas:         0,
+			scaleExpected:       true,
+			expectedNewReplicas: 2,
+		},
+		{
+			deploymentReplicas:  10,
+			maxSurge:            intstr.FromInt(2),
+			oldReplicas:         5,
+			newReplicas:         0,
+			scaleExpected:       true,
+			expectedNewReplicas: 7,
+		},
+		{
+			deploymentReplicas: 10,
+			maxSurge:           intstr.FromInt(2),
+			oldReplicas:        10,
+			newReplicas:        2,
+			scaleExpected:      false,
+		},
+		{
+			// Should scale down.
+			deploymentReplicas:  10,
+			maxSurge:            intstr.FromInt(2),
+			oldReplicas:         2,
+			newReplicas:         11,
+			scaleExpected:       true,
+			expectedNewReplicas: 10,
+		},
+	}
+
+	for i := range tests {
+		test := tests[i]
+		t.Logf("executing scenario %d", i)
+		newRS := rs("foo-v2", test.newReplicas, nil, noTimestamp)
+		oldRS := rs("foo-v2", test.oldReplicas, nil, noTimestamp)
+		allRSs := []*extensions.ReplicaSet{newRS, oldRS}
+		maxUnavailable := intstr.FromInt(0)
+		deployment := newDeployment("foo", test.deploymentReplicas, nil, &test.maxSurge, &maxUnavailable, map[string]string{"foo": "bar"})
+		fake := fake.Clientset{}
+		controller := &DeploymentController{
+			client:        &fake,
+			eventRecorder: &record.FakeRecorder{},
+		}
+		scaled, err := controller.reconcileNewReplicaSet(allRSs, newRS, deployment)
+		if err != nil {
+			t.Errorf("unexpected error: %v", err)
+			continue
+		}
+		if !test.scaleExpected {
+			if scaled || len(fake.Actions()) > 0 {
+				t.Errorf("unexpected scaling: %v", fake.Actions())
+			}
+			continue
+		}
+		if test.scaleExpected && !scaled {
+			t.Errorf("expected scaling to occur")
+			continue
+		}
+		if len(fake.Actions()) != 1 {
+			t.Errorf("expected 1 action during scale, got: %v", fake.Actions())
+			continue
+		}
+		updated := fake.Actions()[0].(core.UpdateAction).GetObject().(*extensions.ReplicaSet)
+		if e, a := test.expectedNewReplicas, int(*(updated.Spec.Replicas)); e != a {
+			t.Errorf("expected update to %d replicas, got %d", e, a)
+		}
+	}
+}
+
+func TestDeploymentController_reconcileOldReplicaSets(t *testing.T) {
+	tests := []struct {
+		deploymentReplicas  int
+		maxUnavailable      intstr.IntOrString
+		oldReplicas         int
+		newReplicas         int
+		readyPodsFromOldRS  int
+		readyPodsFromNewRS  int
+		scaleExpected       bool
+		expectedOldReplicas int
+	}{
+		{
+			deploymentReplicas:  10,
+			maxUnavailable:      intstr.FromInt(0),
+			oldReplicas:         10,
+			newReplicas:         0,
+			readyPodsFromOldRS:  10,
+			readyPodsFromNewRS:  0,
+			scaleExpected:       true,
+			expectedOldReplicas: 9,
+		},
+		{
+			deploymentReplicas:  10,
+			maxUnavailable:      intstr.FromInt(2),
+			oldReplicas:         10,
+			newReplicas:         0,
+			readyPodsFromOldRS:  10,
+			readyPodsFromNewRS:  0,
+			scaleExpected:       true,
+			expectedOldReplicas: 8,
+		},
+		{ // expect unhealthy replicas from old replica sets been cleaned up
+			deploymentReplicas:  10,
+			maxUnavailable:      intstr.FromInt(2),
+			oldReplicas:         10,
+			newReplicas:         0,
+			readyPodsFromOldRS:  8,
+			readyPodsFromNewRS:  0,
+			scaleExpected:       true,
+			expectedOldReplicas: 8,
+		},
+		{ // expect 1 unhealthy replica from old replica sets been cleaned up, and 1 ready pod been scaled down
+			deploymentReplicas:  10,
+			maxUnavailable:      intstr.FromInt(2),
+			oldReplicas:         10,
+			newReplicas:         0,
+			readyPodsFromOldRS:  9,
+			readyPodsFromNewRS:  0,
+			scaleExpected:       true,
+			expectedOldReplicas: 8,
+		},
+		{ // the unavailable pods from the newRS would not make us scale down old RSs in a further step
+			deploymentReplicas: 10,
+			maxUnavailable:     intstr.FromInt(2),
+			oldReplicas:        8,
+			newReplicas:        2,
+			readyPodsFromOldRS: 8,
+			readyPodsFromNewRS: 0,
+			scaleExpected:      false,
+		},
+	}
+	for i := range tests {
+		test := tests[i]
+		t.Logf("executing scenario %d", i)
+
+		newSelector := map[string]string{"foo": "new"}
+		oldSelector := map[string]string{"foo": "old"}
+		newRS := rs("foo-new", test.newReplicas, newSelector, noTimestamp)
+		newRS.Status.AvailableReplicas = int32(test.readyPodsFromNewRS)
+		oldRS := rs("foo-old", test.oldReplicas, oldSelector, noTimestamp)
+		oldRS.Status.AvailableReplicas = int32(test.readyPodsFromOldRS)
+		oldRSs := []*extensions.ReplicaSet{oldRS}
+		allRSs := []*extensions.ReplicaSet{oldRS, newRS}
+		maxSurge := intstr.FromInt(0)
+		deployment := newDeployment("foo", test.deploymentReplicas, nil, &maxSurge, &test.maxUnavailable, newSelector)
+		fakeClientset := fake.Clientset{}
+		controller := &DeploymentController{
+			client:        &fakeClientset,
+			eventRecorder: &record.FakeRecorder{},
+		}
+
+		scaled, err := controller.reconcileOldReplicaSets(allRSs, oldRSs, newRS, deployment)
+		if err != nil {
+			t.Errorf("unexpected error: %v", err)
+			continue
+		}
+		if !test.scaleExpected && scaled {
+			t.Errorf("unexpected scaling: %v", fakeClientset.Actions())
+		}
+		if test.scaleExpected && !scaled {
+			t.Errorf("expected scaling to occur")
+			continue
+		}
+		continue
+	}
+}
+
+func TestDeploymentController_cleanupUnhealthyReplicas(t *testing.T) {
+	tests := []struct {
+		oldReplicas          int
+		readyPods            int
+		unHealthyPods        int
+		maxCleanupCount      int
+		cleanupCountExpected int
+	}{
+		{
+			oldReplicas:          10,
+			readyPods:            8,
+			unHealthyPods:        2,
+			maxCleanupCount:      1,
+			cleanupCountExpected: 1,
+		},
+		{
+			oldReplicas:          10,
+			readyPods:            8,
+			unHealthyPods:        2,
+			maxCleanupCount:      3,
+			cleanupCountExpected: 2,
+		},
+		{
+			oldReplicas:          10,
+			readyPods:            8,
+			unHealthyPods:        2,
+			maxCleanupCount:      0,
+			cleanupCountExpected: 0,
+		},
+		{
+			oldReplicas:          10,
+			readyPods:            10,
+			unHealthyPods:        0,
+			maxCleanupCount:      3,
+			cleanupCountExpected: 0,
+		},
+	}
+
+	for i, test := range tests {
+		t.Logf("executing scenario %d", i)
+		oldRS := rs("foo-v2", test.oldReplicas, nil, noTimestamp)
+		oldRS.Status.AvailableReplicas = int32(test.readyPods)
+		oldRSs := []*extensions.ReplicaSet{oldRS}
+		maxSurge := intstr.FromInt(2)
+		maxUnavailable := intstr.FromInt(2)
+		deployment := newDeployment("foo", 10, nil, &maxSurge, &maxUnavailable, nil)
+		fakeClientset := fake.Clientset{}
+
+		controller := &DeploymentController{
+			client:        &fakeClientset,
+			eventRecorder: &record.FakeRecorder{},
+		}
+		_, cleanupCount, err := controller.cleanupUnhealthyReplicas(oldRSs, deployment, int32(test.maxCleanupCount))
+		if err != nil {
+			t.Errorf("unexpected error: %v", err)
+			continue
+		}
+		if int(cleanupCount) != test.cleanupCountExpected {
+			t.Errorf("expected %v unhealthy replicas been cleaned up, got %v", test.cleanupCountExpected, cleanupCount)
+			continue
+		}
+	}
+}
+
+func TestDeploymentController_scaleDownOldReplicaSetsForRollingUpdate(t *testing.T) {
+	tests := []struct {
+		deploymentReplicas  int
+		maxUnavailable      intstr.IntOrString
+		readyPods           int
+		oldReplicas         int
+		scaleExpected       bool
+		expectedOldReplicas int
+	}{
+		{
+			deploymentReplicas:  10,
+			maxUnavailable:      intstr.FromInt(0),
+			readyPods:           10,
+			oldReplicas:         10,
+			scaleExpected:       true,
+			expectedOldReplicas: 9,
+		},
+		{
+			deploymentReplicas:  10,
+			maxUnavailable:      intstr.FromInt(2),
+			readyPods:           10,
+			oldReplicas:         10,
+			scaleExpected:       true,
+			expectedOldReplicas: 8,
+		},
+		{
+			deploymentReplicas: 10,
+			maxUnavailable:     intstr.FromInt(2),
+			readyPods:          8,
+			oldReplicas:        10,
+			scaleExpected:      false,
+		},
+		{
+			deploymentReplicas: 10,
+			maxUnavailable:     intstr.FromInt(2),
+			readyPods:          10,
+			oldReplicas:        0,
+			scaleExpected:      false,
+		},
+		{
+			deploymentReplicas: 10,
+			maxUnavailable:     intstr.FromInt(2),
+			readyPods:          1,
+			oldReplicas:        10,
+			scaleExpected:      false,
+		},
+	}
+
+	for i := range tests {
+		test := tests[i]
+		t.Logf("executing scenario %d", i)
+		oldRS := rs("foo-v2", test.oldReplicas, nil, noTimestamp)
+		oldRS.Status.AvailableReplicas = int32(test.readyPods)
+		allRSs := []*extensions.ReplicaSet{oldRS}
+		oldRSs := []*extensions.ReplicaSet{oldRS}
+		maxSurge := intstr.FromInt(0)
+		deployment := newDeployment("foo", test.deploymentReplicas, nil, &maxSurge, &test.maxUnavailable, map[string]string{"foo": "bar"})
+		fakeClientset := fake.Clientset{}
+		controller := &DeploymentController{
+			client:        &fakeClientset,
+			eventRecorder: &record.FakeRecorder{},
+		}
+		scaled, err := controller.scaleDownOldReplicaSetsForRollingUpdate(allRSs, oldRSs, deployment)
+		if err != nil {
+			t.Errorf("unexpected error: %v", err)
+			continue
+		}
+		if !test.scaleExpected {
+			if scaled != 0 {
+				t.Errorf("unexpected scaling: %v", fakeClientset.Actions())
+			}
+			continue
+		}
+		if test.scaleExpected && scaled == 0 {
+			t.Errorf("expected scaling to occur; actions: %v", fakeClientset.Actions())
+			continue
+		}
+		// There are both list and update actions logged, so extract the update
+		// action for verification.
+		var updateAction core.UpdateAction
+		for _, action := range fakeClientset.Actions() {
+			switch a := action.(type) {
+			case core.UpdateAction:
+				if updateAction != nil {
+					t.Errorf("expected only 1 update action; had %v and found %v", updateAction, a)
+				} else {
+					updateAction = a
+				}
+			}
+		}
+		if updateAction == nil {
+			t.Errorf("expected an update action")
+			continue
+		}
+		updated := updateAction.GetObject().(*extensions.ReplicaSet)
+		if e, a := test.expectedOldReplicas, int(*(updated.Spec.Replicas)); e != a {
+			t.Errorf("expected update to %d replicas, got %d", e, a)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/deployment/sync.go

@@ -0,0 +1,639 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deployment
+
+import (
+	"fmt"
+	"reflect"
+	"sort"
+	"strconv"
+
+	"github.com/golang/glog"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/controller"
+	deploymentutil "k8s.io/kubernetes/pkg/controller/deployment/util"
+	labelsutil "k8s.io/kubernetes/pkg/util/labels"
+)
+
+// syncStatusOnly only updates Deployments Status and doesn't take any mutating actions.
+func (dc *DeploymentController) syncStatusOnly(deployment *extensions.Deployment) error {
+	newRS, oldRSs, err := dc.getAllReplicaSetsAndSyncRevision(deployment, false)
+	if err != nil {
+		return err
+	}
+
+	allRSs := append(oldRSs, newRS)
+	return dc.syncDeploymentStatus(allRSs, newRS, deployment)
+}
+
+// sync is responsible for reconciling deployments on scaling events or when they
+// are paused.
+func (dc *DeploymentController) sync(deployment *extensions.Deployment) error {
+	newRS, oldRSs, err := dc.getAllReplicaSetsAndSyncRevision(deployment, false)
+	if err != nil {
+		return err
+	}
+	if err := dc.scale(deployment, newRS, oldRSs); err != nil {
+		// If we get an error while trying to scale, the deployment will be requeued
+		// so we can abort this resync
+		return err
+	}
+	dc.cleanupDeployment(oldRSs, deployment)
+
+	allRSs := append(oldRSs, newRS)
+	return dc.syncDeploymentStatus(allRSs, newRS, deployment)
+}
+
+// checkPausedConditions checks if the given deployment is paused or not and adds an appropriate condition.
+// These conditions are needed so that we won't accidentally report lack of progress for resumed deployments
+// that were paused for longer than progressDeadlineSeconds.
+func (dc *DeploymentController) checkPausedConditions(d *extensions.Deployment) error {
+	if d.Spec.ProgressDeadlineSeconds == nil {
+		return nil
+	}
+	cond := deploymentutil.GetDeploymentCondition(d.Status, extensions.DeploymentProgressing)
+	if cond != nil && cond.Reason == deploymentutil.TimedOutReason {
+		// If we have reported lack of progress, do not overwrite it with a paused condition.
+		return nil
+	}
+	pausedCondExists := cond != nil && cond.Reason == deploymentutil.PausedDeployReason
+
+	needsUpdate := false
+	if d.Spec.Paused && !pausedCondExists {
+		condition := deploymentutil.NewDeploymentCondition(extensions.DeploymentProgressing, v1.ConditionUnknown, deploymentutil.PausedDeployReason, "Deployment is paused")
+		deploymentutil.SetDeploymentCondition(&d.Status, *condition)
+		needsUpdate = true
+	} else if !d.Spec.Paused && pausedCondExists {
+		condition := deploymentutil.NewDeploymentCondition(extensions.DeploymentProgressing, v1.ConditionUnknown, deploymentutil.ResumedDeployReason, "Deployment is resumed")
+		deploymentutil.SetDeploymentCondition(&d.Status, *condition)
+		needsUpdate = true
+	}
+
+	if !needsUpdate {
+		return nil
+	}
+
+	var err error
+	d, err = dc.client.Extensions().Deployments(d.Namespace).UpdateStatus(d)
+	return err
+}
+
+// getAllReplicaSetsAndSyncRevision returns all the replica sets for the provided deployment (new and all old), with new RS's and deployment's revision updated.
+// 1. Get all old RSes this deployment targets, and calculate the max revision number among them (maxOldV).
+// 2. Get new RS this deployment targets (whose pod template matches deployment's), and update new RS's revision number to (maxOldV + 1),
+//    only if its revision number is smaller than (maxOldV + 1). If this step failed, we'll update it in the next deployment sync loop.
+// 3. Copy new RS's revision number to deployment (update deployment's revision). If this step failed, we'll update it in the next deployment sync loop.
+// Note that currently the deployment controller is using caches to avoid querying the server for reads.
+// This may lead to stale reads of replica sets, thus incorrect deployment status.
+func (dc *DeploymentController) getAllReplicaSetsAndSyncRevision(deployment *extensions.Deployment, createIfNotExisted bool) (*extensions.ReplicaSet, []*extensions.ReplicaSet, error) {
+	// List the deployment's RSes & Pods and apply pod-template-hash info to deployment's adopted RSes/Pods
+	rsList, podList, err := dc.rsAndPodsWithHashKeySynced(deployment)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error labeling replica sets and pods with pod-template-hash: %v", err)
+	}
+	_, allOldRSs, err := deploymentutil.FindOldReplicaSets(deployment, rsList, podList)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Get new replica set with the updated revision number
+	newRS, err := dc.getNewReplicaSet(deployment, rsList, allOldRSs, createIfNotExisted)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return newRS, allOldRSs, nil
+}
+
+// rsAndPodsWithHashKeySynced returns the RSes and pods the given deployment targets, with pod-template-hash information synced.
+func (dc *DeploymentController) rsAndPodsWithHashKeySynced(deployment *extensions.Deployment) ([]*extensions.ReplicaSet, *v1.PodList, error) {
+	rsList, err := deploymentutil.ListReplicaSets(deployment,
+		func(namespace string, options v1.ListOptions) ([]*extensions.ReplicaSet, error) {
+			parsed, err := labels.Parse(options.LabelSelector)
+			if err != nil {
+				return nil, err
+			}
+			return dc.rsLister.ReplicaSets(namespace).List(parsed)
+		})
+	if err != nil {
+		return nil, nil, fmt.Errorf("error listing ReplicaSets: %v", err)
+	}
+	syncedRSList := []*extensions.ReplicaSet{}
+	for _, rs := range rsList {
+		// Add pod-template-hash information if it's not in the RS.
+		// Otherwise, new RS produced by Deployment will overlap with pre-existing ones
+		// that aren't constrained by the pod-template-hash.
+		syncedRS, err := dc.addHashKeyToRSAndPods(rs)
+		if err != nil {
+			return nil, nil, err
+		}
+		syncedRSList = append(syncedRSList, syncedRS)
+	}
+	syncedPodList, err := dc.listPods(deployment)
+	if err != nil {
+		return nil, nil, err
+	}
+	return syncedRSList, syncedPodList, nil
+}
+
+// addHashKeyToRSAndPods adds pod-template-hash information to the given rs, if it's not already there, with the following steps:
+// 1. Add hash label to the rs's pod template, and make sure the controller sees this update so that no orphaned pods will be created
+// 2. Add hash label to all pods this rs owns, wait until replicaset controller reports rs.Status.FullyLabeledReplicas equal to the desired number of replicas
+// 3. Add hash label to the rs's label and selector
+func (dc *DeploymentController) addHashKeyToRSAndPods(rs *extensions.ReplicaSet) (*extensions.ReplicaSet, error) {
+	// If the rs already has the new hash label in its selector, it's done syncing
+	if labelsutil.SelectorHasLabel(rs.Spec.Selector, extensions.DefaultDeploymentUniqueLabelKey) {
+		return rs, nil
+	}
+	hash := deploymentutil.GetReplicaSetHash(rs)
+	// 1. Add hash template label to the rs. This ensures that any newly created pods will have the new label.
+	updatedRS, err := deploymentutil.UpdateRSWithRetries(dc.client.Extensions().ReplicaSets(rs.Namespace), dc.rsLister, rs.Namespace, rs.Name,
+		func(updated *extensions.ReplicaSet) error {
+			// Precondition: the RS doesn't contain the new hash in its pod template label.
+			if updated.Spec.Template.Labels[extensions.DefaultDeploymentUniqueLabelKey] == hash {
+				return utilerrors.ErrPreconditionViolated
+			}
+			updated.Spec.Template.Labels = labelsutil.AddLabel(updated.Spec.Template.Labels, extensions.DefaultDeploymentUniqueLabelKey, hash)
+			return nil
+		})
+	if err != nil {
+		return nil, fmt.Errorf("error updating replica set %s/%s pod template label with template hash: %v", rs.Namespace, rs.Name, err)
+	}
+	// Make sure rs pod template is updated so that it won't create pods without the new label (orphaned pods).
+	if updatedRS.Generation > updatedRS.Status.ObservedGeneration {
+		if err = deploymentutil.WaitForReplicaSetUpdated(dc.client, updatedRS.Generation, updatedRS.Namespace, updatedRS.Name); err != nil {
+			return nil, fmt.Errorf("error waiting for replica set %s/%s to be observed by controller: %v", updatedRS.Namespace, updatedRS.Name, err)
+		}
+		glog.V(4).Infof("Observed the update of replica set %s/%s's pod template with hash %s.", rs.Namespace, rs.Name, hash)
+	}
+
+	// 2. Update all pods managed by the rs to have the new hash label, so they will be correctly adopted.
+	selector, err := metav1.LabelSelectorAsSelector(updatedRS.Spec.Selector)
+	if err != nil {
+		return nil, fmt.Errorf("error in converting selector to label selector for replica set %s: %s", updatedRS.Name, err)
+	}
+	options := v1.ListOptions{LabelSelector: selector.String()}
+	parsed, err := labels.Parse(options.LabelSelector)
+	if err != nil {
+		return nil, err
+	}
+	pods, err := dc.podLister.Pods(updatedRS.Namespace).List(parsed)
+	if err != nil {
+		return nil, fmt.Errorf("error in getting pod list for namespace %s and list options %+v: %s", rs.Namespace, options, err)
+	}
+	podList := v1.PodList{Items: make([]v1.Pod, 0, len(pods))}
+	for i := range pods {
+		podList.Items = append(podList.Items, *pods[i])
+	}
+	if err := deploymentutil.LabelPodsWithHash(&podList, dc.client, dc.podLister, rs.Namespace, rs.Name, hash); err != nil {
+		return nil, fmt.Errorf("error in adding template hash label %s to pods %+v: %s", hash, podList, err)
+	}
+
+	// We need to wait for the replicaset controller to observe the pods being
+	// labeled with pod template hash. Because previously we've called
+	// WaitForReplicaSetUpdated, the replicaset controller should have dropped
+	// FullyLabeledReplicas to 0 already, we only need to wait it to increase
+	// back to the number of replicas in the spec.
+	if err := deploymentutil.WaitForPodsHashPopulated(dc.client, updatedRS.Generation, updatedRS.Namespace, updatedRS.Name); err != nil {
+		return nil, fmt.Errorf("Replica set %s/%s: error waiting for replicaset controller to observe pods being labeled with template hash: %v", updatedRS.Namespace, updatedRS.Name, err)
+	}
+
+	// 3. Update rs label and selector to include the new hash label
+	// Copy the old selector, so that we can scrub out any orphaned pods
+	updatedRS, err = deploymentutil.UpdateRSWithRetries(dc.client.Extensions().ReplicaSets(rs.Namespace), dc.rsLister, rs.Namespace, rs.Name, func(updated *extensions.ReplicaSet) error {
+		// Precondition: the RS doesn't contain the new hash in its label and selector.
+		if updated.Labels[extensions.DefaultDeploymentUniqueLabelKey] == hash && updated.Spec.Selector.MatchLabels[extensions.DefaultDeploymentUniqueLabelKey] == hash {
+			return utilerrors.ErrPreconditionViolated
+		}
+		updated.Labels = labelsutil.AddLabel(updated.Labels, extensions.DefaultDeploymentUniqueLabelKey, hash)
+		updated.Spec.Selector = labelsutil.AddLabelToSelector(updated.Spec.Selector, extensions.DefaultDeploymentUniqueLabelKey, hash)
+		return nil
+	})
+	// If the RS isn't actually updated, that's okay, we'll retry in the
+	// next sync loop since its selector isn't updated yet.
+	if err != nil {
+		return nil, fmt.Errorf("error updating ReplicaSet %s/%s label and selector with template hash: %v", updatedRS.Namespace, updatedRS.Name, err)
+	}
+
+	// TODO: look for orphaned pods and label them in the background somewhere else periodically
+	return updatedRS, nil
+}
+
+func (dc *DeploymentController) listPods(deployment *extensions.Deployment) (*v1.PodList, error) {
+	return deploymentutil.ListPods(deployment,
+		func(namespace string, options v1.ListOptions) (*v1.PodList, error) {
+			parsed, err := labels.Parse(options.LabelSelector)
+			if err != nil {
+				return nil, err
+			}
+			pods, err := dc.podLister.Pods(namespace).List(parsed)
+			result := v1.PodList{Items: make([]v1.Pod, 0, len(pods))}
+			for i := range pods {
+				result.Items = append(result.Items, *pods[i])
+			}
+			return &result, err
+		})
+}
+
+// Returns a replica set that matches the intent of the given deployment. Returns nil if the new replica set doesn't exist yet.
+// 1. Get existing new RS (the RS that the given deployment targets, whose pod template is the same as deployment's).
+// 2. If there's existing new RS, update its revision number if it's smaller than (maxOldRevision + 1), where maxOldRevision is the max revision number among all old RSes.
+// 3. If there's no existing new RS and createIfNotExisted is true, create one with appropriate revision number (maxOldRevision + 1) and replicas.
+// Note that the pod-template-hash will be added to adopted RSes and pods.
+func (dc *DeploymentController) getNewReplicaSet(deployment *extensions.Deployment, rsList, oldRSs []*extensions.ReplicaSet, createIfNotExisted bool) (*extensions.ReplicaSet, error) {
+	existingNewRS, err := deploymentutil.FindNewReplicaSet(deployment, rsList)
+	if err != nil {
+		return nil, err
+	}
+
+	// Calculate the max revision number among all old RSes
+	maxOldRevision := deploymentutil.MaxRevision(oldRSs)
+	// Calculate revision number for this new replica set
+	newRevision := strconv.FormatInt(maxOldRevision+1, 10)
+
+	// Latest replica set exists. We need to sync its annotations (includes copying all but
+	// annotationsToSkip from the parent deployment, and update revision, desiredReplicas,
+	// and maxReplicas) and also update the revision annotation in the deployment with the
+	// latest revision.
+	if existingNewRS != nil {
+		objCopy, err := api.Scheme.Copy(existingNewRS)
+		if err != nil {
+			return nil, err
+		}
+		rsCopy := objCopy.(*extensions.ReplicaSet)
+
+		// Set existing new replica set's annotation
+		annotationsUpdated := deploymentutil.SetNewReplicaSetAnnotations(deployment, rsCopy, newRevision, true)
+		minReadySecondsNeedsUpdate := rsCopy.Spec.MinReadySeconds != deployment.Spec.MinReadySeconds
+		if annotationsUpdated || minReadySecondsNeedsUpdate {
+			rsCopy.Spec.MinReadySeconds = deployment.Spec.MinReadySeconds
+			return dc.client.Extensions().ReplicaSets(rsCopy.ObjectMeta.Namespace).Update(rsCopy)
+		}
+
+		updateConditions := deploymentutil.SetDeploymentRevision(deployment, newRevision)
+		// If no other Progressing condition has been recorded and we need to estimate the progress
+		// of this deployment then it is likely that old users started caring about progress. In that
+		// case we need to take into account the first time we noticed their new replica set.
+		cond := deploymentutil.GetDeploymentCondition(deployment.Status, extensions.DeploymentProgressing)
+		if deployment.Spec.ProgressDeadlineSeconds != nil && cond == nil {
+			msg := fmt.Sprintf("Found new replica set %q", rsCopy.Name)
+			condition := deploymentutil.NewDeploymentCondition(extensions.DeploymentProgressing, v1.ConditionTrue, deploymentutil.FoundNewRSReason, msg)
+			deploymentutil.SetDeploymentCondition(&deployment.Status, *condition)
+			updateConditions = true
+		}
+
+		if updateConditions {
+			if deployment, err = dc.client.Extensions().Deployments(deployment.Namespace).UpdateStatus(deployment); err != nil {
+				return nil, err
+			}
+		}
+		return rsCopy, nil
+	}
+
+	if !createIfNotExisted {
+		return nil, nil
+	}
+
+	// new ReplicaSet does not exist, create one.
+	namespace := deployment.Namespace
+	podTemplateSpecHash := fmt.Sprintf("%d", deploymentutil.GetPodTemplateSpecHash(deployment.Spec.Template))
+	newRSTemplate := deploymentutil.GetNewReplicaSetTemplate(deployment)
+	newRSTemplate.Labels = labelsutil.CloneAndAddLabel(deployment.Spec.Template.Labels, extensions.DefaultDeploymentUniqueLabelKey, podTemplateSpecHash)
+	// Add podTemplateHash label to selector.
+	newRSSelector := labelsutil.CloneSelectorAndAddLabel(deployment.Spec.Selector, extensions.DefaultDeploymentUniqueLabelKey, podTemplateSpecHash)
+
+	// Create new ReplicaSet
+	newRS := extensions.ReplicaSet{
+		ObjectMeta: v1.ObjectMeta{
+			// Make the name deterministic, to ensure idempotence
+			Name:      deployment.Name + "-" + podTemplateSpecHash,
+			Namespace: namespace,
+		},
+		Spec: extensions.ReplicaSetSpec{
+			Replicas:        func(i int32) *int32 { return &i }(0),
+			MinReadySeconds: deployment.Spec.MinReadySeconds,
+			Selector:        newRSSelector,
+			Template:        newRSTemplate,
+		},
+	}
+	var trueVar = true
+	controllerRef := &metav1.OwnerReference{
+		APIVersion: getDeploymentKind().GroupVersion().String(),
+		Kind:       getDeploymentKind().Kind,
+		Name:       deployment.Name,
+		UID:        deployment.UID,
+		Controller: &trueVar,
+	}
+	newRS.OwnerReferences = append(newRS.OwnerReferences, *controllerRef)
+	allRSs := append(oldRSs, &newRS)
+	newReplicasCount, err := deploymentutil.NewRSNewReplicas(deployment, allRSs, &newRS)
+	if err != nil {
+		return nil, err
+	}
+
+	*(newRS.Spec.Replicas) = newReplicasCount
+	// Set new replica set's annotation
+	deploymentutil.SetNewReplicaSetAnnotations(deployment, &newRS, newRevision, false)
+	createdRS, err := dc.client.Extensions().ReplicaSets(namespace).Create(&newRS)
+	switch {
+	// We may end up hitting this due to a slow cache or a fast resync of the deployment.
+	// TODO: Restore once https://github.com/kubernetes/kubernetes/issues/29735 is fixed
+	// ie. we start using a new hashing algorithm.
+	case errors.IsAlreadyExists(err):
+		return nil, err
+	//	return dc.rsLister.ReplicaSets(namespace).Get(newRS.Name)
+	case err != nil:
+		msg := fmt.Sprintf("Failed to create new replica set %q: %v", newRS.Name, err)
+		if deployment.Spec.ProgressDeadlineSeconds != nil {
+			cond := deploymentutil.NewDeploymentCondition(extensions.DeploymentProgressing, v1.ConditionFalse, deploymentutil.FailedRSCreateReason, msg)
+			deploymentutil.SetDeploymentCondition(&deployment.Status, *cond)
+			// We don't really care about this error at this point, since we have a bigger issue to report.
+			// TODO: Update the rest of the Deployment status, too. We may need to do this every time we
+			// error out in all other places in the controller so that we let users know that their deployments
+			// have been noticed by the controller, albeit with errors.
+			// TODO: Identify which errors are permanent and switch DeploymentIsFailed to take into account
+			// these reasons as well. Related issue: https://github.com/kubernetes/kubernetes/issues/18568
+			_, _ = dc.client.Extensions().Deployments(deployment.ObjectMeta.Namespace).UpdateStatus(deployment)
+		}
+		dc.eventRecorder.Eventf(deployment, v1.EventTypeWarning, deploymentutil.FailedRSCreateReason, msg)
+		return nil, err
+	}
+	if newReplicasCount > 0 {
+		dc.eventRecorder.Eventf(deployment, v1.EventTypeNormal, "ScalingReplicaSet", "Scaled up replica set %s to %d", createdRS.Name, newReplicasCount)
+	}
+
+	deploymentutil.SetDeploymentRevision(deployment, newRevision)
+	if deployment.Spec.ProgressDeadlineSeconds != nil {
+		msg := fmt.Sprintf("Created new replica set %q", createdRS.Name)
+		condition := deploymentutil.NewDeploymentCondition(extensions.DeploymentProgressing, v1.ConditionTrue, deploymentutil.NewReplicaSetReason, msg)
+		deploymentutil.SetDeploymentCondition(&deployment.Status, *condition)
+	}
+	_, err = dc.client.Extensions().Deployments(deployment.Namespace).UpdateStatus(deployment)
+	return createdRS, err
+}
+
+// scale scales proportionally in order to mitigate risk. Otherwise, scaling up can increase the size
+// of the new replica set and scaling down can decrease the sizes of the old ones, both of which would
+// have the effect of hastening the rollout progress, which could produce a higher proportion of unavailable
+// replicas in the event of a problem with the rolled out template. Should run only on scaling events or
+// when a deployment is paused and not during the normal rollout process.
+func (dc *DeploymentController) scale(deployment *extensions.Deployment, newRS *extensions.ReplicaSet, oldRSs []*extensions.ReplicaSet) error {
+	// If there is only one active replica set then we should scale that up to the full count of the
+	// deployment. If there is no active replica set, then we should scale up the newest replica set.
+	if activeOrLatest := deploymentutil.FindActiveOrLatest(newRS, oldRSs); activeOrLatest != nil {
+		if *(activeOrLatest.Spec.Replicas) == *(deployment.Spec.Replicas) {
+			return nil
+		}
+		_, _, err := dc.scaleReplicaSetAndRecordEvent(activeOrLatest, *(deployment.Spec.Replicas), deployment)
+		return err
+	}
+
+	// If the new replica set is saturated, old replica sets should be fully scaled down.
+	// This case handles replica set adoption during a saturated new replica set.
+	if deploymentutil.IsSaturated(deployment, newRS) {
+		for _, old := range controller.FilterActiveReplicaSets(oldRSs) {
+			if _, _, err := dc.scaleReplicaSetAndRecordEvent(old, 0, deployment); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	// There are old replica sets with pods and the new replica set is not saturated.
+	// We need to proportionally scale all replica sets (new and old) in case of a
+	// rolling deployment.
+	if deploymentutil.IsRollingUpdate(deployment) {
+		allRSs := controller.FilterActiveReplicaSets(append(oldRSs, newRS))
+		allRSsReplicas := deploymentutil.GetReplicaCountForReplicaSets(allRSs)
+
+		allowedSize := int32(0)
+		if *(deployment.Spec.Replicas) > 0 {
+			allowedSize = *(deployment.Spec.Replicas) + deploymentutil.MaxSurge(*deployment)
+		}
+
+		// Number of additional replicas that can be either added or removed from the total
+		// replicas count. These replicas should be distributed proportionally to the active
+		// replica sets.
+		deploymentReplicasToAdd := allowedSize - allRSsReplicas
+
+		// The additional replicas should be distributed proportionally amongst the active
+		// replica sets from the larger to the smaller in size replica set. Scaling direction
+		// drives what happens in case we are trying to scale replica sets of the same size.
+		// In such a case when scaling up, we should scale up newer replica sets first, and
+		// when scaling down, we should scale down older replica sets first.
+		var scalingOperation string
+		switch {
+		case deploymentReplicasToAdd > 0:
+			sort.Sort(controller.ReplicaSetsBySizeNewer(allRSs))
+			scalingOperation = "up"
+
+		case deploymentReplicasToAdd < 0:
+			sort.Sort(controller.ReplicaSetsBySizeOlder(allRSs))
+			scalingOperation = "down"
+		}
+
+		// Iterate over all active replica sets and estimate proportions for each of them.
+		// The absolute value of deploymentReplicasAdded should never exceed the absolute
+		// value of deploymentReplicasToAdd.
+		deploymentReplicasAdded := int32(0)
+		nameToSize := make(map[string]int32)
+		for i := range allRSs {
+			rs := allRSs[i]
+
+			// Estimate proportions if we have replicas to add, otherwise simply populate
+			// nameToSize with the current sizes for each replica set.
+			if deploymentReplicasToAdd != 0 {
+				proportion := deploymentutil.GetProportion(rs, *deployment, deploymentReplicasToAdd, deploymentReplicasAdded)
+
+				nameToSize[rs.Name] = *(rs.Spec.Replicas) + proportion
+				deploymentReplicasAdded += proportion
+			} else {
+				nameToSize[rs.Name] = *(rs.Spec.Replicas)
+			}
+		}
+
+		// Update all replica sets
+		for i := range allRSs {
+			rs := allRSs[i]
+
+			// Add/remove any leftovers to the largest replica set.
+			if i == 0 && deploymentReplicasToAdd != 0 {
+				leftover := deploymentReplicasToAdd - deploymentReplicasAdded
+				nameToSize[rs.Name] = nameToSize[rs.Name] + leftover
+				if nameToSize[rs.Name] < 0 {
+					nameToSize[rs.Name] = 0
+				}
+			}
+
+			// TODO: Use transactions when we have them.
+			if _, _, err := dc.scaleReplicaSet(rs, nameToSize[rs.Name], deployment, scalingOperation); err != nil {
+				// Return as soon as we fail, the deployment is requeued
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (dc *DeploymentController) scaleReplicaSetAndRecordEvent(rs *extensions.ReplicaSet, newScale int32, deployment *extensions.Deployment) (bool, *extensions.ReplicaSet, error) {
+	// No need to scale
+	if *(rs.Spec.Replicas) == newScale {
+		return false, rs, nil
+	}
+	var scalingOperation string
+	if *(rs.Spec.Replicas) < newScale {
+		scalingOperation = "up"
+	} else {
+		scalingOperation = "down"
+	}
+	scaled, newRS, err := dc.scaleReplicaSet(rs, newScale, deployment, scalingOperation)
+	return scaled, newRS, err
+}
+
+func (dc *DeploymentController) scaleReplicaSet(rs *extensions.ReplicaSet, newScale int32, deployment *extensions.Deployment, scalingOperation string) (bool, *extensions.ReplicaSet, error) {
+	objCopy, err := api.Scheme.Copy(rs)
+	if err != nil {
+		return false, nil, err
+	}
+	rsCopy := objCopy.(*extensions.ReplicaSet)
+
+	sizeNeedsUpdate := *(rsCopy.Spec.Replicas) != newScale
+	// TODO: Do not mutate the replica set here, instead simply compare the annotation and if they mismatch
+	// call SetReplicasAnnotations inside the following if clause. Then we can also move the deep-copy from
+	// above inside the if too.
+	annotationsNeedUpdate := deploymentutil.SetReplicasAnnotations(rsCopy, *(deployment.Spec.Replicas), *(deployment.Spec.Replicas)+deploymentutil.MaxSurge(*deployment))
+
+	scaled := false
+	if sizeNeedsUpdate || annotationsNeedUpdate {
+		*(rsCopy.Spec.Replicas) = newScale
+		rs, err = dc.client.Extensions().ReplicaSets(rsCopy.Namespace).Update(rsCopy)
+		if err == nil && sizeNeedsUpdate {
+			scaled = true
+			dc.eventRecorder.Eventf(deployment, v1.EventTypeNormal, "ScalingReplicaSet", "Scaled %s replica set %s to %d", scalingOperation, rs.Name, newScale)
+		}
+	}
+	return scaled, rs, err
+}
+
+// cleanupDeployment is responsible for cleaning up a deployment ie. retains all but the latest N old replica sets
+// where N=d.Spec.RevisionHistoryLimit. Old replica sets are older versions of the podtemplate of a deployment kept
+// around by default 1) for historical reasons and 2) for the ability to rollback a deployment.
+func (dc *DeploymentController) cleanupDeployment(oldRSs []*extensions.ReplicaSet, deployment *extensions.Deployment) error {
+	if deployment.Spec.RevisionHistoryLimit == nil {
+		return nil
+	}
+	diff := int32(len(oldRSs)) - *deployment.Spec.RevisionHistoryLimit
+	if diff <= 0 {
+		return nil
+	}
+
+	sort.Sort(controller.ReplicaSetsByCreationTimestamp(oldRSs))
+
+	var errList []error
+	// TODO: This should be parallelized.
+	for i := int32(0); i < diff; i++ {
+		rs := oldRSs[i]
+		// Avoid delete replica set with non-zero replica counts
+		if rs.Status.Replicas != 0 || *(rs.Spec.Replicas) != 0 || rs.Generation > rs.Status.ObservedGeneration {
+			continue
+		}
+		if err := dc.client.Extensions().ReplicaSets(rs.Namespace).Delete(rs.Name, nil); err != nil && !errors.IsNotFound(err) {
+			glog.V(2).Infof("Failed deleting old replica set %v for deployment %v: %v", rs.Name, deployment.Name, err)
+			errList = append(errList, err)
+		}
+	}
+
+	return utilerrors.NewAggregate(errList)
+}
+
+// syncDeploymentStatus checks if the status is up-to-date and sync it if necessary
+func (dc *DeploymentController) syncDeploymentStatus(allRSs []*extensions.ReplicaSet, newRS *extensions.ReplicaSet, d *extensions.Deployment) error {
+	newStatus := calculateStatus(allRSs, newRS, d)
+
+	if reflect.DeepEqual(d.Status, newStatus) {
+		return nil
+	}
+
+	newDeployment := d
+	newDeployment.Status = newStatus
+	_, err := dc.client.Extensions().Deployments(newDeployment.Namespace).UpdateStatus(newDeployment)
+	return err
+}
+
+// calculateStatus calculates the latest status for the provided deployment by looking into the provided replica sets.
+func calculateStatus(allRSs []*extensions.ReplicaSet, newRS *extensions.ReplicaSet, deployment *extensions.Deployment) extensions.DeploymentStatus {
+	availableReplicas := deploymentutil.GetAvailableReplicaCountForReplicaSets(allRSs)
+	totalReplicas := deploymentutil.GetReplicaCountForReplicaSets(allRSs)
+	unavailableReplicas := totalReplicas - availableReplicas
+	// If unavailableReplicas is negative, then that means the Deployment has more available replicas running than
+	// desired, eg. whenever it scales down. In such a case we should simply default unavailableReplicas to zero.
+	if unavailableReplicas < 0 {
+		unavailableReplicas = 0
+	}
+
+	status := extensions.DeploymentStatus{
+		// TODO: Ensure that if we start retrying status updates, we won't pick up a new Generation value.
+		ObservedGeneration:  deployment.Generation,
+		Replicas:            deploymentutil.GetActualReplicaCountForReplicaSets(allRSs),
+		UpdatedReplicas:     deploymentutil.GetActualReplicaCountForReplicaSets([]*extensions.ReplicaSet{newRS}),
+		ReadyReplicas:       deploymentutil.GetReadyReplicaCountForReplicaSets(allRSs),
+		AvailableReplicas:   availableReplicas,
+		UnavailableReplicas: unavailableReplicas,
+	}
+
+	// Copy conditions one by one so we won't mutate the original object.
+	conditions := deployment.Status.Conditions
+	for i := range conditions {
+		status.Conditions = append(status.Conditions, conditions[i])
+	}
+
+	if availableReplicas >= *(deployment.Spec.Replicas)-deploymentutil.MaxUnavailable(*deployment) {
+		minAvailability := deploymentutil.NewDeploymentCondition(extensions.DeploymentAvailable, v1.ConditionTrue, deploymentutil.MinimumReplicasAvailable, "Deployment has minimum availability.")
+		deploymentutil.SetDeploymentCondition(&status, *minAvailability)
+	} else {
+		noMinAvailability := deploymentutil.NewDeploymentCondition(extensions.DeploymentAvailable, v1.ConditionFalse, deploymentutil.MinimumReplicasUnavailable, "Deployment does not have minimum availability.")
+		deploymentutil.SetDeploymentCondition(&status, *noMinAvailability)
+	}
+
+	return status
+}
+
+// isScalingEvent checks whether the provided deployment has been updated with a scaling event
+// by looking at the desired-replicas annotation in the active replica sets of the deployment.
+func (dc *DeploymentController) isScalingEvent(d *extensions.Deployment) (bool, error) {
+	newRS, oldRSs, err := dc.getAllReplicaSetsAndSyncRevision(d, false)
+	if err != nil {
+		return false, err
+	}
+	allRSs := append(oldRSs, newRS)
+	for _, rs := range controller.FilterActiveReplicaSets(allRSs) {
+		desired, ok := deploymentutil.GetDesiredReplicasAnnotation(rs)
+		if !ok {
+			continue
+		}
+		if desired != *(d.Spec.Replicas) {
+			return true, nil
+		}
+	}
+	return false, nil
+}

vendor/k8s.io/kubernetes/pkg/controller/deployment/sync_test.go

@@ -0,0 +1,403 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deployment
+
+import (
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/fake"
+	"k8s.io/kubernetes/pkg/client/record"
+	testclient "k8s.io/kubernetes/pkg/client/testing/core"
+	"k8s.io/kubernetes/pkg/controller"
+	deploymentutil "k8s.io/kubernetes/pkg/controller/deployment/util"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/util/intstr"
+)
+
+func maxSurge(val int) *intstr.IntOrString {
+	surge := intstr.FromInt(val)
+	return &surge
+}
+
+func TestScale(t *testing.T) {
+	newTimestamp := metav1.Date(2016, 5, 20, 2, 0, 0, 0, time.UTC)
+	oldTimestamp := metav1.Date(2016, 5, 20, 1, 0, 0, 0, time.UTC)
+	olderTimestamp := metav1.Date(2016, 5, 20, 0, 0, 0, 0, time.UTC)
+
+	var updatedTemplate = func(replicas int) *extensions.Deployment {
+		d := newDeployment("foo", replicas, nil, nil, nil, map[string]string{"foo": "bar"})
+		d.Spec.Template.Labels["another"] = "label"
+		return d
+	}
+
+	tests := []struct {
+		name          string
+		deployment    *extensions.Deployment
+		oldDeployment *extensions.Deployment
+
+		newRS  *extensions.ReplicaSet
+		oldRSs []*extensions.ReplicaSet
+
+		expectedNew  *extensions.ReplicaSet
+		expectedOld  []*extensions.ReplicaSet
+		wasntUpdated map[string]bool
+
+		desiredReplicasAnnotations map[string]int32
+	}{
+		{
+			name:          "normal scaling event: 10 -> 12",
+			deployment:    newDeployment("foo", 12, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 10, nil, nil, nil, nil),
+
+			newRS:  rs("foo-v1", 10, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{},
+
+			expectedNew: rs("foo-v1", 12, nil, newTimestamp),
+			expectedOld: []*extensions.ReplicaSet{},
+		},
+		{
+			name:          "normal scaling event: 10 -> 5",
+			deployment:    newDeployment("foo", 5, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 10, nil, nil, nil, nil),
+
+			newRS:  rs("foo-v1", 10, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{},
+
+			expectedNew: rs("foo-v1", 5, nil, newTimestamp),
+			expectedOld: []*extensions.ReplicaSet{},
+		},
+		{
+			name:          "proportional scaling: 5 -> 10",
+			deployment:    newDeployment("foo", 10, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 5, nil, nil, nil, nil),
+
+			newRS:  rs("foo-v2", 2, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v1", 3, nil, oldTimestamp)},
+
+			expectedNew: rs("foo-v2", 4, nil, newTimestamp),
+			expectedOld: []*extensions.ReplicaSet{rs("foo-v1", 6, nil, oldTimestamp)},
+		},
+		{
+			name:          "proportional scaling: 5 -> 3",
+			deployment:    newDeployment("foo", 3, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 5, nil, nil, nil, nil),
+
+			newRS:  rs("foo-v2", 2, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v1", 3, nil, oldTimestamp)},
+
+			expectedNew: rs("foo-v2", 1, nil, newTimestamp),
+			expectedOld: []*extensions.ReplicaSet{rs("foo-v1", 2, nil, oldTimestamp)},
+		},
+		{
+			name:          "proportional scaling: 9 -> 4",
+			deployment:    newDeployment("foo", 4, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 9, nil, nil, nil, nil),
+
+			newRS:  rs("foo-v2", 8, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v1", 1, nil, oldTimestamp)},
+
+			expectedNew: rs("foo-v2", 4, nil, newTimestamp),
+			expectedOld: []*extensions.ReplicaSet{rs("foo-v1", 0, nil, oldTimestamp)},
+		},
+		{
+			name:          "proportional scaling: 7 -> 10",
+			deployment:    newDeployment("foo", 10, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 7, nil, nil, nil, nil),
+
+			newRS:  rs("foo-v3", 2, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v2", 3, nil, oldTimestamp), rs("foo-v1", 2, nil, olderTimestamp)},
+
+			expectedNew: rs("foo-v3", 3, nil, newTimestamp),
+			expectedOld: []*extensions.ReplicaSet{rs("foo-v2", 4, nil, oldTimestamp), rs("foo-v1", 3, nil, olderTimestamp)},
+		},
+		{
+			name:          "proportional scaling: 13 -> 8",
+			deployment:    newDeployment("foo", 8, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 13, nil, nil, nil, nil),
+
+			newRS:  rs("foo-v3", 2, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v2", 8, nil, oldTimestamp), rs("foo-v1", 3, nil, olderTimestamp)},
+
+			expectedNew: rs("foo-v3", 1, nil, newTimestamp),
+			expectedOld: []*extensions.ReplicaSet{rs("foo-v2", 5, nil, oldTimestamp), rs("foo-v1", 2, nil, olderTimestamp)},
+		},
+		// Scales up the new replica set.
+		{
+			name:          "leftover distribution: 3 -> 4",
+			deployment:    newDeployment("foo", 4, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 3, nil, nil, nil, nil),
+
+			newRS:  rs("foo-v3", 1, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v2", 1, nil, oldTimestamp), rs("foo-v1", 1, nil, olderTimestamp)},
+
+			expectedNew: rs("foo-v3", 2, nil, newTimestamp),
+			expectedOld: []*extensions.ReplicaSet{rs("foo-v2", 1, nil, oldTimestamp), rs("foo-v1", 1, nil, olderTimestamp)},
+		},
+		// Scales down the older replica set.
+		{
+			name:          "leftover distribution: 3 -> 2",
+			deployment:    newDeployment("foo", 2, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 3, nil, nil, nil, nil),
+
+			newRS:  rs("foo-v3", 1, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v2", 1, nil, oldTimestamp), rs("foo-v1", 1, nil, olderTimestamp)},
+
+			expectedNew: rs("foo-v3", 1, nil, newTimestamp),
+			expectedOld: []*extensions.ReplicaSet{rs("foo-v2", 1, nil, oldTimestamp), rs("foo-v1", 0, nil, olderTimestamp)},
+		},
+		// Scales up the latest replica set first.
+		{
+			name:          "proportional scaling (no new rs): 4 -> 5",
+			deployment:    newDeployment("foo", 5, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 4, nil, nil, nil, nil),
+
+			newRS:  nil,
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v2", 2, nil, oldTimestamp), rs("foo-v1", 2, nil, olderTimestamp)},
+
+			expectedNew: nil,
+			expectedOld: []*extensions.ReplicaSet{rs("foo-v2", 3, nil, oldTimestamp), rs("foo-v1", 2, nil, olderTimestamp)},
+		},
+		// Scales down to zero
+		{
+			name:          "proportional scaling: 6 -> 0",
+			deployment:    newDeployment("foo", 0, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 6, nil, nil, nil, nil),
+
+			newRS:  rs("foo-v3", 3, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v2", 2, nil, oldTimestamp), rs("foo-v1", 1, nil, olderTimestamp)},
+
+			expectedNew: rs("foo-v3", 0, nil, newTimestamp),
+			expectedOld: []*extensions.ReplicaSet{rs("foo-v2", 0, nil, oldTimestamp), rs("foo-v1", 0, nil, olderTimestamp)},
+		},
+		// Scales up from zero
+		{
+			name:          "proportional scaling: 0 -> 6",
+			deployment:    newDeployment("foo", 6, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 6, nil, nil, nil, nil),
+
+			newRS:  rs("foo-v3", 0, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v2", 0, nil, oldTimestamp), rs("foo-v1", 0, nil, olderTimestamp)},
+
+			expectedNew:  rs("foo-v3", 6, nil, newTimestamp),
+			expectedOld:  []*extensions.ReplicaSet{rs("foo-v2", 0, nil, oldTimestamp), rs("foo-v1", 0, nil, olderTimestamp)},
+			wasntUpdated: map[string]bool{"foo-v2": true, "foo-v1": true},
+		},
+		// Scenario: deployment.spec.replicas == 3 ( foo-v1.spec.replicas == foo-v2.spec.replicas == foo-v3.spec.replicas == 1 )
+		// Deployment is scaled to 5. foo-v3.spec.replicas and foo-v2.spec.replicas should increment by 1 but foo-v2 fails to
+		// update.
+		{
+			name:          "failed rs update",
+			deployment:    newDeployment("foo", 5, nil, nil, nil, nil),
+			oldDeployment: newDeployment("foo", 5, nil, nil, nil, nil),
+
+			newRS:  rs("foo-v3", 2, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v2", 1, nil, oldTimestamp), rs("foo-v1", 1, nil, olderTimestamp)},
+
+			expectedNew:  rs("foo-v3", 2, nil, newTimestamp),
+			expectedOld:  []*extensions.ReplicaSet{rs("foo-v2", 2, nil, oldTimestamp), rs("foo-v1", 1, nil, olderTimestamp)},
+			wasntUpdated: map[string]bool{"foo-v3": true, "foo-v1": true},
+
+			desiredReplicasAnnotations: map[string]int32{"foo-v2": int32(3)},
+		},
+		{
+			name:          "deployment with surge pods",
+			deployment:    newDeployment("foo", 20, nil, maxSurge(2), nil, nil),
+			oldDeployment: newDeployment("foo", 10, nil, maxSurge(2), nil, nil),
+
+			newRS:  rs("foo-v2", 6, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v1", 6, nil, oldTimestamp)},
+
+			expectedNew: rs("foo-v2", 11, nil, newTimestamp),
+			expectedOld: []*extensions.ReplicaSet{rs("foo-v1", 11, nil, oldTimestamp)},
+		},
+		{
+			name:          "change both surge and size",
+			deployment:    newDeployment("foo", 50, nil, maxSurge(6), nil, nil),
+			oldDeployment: newDeployment("foo", 10, nil, maxSurge(3), nil, nil),
+
+			newRS:  rs("foo-v2", 5, nil, newTimestamp),
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v1", 8, nil, oldTimestamp)},
+
+			expectedNew: rs("foo-v2", 22, nil, newTimestamp),
+			expectedOld: []*extensions.ReplicaSet{rs("foo-v1", 34, nil, oldTimestamp)},
+		},
+		{
+			name:          "change both size and template",
+			deployment:    updatedTemplate(14),
+			oldDeployment: newDeployment("foo", 10, nil, nil, nil, map[string]string{"foo": "bar"}),
+
+			newRS:  nil,
+			oldRSs: []*extensions.ReplicaSet{rs("foo-v2", 7, nil, newTimestamp), rs("foo-v1", 3, nil, oldTimestamp)},
+
+			expectedNew: nil,
+			expectedOld: []*extensions.ReplicaSet{rs("foo-v2", 10, nil, newTimestamp), rs("foo-v1", 4, nil, oldTimestamp)},
+		},
+	}
+
+	for _, test := range tests {
+		_ = olderTimestamp
+		t.Log(test.name)
+		fake := fake.Clientset{}
+		dc := &DeploymentController{
+			client:        &fake,
+			eventRecorder: &record.FakeRecorder{},
+		}
+
+		if test.newRS != nil {
+			desiredReplicas := *(test.oldDeployment.Spec.Replicas)
+			if desired, ok := test.desiredReplicasAnnotations[test.newRS.Name]; ok {
+				desiredReplicas = desired
+			}
+			deploymentutil.SetReplicasAnnotations(test.newRS, desiredReplicas, desiredReplicas+deploymentutil.MaxSurge(*test.oldDeployment))
+		}
+		for i := range test.oldRSs {
+			rs := test.oldRSs[i]
+			if rs == nil {
+				continue
+			}
+			desiredReplicas := *(test.oldDeployment.Spec.Replicas)
+			if desired, ok := test.desiredReplicasAnnotations[rs.Name]; ok {
+				desiredReplicas = desired
+			}
+			deploymentutil.SetReplicasAnnotations(rs, desiredReplicas, desiredReplicas+deploymentutil.MaxSurge(*test.oldDeployment))
+		}
+
+		if err := dc.scale(test.deployment, test.newRS, test.oldRSs); err != nil {
+			t.Errorf("%s: unexpected error: %v", test.name, err)
+			continue
+		}
+
+		// Construct the nameToSize map that will hold all the sizes we got our of tests
+		// Skip updating the map if the replica set wasn't updated since there will be
+		// no update action for it.
+		nameToSize := make(map[string]int32)
+		if test.newRS != nil {
+			nameToSize[test.newRS.Name] = *(test.newRS.Spec.Replicas)
+		}
+		for i := range test.oldRSs {
+			rs := test.oldRSs[i]
+			nameToSize[rs.Name] = *(rs.Spec.Replicas)
+		}
+		// Get all the UPDATE actions and update nameToSize with all the updated sizes.
+		for _, action := range fake.Actions() {
+			rs := action.(testclient.UpdateAction).GetObject().(*extensions.ReplicaSet)
+			if !test.wasntUpdated[rs.Name] {
+				nameToSize[rs.Name] = *(rs.Spec.Replicas)
+			}
+		}
+
+		if test.expectedNew != nil && test.newRS != nil && *(test.expectedNew.Spec.Replicas) != nameToSize[test.newRS.Name] {
+			t.Errorf("%s: expected new replicas: %d, got: %d", test.name, *(test.expectedNew.Spec.Replicas), nameToSize[test.newRS.Name])
+			continue
+		}
+		if len(test.expectedOld) != len(test.oldRSs) {
+			t.Errorf("%s: expected %d old replica sets, got %d", test.name, len(test.expectedOld), len(test.oldRSs))
+			continue
+		}
+		for n := range test.oldRSs {
+			rs := test.oldRSs[n]
+			expected := test.expectedOld[n]
+			if *(expected.Spec.Replicas) != nameToSize[rs.Name] {
+				t.Errorf("%s: expected old (%s) replicas: %d, got: %d", test.name, rs.Name, *(expected.Spec.Replicas), nameToSize[rs.Name])
+			}
+		}
+	}
+}
+
+func TestDeploymentController_cleanupDeployment(t *testing.T) {
+	selector := map[string]string{"foo": "bar"}
+
+	tests := []struct {
+		oldRSs               []*extensions.ReplicaSet
+		revisionHistoryLimit int32
+		expectedDeletions    int
+	}{
+		{
+			oldRSs: []*extensions.ReplicaSet{
+				newRSWithStatus("foo-1", 0, 0, selector),
+				newRSWithStatus("foo-2", 0, 0, selector),
+				newRSWithStatus("foo-3", 0, 0, selector),
+			},
+			revisionHistoryLimit: 1,
+			expectedDeletions:    2,
+		},
+		{
+			// Only delete the replica set with Spec.Replicas = Status.Replicas = 0.
+			oldRSs: []*extensions.ReplicaSet{
+				newRSWithStatus("foo-1", 0, 0, selector),
+				newRSWithStatus("foo-2", 0, 1, selector),
+				newRSWithStatus("foo-3", 1, 0, selector),
+				newRSWithStatus("foo-4", 1, 1, selector),
+			},
+			revisionHistoryLimit: 0,
+			expectedDeletions:    1,
+		},
+
+		{
+			oldRSs: []*extensions.ReplicaSet{
+				newRSWithStatus("foo-1", 0, 0, selector),
+				newRSWithStatus("foo-2", 0, 0, selector),
+			},
+			revisionHistoryLimit: 0,
+			expectedDeletions:    2,
+		},
+		{
+			oldRSs: []*extensions.ReplicaSet{
+				newRSWithStatus("foo-1", 1, 1, selector),
+				newRSWithStatus("foo-2", 1, 1, selector),
+			},
+			revisionHistoryLimit: 0,
+			expectedDeletions:    0,
+		},
+	}
+
+	for i := range tests {
+		test := tests[i]
+		fake := &fake.Clientset{}
+		informers := informers.NewSharedInformerFactory(fake, nil, controller.NoResyncPeriodFunc())
+		controller := NewDeploymentController(informers.Deployments(), informers.ReplicaSets(), informers.Pods(), fake)
+
+		controller.eventRecorder = &record.FakeRecorder{}
+		controller.dListerSynced = alwaysReady
+		controller.rsListerSynced = alwaysReady
+		controller.podListerSynced = alwaysReady
+		for _, rs := range test.oldRSs {
+			controller.rsLister.Indexer.Add(rs)
+		}
+
+		stopCh := make(chan struct{})
+		defer close(stopCh)
+		informers.Start(stopCh)
+
+		d := newDeployment("foo", 1, &test.revisionHistoryLimit, nil, nil, map[string]string{"foo": "bar"})
+		controller.cleanupDeployment(test.oldRSs, d)
+
+		gotDeletions := 0
+		for _, action := range fake.Actions() {
+			if "delete" == action.GetVerb() {
+				gotDeletions++
+			}
+		}
+		if gotDeletions != test.expectedDeletions {
+			t.Errorf("expect %v old replica sets been deleted, but got %v", test.expectedDeletions, gotDeletions)
+			continue
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/deployment/util/BUILD

@@ -0,0 +1,77 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "deployment_util.go",
+        "pod_util.go",
+        "replicaset_util.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/annotations:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/extensions:go_default_library",
+        "//pkg/apis/extensions/v1beta1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/core/v1:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/extensions/v1beta1:go_default_library",
+        "//pkg/client/retry:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/util/hash:go_default_library",
+        "//pkg/util/integer:go_default_library",
+        "//pkg/util/intstr:go_default_library",
+        "//pkg/util/labels:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/api/meta",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/labels",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/errors",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "deployment_util_test.go",
+        "hash_test.go",
+    ],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/extensions/v1beta1:go_default_library",
+        "//pkg/client/clientset_generated/clientset/fake:go_default_library",
+        "//pkg/client/testing/core:go_default_library",
+        "//pkg/util/intstr:go_default_library",
+        "//vendor:github.com/stretchr/testify/assert",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/deployment/util/hash_test.go

@@ -0,0 +1,158 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"encoding/json"
+	"strconv"
+	"strings"
+	"testing"
+
+	"k8s.io/kubernetes/pkg/api/v1"
+)
+
+var podSpec string = `
+{
+    "metadata": {
+        "creationTimestamp": null,
+        "labels": {
+            "app": "cats"
+        }
+    },
+    "spec": {
+        "containers": [
+            {
+                "name": "cats",
+                "image": "registry/test/cats:v0.@@VERSION@@.0",
+                "ports": [
+                    {
+                        "name": "http",
+                        "containerPort": 9077,
+                        "protocol": "TCP"
+                    }
+                ],
+                "env": [
+                    {
+                        "name": "DEPLOYMENT_ENVIRONMENT",
+                        "value": "cats-stubbed-functional"
+                    },
+                    {
+                        "name": "APP_NAME",
+                        "value": "cats"
+                    }
+                ],
+                "resources": {
+                    "limits": {
+                        "cpu": "1",
+                        "memory": "1Gi"
+                    },
+                    "requests": {
+                        "cpu": "1",
+                        "memory": "1Gi"
+                    }
+                },
+                "livenessProbe": {
+                    "httpGet": {
+                        "path": "/private/status",
+                        "port": 9077,
+                        "scheme": "HTTP"
+                    },
+                    "initialDelaySeconds": 30,
+                    "timeoutSeconds": 1,
+                    "periodSeconds": 10,
+                    "successThreshold": 1,
+                    "failureThreshold": 3
+                },
+                "readinessProbe": {
+                    "httpGet": {
+                        "path": "/private/status",
+                        "port": 9077,
+                        "scheme": "HTTP"
+                    },
+                    "initialDelaySeconds": 1,
+                    "timeoutSeconds": 1,
+                    "periodSeconds": 10,
+                    "successThreshold": 1,
+                    "failureThreshold": 3
+                },
+                "terminationMessagePath": "/dev/termination-log",
+                "imagePullPolicy": "IfNotPresent"
+            }
+        ],
+        "restartPolicy": "Always",
+        "terminationGracePeriodSeconds": 30,
+        "dnsPolicy": "ClusterFirst",
+        "securityContext": {}
+    }
+}
+`
+
+func TestPodTemplateSpecHash(t *testing.T) {
+	seenHashes := make(map[uint32]int)
+	broken := false
+
+	for i := 0; i < 1000; i++ {
+		specJson := strings.Replace(podSpec, "@@VERSION@@", strconv.Itoa(i), 1)
+		spec := v1.PodTemplateSpec{}
+		json.Unmarshal([]byte(specJson), &spec)
+		hash := GetPodTemplateSpecHash(spec)
+		if v, ok := seenHashes[hash]; ok {
+			broken = true
+			t.Logf("Hash collision, old: %d new: %d", v, i)
+			break
+		}
+		seenHashes[hash] = i
+	}
+
+	if !broken {
+		t.Errorf("expected adler to break but it didn't")
+	}
+}
+
+func TestPodTemplateSpecHashFnv(t *testing.T) {
+	seenHashes := make(map[uint32]int)
+
+	for i := 0; i < 1000; i++ {
+		specJson := strings.Replace(podSpec, "@@VERSION@@", strconv.Itoa(i), 1)
+		spec := v1.PodTemplateSpec{}
+		json.Unmarshal([]byte(specJson), &spec)
+		hash := GetPodTemplateSpecHashFnv(spec)
+		if v, ok := seenHashes[hash]; ok {
+			t.Errorf("Hash collision, old: %d new: %d", v, i)
+			break
+		}
+		seenHashes[hash] = i
+	}
+}
+
+func BenchmarkAdler(b *testing.B) {
+	spec := v1.PodTemplateSpec{}
+	json.Unmarshal([]byte(podSpec), &spec)
+
+	for i := 0; i < b.N; i++ {
+		GetPodTemplateSpecHash(spec)
+	}
+}
+
+func BenchmarkFnv(b *testing.B) {
+	spec := v1.PodTemplateSpec{}
+	json.Unmarshal([]byte(podSpec), &spec)
+
+	for i := 0; i < b.N; i++ {
+		GetPodTemplateSpecHashFnv(spec)
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/deployment/util/pod_util.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"hash/adler32"
+	"hash/fnv"
+
+	"github.com/golang/glog"
+
+	errorsutil "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	v1core "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/core/v1"
+	"k8s.io/kubernetes/pkg/client/retry"
+	hashutil "k8s.io/kubernetes/pkg/util/hash"
+)
+
+func GetPodTemplateSpecHash(template v1.PodTemplateSpec) uint32 {
+	podTemplateSpecHasher := adler32.New()
+	hashutil.DeepHashObject(podTemplateSpecHasher, template)
+	return podTemplateSpecHasher.Sum32()
+}
+
+// TODO: remove the duplicate
+func GetInternalPodTemplateSpecHash(template api.PodTemplateSpec) uint32 {
+	podTemplateSpecHasher := adler32.New()
+	hashutil.DeepHashObject(podTemplateSpecHasher, template)
+	return podTemplateSpecHasher.Sum32()
+}
+
+func GetPodTemplateSpecHashFnv(template v1.PodTemplateSpec) uint32 {
+	podTemplateSpecHasher := fnv.New32a()
+	hashutil.DeepHashObject(podTemplateSpecHasher, template)
+	return podTemplateSpecHasher.Sum32()
+}
+
+// TODO: use client library instead when it starts to support update retries
+//       see https://github.com/kubernetes/kubernetes/issues/21479
+type updatePodFunc func(pod *v1.Pod) error
+
+// UpdatePodWithRetries updates a pod with given applyUpdate function. Note that pod not found error is ignored.
+// The returned bool value can be used to tell if the pod is actually updated.
+func UpdatePodWithRetries(podClient v1core.PodInterface, podLister *cache.StoreToPodLister, namespace, name string, applyUpdate updatePodFunc) (*v1.Pod, error) {
+	var pod *v1.Pod
+
+	retryErr := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		var err error
+		pod, err = podLister.Pods(namespace).Get(name)
+		if err != nil {
+			return err
+		}
+		obj, deepCopyErr := api.Scheme.DeepCopy(pod)
+		if deepCopyErr != nil {
+			return deepCopyErr
+		}
+		pod = obj.(*v1.Pod)
+		// Apply the update, then attempt to push it to the apiserver.
+		if applyErr := applyUpdate(pod); applyErr != nil {
+			return applyErr
+		}
+		pod, err = podClient.Update(pod)
+		return err
+	})
+
+	// Ignore the precondition violated error, this pod is already updated
+	// with the desired label.
+	if retryErr == errorsutil.ErrPreconditionViolated {
+		glog.V(4).Infof("Pod %s/%s precondition doesn't hold, skip updating it.", namespace, name)
+		retryErr = nil
+	}
+
+	return pod, retryErr
+}

vendor/k8s.io/kubernetes/pkg/controller/deployment/util/replicaset_util.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"fmt"
+
+	"github.com/golang/glog"
+
+	errorsutil "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	unversionedextensions "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/client/retry"
+	labelsutil "k8s.io/kubernetes/pkg/util/labels"
+)
+
+// TODO: use client library instead when it starts to support update retries
+//       see https://github.com/kubernetes/kubernetes/issues/21479
+type updateRSFunc func(rs *extensions.ReplicaSet) error
+
+// UpdateRSWithRetries updates a RS with given applyUpdate function. Note that RS not found error is ignored.
+// The returned bool value can be used to tell if the RS is actually updated.
+func UpdateRSWithRetries(rsClient unversionedextensions.ReplicaSetInterface, rsLister *cache.StoreToReplicaSetLister, namespace, name string, applyUpdate updateRSFunc) (*extensions.ReplicaSet, error) {
+	var rs *extensions.ReplicaSet
+
+	retryErr := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		var err error
+		rs, err = rsLister.ReplicaSets(namespace).Get(name)
+		if err != nil {
+			return err
+		}
+		obj, deepCopyErr := api.Scheme.DeepCopy(rs)
+		if deepCopyErr != nil {
+			return deepCopyErr
+		}
+		rs = obj.(*extensions.ReplicaSet)
+		// Apply the update, then attempt to push it to the apiserver.
+		if applyErr := applyUpdate(rs); applyErr != nil {
+			return applyErr
+		}
+		rs, err = rsClient.Update(rs)
+		return err
+	})
+
+	// Ignore the precondition violated error, but the RS isn't updated.
+	if retryErr == errorsutil.ErrPreconditionViolated {
+		glog.V(4).Infof("Replica set %s/%s precondition doesn't hold, skip updating it.", namespace, name)
+		retryErr = nil
+	}
+
+	return rs, retryErr
+}
+
+// GetReplicaSetHash returns the pod template hash of a ReplicaSet's pod template space
+func GetReplicaSetHash(rs *extensions.ReplicaSet) string {
+	meta := rs.Spec.Template.ObjectMeta
+	meta.Labels = labelsutil.CloneAndRemoveLabel(meta.Labels, extensions.DefaultDeploymentUniqueLabelKey)
+	return fmt.Sprintf("%d", GetPodTemplateSpecHash(v1.PodTemplateSpec{
+		ObjectMeta: meta,
+		Spec:       rs.Spec.Template.Spec,
+	}))
+}
+
+// GetReplicaSetHashFnv returns the pod template hash of a ReplicaSet's pod template spec.
+func GetReplicaSetHashFnv(rs *extensions.ReplicaSet) string {
+	meta := rs.Spec.Template.ObjectMeta
+	meta.Labels = labelsutil.CloneAndRemoveLabel(meta.Labels, extensions.DefaultDeploymentUniqueLabelKey)
+	return fmt.Sprintf("%d", GetPodTemplateSpecHashFnv(v1.PodTemplateSpec{
+		ObjectMeta: meta,
+		Spec:       rs.Spec.Template.Spec,
+	}))
+}

vendor/k8s.io/kubernetes/pkg/controller/disruption/BUILD

@@ -0,0 +1,71 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["disruption.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/apps/v1beta1:go_default_library",
+        "//pkg/apis/extensions/v1beta1:go_default_library",
+        "//pkg/apis/policy/v1beta1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/core/v1:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/policy/v1beta1:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/util/intstr:go_default_library",
+        "//pkg/util/workqueue:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/types",
+        "//vendor:k8s.io/apimachinery/pkg/util/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+        "//vendor:k8s.io/apimachinery/pkg/watch",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["disruption_test.go"],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/apps/v1beta1:go_default_library",
+        "//pkg/apis/extensions/v1beta1:go_default_library",
+        "//pkg/apis/policy/v1beta1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/util/intstr:go_default_library",
+        "//pkg/util/uuid:go_default_library",
+        "//pkg/util/workqueue:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/disruption/OWNERS

@@ -0,0 +1,5 @@
+reviewers:
+- mml
+- davidopp
+- kargakis
+- mwielgus

vendor/k8s.io/kubernetes/pkg/controller/disruption/disruption.go

@@ -0,0 +1,765 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package disruption
+
+import (
+	"fmt"
+	"reflect"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	apps "k8s.io/kubernetes/pkg/apis/apps/v1beta1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	policy "k8s.io/kubernetes/pkg/apis/policy/v1beta1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	v1core "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/core/v1"
+	policyclientset "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/policy/v1beta1"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/util/intstr"
+	"k8s.io/kubernetes/pkg/util/workqueue"
+
+	"github.com/golang/glog"
+)
+
+const statusUpdateRetries = 2
+
+// DeletionTimeout sets maximum time from the moment a pod is added to DisruptedPods in PDB.Status
+// to the time when the pod is expected to be seen by PDB controller as having been marked for deletion.
+// If the pod was not marked for deletion during that time it is assumed that it won't be deleted at
+// all and the corresponding entry can be removed from pdb.Status.DisruptedPods. It is assumed that
+// pod/pdb apiserver to controller latency is relatively small (like 1-2sec) so the below value should
+// be more than enough.
+// If the controller is running on a different node it is important that the two nodes have synced
+// clock (via ntp for example). Otherwise PodDisruptionBudget controller may not provide enough
+// protection against unwanted pod disruptions.
+const DeletionTimeout = 2 * 60 * time.Second
+
+type updater func(*policy.PodDisruptionBudget) error
+
+type DisruptionController struct {
+	kubeClient clientset.Interface
+
+	pdbStore      cache.Store
+	pdbController cache.Controller
+	pdbLister     cache.StoreToPodDisruptionBudgetLister
+
+	podController cache.Controller
+	podLister     cache.StoreToPodLister
+
+	rcIndexer    cache.Indexer
+	rcController cache.Controller
+	rcLister     cache.StoreToReplicationControllerLister
+
+	rsStore      cache.Store
+	rsController cache.Controller
+	rsLister     cache.StoreToReplicaSetLister
+
+	dIndexer    cache.Indexer
+	dController cache.Controller
+	dLister     cache.StoreToDeploymentLister
+
+	ssStore      cache.Store
+	ssController cache.Controller
+	ssLister     cache.StoreToStatefulSetLister
+
+	// PodDisruptionBudget keys that need to be synced.
+	queue        workqueue.RateLimitingInterface
+	recheckQueue workqueue.DelayingInterface
+
+	broadcaster record.EventBroadcaster
+	recorder    record.EventRecorder
+
+	getUpdater func() updater
+}
+
+// controllerAndScale is used to return (controller, scale) pairs from the
+// controller finder functions.
+type controllerAndScale struct {
+	types.UID
+	scale int32
+}
+
+// podControllerFinder is a function type that maps a pod to a list of
+// controllers and their scale.
+type podControllerFinder func(*v1.Pod) ([]controllerAndScale, error)
+
+func NewDisruptionController(podInformer cache.SharedIndexInformer, kubeClient clientset.Interface) *DisruptionController {
+	dc := &DisruptionController{
+		kubeClient:    kubeClient,
+		podController: podInformer.GetController(),
+		queue:         workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "disruption"),
+		recheckQueue:  workqueue.NewNamedDelayingQueue("disruption-recheck"),
+		broadcaster:   record.NewBroadcaster(),
+	}
+	dc.recorder = dc.broadcaster.NewRecorder(v1.EventSource{Component: "controllermanager"})
+
+	dc.getUpdater = func() updater { return dc.writePdbStatus }
+
+	dc.podLister.Indexer = podInformer.GetIndexer()
+
+	podInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    dc.addPod,
+		UpdateFunc: dc.updatePod,
+		DeleteFunc: dc.deletePod,
+	})
+
+	dc.pdbStore, dc.pdbController = cache.NewInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return dc.kubeClient.Policy().PodDisruptionBudgets(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return dc.kubeClient.Policy().PodDisruptionBudgets(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&policy.PodDisruptionBudget{},
+		30*time.Second,
+		cache.ResourceEventHandlerFuncs{
+			AddFunc:    dc.addDb,
+			UpdateFunc: dc.updateDb,
+			DeleteFunc: dc.removeDb,
+		},
+	)
+	dc.pdbLister.Store = dc.pdbStore
+
+	dc.rcIndexer, dc.rcController = cache.NewIndexerInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return dc.kubeClient.Core().ReplicationControllers(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return dc.kubeClient.Core().ReplicationControllers(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&v1.ReplicationController{},
+		30*time.Second,
+		cache.ResourceEventHandlerFuncs{},
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+
+	dc.rcLister.Indexer = dc.rcIndexer
+
+	dc.rsLister.Indexer, dc.rsController = cache.NewIndexerInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return dc.kubeClient.Extensions().ReplicaSets(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return dc.kubeClient.Extensions().ReplicaSets(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&extensions.ReplicaSet{},
+		30*time.Second,
+		cache.ResourceEventHandlerFuncs{},
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	dc.rsStore = dc.rsLister.Indexer
+
+	dc.dIndexer, dc.dController = cache.NewIndexerInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return dc.kubeClient.Extensions().Deployments(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return dc.kubeClient.Extensions().Deployments(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&extensions.Deployment{},
+		30*time.Second,
+		cache.ResourceEventHandlerFuncs{},
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	dc.dLister.Indexer = dc.dIndexer
+
+	dc.ssStore, dc.ssController = cache.NewInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return dc.kubeClient.Apps().StatefulSets(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return dc.kubeClient.Apps().StatefulSets(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&apps.StatefulSet{},
+		30*time.Second,
+		cache.ResourceEventHandlerFuncs{},
+	)
+	dc.ssLister.Store = dc.ssStore
+
+	return dc
+}
+
+// TODO(mml): When controllerRef is implemented (#2210), we *could* simply
+// return controllers without their scales, and access scale type-generically
+// via the scale subresource.  That may not be as much of a win as it sounds,
+// however.  We are accessing everything through the pkg/client/cache API that
+// we have to set up and tune to the types we know we'll be accessing anyway,
+// and we may well need further tweaks just to be able to access scale
+// subresources.
+func (dc *DisruptionController) finders() []podControllerFinder {
+	return []podControllerFinder{dc.getPodReplicationControllers, dc.getPodDeployments, dc.getPodReplicaSets,
+		dc.getPodStatefulSets}
+}
+
+// getPodReplicaSets finds replicasets which have no matching deployments.
+func (dc *DisruptionController) getPodReplicaSets(pod *v1.Pod) ([]controllerAndScale, error) {
+	cas := []controllerAndScale{}
+	rss, err := dc.rsLister.GetPodReplicaSets(pod)
+	// GetPodReplicaSets returns an error only if no ReplicaSets are found.  We
+	// don't return that as an error to the caller.
+	if err != nil {
+		return cas, nil
+	}
+	controllerScale := map[types.UID]int32{}
+	for _, rs := range rss {
+		// GetDeploymentsForReplicaSet returns an error only if no matching
+		// deployments are found.
+		_, err := dc.dLister.GetDeploymentsForReplicaSet(rs)
+		if err == nil { // A deployment was found, so this finder will not count this RS.
+			continue
+		}
+		controllerScale[rs.UID] = *(rs.Spec.Replicas)
+	}
+
+	for uid, scale := range controllerScale {
+		cas = append(cas, controllerAndScale{UID: uid, scale: scale})
+	}
+
+	return cas, nil
+}
+
+// getPodStatefulSet returns the statefulset managing the given pod.
+func (dc *DisruptionController) getPodStatefulSets(pod *v1.Pod) ([]controllerAndScale, error) {
+	cas := []controllerAndScale{}
+	ss, err := dc.ssLister.GetPodStatefulSets(pod)
+
+	// GetPodStatefulSets returns an error only if no StatefulSets are found. We
+	// don't return that as an error to the caller.
+	if err != nil {
+		return cas, nil
+	}
+
+	controllerScale := map[types.UID]int32{}
+	for _, s := range ss {
+		controllerScale[s.UID] = *(s.Spec.Replicas)
+	}
+
+	for uid, scale := range controllerScale {
+		cas = append(cas, controllerAndScale{UID: uid, scale: scale})
+	}
+
+	return cas, nil
+}
+
+// getPodDeployments finds deployments for any replicasets which are being managed by deployments.
+func (dc *DisruptionController) getPodDeployments(pod *v1.Pod) ([]controllerAndScale, error) {
+	cas := []controllerAndScale{}
+	rss, err := dc.rsLister.GetPodReplicaSets(pod)
+	// GetPodReplicaSets returns an error only if no ReplicaSets are found.  We
+	// don't return that as an error to the caller.
+	if err != nil {
+		return cas, nil
+	}
+	controllerScale := map[types.UID]int32{}
+	for _, rs := range rss {
+		ds, err := dc.dLister.GetDeploymentsForReplicaSet(rs)
+		// GetDeploymentsForReplicaSet returns an error only if no matching
+		// deployments are found.  In that case we skip this ReplicaSet.
+		if err != nil {
+			continue
+		}
+		for _, d := range ds {
+			controllerScale[d.UID] = *(d.Spec.Replicas)
+		}
+	}
+
+	for uid, scale := range controllerScale {
+		cas = append(cas, controllerAndScale{UID: uid, scale: scale})
+	}
+
+	return cas, nil
+}
+
+func (dc *DisruptionController) getPodReplicationControllers(pod *v1.Pod) ([]controllerAndScale, error) {
+	cas := []controllerAndScale{}
+	rcs, err := dc.rcLister.GetPodControllers(pod)
+	if err == nil {
+		for _, rc := range rcs {
+			cas = append(cas, controllerAndScale{UID: rc.UID, scale: *(rc.Spec.Replicas)})
+		}
+	}
+	return cas, nil
+}
+
+func (dc *DisruptionController) Run(stopCh <-chan struct{}) {
+	glog.V(0).Infof("Starting disruption controller")
+	if dc.kubeClient != nil {
+		glog.V(0).Infof("Sending events to api server.")
+		dc.broadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: dc.kubeClient.Core().Events("")})
+	} else {
+		glog.V(0).Infof("No api server defined - no events will be sent to API server.")
+	}
+	go dc.pdbController.Run(stopCh)
+	go dc.podController.Run(stopCh)
+	go dc.rcController.Run(stopCh)
+	go dc.rsController.Run(stopCh)
+	go dc.dController.Run(stopCh)
+	go dc.ssController.Run(stopCh)
+	go wait.Until(dc.worker, time.Second, stopCh)
+	go wait.Until(dc.recheckWorker, time.Second, stopCh)
+
+	<-stopCh
+	glog.V(0).Infof("Shutting down disruption controller")
+}
+
+func (dc *DisruptionController) addDb(obj interface{}) {
+	pdb := obj.(*policy.PodDisruptionBudget)
+	glog.V(4).Infof("add DB %q", pdb.Name)
+	dc.enqueuePdb(pdb)
+}
+
+func (dc *DisruptionController) updateDb(old, cur interface{}) {
+	// TODO(mml) ignore updates where 'old' is equivalent to 'cur'.
+	pdb := cur.(*policy.PodDisruptionBudget)
+	glog.V(4).Infof("update DB %q", pdb.Name)
+	dc.enqueuePdb(pdb)
+}
+
+func (dc *DisruptionController) removeDb(obj interface{}) {
+	pdb := obj.(*policy.PodDisruptionBudget)
+	glog.V(4).Infof("remove DB %q", pdb.Name)
+	dc.enqueuePdb(pdb)
+}
+
+func (dc *DisruptionController) addPod(obj interface{}) {
+	pod := obj.(*v1.Pod)
+	glog.V(4).Infof("addPod called on pod %q", pod.Name)
+	pdb := dc.getPdbForPod(pod)
+	if pdb == nil {
+		glog.V(4).Infof("No matching pdb for pod %q", pod.Name)
+		return
+	}
+	glog.V(4).Infof("addPod %q -> PDB %q", pod.Name, pdb.Name)
+	dc.enqueuePdb(pdb)
+}
+
+func (dc *DisruptionController) updatePod(old, cur interface{}) {
+	pod := cur.(*v1.Pod)
+	glog.V(4).Infof("updatePod called on pod %q", pod.Name)
+	pdb := dc.getPdbForPod(pod)
+	if pdb == nil {
+		glog.V(4).Infof("No matching pdb for pod %q", pod.Name)
+		return
+	}
+	glog.V(4).Infof("updatePod %q -> PDB %q", pod.Name, pdb.Name)
+	dc.enqueuePdb(pdb)
+}
+
+func (dc *DisruptionController) deletePod(obj interface{}) {
+	pod, ok := obj.(*v1.Pod)
+	// When a delete is dropped, the relist will notice a pod in the store not
+	// in the list, leading to the insertion of a tombstone object which contains
+	// the deleted key/value. Note that this value might be stale. If the pod
+	// changed labels the new ReplicaSet will not be woken up till the periodic
+	// resync.
+	if !ok {
+		tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+		if !ok {
+			glog.Errorf("Couldn't get object from tombstone %+v", obj)
+			return
+		}
+		pod, ok = tombstone.Obj.(*v1.Pod)
+		if !ok {
+			glog.Errorf("Tombstone contained object that is not a pod %+v", obj)
+			return
+		}
+	}
+	glog.V(4).Infof("deletePod called on pod %q", pod.Name)
+	pdb := dc.getPdbForPod(pod)
+	if pdb == nil {
+		glog.V(4).Infof("No matching pdb for pod %q", pod.Name)
+		return
+	}
+	glog.V(4).Infof("deletePod %q -> PDB %q", pod.Name, pdb.Name)
+	dc.enqueuePdb(pdb)
+}
+
+func (dc *DisruptionController) enqueuePdb(pdb *policy.PodDisruptionBudget) {
+	key, err := controller.KeyFunc(pdb)
+	if err != nil {
+		glog.Errorf("Cound't get key for PodDisruptionBudget object %+v: %v", pdb, err)
+		return
+	}
+	dc.queue.Add(key)
+}
+
+func (dc *DisruptionController) enqueuePdbForRecheck(pdb *policy.PodDisruptionBudget, delay time.Duration) {
+	key, err := controller.KeyFunc(pdb)
+	if err != nil {
+		glog.Errorf("Cound't get key for PodDisruptionBudget object %+v: %v", pdb, err)
+		return
+	}
+	dc.recheckQueue.AddAfter(key, delay)
+}
+
+func (dc *DisruptionController) getPdbForPod(pod *v1.Pod) *policy.PodDisruptionBudget {
+	// GetPodPodDisruptionBudgets returns an error only if no
+	// PodDisruptionBudgets are found.  We don't return that as an error to the
+	// caller.
+	pdbs, err := dc.pdbLister.GetPodPodDisruptionBudgets(pod)
+	if err != nil {
+		glog.V(4).Infof("No PodDisruptionBudgets found for pod %v, PodDisruptionBudget controller will avoid syncing.", pod.Name)
+		return nil
+	}
+
+	if len(pdbs) > 1 {
+		msg := fmt.Sprintf("Pod %q/%q matches multiple PodDisruptionBudgets.  Chose %q arbitrarily.", pod.Namespace, pod.Name, pdbs[0].Name)
+		glog.Warning(msg)
+		dc.recorder.Event(pod, v1.EventTypeWarning, "MultiplePodDisruptionBudgets", msg)
+	}
+	return &pdbs[0]
+}
+
+func (dc *DisruptionController) getPodsForPdb(pdb *policy.PodDisruptionBudget) ([]*v1.Pod, error) {
+	sel, err := metav1.LabelSelectorAsSelector(pdb.Spec.Selector)
+	if sel.Empty() {
+		return []*v1.Pod{}, nil
+	}
+	if err != nil {
+		return []*v1.Pod{}, err
+	}
+	pods, err := dc.podLister.Pods(pdb.Namespace).List(sel)
+	if err != nil {
+		return []*v1.Pod{}, err
+	}
+	// TODO: Do we need to copy here?
+	result := make([]*v1.Pod, 0, len(pods))
+	for i := range pods {
+		result = append(result, &(*pods[i]))
+	}
+	return result, nil
+}
+
+func (dc *DisruptionController) worker() {
+	for dc.processNextWorkItem() {
+	}
+}
+
+func (dc *DisruptionController) processNextWorkItem() bool {
+	dKey, quit := dc.queue.Get()
+	if quit {
+		return false
+	}
+	defer dc.queue.Done(dKey)
+
+	err := dc.sync(dKey.(string))
+	if err == nil {
+		dc.queue.Forget(dKey)
+		return true
+	}
+
+	utilruntime.HandleError(fmt.Errorf("Error syncing PodDisruptionBudget %v, requeuing: %v", dKey.(string), err))
+	dc.queue.AddRateLimited(dKey)
+
+	return true
+}
+
+func (dc *DisruptionController) recheckWorker() {
+	for dc.processNextRecheckWorkItem() {
+	}
+}
+
+func (dc *DisruptionController) processNextRecheckWorkItem() bool {
+	dKey, quit := dc.recheckQueue.Get()
+	if quit {
+		return false
+	}
+	defer dc.recheckQueue.Done(dKey)
+	dc.queue.AddRateLimited(dKey)
+	return true
+}
+
+func (dc *DisruptionController) sync(key string) error {
+	startTime := time.Now()
+	defer func() {
+		glog.V(4).Infof("Finished syncing PodDisruptionBudget %q (%v)", key, time.Now().Sub(startTime))
+	}()
+
+	obj, exists, err := dc.pdbLister.Store.GetByKey(key)
+	if !exists {
+		glog.V(4).Infof("PodDisruptionBudget %q has been deleted", key)
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+
+	pdb := obj.(*policy.PodDisruptionBudget)
+
+	if err := dc.trySync(pdb); err != nil {
+		glog.Errorf("Failed to sync pdb %s/%s: %v", pdb.Namespace, pdb.Name, err)
+		return dc.failSafe(pdb)
+	}
+
+	return nil
+}
+
+func (dc *DisruptionController) trySync(pdb *policy.PodDisruptionBudget) error {
+	pods, err := dc.getPodsForPdb(pdb)
+	if err != nil {
+		dc.recorder.Eventf(pdb, v1.EventTypeWarning, "NoPods", "Failed to get pods: %v", err)
+		return err
+	}
+	if len(pods) == 0 {
+		dc.recorder.Eventf(pdb, v1.EventTypeNormal, "NoPods", "No matching pods found")
+	}
+
+	expectedCount, desiredHealthy, err := dc.getExpectedPodCount(pdb, pods)
+	if err != nil {
+		dc.recorder.Eventf(pdb, v1.EventTypeNormal, "ExpectedPods", "Failed to calculate the number of expected pods: %v", err)
+		return err
+	}
+
+	currentTime := time.Now()
+	disruptedPods, recheckTime := dc.buildDisruptedPodMap(pods, pdb, currentTime)
+	currentHealthy := countHealthyPods(pods, disruptedPods, currentTime)
+	err = dc.updatePdbStatus(pdb, currentHealthy, desiredHealthy, expectedCount, disruptedPods)
+
+	if err == nil && recheckTime != nil {
+		// There is always at most one PDB waiting with a particular name in the queue,
+		// and each PDB in the queue is associated with the lowest timestamp
+		// that was supplied when a PDB with that name was added.
+		dc.enqueuePdbForRecheck(pdb, recheckTime.Sub(currentTime))
+	}
+	return err
+}
+
+func (dc *DisruptionController) getExpectedPodCount(pdb *policy.PodDisruptionBudget, pods []*v1.Pod) (expectedCount, desiredHealthy int32, err error) {
+	err = nil
+	// TODO(davidopp): consider making the way expectedCount and rules about
+	// permitted controller configurations (specifically, considering it an error
+	// if a pod covered by a PDB has 0 controllers or > 1 controller) should be
+	// handled the same way for integer and percentage minAvailable
+	if pdb.Spec.MinAvailable.Type == intstr.Int {
+		desiredHealthy = pdb.Spec.MinAvailable.IntVal
+		expectedCount = int32(len(pods))
+	} else if pdb.Spec.MinAvailable.Type == intstr.String {
+		// When the user specifies a fraction of pods that must be available, we
+		// use as the fraction's denominator
+		// SUM_{all c in C} scale(c)
+		// where C is the union of C_p1, C_p2, ..., C_pN
+		// and each C_pi is the set of controllers controlling the pod pi
+
+		// k8s only defines what will happens when 0 or 1 controllers control a
+		// given pod.  We explicitly exclude the 0 controllers case here, and we
+		// report an error if we find a pod with more than 1 controller.  Thus in
+		// practice each C_pi is a set of exactly 1 controller.
+
+		// A mapping from controllers to their scale.
+		controllerScale := map[types.UID]int32{}
+
+		// 1. Find the controller(s) for each pod.  If any pod has 0 controllers,
+		// that's an error.  If any pod has more than 1 controller, that's also an
+		// error.
+		for _, pod := range pods {
+			controllerCount := 0
+			for _, finder := range dc.finders() {
+				var controllers []controllerAndScale
+				controllers, err = finder(pod)
+				if err != nil {
+					return
+				}
+				for _, controller := range controllers {
+					controllerScale[controller.UID] = controller.scale
+					controllerCount++
+				}
+			}
+			if controllerCount == 0 {
+				err = fmt.Errorf("asked for percentage, but found no controllers for pod %q", pod.Name)
+				dc.recorder.Event(pdb, v1.EventTypeWarning, "NoControllers", err.Error())
+				return
+			} else if controllerCount > 1 {
+				err = fmt.Errorf("pod %q has %v>1 controllers", pod.Name, controllerCount)
+				dc.recorder.Event(pdb, v1.EventTypeWarning, "TooManyControllers", err.Error())
+				return
+			}
+		}
+
+		// 2. Add up all the controllers.
+		expectedCount = 0
+		for _, count := range controllerScale {
+			expectedCount += count
+		}
+
+		// 3. Do the math.
+		var dh int
+		dh, err = intstr.GetValueFromIntOrPercent(&pdb.Spec.MinAvailable, int(expectedCount), true)
+		if err != nil {
+			return
+		}
+		desiredHealthy = int32(dh)
+	}
+
+	return
+}
+
+func countHealthyPods(pods []*v1.Pod, disruptedPods map[string]metav1.Time, currentTime time.Time) (currentHealthy int32) {
+Pod:
+	for _, pod := range pods {
+		// Pod is beeing deleted.
+		if pod.DeletionTimestamp != nil {
+			continue
+		}
+		// Pod is expected to be deleted soon.
+		if disruptionTime, found := disruptedPods[pod.Name]; found && disruptionTime.Time.Add(DeletionTimeout).After(currentTime) {
+			continue
+		}
+		if v1.IsPodReady(pod) {
+			currentHealthy++
+			continue Pod
+		}
+	}
+
+	return
+}
+
+// Builds new PodDisruption map, possibly removing items that refer to non-existing, already deleted
+// or not-deleted at all items. Also returns an information when this check should be repeated.
+func (dc *DisruptionController) buildDisruptedPodMap(pods []*v1.Pod, pdb *policy.PodDisruptionBudget, currentTime time.Time) (map[string]metav1.Time, *time.Time) {
+	disruptedPods := pdb.Status.DisruptedPods
+	result := make(map[string]metav1.Time)
+	var recheckTime *time.Time
+
+	if disruptedPods == nil || len(disruptedPods) == 0 {
+		return result, recheckTime
+	}
+	for _, pod := range pods {
+		if pod.DeletionTimestamp != nil {
+			// Already being deleted.
+			continue
+		}
+		disruptionTime, found := disruptedPods[pod.Name]
+		if !found {
+			// Pod not on the list.
+			continue
+		}
+		expectedDeletion := disruptionTime.Time.Add(DeletionTimeout)
+		if expectedDeletion.Before(currentTime) {
+			glog.V(1).Infof("Pod %s/%s was expected to be deleted at %s but it wasn't, updating pdb %s/%s",
+				pod.Namespace, pod.Name, disruptionTime.String(), pdb.Namespace, pdb.Name)
+			dc.recorder.Eventf(pod, v1.EventTypeWarning, "NotDeleted", "Pod was expected by PDB %s/%s to be deleted but it wasn't",
+				pdb.Namespace, pdb.Namespace)
+		} else {
+			if recheckTime == nil || expectedDeletion.Before(*recheckTime) {
+				recheckTime = &expectedDeletion
+			}
+			result[pod.Name] = disruptionTime
+		}
+	}
+	return result, recheckTime
+}
+
+// failSafe is an attempt to at least update the PodDisruptionsAllowed field to
+// 0 if everything else has failed.  This is one place we
+// implement the  "fail open" part of the design since if we manage to update
+// this field correctly, we will prevent the /evict handler from approving an
+// eviction when it may be unsafe to do so.
+func (dc *DisruptionController) failSafe(pdb *policy.PodDisruptionBudget) error {
+	obj, err := api.Scheme.DeepCopy(pdb)
+	if err != nil {
+		return err
+	}
+	newPdb := obj.(*policy.PodDisruptionBudget)
+	newPdb.Status.PodDisruptionsAllowed = 0
+
+	return dc.getUpdater()(newPdb)
+}
+
+func (dc *DisruptionController) updatePdbStatus(pdb *policy.PodDisruptionBudget, currentHealthy, desiredHealthy, expectedCount int32,
+	disruptedPods map[string]metav1.Time) error {
+
+	// We require expectedCount to be > 0 so that PDBs which currently match no
+	// pods are in a safe state when their first pods appear but this controller
+	// has not updated their status yet.  This isn't the only race, but it's a
+	// common one that's easy to detect.
+	disruptionsAllowed := currentHealthy - desiredHealthy
+	if expectedCount <= 0 || disruptionsAllowed <= 0 {
+		disruptionsAllowed = 0
+	}
+
+	if pdb.Status.CurrentHealthy == currentHealthy &&
+		pdb.Status.DesiredHealthy == desiredHealthy &&
+		pdb.Status.ExpectedPods == expectedCount &&
+		pdb.Status.PodDisruptionsAllowed == disruptionsAllowed &&
+		reflect.DeepEqual(pdb.Status.DisruptedPods, disruptedPods) &&
+		pdb.Status.ObservedGeneration == pdb.Generation {
+		return nil
+	}
+
+	obj, err := api.Scheme.DeepCopy(pdb)
+	if err != nil {
+		return err
+	}
+	newPdb := obj.(*policy.PodDisruptionBudget)
+
+	newPdb.Status = policy.PodDisruptionBudgetStatus{
+		CurrentHealthy:        currentHealthy,
+		DesiredHealthy:        desiredHealthy,
+		ExpectedPods:          expectedCount,
+		PodDisruptionsAllowed: disruptionsAllowed,
+		DisruptedPods:         disruptedPods,
+		ObservedGeneration:    pdb.Generation,
+	}
+
+	return dc.getUpdater()(newPdb)
+}
+
+// refresh tries to re-GET the given PDB.  If there are any errors, it just
+// returns the old PDB.  Intended to be used in a retry loop where it runs a
+// bounded number of times.
+func refresh(pdbClient policyclientset.PodDisruptionBudgetInterface, pdb *policy.PodDisruptionBudget) *policy.PodDisruptionBudget {
+	newPdb, err := pdbClient.Get(pdb.Name, metav1.GetOptions{})
+	if err == nil {
+		return newPdb
+	} else {
+		return pdb
+	}
+}
+
+func (dc *DisruptionController) writePdbStatus(pdb *policy.PodDisruptionBudget) error {
+	pdbClient := dc.kubeClient.Policy().PodDisruptionBudgets(pdb.Namespace)
+	st := pdb.Status
+
+	var err error
+	for i, pdb := 0, pdb; i < statusUpdateRetries; i, pdb = i+1, refresh(pdbClient, pdb) {
+		pdb.Status = st
+		if _, err = pdbClient.UpdateStatus(pdb); err == nil {
+			break
+		}
+	}
+
+	return err
+}

vendor/k8s.io/kubernetes/pkg/controller/disruption/disruption_test.go

@@ -0,0 +1,613 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package disruption
+
+import (
+	"fmt"
+	"reflect"
+	"runtime/debug"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	apps "k8s.io/kubernetes/pkg/apis/apps/v1beta1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	policy "k8s.io/kubernetes/pkg/apis/policy/v1beta1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/util/intstr"
+	"k8s.io/kubernetes/pkg/util/uuid"
+	"k8s.io/kubernetes/pkg/util/workqueue"
+)
+
+type pdbStates map[string]policy.PodDisruptionBudget
+
+func (ps *pdbStates) Set(pdb *policy.PodDisruptionBudget) error {
+	key, err := controller.KeyFunc(pdb)
+	if err != nil {
+		return err
+	}
+	obj, err := api.Scheme.DeepCopy(pdb)
+	if err != nil {
+		return err
+	}
+	(*ps)[key] = *obj.(*policy.PodDisruptionBudget)
+
+	return nil
+}
+
+func (ps *pdbStates) Get(key string) policy.PodDisruptionBudget {
+	return (*ps)[key]
+}
+
+func (ps *pdbStates) VerifyPdbStatus(t *testing.T, key string, disruptionsAllowed, currentHealthy, desiredHealthy, expectedPods int32,
+	disruptedPodMap map[string]metav1.Time) {
+	actualPDB := ps.Get(key)
+	expectedStatus := policy.PodDisruptionBudgetStatus{
+		PodDisruptionsAllowed: disruptionsAllowed,
+		CurrentHealthy:        currentHealthy,
+		DesiredHealthy:        desiredHealthy,
+		ExpectedPods:          expectedPods,
+		DisruptedPods:         disruptedPodMap,
+		ObservedGeneration:    actualPDB.Generation,
+	}
+	actualStatus := actualPDB.Status
+	if !reflect.DeepEqual(actualStatus, expectedStatus) {
+		debug.PrintStack()
+		t.Fatalf("PDB %q status mismatch.  Expected %+v but got %+v.", key, expectedStatus, actualStatus)
+	}
+}
+
+func (ps *pdbStates) VerifyDisruptionAllowed(t *testing.T, key string, disruptionsAllowed int32) {
+	pdb := ps.Get(key)
+	if pdb.Status.PodDisruptionsAllowed != disruptionsAllowed {
+		debug.PrintStack()
+		t.Fatalf("PodDisruptionAllowed mismatch for PDB %q.  Expected %v but got %v.", key, disruptionsAllowed, pdb.Status.PodDisruptionsAllowed)
+	}
+}
+
+func newFakeDisruptionController() (*DisruptionController, *pdbStates) {
+	ps := &pdbStates{}
+
+	dc := &DisruptionController{
+		pdbLister:   cache.StoreToPodDisruptionBudgetLister{Store: cache.NewStore(controller.KeyFunc)},
+		podLister:   cache.StoreToPodLister{Indexer: cache.NewIndexer(controller.KeyFunc, cache.Indexers{})},
+		rcLister:    cache.StoreToReplicationControllerLister{Indexer: cache.NewIndexer(controller.KeyFunc, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc})},
+		rsLister:    cache.StoreToReplicaSetLister{Indexer: cache.NewIndexer(controller.KeyFunc, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc})},
+		dLister:     cache.StoreToDeploymentLister{Indexer: cache.NewIndexer(controller.KeyFunc, cache.Indexers{})},
+		ssLister:    cache.StoreToStatefulSetLister{Store: cache.NewStore(controller.KeyFunc)},
+		getUpdater:  func() updater { return ps.Set },
+		broadcaster: record.NewBroadcaster(),
+	}
+
+	dc.recorder = dc.broadcaster.NewRecorder(v1.EventSource{Component: "disruption_test"})
+
+	return dc, ps
+}
+
+func fooBar() map[string]string {
+	return map[string]string{"foo": "bar"}
+}
+
+func newSel(labels map[string]string) *metav1.LabelSelector {
+	return &metav1.LabelSelector{MatchLabels: labels}
+}
+
+func newSelFooBar() *metav1.LabelSelector {
+	return newSel(map[string]string{"foo": "bar"})
+}
+
+func newPodDisruptionBudget(t *testing.T, minAvailable intstr.IntOrString) (*policy.PodDisruptionBudget, string) {
+
+	pdb := &policy.PodDisruptionBudget{
+		TypeMeta: metav1.TypeMeta{APIVersion: api.Registry.GroupOrDie(v1.GroupName).GroupVersion.String()},
+		ObjectMeta: v1.ObjectMeta{
+			UID:             uuid.NewUUID(),
+			Name:            "foobar",
+			Namespace:       v1.NamespaceDefault,
+			ResourceVersion: "18",
+		},
+		Spec: policy.PodDisruptionBudgetSpec{
+			MinAvailable: minAvailable,
+			Selector:     newSelFooBar(),
+		},
+	}
+
+	pdbName, err := controller.KeyFunc(pdb)
+	if err != nil {
+		t.Fatalf("Unexpected error naming pdb %q: %v", pdb.Name, err)
+	}
+
+	return pdb, pdbName
+}
+
+func newPod(t *testing.T, name string) (*v1.Pod, string) {
+	pod := &v1.Pod{
+		TypeMeta: metav1.TypeMeta{APIVersion: api.Registry.GroupOrDie(v1.GroupName).GroupVersion.String()},
+		ObjectMeta: v1.ObjectMeta{
+			UID:             uuid.NewUUID(),
+			Annotations:     make(map[string]string),
+			Name:            name,
+			Namespace:       v1.NamespaceDefault,
+			ResourceVersion: "18",
+			Labels:          fooBar(),
+		},
+		Spec: v1.PodSpec{},
+		Status: v1.PodStatus{
+			Conditions: []v1.PodCondition{
+				{Type: v1.PodReady, Status: v1.ConditionTrue},
+			},
+		},
+	}
+
+	podName, err := controller.KeyFunc(pod)
+	if err != nil {
+		t.Fatalf("Unexpected error naming pod %q: %v", pod.Name, err)
+	}
+
+	return pod, podName
+}
+
+func newReplicationController(t *testing.T, size int32) (*v1.ReplicationController, string) {
+	rc := &v1.ReplicationController{
+		TypeMeta: metav1.TypeMeta{APIVersion: api.Registry.GroupOrDie(v1.GroupName).GroupVersion.String()},
+		ObjectMeta: v1.ObjectMeta{
+			UID:             uuid.NewUUID(),
+			Name:            "foobar",
+			Namespace:       v1.NamespaceDefault,
+			ResourceVersion: "18",
+			Labels:          fooBar(),
+		},
+		Spec: v1.ReplicationControllerSpec{
+			Replicas: &size,
+			Selector: fooBar(),
+		},
+	}
+
+	rcName, err := controller.KeyFunc(rc)
+	if err != nil {
+		t.Fatalf("Unexpected error naming RC %q", rc.Name)
+	}
+
+	return rc, rcName
+}
+
+func newDeployment(t *testing.T, size int32) (*extensions.Deployment, string) {
+	d := &extensions.Deployment{
+		TypeMeta: metav1.TypeMeta{APIVersion: api.Registry.GroupOrDie(v1.GroupName).GroupVersion.String()},
+		ObjectMeta: v1.ObjectMeta{
+			UID:             uuid.NewUUID(),
+			Name:            "foobar",
+			Namespace:       v1.NamespaceDefault,
+			ResourceVersion: "18",
+			Labels:          fooBar(),
+		},
+		Spec: extensions.DeploymentSpec{
+			Replicas: &size,
+			Selector: newSelFooBar(),
+		},
+	}
+
+	dName, err := controller.KeyFunc(d)
+	if err != nil {
+		t.Fatalf("Unexpected error naming Deployment %q: %v", d.Name, err)
+	}
+
+	return d, dName
+}
+
+func newReplicaSet(t *testing.T, size int32) (*extensions.ReplicaSet, string) {
+	rs := &extensions.ReplicaSet{
+		TypeMeta: metav1.TypeMeta{APIVersion: api.Registry.GroupOrDie(v1.GroupName).GroupVersion.String()},
+		ObjectMeta: v1.ObjectMeta{
+			UID:             uuid.NewUUID(),
+			Name:            "foobar",
+			Namespace:       v1.NamespaceDefault,
+			ResourceVersion: "18",
+			Labels:          fooBar(),
+		},
+		Spec: extensions.ReplicaSetSpec{
+			Replicas: &size,
+			Selector: newSelFooBar(),
+		},
+	}
+
+	rsName, err := controller.KeyFunc(rs)
+	if err != nil {
+		t.Fatalf("Unexpected error naming ReplicaSet %q: %v", rs.Name, err)
+	}
+
+	return rs, rsName
+}
+
+func newStatefulSet(t *testing.T, size int32) (*apps.StatefulSet, string) {
+	ss := &apps.StatefulSet{
+		TypeMeta: metav1.TypeMeta{APIVersion: api.Registry.GroupOrDie(v1.GroupName).GroupVersion.String()},
+		ObjectMeta: v1.ObjectMeta{
+			UID:             uuid.NewUUID(),
+			Name:            "foobar",
+			Namespace:       v1.NamespaceDefault,
+			ResourceVersion: "18",
+			Labels:          fooBar(),
+		},
+		Spec: apps.StatefulSetSpec{
+			Replicas: &size,
+			Selector: newSelFooBar(),
+		},
+	}
+
+	ssName, err := controller.KeyFunc(ss)
+	if err != nil {
+		t.Fatalf("Unexpected error naming StatefulSet %q: %v", ss.Name, err)
+	}
+
+	return ss, ssName
+}
+
+func update(t *testing.T, store cache.Store, obj interface{}) {
+	if err := store.Update(obj); err != nil {
+		t.Fatalf("Could not add %+v to %+v: %v", obj, store, err)
+	}
+}
+
+func add(t *testing.T, store cache.Store, obj interface{}) {
+	if err := store.Add(obj); err != nil {
+		t.Fatalf("Could not add %+v to %+v: %v", obj, store, err)
+	}
+}
+
+// Create one with no selector.  Verify it matches 0 pods.
+func TestNoSelector(t *testing.T) {
+	dc, ps := newFakeDisruptionController()
+
+	pdb, pdbName := newPodDisruptionBudget(t, intstr.FromInt(3))
+	pdb.Spec.Selector = &metav1.LabelSelector{}
+	pod, _ := newPod(t, "yo-yo-yo")
+
+	add(t, dc.pdbLister.Store, pdb)
+	dc.sync(pdbName)
+	ps.VerifyPdbStatus(t, pdbName, 0, 0, 3, 0, map[string]metav1.Time{})
+
+	add(t, dc.podLister.Indexer, pod)
+	dc.sync(pdbName)
+	ps.VerifyPdbStatus(t, pdbName, 0, 0, 3, 0, map[string]metav1.Time{})
+}
+
+// Verify that available/expected counts go up as we add pods, then verify that
+// available count goes down when we make a pod unavailable.
+func TestUnavailable(t *testing.T) {
+	dc, ps := newFakeDisruptionController()
+
+	pdb, pdbName := newPodDisruptionBudget(t, intstr.FromInt(3))
+	add(t, dc.pdbLister.Store, pdb)
+	dc.sync(pdbName)
+
+	// Add three pods, verifying that the counts go up at each step.
+	pods := []*v1.Pod{}
+	for i := int32(0); i < 4; i++ {
+		ps.VerifyPdbStatus(t, pdbName, 0, i, 3, i, map[string]metav1.Time{})
+		pod, _ := newPod(t, fmt.Sprintf("yo-yo-yo %d", i))
+		pods = append(pods, pod)
+		add(t, dc.podLister.Indexer, pod)
+		dc.sync(pdbName)
+	}
+	ps.VerifyPdbStatus(t, pdbName, 1, 4, 3, 4, map[string]metav1.Time{})
+
+	// Now set one pod as unavailable
+	pods[0].Status.Conditions = []v1.PodCondition{}
+	update(t, dc.podLister.Indexer, pods[0])
+	dc.sync(pdbName)
+
+	// Verify expected update
+	ps.VerifyPdbStatus(t, pdbName, 0, 3, 3, 4, map[string]metav1.Time{})
+}
+
+// Create a pod  with no controller, and verify that a PDB with a percentage
+// specified won't allow a disruption.
+func TestNakedPod(t *testing.T) {
+	dc, ps := newFakeDisruptionController()
+
+	pdb, pdbName := newPodDisruptionBudget(t, intstr.FromString("28%"))
+	add(t, dc.pdbLister.Store, pdb)
+	dc.sync(pdbName)
+	// This verifies that when a PDB has 0 pods, disruptions are not allowed.
+	ps.VerifyDisruptionAllowed(t, pdbName, 0)
+
+	pod, _ := newPod(t, "naked")
+	add(t, dc.podLister.Indexer, pod)
+	dc.sync(pdbName)
+
+	ps.VerifyDisruptionAllowed(t, pdbName, 0)
+}
+
+// Verify that we count the scale of a ReplicaSet even when it has no Deployment.
+func TestReplicaSet(t *testing.T) {
+	dc, ps := newFakeDisruptionController()
+
+	pdb, pdbName := newPodDisruptionBudget(t, intstr.FromString("20%"))
+	add(t, dc.pdbLister.Store, pdb)
+
+	rs, _ := newReplicaSet(t, 10)
+	add(t, dc.rsLister.Indexer, rs)
+
+	pod, _ := newPod(t, "pod")
+	add(t, dc.podLister.Indexer, pod)
+	dc.sync(pdbName)
+	ps.VerifyPdbStatus(t, pdbName, 0, 1, 2, 10, map[string]metav1.Time{})
+}
+
+// Verify that multiple controllers doesn't allow the PDB to be set true.
+func TestMultipleControllers(t *testing.T) {
+	const rcCount = 2
+	const podCount = 2
+
+	dc, ps := newFakeDisruptionController()
+
+	pdb, pdbName := newPodDisruptionBudget(t, intstr.FromString("1%"))
+	add(t, dc.pdbLister.Store, pdb)
+
+	for i := 0; i < podCount; i++ {
+		pod, _ := newPod(t, fmt.Sprintf("pod %d", i))
+		add(t, dc.podLister.Indexer, pod)
+	}
+	dc.sync(pdbName)
+
+	// No controllers yet => no disruption allowed
+	ps.VerifyDisruptionAllowed(t, pdbName, 0)
+
+	rc, _ := newReplicationController(t, 1)
+	rc.Name = "rc 1"
+	add(t, dc.rcLister.Indexer, rc)
+	dc.sync(pdbName)
+
+	// One RC and 200%>1% healthy => disruption allowed
+	ps.VerifyDisruptionAllowed(t, pdbName, 1)
+
+	rc, _ = newReplicationController(t, 1)
+	rc.Name = "rc 2"
+	add(t, dc.rcLister.Indexer, rc)
+	dc.sync(pdbName)
+
+	// 100%>1% healthy BUT two RCs => no disruption allowed
+	ps.VerifyDisruptionAllowed(t, pdbName, 0)
+}
+
+func TestReplicationController(t *testing.T) {
+	// The budget in this test matches foo=bar, but the RC and its pods match
+	// {foo=bar, baz=quux}.  Later, when we add a rogue pod with only a foo=bar
+	// label, it will match the budget but have no controllers, which should
+	// trigger the controller to set PodDisruptionAllowed to false.
+	labels := map[string]string{
+		"foo": "bar",
+		"baz": "quux",
+	}
+
+	dc, ps := newFakeDisruptionController()
+
+	// 34% should round up to 2
+	pdb, pdbName := newPodDisruptionBudget(t, intstr.FromString("34%"))
+	add(t, dc.pdbLister.Store, pdb)
+	rc, _ := newReplicationController(t, 3)
+	rc.Spec.Selector = labels
+	add(t, dc.rcLister.Indexer, rc)
+	dc.sync(pdbName)
+
+	// It starts out at 0 expected because, with no pods, the PDB doesn't know
+	// about the RC.  This is a known bug.  TODO(mml): file issue
+	ps.VerifyPdbStatus(t, pdbName, 0, 0, 0, 0, map[string]metav1.Time{})
+
+	pods := []*v1.Pod{}
+
+	for i := int32(0); i < 3; i++ {
+		pod, _ := newPod(t, fmt.Sprintf("foobar %d", i))
+		pods = append(pods, pod)
+		pod.Labels = labels
+		add(t, dc.podLister.Indexer, pod)
+		dc.sync(pdbName)
+		if i < 2 {
+			ps.VerifyPdbStatus(t, pdbName, 0, i+1, 2, 3, map[string]metav1.Time{})
+		} else {
+			ps.VerifyPdbStatus(t, pdbName, 1, 3, 2, 3, map[string]metav1.Time{})
+		}
+	}
+
+	rogue, _ := newPod(t, "rogue")
+	add(t, dc.podLister.Indexer, rogue)
+	dc.sync(pdbName)
+	ps.VerifyDisruptionAllowed(t, pdbName, 0)
+}
+
+func TestStatefulSetController(t *testing.T) {
+	labels := map[string]string{
+		"foo": "bar",
+		"baz": "quux",
+	}
+
+	dc, ps := newFakeDisruptionController()
+
+	// 34% should round up to 2
+	pdb, pdbName := newPodDisruptionBudget(t, intstr.FromString("34%"))
+	add(t, dc.pdbLister.Store, pdb)
+	ss, _ := newStatefulSet(t, 3)
+	add(t, dc.ssLister.Store, ss)
+	dc.sync(pdbName)
+
+	// It starts out at 0 expected because, with no pods, the PDB doesn't know
+	// about the SS.  This is a known bug.  TODO(mml): file issue
+	ps.VerifyPdbStatus(t, pdbName, 0, 0, 0, 0, map[string]metav1.Time{})
+
+	pods := []*v1.Pod{}
+
+	for i := int32(0); i < 3; i++ {
+		pod, _ := newPod(t, fmt.Sprintf("foobar %d", i))
+		pods = append(pods, pod)
+		pod.Labels = labels
+		add(t, dc.podLister.Indexer, pod)
+		dc.sync(pdbName)
+		if i < 2 {
+			ps.VerifyPdbStatus(t, pdbName, 0, i+1, 2, 3, map[string]metav1.Time{})
+		} else {
+			ps.VerifyPdbStatus(t, pdbName, 1, 3, 2, 3, map[string]metav1.Time{})
+		}
+	}
+}
+
+func TestTwoControllers(t *testing.T) {
+	// Most of this test is in verifying intermediate cases as we define the
+	// three controllers and create the pods.
+	rcLabels := map[string]string{
+		"foo": "bar",
+		"baz": "quux",
+	}
+	dLabels := map[string]string{
+		"foo": "bar",
+		"baz": "quuux",
+	}
+	dc, ps := newFakeDisruptionController()
+
+	// These constants are related, but I avoid calculating the correct values in
+	// code.  If you update a parameter here, recalculate the correct values for
+	// all of them.  Further down in the test, we use these to control loops, and
+	// that level of logic is enough complexity for me.
+	const collectionSize int32 = 11   // How big each collection is
+	const minAvailable string = "28%" // minAvailable we'll specify
+	const minimumOne int32 = 4        // integer minimum with one controller
+	const minimumTwo int32 = 7        // integer minimum with two controllers
+
+	pdb, pdbName := newPodDisruptionBudget(t, intstr.FromString("28%"))
+	add(t, dc.pdbLister.Store, pdb)
+	rc, _ := newReplicationController(t, collectionSize)
+	rc.Spec.Selector = rcLabels
+	add(t, dc.rcLister.Indexer, rc)
+	dc.sync(pdbName)
+
+	ps.VerifyPdbStatus(t, pdbName, 0, 0, 0, 0, map[string]metav1.Time{})
+
+	pods := []*v1.Pod{}
+
+	unavailablePods := collectionSize - minimumOne - 1
+	for i := int32(1); i <= collectionSize; i++ {
+		pod, _ := newPod(t, fmt.Sprintf("quux %d", i))
+		pods = append(pods, pod)
+		pod.Labels = rcLabels
+		if i <= unavailablePods {
+			pod.Status.Conditions = []v1.PodCondition{}
+		}
+		add(t, dc.podLister.Indexer, pod)
+		dc.sync(pdbName)
+		if i <= unavailablePods {
+			ps.VerifyPdbStatus(t, pdbName, 0, 0, minimumOne, collectionSize, map[string]metav1.Time{})
+		} else if i-unavailablePods <= minimumOne {
+			ps.VerifyPdbStatus(t, pdbName, 0, i-unavailablePods, minimumOne, collectionSize, map[string]metav1.Time{})
+		} else {
+			ps.VerifyPdbStatus(t, pdbName, 1, i-unavailablePods, minimumOne, collectionSize, map[string]metav1.Time{})
+		}
+	}
+
+	d, _ := newDeployment(t, collectionSize)
+	d.Spec.Selector = newSel(dLabels)
+	add(t, dc.dLister.Indexer, d)
+	dc.sync(pdbName)
+	ps.VerifyPdbStatus(t, pdbName, 1, minimumOne+1, minimumOne, collectionSize, map[string]metav1.Time{})
+
+	rs, _ := newReplicaSet(t, collectionSize)
+	rs.Spec.Selector = newSel(dLabels)
+	rs.Labels = dLabels
+	add(t, dc.rsLister.Indexer, rs)
+	dc.sync(pdbName)
+	ps.VerifyPdbStatus(t, pdbName, 1, minimumOne+1, minimumOne, collectionSize, map[string]metav1.Time{})
+
+	// By the end of this loop, the number of ready pods should be N+2 (hence minimumTwo+2).
+	unavailablePods = 2*collectionSize - (minimumTwo + 2) - unavailablePods
+	for i := int32(1); i <= collectionSize; i++ {
+		pod, _ := newPod(t, fmt.Sprintf("quuux %d", i))
+		pods = append(pods, pod)
+		pod.Labels = dLabels
+		if i <= unavailablePods {
+			pod.Status.Conditions = []v1.PodCondition{}
+		}
+		add(t, dc.podLister.Indexer, pod)
+		dc.sync(pdbName)
+		if i <= unavailablePods {
+			ps.VerifyPdbStatus(t, pdbName, 0, minimumOne+1, minimumTwo, 2*collectionSize, map[string]metav1.Time{})
+		} else if i-unavailablePods <= minimumTwo-(minimumOne+1) {
+			ps.VerifyPdbStatus(t, pdbName, 0, (minimumOne+1)+(i-unavailablePods), minimumTwo, 2*collectionSize, map[string]metav1.Time{})
+		} else {
+			ps.VerifyPdbStatus(t, pdbName, i-unavailablePods-(minimumTwo-(minimumOne+1)),
+				(minimumOne+1)+(i-unavailablePods), minimumTwo, 2*collectionSize, map[string]metav1.Time{})
+		}
+	}
+
+	// Now we verify we can bring down 1 pod and a disruption is still permitted,
+	// but if we bring down two, it's not.  Then we make the pod ready again and
+	// verify that a disruption is permitted again.
+	ps.VerifyPdbStatus(t, pdbName, 2, 2+minimumTwo, minimumTwo, 2*collectionSize, map[string]metav1.Time{})
+	pods[collectionSize-1].Status.Conditions = []v1.PodCondition{}
+	update(t, dc.podLister.Indexer, pods[collectionSize-1])
+	dc.sync(pdbName)
+	ps.VerifyPdbStatus(t, pdbName, 1, 1+minimumTwo, minimumTwo, 2*collectionSize, map[string]metav1.Time{})
+
+	pods[collectionSize-2].Status.Conditions = []v1.PodCondition{}
+	update(t, dc.podLister.Indexer, pods[collectionSize-2])
+	dc.sync(pdbName)
+	ps.VerifyPdbStatus(t, pdbName, 0, minimumTwo, minimumTwo, 2*collectionSize, map[string]metav1.Time{})
+
+	pods[collectionSize-1].Status.Conditions = []v1.PodCondition{{Type: v1.PodReady, Status: v1.ConditionTrue}}
+	update(t, dc.podLister.Indexer, pods[collectionSize-1])
+	dc.sync(pdbName)
+	ps.VerifyPdbStatus(t, pdbName, 1, 1+minimumTwo, minimumTwo, 2*collectionSize, map[string]metav1.Time{})
+}
+
+// Test pdb doesn't exist
+func TestPDBNotExist(t *testing.T) {
+	dc, _ := newFakeDisruptionController()
+	pdb, _ := newPodDisruptionBudget(t, intstr.FromString("67%"))
+	add(t, dc.pdbLister.Store, pdb)
+	if err := dc.sync("notExist"); err != nil {
+		t.Errorf("Unexpected error: %v, expect nil", err)
+	}
+}
+
+func TestUpdateDisruptedPods(t *testing.T) {
+	dc, ps := newFakeDisruptionController()
+	dc.recheckQueue = workqueue.NewNamedDelayingQueue("pdb-queue")
+	pdb, pdbName := newPodDisruptionBudget(t, intstr.FromInt(1))
+	currentTime := time.Now()
+	pdb.Status.DisruptedPods = map[string]metav1.Time{
+		"p1":       {Time: currentTime},                       // Should be removed, pod deletion started.
+		"p2":       {Time: currentTime.Add(-5 * time.Minute)}, // Should be removed, expired.
+		"p3":       {Time: currentTime},                       // Should remain, pod untouched.
+		"notthere": {Time: currentTime},                       // Should be removed, pod deleted.
+	}
+	add(t, dc.pdbLister.Store, pdb)
+
+	pod1, _ := newPod(t, "p1")
+	pod1.DeletionTimestamp = &metav1.Time{Time: time.Now()}
+	pod2, _ := newPod(t, "p2")
+	pod3, _ := newPod(t, "p3")
+
+	add(t, dc.podLister.Indexer, pod1)
+	add(t, dc.podLister.Indexer, pod2)
+	add(t, dc.podLister.Indexer, pod3)
+
+	dc.sync(pdbName)
+
+	ps.VerifyPdbStatus(t, pdbName, 0, 1, 1, 3, map[string]metav1.Time{"p3": {Time: currentTime}})
+}

vendor/k8s.io/kubernetes/pkg/controller/doc.go

@@ -0,0 +1,19 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package controller contains code for controllers (like the replication
+// controller).
+package controller // import "k8s.io/kubernetes/pkg/controller"

vendor/k8s.io/kubernetes/pkg/controller/endpoint/BUILD

@@ -0,0 +1,72 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "endpoints_controller.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api/v1:go_default_library",
+        "//pkg/api/v1/endpoints:go_default_library",
+        "//pkg/api/v1/pod:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/util/metrics:go_default_library",
+        "//pkg/util/workqueue:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/api/errors",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/labels",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/sets",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+        "//vendor:k8s.io/apimachinery/pkg/watch",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["endpoints_controller_test.go"],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/api/v1/endpoints:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/restclient:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/util/intstr:go_default_library",
+        "//pkg/util/testing:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/endpoint/OWNERS

@@ -0,0 +1,6 @@
+reviewers:
+- bprashanth
+- bowei 
+- MrHohn
+- thockin
+- mrubin

vendor/k8s.io/kubernetes/pkg/controller/endpoint/doc.go

@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package service provides EndpointController implementation
+// to manage and sync service endpoints.
+package endpoint // import "k8s.io/kubernetes/pkg/controller/endpoint"

vendor/k8s.io/kubernetes/pkg/controller/endpoint/endpoints_controller.go

@@ -0,0 +1,519 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package endpoint
+
+import (
+	"fmt"
+	"reflect"
+	"strconv"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/api/v1/endpoints"
+	podutil "k8s.io/kubernetes/pkg/api/v1/pod"
+	utilpod "k8s.io/kubernetes/pkg/api/v1/pod"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/util/metrics"
+	"k8s.io/kubernetes/pkg/util/workqueue"
+
+	"github.com/golang/glog"
+)
+
+const (
+	// We'll attempt to recompute EVERY service's endpoints at least this
+	// often. Higher numbers = lower CPU/network load; lower numbers =
+	// shorter amount of time before a mistaken endpoint is corrected.
+	FullServiceResyncPeriod = 30 * time.Second
+
+	// We must avoid syncing service until the pod store has synced. If it hasn't synced, to
+	// avoid a hot loop, we'll wait this long between checks.
+	PodStoreSyncedPollPeriod = 100 * time.Millisecond
+
+	// An annotation on the Service denoting if the endpoints controller should
+	// go ahead and create endpoints for unready pods. This annotation is
+	// currently only used by StatefulSets, where we need the pod to be DNS
+	// resolvable during initialization and termination. In this situation we
+	// create a headless Service just for the StatefulSet, and clients shouldn't
+	// be using this Service for anything so unready endpoints don't matter.
+	// Endpoints of these Services retain their DNS records and continue
+	// receiving traffic for the Service from the moment the kubelet starts all
+	// containers in the pod and marks it "Running", till the kubelet stops all
+	// containers and deletes the pod from the apiserver.
+	TolerateUnreadyEndpointsAnnotation = "service.alpha.kubernetes.io/tolerate-unready-endpoints"
+)
+
+var (
+	keyFunc = cache.DeletionHandlingMetaNamespaceKeyFunc
+)
+
+// NewEndpointController returns a new *EndpointController.
+func NewEndpointController(podInformer cache.SharedIndexInformer, client clientset.Interface) *EndpointController {
+	if client != nil && client.Core().RESTClient().GetRateLimiter() != nil {
+		metrics.RegisterMetricAndTrackRateLimiterUsage("endpoint_controller", client.Core().RESTClient().GetRateLimiter())
+	}
+	e := &EndpointController{
+		client: client,
+		queue:  workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "endpoint"),
+	}
+
+	e.serviceStore.Indexer, e.serviceController = cache.NewIndexerInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return e.client.Core().Services(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return e.client.Core().Services(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&v1.Service{},
+		// TODO: Can we have much longer period here?
+		FullServiceResyncPeriod,
+		cache.ResourceEventHandlerFuncs{
+			AddFunc: e.enqueueService,
+			UpdateFunc: func(old, cur interface{}) {
+				e.enqueueService(cur)
+			},
+			DeleteFunc: e.enqueueService,
+		},
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+
+	podInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    e.addPod,
+		UpdateFunc: e.updatePod,
+		DeleteFunc: e.deletePod,
+	})
+	e.podStore.Indexer = podInformer.GetIndexer()
+	e.podController = podInformer.GetController()
+	e.podStoreSynced = podInformer.HasSynced
+
+	return e
+}
+
+// NewEndpointControllerFromClient returns a new *EndpointController that runs its own informer.
+func NewEndpointControllerFromClient(client *clientset.Clientset, resyncPeriod controller.ResyncPeriodFunc) *EndpointController {
+	podInformer := informers.NewPodInformer(client, resyncPeriod())
+	e := NewEndpointController(podInformer, client)
+	e.internalPodInformer = podInformer
+
+	return e
+}
+
+// EndpointController manages selector-based service endpoints.
+type EndpointController struct {
+	client clientset.Interface
+
+	serviceStore cache.StoreToServiceLister
+	podStore     cache.StoreToPodLister
+
+	// internalPodInformer is used to hold a personal informer.  If we're using
+	// a normal shared informer, then the informer will be started for us.  If
+	// we have a personal informer, we must start it ourselves.   If you start
+	// the controller using NewEndpointController(passing SharedInformer), this
+	// will be null
+	internalPodInformer cache.SharedIndexInformer
+
+	// Services that need to be updated. A channel is inappropriate here,
+	// because it allows services with lots of pods to be serviced much
+	// more often than services with few pods; it also would cause a
+	// service that's inserted multiple times to be processed more than
+	// necessary.
+	queue workqueue.RateLimitingInterface
+
+	// Since we join two objects, we'll watch both of them with
+	// controllers.
+	serviceController cache.Controller
+	podController     cache.Controller
+	// podStoreSynced returns true if the pod store has been synced at least once.
+	// Added as a member to the struct to allow injection for testing.
+	podStoreSynced func() bool
+}
+
+// Runs e; will not return until stopCh is closed. workers determines how many
+// endpoints will be handled in parallel.
+func (e *EndpointController) Run(workers int, stopCh <-chan struct{}) {
+	defer utilruntime.HandleCrash()
+	defer e.queue.ShutDown()
+
+	go e.serviceController.Run(stopCh)
+	go e.podController.Run(stopCh)
+
+	if !cache.WaitForCacheSync(stopCh, e.podStoreSynced) {
+		return
+	}
+
+	for i := 0; i < workers; i++ {
+		go wait.Until(e.worker, time.Second, stopCh)
+	}
+	go func() {
+		defer utilruntime.HandleCrash()
+		time.Sleep(5 * time.Minute) // give time for our cache to fill
+		e.checkLeftoverEndpoints()
+	}()
+
+	if e.internalPodInformer != nil {
+		go e.internalPodInformer.Run(stopCh)
+	}
+
+	<-stopCh
+}
+
+func (e *EndpointController) getPodServiceMemberships(pod *v1.Pod) (sets.String, error) {
+	set := sets.String{}
+	services, err := e.serviceStore.GetPodServices(pod)
+	if err != nil {
+		// don't log this error because this function makes pointless
+		// errors when no services match.
+		return set, nil
+	}
+	for i := range services {
+		key, err := keyFunc(services[i])
+		if err != nil {
+			return nil, err
+		}
+		set.Insert(key)
+	}
+	return set, nil
+}
+
+// When a pod is added, figure out what services it will be a member of and
+// enqueue them. obj must have *v1.Pod type.
+func (e *EndpointController) addPod(obj interface{}) {
+	pod := obj.(*v1.Pod)
+	services, err := e.getPodServiceMemberships(pod)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("Unable to get pod %v/%v's service memberships: %v", pod.Namespace, pod.Name, err))
+		return
+	}
+	for key := range services {
+		e.queue.Add(key)
+	}
+}
+
+// When a pod is updated, figure out what services it used to be a member of
+// and what services it will be a member of, and enqueue the union of these.
+// old and cur must be *v1.Pod types.
+func (e *EndpointController) updatePod(old, cur interface{}) {
+	newPod := cur.(*v1.Pod)
+	oldPod := old.(*v1.Pod)
+	if newPod.ResourceVersion == oldPod.ResourceVersion {
+		// Periodic resync will send update events for all known pods.
+		// Two different versions of the same pod will always have different RVs.
+		return
+	}
+	services, err := e.getPodServiceMemberships(newPod)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("Unable to get pod %v/%v's service memberships: %v", newPod.Namespace, newPod.Name, err))
+		return
+	}
+
+	// Only need to get the old services if the labels changed.
+	if !reflect.DeepEqual(newPod.Labels, oldPod.Labels) ||
+		!hostNameAndDomainAreEqual(newPod, oldPod) {
+		oldServices, err := e.getPodServiceMemberships(oldPod)
+		if err != nil {
+			utilruntime.HandleError(fmt.Errorf("Unable to get pod %v/%v's service memberships: %v", oldPod.Namespace, oldPod.Name, err))
+			return
+		}
+		services = services.Union(oldServices)
+	}
+	for key := range services {
+		e.queue.Add(key)
+	}
+}
+
+func hostNameAndDomainAreEqual(pod1, pod2 *v1.Pod) bool {
+	return getHostname(pod1) == getHostname(pod2) &&
+		getSubdomain(pod1) == getSubdomain(pod2)
+}
+
+func getHostname(pod *v1.Pod) string {
+	if len(pod.Spec.Hostname) > 0 {
+		return pod.Spec.Hostname
+	}
+	if pod.Annotations != nil {
+		return pod.Annotations[utilpod.PodHostnameAnnotation]
+	}
+	return ""
+}
+
+func getSubdomain(pod *v1.Pod) string {
+	if len(pod.Spec.Subdomain) > 0 {
+		return pod.Spec.Subdomain
+	}
+	if pod.Annotations != nil {
+		return pod.Annotations[utilpod.PodSubdomainAnnotation]
+	}
+	return ""
+}
+
+// When a pod is deleted, enqueue the services the pod used to be a member of.
+// obj could be an *v1.Pod, or a DeletionFinalStateUnknown marker item.
+func (e *EndpointController) deletePod(obj interface{}) {
+	if _, ok := obj.(*v1.Pod); ok {
+		// Enqueue all the services that the pod used to be a member
+		// of. This happens to be exactly the same thing we do when a
+		// pod is added.
+		e.addPod(obj)
+		return
+	}
+	podKey, err := keyFunc(obj)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("Couldn't get key for object %#v: %v", obj, err))
+		return
+	}
+	glog.V(4).Infof("Pod %q was deleted but we don't have a record of its final state, so it will take up to %v before it will be removed from all endpoint records.", podKey, FullServiceResyncPeriod)
+
+	// TODO: keep a map of pods to services to handle this condition.
+}
+
+// obj could be an *v1.Service, or a DeletionFinalStateUnknown marker item.
+func (e *EndpointController) enqueueService(obj interface{}) {
+	key, err := keyFunc(obj)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("Couldn't get key for object %+v: %v", obj, err))
+		return
+	}
+
+	e.queue.Add(key)
+}
+
+// worker runs a worker thread that just dequeues items, processes them, and
+// marks them done. You may run as many of these in parallel as you wish; the
+// workqueue guarantees that they will not end up processing the same service
+// at the same time.
+func (e *EndpointController) worker() {
+	for e.processNextWorkItem() {
+	}
+}
+
+func (e *EndpointController) processNextWorkItem() bool {
+	eKey, quit := e.queue.Get()
+	if quit {
+		return false
+	}
+	defer e.queue.Done(eKey)
+
+	err := e.syncService(eKey.(string))
+	if err == nil {
+		e.queue.Forget(eKey)
+		return true
+	}
+
+	utilruntime.HandleError(fmt.Errorf("Sync %v failed with %v", eKey, err))
+	e.queue.AddRateLimited(eKey)
+
+	return true
+}
+
+func (e *EndpointController) syncService(key string) error {
+	startTime := time.Now()
+	defer func() {
+		glog.V(4).Infof("Finished syncing service %q endpoints. (%v)", key, time.Now().Sub(startTime))
+	}()
+
+	obj, exists, err := e.serviceStore.Indexer.GetByKey(key)
+	if err != nil || !exists {
+		// Delete the corresponding endpoint, as the service has been deleted.
+		// TODO: Please note that this will delete an endpoint when a
+		// service is deleted. However, if we're down at the time when
+		// the service is deleted, we will miss that deletion, so this
+		// doesn't completely solve the problem. See #6877.
+		namespace, name, err := cache.SplitMetaNamespaceKey(key)
+		if err != nil {
+			utilruntime.HandleError(fmt.Errorf("Need to delete endpoint with key %q, but couldn't understand the key: %v", key, err))
+			// Don't retry, as the key isn't going to magically become understandable.
+			return nil
+		}
+		err = e.client.Core().Endpoints(namespace).Delete(name, nil)
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+		return nil
+	}
+
+	service := obj.(*v1.Service)
+	if service.Spec.Selector == nil {
+		// services without a selector receive no endpoints from this controller;
+		// these services will receive the endpoints that are created out-of-band via the REST API.
+		return nil
+	}
+
+	glog.V(5).Infof("About to update endpoints for service %q", key)
+	pods, err := e.podStore.Pods(service.Namespace).List(labels.Set(service.Spec.Selector).AsSelectorPreValidated())
+	if err != nil {
+		// Since we're getting stuff from a local cache, it is
+		// basically impossible to get this error.
+		return err
+	}
+
+	subsets := []v1.EndpointSubset{}
+
+	var tolerateUnreadyEndpoints bool
+	if v, ok := service.Annotations[TolerateUnreadyEndpointsAnnotation]; ok {
+		b, err := strconv.ParseBool(v)
+		if err == nil {
+			tolerateUnreadyEndpoints = b
+		} else {
+			utilruntime.HandleError(fmt.Errorf("Failed to parse annotation %v: %v", TolerateUnreadyEndpointsAnnotation, err))
+		}
+	}
+
+	readyEps := 0
+	notReadyEps := 0
+	for i := range pods {
+		// TODO: Do we need to copy here?
+		pod := &(*pods[i])
+
+		for i := range service.Spec.Ports {
+			servicePort := &service.Spec.Ports[i]
+
+			portName := servicePort.Name
+			portProto := servicePort.Protocol
+			portNum, err := podutil.FindPort(pod, servicePort)
+			if err != nil {
+				glog.V(4).Infof("Failed to find port for service %s/%s: %v", service.Namespace, service.Name, err)
+				continue
+			}
+			if len(pod.Status.PodIP) == 0 {
+				glog.V(5).Infof("Failed to find an IP for pod %s/%s", pod.Namespace, pod.Name)
+				continue
+			}
+			if !tolerateUnreadyEndpoints && pod.DeletionTimestamp != nil {
+				glog.V(5).Infof("Pod is being deleted %s/%s", pod.Namespace, pod.Name)
+				continue
+			}
+
+			epp := v1.EndpointPort{Name: portName, Port: int32(portNum), Protocol: portProto}
+			epa := v1.EndpointAddress{
+				IP:       pod.Status.PodIP,
+				NodeName: &pod.Spec.NodeName,
+				TargetRef: &v1.ObjectReference{
+					Kind:            "Pod",
+					Namespace:       pod.ObjectMeta.Namespace,
+					Name:            pod.ObjectMeta.Name,
+					UID:             pod.ObjectMeta.UID,
+					ResourceVersion: pod.ObjectMeta.ResourceVersion,
+				}}
+
+			hostname := getHostname(pod)
+			if len(hostname) > 0 &&
+				getSubdomain(pod) == service.Name &&
+				service.Namespace == pod.Namespace {
+				epa.Hostname = hostname
+			}
+
+			if tolerateUnreadyEndpoints || v1.IsPodReady(pod) {
+				subsets = append(subsets, v1.EndpointSubset{
+					Addresses: []v1.EndpointAddress{epa},
+					Ports:     []v1.EndpointPort{epp},
+				})
+				readyEps++
+			} else {
+				glog.V(5).Infof("Pod is out of service: %v/%v", pod.Namespace, pod.Name)
+				subsets = append(subsets, v1.EndpointSubset{
+					NotReadyAddresses: []v1.EndpointAddress{epa},
+					Ports:             []v1.EndpointPort{epp},
+				})
+				notReadyEps++
+			}
+		}
+	}
+	subsets = endpoints.RepackSubsets(subsets)
+
+	// See if there's actually an update here.
+	currentEndpoints, err := e.client.Core().Endpoints(service.Namespace).Get(service.Name, metav1.GetOptions{})
+	if err != nil {
+		if errors.IsNotFound(err) {
+			currentEndpoints = &v1.Endpoints{
+				ObjectMeta: v1.ObjectMeta{
+					Name:   service.Name,
+					Labels: service.Labels,
+				},
+			}
+		} else {
+			return err
+		}
+	}
+
+	if reflect.DeepEqual(currentEndpoints.Subsets, subsets) &&
+		reflect.DeepEqual(currentEndpoints.Labels, service.Labels) {
+		glog.V(5).Infof("endpoints are equal for %s/%s, skipping update", service.Namespace, service.Name)
+		return nil
+	}
+	newEndpoints := currentEndpoints
+	newEndpoints.Subsets = subsets
+	newEndpoints.Labels = service.Labels
+	if newEndpoints.Annotations == nil {
+		newEndpoints.Annotations = make(map[string]string)
+	}
+
+	glog.V(4).Infof("Update endpoints for %v/%v, ready: %d not ready: %d", service.Namespace, service.Name, readyEps, notReadyEps)
+	createEndpoints := len(currentEndpoints.ResourceVersion) == 0
+	if createEndpoints {
+		// No previous endpoints, create them
+		_, err = e.client.Core().Endpoints(service.Namespace).Create(newEndpoints)
+	} else {
+		// Pre-existing
+		_, err = e.client.Core().Endpoints(service.Namespace).Update(newEndpoints)
+	}
+	if err != nil {
+		if createEndpoints && errors.IsForbidden(err) {
+			// A request is forbidden primarily for two reasons:
+			// 1. namespace is terminating, endpoint creation is not allowed by default.
+			// 2. policy is misconfigured, in which case no service would function anywhere.
+			// Given the frequency of 1, we log at a lower level.
+			glog.V(5).Infof("Forbidden from creating endpoints: %v", err)
+		}
+		return err
+	}
+	return nil
+}
+
+// checkLeftoverEndpoints lists all currently existing endpoints and adds their
+// service to the queue. This will detect endpoints that exist with no
+// corresponding service; these endpoints need to be deleted. We only need to
+// do this once on startup, because in steady-state these are detected (but
+// some stragglers could have been left behind if the endpoint controller
+// reboots).
+func (e *EndpointController) checkLeftoverEndpoints() {
+	list, err := e.client.Core().Endpoints(v1.NamespaceAll).List(v1.ListOptions{})
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("Unable to list endpoints (%v); orphaned endpoints will not be cleaned up. (They're pretty harmless, but you can restart this component if you want another attempt made.)", err))
+		return
+	}
+	for i := range list.Items {
+		ep := &list.Items[i]
+		key, err := keyFunc(ep)
+		if err != nil {
+			utilruntime.HandleError(fmt.Errorf("Unable to get key for endpoint %#v", ep))
+			continue
+		}
+		e.queue.Add(key)
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/endpoint/endpoints_controller_test.go

@@ -0,0 +1,567 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package endpoint
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/pkg/api/v1"
+	endptspkg "k8s.io/kubernetes/pkg/api/v1/endpoints"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/client/restclient"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/util/intstr"
+	utiltesting "k8s.io/kubernetes/pkg/util/testing"
+)
+
+var alwaysReady = func() bool { return true }
+var emptyNodeName string
+
+func addPods(store cache.Store, namespace string, nPods int, nPorts int, nNotReady int) {
+	for i := 0; i < nPods+nNotReady; i++ {
+		p := &v1.Pod{
+			TypeMeta: metav1.TypeMeta{APIVersion: api.Registry.GroupOrDie(v1.GroupName).GroupVersion.String()},
+			ObjectMeta: v1.ObjectMeta{
+				Namespace: namespace,
+				Name:      fmt.Sprintf("pod%d", i),
+				Labels:    map[string]string{"foo": "bar"},
+			},
+			Spec: v1.PodSpec{
+				Containers: []v1.Container{{Ports: []v1.ContainerPort{}}},
+			},
+			Status: v1.PodStatus{
+				PodIP: fmt.Sprintf("1.2.3.%d", 4+i),
+				Conditions: []v1.PodCondition{
+					{
+						Type:   v1.PodReady,
+						Status: v1.ConditionTrue,
+					},
+				},
+			},
+		}
+		if i >= nPods {
+			p.Status.Conditions[0].Status = v1.ConditionFalse
+		}
+		for j := 0; j < nPorts; j++ {
+			p.Spec.Containers[0].Ports = append(p.Spec.Containers[0].Ports,
+				v1.ContainerPort{Name: fmt.Sprintf("port%d", i), ContainerPort: int32(8080 + j)})
+		}
+		store.Add(p)
+	}
+}
+
+type serverResponse struct {
+	statusCode int
+	obj        interface{}
+}
+
+func makeTestServer(t *testing.T, namespace string, endpointsResponse serverResponse) (*httptest.Server, *utiltesting.FakeHandler) {
+	fakeEndpointsHandler := utiltesting.FakeHandler{
+		StatusCode:   endpointsResponse.statusCode,
+		ResponseBody: runtime.EncodeOrDie(testapi.Default.Codec(), endpointsResponse.obj.(runtime.Object)),
+	}
+	mux := http.NewServeMux()
+	mux.Handle(testapi.Default.ResourcePath("endpoints", namespace, ""), &fakeEndpointsHandler)
+	mux.Handle(testapi.Default.ResourcePath("endpoints/", namespace, ""), &fakeEndpointsHandler)
+	mux.HandleFunc("/", func(res http.ResponseWriter, req *http.Request) {
+		t.Errorf("unexpected request: %v", req.RequestURI)
+		res.WriteHeader(http.StatusNotFound)
+	})
+	return httptest.NewServer(mux), &fakeEndpointsHandler
+}
+
+func TestSyncEndpointsItemsPreserveNoSelector(t *testing.T) {
+	ns := v1.NamespaceDefault
+	testServer, endpointsHandler := makeTestServer(t, ns,
+		serverResponse{http.StatusOK, &v1.Endpoints{
+			ObjectMeta: v1.ObjectMeta{
+				Name:            "foo",
+				Namespace:       ns,
+				ResourceVersion: "1",
+			},
+			Subsets: []v1.EndpointSubset{{
+				Addresses: []v1.EndpointAddress{{IP: "6.7.8.9", NodeName: &emptyNodeName}},
+				Ports:     []v1.EndpointPort{{Port: 1000}},
+			}},
+		}})
+	defer testServer.Close()
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	endpoints := NewEndpointControllerFromClient(client, controller.NoResyncPeriodFunc)
+	endpoints.podStoreSynced = alwaysReady
+	endpoints.serviceStore.Indexer.Add(&v1.Service{
+		ObjectMeta: v1.ObjectMeta{Name: "foo", Namespace: ns},
+		Spec:       v1.ServiceSpec{Ports: []v1.ServicePort{{Port: 80}}},
+	})
+	endpoints.syncService(ns + "/foo")
+	endpointsHandler.ValidateRequestCount(t, 0)
+}
+
+func TestCheckLeftoverEndpoints(t *testing.T) {
+	ns := v1.NamespaceDefault
+	// Note that this requests *all* endpoints, therefore the NamespaceAll
+	// below.
+	testServer, _ := makeTestServer(t, v1.NamespaceAll,
+		serverResponse{http.StatusOK, &v1.EndpointsList{
+			ListMeta: metav1.ListMeta{
+				ResourceVersion: "1",
+			},
+			Items: []v1.Endpoints{{
+				ObjectMeta: v1.ObjectMeta{
+					Name:            "foo",
+					Namespace:       ns,
+					ResourceVersion: "1",
+				},
+				Subsets: []v1.EndpointSubset{{
+					Addresses: []v1.EndpointAddress{{IP: "6.7.8.9", NodeName: &emptyNodeName}},
+					Ports:     []v1.EndpointPort{{Port: 1000}},
+				}},
+			}},
+		}})
+	defer testServer.Close()
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	endpoints := NewEndpointControllerFromClient(client, controller.NoResyncPeriodFunc)
+	endpoints.podStoreSynced = alwaysReady
+	endpoints.checkLeftoverEndpoints()
+
+	if e, a := 1, endpoints.queue.Len(); e != a {
+		t.Fatalf("Expected %v, got %v", e, a)
+	}
+	got, _ := endpoints.queue.Get()
+	if e, a := ns+"/foo", got; e != a {
+		t.Errorf("Expected %v, got %v", e, a)
+	}
+}
+
+func TestSyncEndpointsProtocolTCP(t *testing.T) {
+	ns := "other"
+	testServer, endpointsHandler := makeTestServer(t, ns,
+		serverResponse{http.StatusOK, &v1.Endpoints{
+			ObjectMeta: v1.ObjectMeta{
+				Name:            "foo",
+				Namespace:       ns,
+				ResourceVersion: "1",
+			},
+			Subsets: []v1.EndpointSubset{{
+				Addresses: []v1.EndpointAddress{{IP: "6.7.8.9", NodeName: &emptyNodeName}},
+				Ports:     []v1.EndpointPort{{Port: 1000, Protocol: "TCP"}},
+			}},
+		}})
+	defer testServer.Close()
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	endpoints := NewEndpointControllerFromClient(client, controller.NoResyncPeriodFunc)
+	endpoints.podStoreSynced = alwaysReady
+
+	addPods(endpoints.podStore.Indexer, ns, 1, 1, 0)
+	endpoints.serviceStore.Indexer.Add(&v1.Service{
+		ObjectMeta: v1.ObjectMeta{Name: "foo", Namespace: ns},
+		Spec: v1.ServiceSpec{
+			Selector: map[string]string{},
+			Ports:    []v1.ServicePort{{Port: 80, TargetPort: intstr.FromInt(8080), Protocol: "TCP"}},
+		},
+	})
+	endpoints.syncService(ns + "/foo")
+	endpointsHandler.ValidateRequestCount(t, 2)
+	data := runtime.EncodeOrDie(testapi.Default.Codec(), &v1.Endpoints{
+		ObjectMeta: v1.ObjectMeta{
+			Name:            "foo",
+			Namespace:       ns,
+			ResourceVersion: "1",
+		},
+		Subsets: []v1.EndpointSubset{{
+			Addresses: []v1.EndpointAddress{{IP: "1.2.3.4", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod0", Namespace: ns}}},
+			Ports:     []v1.EndpointPort{{Port: 8080, Protocol: "TCP"}},
+		}},
+	})
+	endpointsHandler.ValidateRequest(t, testapi.Default.ResourcePath("endpoints", ns, "foo"), "PUT", &data)
+}
+
+func TestSyncEndpointsProtocolUDP(t *testing.T) {
+	ns := "other"
+	testServer, endpointsHandler := makeTestServer(t, ns,
+		serverResponse{http.StatusOK, &v1.Endpoints{
+			ObjectMeta: v1.ObjectMeta{
+				Name:            "foo",
+				Namespace:       ns,
+				ResourceVersion: "1",
+			},
+			Subsets: []v1.EndpointSubset{{
+				Addresses: []v1.EndpointAddress{{IP: "6.7.8.9", NodeName: &emptyNodeName}},
+				Ports:     []v1.EndpointPort{{Port: 1000, Protocol: "UDP"}},
+			}},
+		}})
+	defer testServer.Close()
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	endpoints := NewEndpointControllerFromClient(client, controller.NoResyncPeriodFunc)
+	endpoints.podStoreSynced = alwaysReady
+	addPods(endpoints.podStore.Indexer, ns, 1, 1, 0)
+	endpoints.serviceStore.Indexer.Add(&v1.Service{
+		ObjectMeta: v1.ObjectMeta{Name: "foo", Namespace: ns},
+		Spec: v1.ServiceSpec{
+			Selector: map[string]string{},
+			Ports:    []v1.ServicePort{{Port: 80, TargetPort: intstr.FromInt(8080), Protocol: "UDP"}},
+		},
+	})
+	endpoints.syncService(ns + "/foo")
+	endpointsHandler.ValidateRequestCount(t, 2)
+	data := runtime.EncodeOrDie(testapi.Default.Codec(), &v1.Endpoints{
+		ObjectMeta: v1.ObjectMeta{
+			Name:            "foo",
+			Namespace:       ns,
+			ResourceVersion: "1",
+		},
+		Subsets: []v1.EndpointSubset{{
+			Addresses: []v1.EndpointAddress{{IP: "1.2.3.4", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod0", Namespace: ns}}},
+			Ports:     []v1.EndpointPort{{Port: 8080, Protocol: "UDP"}},
+		}},
+	})
+	endpointsHandler.ValidateRequest(t, testapi.Default.ResourcePath("endpoints", ns, "foo"), "PUT", &data)
+}
+
+func TestSyncEndpointsItemsEmptySelectorSelectsAll(t *testing.T) {
+	ns := "other"
+	testServer, endpointsHandler := makeTestServer(t, ns,
+		serverResponse{http.StatusOK, &v1.Endpoints{
+			ObjectMeta: v1.ObjectMeta{
+				Name:            "foo",
+				Namespace:       ns,
+				ResourceVersion: "1",
+			},
+			Subsets: []v1.EndpointSubset{},
+		}})
+	defer testServer.Close()
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	endpoints := NewEndpointControllerFromClient(client, controller.NoResyncPeriodFunc)
+	endpoints.podStoreSynced = alwaysReady
+	addPods(endpoints.podStore.Indexer, ns, 1, 1, 0)
+	endpoints.serviceStore.Indexer.Add(&v1.Service{
+		ObjectMeta: v1.ObjectMeta{Name: "foo", Namespace: ns},
+		Spec: v1.ServiceSpec{
+			Selector: map[string]string{},
+			Ports:    []v1.ServicePort{{Port: 80, Protocol: "TCP", TargetPort: intstr.FromInt(8080)}},
+		},
+	})
+	endpoints.syncService(ns + "/foo")
+	data := runtime.EncodeOrDie(testapi.Default.Codec(), &v1.Endpoints{
+		ObjectMeta: v1.ObjectMeta{
+			Name:            "foo",
+			Namespace:       ns,
+			ResourceVersion: "1",
+		},
+		Subsets: []v1.EndpointSubset{{
+			Addresses: []v1.EndpointAddress{{IP: "1.2.3.4", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod0", Namespace: ns}}},
+			Ports:     []v1.EndpointPort{{Port: 8080, Protocol: "TCP"}},
+		}},
+	})
+	endpointsHandler.ValidateRequest(t, testapi.Default.ResourcePath("endpoints", ns, "foo"), "PUT", &data)
+}
+
+func TestSyncEndpointsItemsEmptySelectorSelectsAllNotReady(t *testing.T) {
+	ns := "other"
+	testServer, endpointsHandler := makeTestServer(t, ns,
+		serverResponse{http.StatusOK, &v1.Endpoints{
+			ObjectMeta: v1.ObjectMeta{
+				Name:            "foo",
+				Namespace:       ns,
+				ResourceVersion: "1",
+			},
+			Subsets: []v1.EndpointSubset{},
+		}})
+	defer testServer.Close()
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	endpoints := NewEndpointControllerFromClient(client, controller.NoResyncPeriodFunc)
+	endpoints.podStoreSynced = alwaysReady
+	addPods(endpoints.podStore.Indexer, ns, 0, 1, 1)
+	endpoints.serviceStore.Indexer.Add(&v1.Service{
+		ObjectMeta: v1.ObjectMeta{Name: "foo", Namespace: ns},
+		Spec: v1.ServiceSpec{
+			Selector: map[string]string{},
+			Ports:    []v1.ServicePort{{Port: 80, Protocol: "TCP", TargetPort: intstr.FromInt(8080)}},
+		},
+	})
+	endpoints.syncService(ns + "/foo")
+	data := runtime.EncodeOrDie(testapi.Default.Codec(), &v1.Endpoints{
+		ObjectMeta: v1.ObjectMeta{
+			Name:            "foo",
+			Namespace:       ns,
+			ResourceVersion: "1",
+		},
+		Subsets: []v1.EndpointSubset{{
+			NotReadyAddresses: []v1.EndpointAddress{{IP: "1.2.3.4", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod0", Namespace: ns}}},
+			Ports:             []v1.EndpointPort{{Port: 8080, Protocol: "TCP"}},
+		}},
+	})
+	endpointsHandler.ValidateRequest(t, testapi.Default.ResourcePath("endpoints", ns, "foo"), "PUT", &data)
+}
+
+func TestSyncEndpointsItemsEmptySelectorSelectsAllMixed(t *testing.T) {
+	ns := "other"
+	testServer, endpointsHandler := makeTestServer(t, ns,
+		serverResponse{http.StatusOK, &v1.Endpoints{
+			ObjectMeta: v1.ObjectMeta{
+				Name:            "foo",
+				Namespace:       ns,
+				ResourceVersion: "1",
+			},
+			Subsets: []v1.EndpointSubset{},
+		}})
+	defer testServer.Close()
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	endpoints := NewEndpointControllerFromClient(client, controller.NoResyncPeriodFunc)
+	endpoints.podStoreSynced = alwaysReady
+	addPods(endpoints.podStore.Indexer, ns, 1, 1, 1)
+	endpoints.serviceStore.Indexer.Add(&v1.Service{
+		ObjectMeta: v1.ObjectMeta{Name: "foo", Namespace: ns},
+		Spec: v1.ServiceSpec{
+			Selector: map[string]string{},
+			Ports:    []v1.ServicePort{{Port: 80, Protocol: "TCP", TargetPort: intstr.FromInt(8080)}},
+		},
+	})
+	endpoints.syncService(ns + "/foo")
+	data := runtime.EncodeOrDie(testapi.Default.Codec(), &v1.Endpoints{
+		ObjectMeta: v1.ObjectMeta{
+			Name:            "foo",
+			Namespace:       ns,
+			ResourceVersion: "1",
+		},
+		Subsets: []v1.EndpointSubset{{
+			Addresses:         []v1.EndpointAddress{{IP: "1.2.3.4", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod0", Namespace: ns}}},
+			NotReadyAddresses: []v1.EndpointAddress{{IP: "1.2.3.5", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod1", Namespace: ns}}},
+			Ports:             []v1.EndpointPort{{Port: 8080, Protocol: "TCP"}},
+		}},
+	})
+	endpointsHandler.ValidateRequest(t, testapi.Default.ResourcePath("endpoints", ns, "foo"), "PUT", &data)
+}
+
+func TestSyncEndpointsItemsPreexisting(t *testing.T) {
+	ns := "bar"
+	testServer, endpointsHandler := makeTestServer(t, ns,
+		serverResponse{http.StatusOK, &v1.Endpoints{
+			ObjectMeta: v1.ObjectMeta{
+				Name:            "foo",
+				Namespace:       ns,
+				ResourceVersion: "1",
+			},
+			Subsets: []v1.EndpointSubset{{
+				Addresses: []v1.EndpointAddress{{IP: "6.7.8.9", NodeName: &emptyNodeName}},
+				Ports:     []v1.EndpointPort{{Port: 1000}},
+			}},
+		}})
+	defer testServer.Close()
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	endpoints := NewEndpointControllerFromClient(client, controller.NoResyncPeriodFunc)
+	endpoints.podStoreSynced = alwaysReady
+	addPods(endpoints.podStore.Indexer, ns, 1, 1, 0)
+	endpoints.serviceStore.Indexer.Add(&v1.Service{
+		ObjectMeta: v1.ObjectMeta{Name: "foo", Namespace: ns},
+		Spec: v1.ServiceSpec{
+			Selector: map[string]string{"foo": "bar"},
+			Ports:    []v1.ServicePort{{Port: 80, Protocol: "TCP", TargetPort: intstr.FromInt(8080)}},
+		},
+	})
+	endpoints.syncService(ns + "/foo")
+	data := runtime.EncodeOrDie(testapi.Default.Codec(), &v1.Endpoints{
+		ObjectMeta: v1.ObjectMeta{
+			Name:            "foo",
+			Namespace:       ns,
+			ResourceVersion: "1",
+		},
+		Subsets: []v1.EndpointSubset{{
+			Addresses: []v1.EndpointAddress{{IP: "1.2.3.4", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod0", Namespace: ns}}},
+			Ports:     []v1.EndpointPort{{Port: 8080, Protocol: "TCP"}},
+		}},
+	})
+	endpointsHandler.ValidateRequest(t, testapi.Default.ResourcePath("endpoints", ns, "foo"), "PUT", &data)
+}
+
+func TestSyncEndpointsItemsPreexistingIdentical(t *testing.T) {
+	ns := v1.NamespaceDefault
+	testServer, endpointsHandler := makeTestServer(t, v1.NamespaceDefault,
+		serverResponse{http.StatusOK, &v1.Endpoints{
+			ObjectMeta: v1.ObjectMeta{
+				ResourceVersion: "1",
+				Name:            "foo",
+				Namespace:       ns,
+			},
+			Subsets: []v1.EndpointSubset{{
+				Addresses: []v1.EndpointAddress{{IP: "1.2.3.4", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod0", Namespace: ns}}},
+				Ports:     []v1.EndpointPort{{Port: 8080, Protocol: "TCP"}},
+			}},
+		}})
+	defer testServer.Close()
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	endpoints := NewEndpointControllerFromClient(client, controller.NoResyncPeriodFunc)
+	endpoints.podStoreSynced = alwaysReady
+	addPods(endpoints.podStore.Indexer, v1.NamespaceDefault, 1, 1, 0)
+	endpoints.serviceStore.Indexer.Add(&v1.Service{
+		ObjectMeta: v1.ObjectMeta{Name: "foo", Namespace: v1.NamespaceDefault},
+		Spec: v1.ServiceSpec{
+			Selector: map[string]string{"foo": "bar"},
+			Ports:    []v1.ServicePort{{Port: 80, Protocol: "TCP", TargetPort: intstr.FromInt(8080)}},
+		},
+	})
+	endpoints.syncService(ns + "/foo")
+	endpointsHandler.ValidateRequest(t, testapi.Default.ResourcePath("endpoints", v1.NamespaceDefault, "foo"), "GET", nil)
+}
+
+func TestSyncEndpointsItems(t *testing.T) {
+	ns := "other"
+	testServer, endpointsHandler := makeTestServer(t, ns,
+		serverResponse{http.StatusOK, &v1.Endpoints{}})
+	defer testServer.Close()
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	endpoints := NewEndpointControllerFromClient(client, controller.NoResyncPeriodFunc)
+	endpoints.podStoreSynced = alwaysReady
+	addPods(endpoints.podStore.Indexer, ns, 3, 2, 0)
+	addPods(endpoints.podStore.Indexer, "blah", 5, 2, 0) // make sure these aren't found!
+	endpoints.serviceStore.Indexer.Add(&v1.Service{
+		ObjectMeta: v1.ObjectMeta{Name: "foo", Namespace: ns},
+		Spec: v1.ServiceSpec{
+			Selector: map[string]string{"foo": "bar"},
+			Ports: []v1.ServicePort{
+				{Name: "port0", Port: 80, Protocol: "TCP", TargetPort: intstr.FromInt(8080)},
+				{Name: "port1", Port: 88, Protocol: "TCP", TargetPort: intstr.FromInt(8088)},
+			},
+		},
+	})
+	endpoints.syncService("other/foo")
+	expectedSubsets := []v1.EndpointSubset{{
+		Addresses: []v1.EndpointAddress{
+			{IP: "1.2.3.4", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod0", Namespace: ns}},
+			{IP: "1.2.3.5", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod1", Namespace: ns}},
+			{IP: "1.2.3.6", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod2", Namespace: ns}},
+		},
+		Ports: []v1.EndpointPort{
+			{Name: "port0", Port: 8080, Protocol: "TCP"},
+			{Name: "port1", Port: 8088, Protocol: "TCP"},
+		},
+	}}
+	data := runtime.EncodeOrDie(testapi.Default.Codec(), &v1.Endpoints{
+		ObjectMeta: v1.ObjectMeta{
+			ResourceVersion: "",
+		},
+		Subsets: endptspkg.SortSubsets(expectedSubsets),
+	})
+	// endpointsHandler should get 2 requests - one for "GET" and the next for "POST".
+	endpointsHandler.ValidateRequestCount(t, 2)
+	endpointsHandler.ValidateRequest(t, testapi.Default.ResourcePath("endpoints", ns, ""), "POST", &data)
+}
+
+func TestSyncEndpointsItemsWithLabels(t *testing.T) {
+	ns := "other"
+	testServer, endpointsHandler := makeTestServer(t, ns,
+		serverResponse{http.StatusOK, &v1.Endpoints{}})
+	defer testServer.Close()
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	endpoints := NewEndpointControllerFromClient(client, controller.NoResyncPeriodFunc)
+	endpoints.podStoreSynced = alwaysReady
+	addPods(endpoints.podStore.Indexer, ns, 3, 2, 0)
+	serviceLabels := map[string]string{"foo": "bar"}
+	endpoints.serviceStore.Indexer.Add(&v1.Service{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: ns,
+			Labels:    serviceLabels,
+		},
+		Spec: v1.ServiceSpec{
+			Selector: map[string]string{"foo": "bar"},
+			Ports: []v1.ServicePort{
+				{Name: "port0", Port: 80, Protocol: "TCP", TargetPort: intstr.FromInt(8080)},
+				{Name: "port1", Port: 88, Protocol: "TCP", TargetPort: intstr.FromInt(8088)},
+			},
+		},
+	})
+	endpoints.syncService(ns + "/foo")
+	expectedSubsets := []v1.EndpointSubset{{
+		Addresses: []v1.EndpointAddress{
+			{IP: "1.2.3.4", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod0", Namespace: ns}},
+			{IP: "1.2.3.5", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod1", Namespace: ns}},
+			{IP: "1.2.3.6", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod2", Namespace: ns}},
+		},
+		Ports: []v1.EndpointPort{
+			{Name: "port0", Port: 8080, Protocol: "TCP"},
+			{Name: "port1", Port: 8088, Protocol: "TCP"},
+		},
+	}}
+	data := runtime.EncodeOrDie(testapi.Default.Codec(), &v1.Endpoints{
+		ObjectMeta: v1.ObjectMeta{
+			ResourceVersion: "",
+			Labels:          serviceLabels,
+		},
+		Subsets: endptspkg.SortSubsets(expectedSubsets),
+	})
+	// endpointsHandler should get 2 requests - one for "GET" and the next for "POST".
+	endpointsHandler.ValidateRequestCount(t, 2)
+	endpointsHandler.ValidateRequest(t, testapi.Default.ResourcePath("endpoints", ns, ""), "POST", &data)
+}
+
+func TestSyncEndpointsItemsPreexistingLabelsChange(t *testing.T) {
+	ns := "bar"
+	testServer, endpointsHandler := makeTestServer(t, ns,
+		serverResponse{http.StatusOK, &v1.Endpoints{
+			ObjectMeta: v1.ObjectMeta{
+				Name:            "foo",
+				Namespace:       ns,
+				ResourceVersion: "1",
+				Labels: map[string]string{
+					"foo": "bar",
+				},
+			},
+			Subsets: []v1.EndpointSubset{{
+				Addresses: []v1.EndpointAddress{{IP: "6.7.8.9", NodeName: &emptyNodeName}},
+				Ports:     []v1.EndpointPort{{Port: 1000}},
+			}},
+		}})
+	defer testServer.Close()
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: testServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	endpoints := NewEndpointControllerFromClient(client, controller.NoResyncPeriodFunc)
+	endpoints.podStoreSynced = alwaysReady
+	addPods(endpoints.podStore.Indexer, ns, 1, 1, 0)
+	serviceLabels := map[string]string{"baz": "blah"}
+	endpoints.serviceStore.Indexer.Add(&v1.Service{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "foo",
+			Namespace: ns,
+			Labels:    serviceLabels,
+		},
+		Spec: v1.ServiceSpec{
+			Selector: map[string]string{"foo": "bar"},
+			Ports:    []v1.ServicePort{{Port: 80, Protocol: "TCP", TargetPort: intstr.FromInt(8080)}},
+		},
+	})
+	endpoints.syncService(ns + "/foo")
+	data := runtime.EncodeOrDie(testapi.Default.Codec(), &v1.Endpoints{
+		ObjectMeta: v1.ObjectMeta{
+			Name:            "foo",
+			Namespace:       ns,
+			ResourceVersion: "1",
+			Labels:          serviceLabels,
+		},
+		Subsets: []v1.EndpointSubset{{
+			Addresses: []v1.EndpointAddress{{IP: "1.2.3.4", NodeName: &emptyNodeName, TargetRef: &v1.ObjectReference{Kind: "Pod", Name: "pod0", Namespace: ns}}},
+			Ports:     []v1.EndpointPort{{Port: 8080, Protocol: "TCP"}},
+		}},
+	})
+	endpointsHandler.ValidateRequest(t, testapi.Default.ResourcePath("endpoints", ns, "foo"), "PUT", &data)
+}

vendor/k8s.io/kubernetes/pkg/controller/garbagecollector/BUILD

@@ -0,0 +1,85 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "garbagecollector.go",
+        "metrics.go",
+        "rate_limiter_helper.go",
+        "uid_cache.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/typed/dynamic:go_default_library",
+        "//pkg/controller/garbagecollector/metaonly:go_default_library",
+        "//pkg/util/clock:go_default_library",
+        "//pkg/util/metrics:go_default_library",
+        "//pkg/util/workqueue:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/golang/groupcache/lru",
+        "//vendor:github.com/prometheus/client_golang/prometheus",
+        "//vendor:k8s.io/apimachinery/pkg/api/errors",
+        "//vendor:k8s.io/apimachinery/pkg/api/meta",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1/unstructured",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/types",
+        "//vendor:k8s.io/apimachinery/pkg/util/errors",
+        "//vendor:k8s.io/apimachinery/pkg/util/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/sets",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+        "//vendor:k8s.io/apimachinery/pkg/watch",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["garbagecollector_test.go"],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/install:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/client/restclient:go_default_library",
+        "//pkg/client/typed/dynamic:go_default_library",
+        "//pkg/controller/garbagecollector/metaonly:go_default_library",
+        "//pkg/util/clock:go_default_library",
+        "//pkg/util/workqueue:go_default_library",
+        "//vendor:github.com/stretchr/testify/assert",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/serializer",
+        "//vendor:k8s.io/apimachinery/pkg/types",
+        "//vendor:k8s.io/apimachinery/pkg/util/json",
+        "//vendor:k8s.io/apimachinery/pkg/util/sets",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//pkg/controller/garbagecollector/metaonly:all-srcs",
+    ],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/garbagecollector/OWNERS

@@ -0,0 +1,4 @@
+reviewers:
+- caesarxuchao
+- lavalamp
+- deads2k

vendor/k8s.io/kubernetes/pkg/controller/garbagecollector/garbagecollector.go

@@ -0,0 +1,809 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package garbagecollector
+
+import (
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/typed/dynamic"
+	"k8s.io/kubernetes/pkg/controller/garbagecollector/metaonly"
+	"k8s.io/kubernetes/pkg/util/clock"
+	"k8s.io/kubernetes/pkg/util/workqueue"
+)
+
+const ResourceResyncTime time.Duration = 0
+
+type monitor struct {
+	store      cache.Store
+	controller cache.Controller
+}
+
+type objectReference struct {
+	metav1.OwnerReference
+	// This is needed by the dynamic client
+	Namespace string
+}
+
+func (s objectReference) String() string {
+	return fmt.Sprintf("[%s/%s, namespace: %s, name: %s, uid: %s]", s.APIVersion, s.Kind, s.Namespace, s.Name, s.UID)
+}
+
+// node does not require a lock to protect. The single-threaded
+// Propagator.processEvent() is the sole writer of the nodes. The multi-threaded
+// GarbageCollector.processItem() reads the nodes, but it only reads the fields
+// that never get changed by Propagator.processEvent().
+type node struct {
+	identity objectReference
+	// dependents will be read by the orphan() routine, we need to protect it with a lock.
+	dependentsLock sync.RWMutex
+	dependents     map[*node]struct{}
+	// When processing an Update event, we need to compare the updated
+	// ownerReferences with the owners recorded in the graph.
+	owners []metav1.OwnerReference
+}
+
+func (ownerNode *node) addDependent(dependent *node) {
+	ownerNode.dependentsLock.Lock()
+	defer ownerNode.dependentsLock.Unlock()
+	ownerNode.dependents[dependent] = struct{}{}
+}
+
+func (ownerNode *node) deleteDependent(dependent *node) {
+	ownerNode.dependentsLock.Lock()
+	defer ownerNode.dependentsLock.Unlock()
+	delete(ownerNode.dependents, dependent)
+}
+
+type eventType int
+
+const (
+	addEvent eventType = iota
+	updateEvent
+	deleteEvent
+)
+
+type event struct {
+	eventType eventType
+	obj       interface{}
+	// the update event comes with an old object, but it's not used by the garbage collector.
+	oldObj interface{}
+}
+
+type concurrentUIDToNode struct {
+	*sync.RWMutex
+	uidToNode map[types.UID]*node
+}
+
+func (m *concurrentUIDToNode) Write(node *node) {
+	m.Lock()
+	defer m.Unlock()
+	m.uidToNode[node.identity.UID] = node
+}
+
+func (m *concurrentUIDToNode) Read(uid types.UID) (*node, bool) {
+	m.RLock()
+	defer m.RUnlock()
+	n, ok := m.uidToNode[uid]
+	return n, ok
+}
+
+func (m *concurrentUIDToNode) Delete(uid types.UID) {
+	m.Lock()
+	defer m.Unlock()
+	delete(m.uidToNode, uid)
+}
+
+type Propagator struct {
+	eventQueue *workqueue.TimedWorkQueue
+	// uidToNode doesn't require a lock to protect, because only the
+	// single-threaded Propagator.processEvent() reads/writes it.
+	uidToNode *concurrentUIDToNode
+	gc        *GarbageCollector
+}
+
+// addDependentToOwners adds n to owners' dependents list. If the owner does not
+// exist in the p.uidToNode yet, a "virtual" node will be created to represent
+// the owner. The "virtual" node will be enqueued to the dirtyQueue, so that
+// processItem() will verify if the owner exists according to the API server.
+func (p *Propagator) addDependentToOwners(n *node, owners []metav1.OwnerReference) {
+	for _, owner := range owners {
+		ownerNode, ok := p.uidToNode.Read(owner.UID)
+		if !ok {
+			// Create a "virtual" node in the graph for the owner if it doesn't
+			// exist in the graph yet. Then enqueue the virtual node into the
+			// dirtyQueue. The garbage processor will enqueue a virtual delete
+			// event to delete it from the graph if API server confirms this
+			// owner doesn't exist.
+			ownerNode = &node{
+				identity: objectReference{
+					OwnerReference: owner,
+					Namespace:      n.identity.Namespace,
+				},
+				dependents: make(map[*node]struct{}),
+			}
+			glog.V(6).Infof("add virtual node.identity: %s\n\n", ownerNode.identity)
+			p.uidToNode.Write(ownerNode)
+			p.gc.dirtyQueue.Add(&workqueue.TimedWorkQueueItem{StartTime: p.gc.clock.Now(), Object: ownerNode})
+		}
+		ownerNode.addDependent(n)
+	}
+}
+
+// insertNode insert the node to p.uidToNode; then it finds all owners as listed
+// in n.owners, and adds the node to their dependents list.
+func (p *Propagator) insertNode(n *node) {
+	p.uidToNode.Write(n)
+	p.addDependentToOwners(n, n.owners)
+}
+
+// removeDependentFromOwners remove n from owners' dependents list.
+func (p *Propagator) removeDependentFromOwners(n *node, owners []metav1.OwnerReference) {
+	for _, owner := range owners {
+		ownerNode, ok := p.uidToNode.Read(owner.UID)
+		if !ok {
+			continue
+		}
+		ownerNode.deleteDependent(n)
+	}
+}
+
+// removeNode removes the node from p.uidToNode, then finds all
+// owners as listed in n.owners, and removes n from their dependents list.
+func (p *Propagator) removeNode(n *node) {
+	p.uidToNode.Delete(n.identity.UID)
+	p.removeDependentFromOwners(n, n.owners)
+}
+
+// TODO: profile this function to see if a naive N^2 algorithm performs better
+// when the number of references is small.
+func referencesDiffs(old []metav1.OwnerReference, new []metav1.OwnerReference) (added []metav1.OwnerReference, removed []metav1.OwnerReference) {
+	oldUIDToRef := make(map[string]metav1.OwnerReference)
+	for i := 0; i < len(old); i++ {
+		oldUIDToRef[string(old[i].UID)] = old[i]
+	}
+	oldUIDSet := sets.StringKeySet(oldUIDToRef)
+	newUIDToRef := make(map[string]metav1.OwnerReference)
+	for i := 0; i < len(new); i++ {
+		newUIDToRef[string(new[i].UID)] = new[i]
+	}
+	newUIDSet := sets.StringKeySet(newUIDToRef)
+
+	addedUID := newUIDSet.Difference(oldUIDSet)
+	removedUID := oldUIDSet.Difference(newUIDSet)
+
+	for uid := range addedUID {
+		added = append(added, newUIDToRef[uid])
+	}
+	for uid := range removedUID {
+		removed = append(removed, oldUIDToRef[uid])
+	}
+	return added, removed
+}
+
+func shouldOrphanDependents(e *event, accessor meta.Object) bool {
+	// The delta_fifo may combine the creation and update of the object into one
+	// event, so we need to check AddEvent as well.
+	if e.oldObj == nil {
+		if accessor.GetDeletionTimestamp() == nil {
+			return false
+		}
+	} else {
+		oldAccessor, err := meta.Accessor(e.oldObj)
+		if err != nil {
+			utilruntime.HandleError(fmt.Errorf("cannot access oldObj: %v", err))
+			return false
+		}
+		// ignore the event if it's not updating DeletionTimestamp from non-nil to nil.
+		if accessor.GetDeletionTimestamp() == nil || oldAccessor.GetDeletionTimestamp() != nil {
+			return false
+		}
+	}
+	finalizers := accessor.GetFinalizers()
+	for _, finalizer := range finalizers {
+		if finalizer == v1.FinalizerOrphan {
+			return true
+		}
+	}
+	return false
+}
+
+// dependents are copies of pointers to the owner's dependents, they don't need to be locked.
+func (gc *GarbageCollector) orhpanDependents(owner objectReference, dependents []*node) error {
+	var failedDependents []objectReference
+	var errorsSlice []error
+	for _, dependent := range dependents {
+		// the dependent.identity.UID is used as precondition
+		deleteOwnerRefPatch := fmt.Sprintf(`{"metadata":{"ownerReferences":[{"$patch":"delete","uid":"%s"}],"uid":"%s"}}`, owner.UID, dependent.identity.UID)
+		_, err := gc.patchObject(dependent.identity, []byte(deleteOwnerRefPatch))
+		// note that if the target ownerReference doesn't exist in the
+		// dependent, strategic merge patch will NOT return an error.
+		if err != nil && !errors.IsNotFound(err) {
+			errorsSlice = append(errorsSlice, fmt.Errorf("orphaning %s failed with %v", dependent.identity, err))
+		}
+	}
+	if len(failedDependents) != 0 {
+		return fmt.Errorf("failed to orphan dependents of owner %s, got errors: %s", owner, utilerrors.NewAggregate(errorsSlice).Error())
+	}
+	glog.V(6).Infof("successfully updated all dependents")
+	return nil
+}
+
+// TODO: Using Patch when strategicmerge supports deleting an entry from a
+// slice of a base type.
+func (gc *GarbageCollector) removeOrphanFinalizer(owner *node) error {
+	const retries = 5
+	for count := 0; count < retries; count++ {
+		ownerObject, err := gc.getObject(owner.identity)
+		if err != nil {
+			return fmt.Errorf("cannot finalize owner %s, because cannot get it. The garbage collector will retry later.", owner.identity)
+		}
+		accessor, err := meta.Accessor(ownerObject)
+		if err != nil {
+			return fmt.Errorf("cannot access the owner object: %v. The garbage collector will retry later.", err)
+		}
+		finalizers := accessor.GetFinalizers()
+		var newFinalizers []string
+		found := false
+		for _, f := range finalizers {
+			if f == v1.FinalizerOrphan {
+				found = true
+				break
+			} else {
+				newFinalizers = append(newFinalizers, f)
+			}
+		}
+		if !found {
+			glog.V(6).Infof("the orphan finalizer is already removed from object %s", owner.identity)
+			return nil
+		}
+		// remove the owner from dependent's OwnerReferences
+		ownerObject.SetFinalizers(newFinalizers)
+		_, err = gc.updateObject(owner.identity, ownerObject)
+		if err == nil {
+			return nil
+		}
+		if err != nil && !errors.IsConflict(err) {
+			return fmt.Errorf("cannot update the finalizers of owner %s, with error: %v, tried %d times", owner.identity, err, count+1)
+		}
+		// retry if it's a conflict
+		glog.V(6).Infof("got conflict updating the owner object %s, tried %d times", owner.identity, count+1)
+	}
+	return fmt.Errorf("updateMaxRetries(%d) has reached. The garbage collector will retry later for owner %v.", retries, owner.identity)
+}
+
+// orphanFinalizer dequeues a node from the orphanQueue, then finds its dependents
+// based on the graph maintained by the GC, then removes it from the
+// OwnerReferences of its dependents, and finally updates the owner to remove
+// the "Orphan" finalizer. The node is add back into the orphanQueue if any of
+// these steps fail.
+func (gc *GarbageCollector) orphanFinalizer() {
+	timedItem, quit := gc.orphanQueue.Get()
+	if quit {
+		return
+	}
+	defer gc.orphanQueue.Done(timedItem)
+	owner, ok := timedItem.Object.(*node)
+	if !ok {
+		utilruntime.HandleError(fmt.Errorf("expect *node, got %#v", timedItem.Object))
+	}
+	// we don't need to lock each element, because they never get updated
+	owner.dependentsLock.RLock()
+	dependents := make([]*node, 0, len(owner.dependents))
+	for dependent := range owner.dependents {
+		dependents = append(dependents, dependent)
+	}
+	owner.dependentsLock.RUnlock()
+
+	err := gc.orhpanDependents(owner.identity, dependents)
+	if err != nil {
+		glog.V(6).Infof("orphanDependents for %s failed with %v", owner.identity, err)
+		gc.orphanQueue.Add(timedItem)
+		return
+	}
+	// update the owner, remove "orphaningFinalizer" from its finalizers list
+	err = gc.removeOrphanFinalizer(owner)
+	if err != nil {
+		glog.V(6).Infof("removeOrphanFinalizer for %s failed with %v", owner.identity, err)
+		gc.orphanQueue.Add(timedItem)
+	}
+	OrphanProcessingLatency.Observe(sinceInMicroseconds(gc.clock, timedItem.StartTime))
+}
+
+// Dequeueing an event from eventQueue, updating graph, populating dirty_queue.
+func (p *Propagator) processEvent() {
+	timedItem, quit := p.eventQueue.Get()
+	if quit {
+		return
+	}
+	defer p.eventQueue.Done(timedItem)
+	event, ok := timedItem.Object.(*event)
+	if !ok {
+		utilruntime.HandleError(fmt.Errorf("expect a *event, got %v", timedItem.Object))
+		return
+	}
+	obj := event.obj
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("cannot access obj: %v", err))
+		return
+	}
+	typeAccessor, err := meta.TypeAccessor(obj)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("cannot access obj: %v", err))
+		return
+	}
+	glog.V(6).Infof("Propagator process object: %s/%s, namespace %s, name %s, event type %s", typeAccessor.GetAPIVersion(), typeAccessor.GetKind(), accessor.GetNamespace(), accessor.GetName(), event.eventType)
+	// Check if the node already exsits
+	existingNode, found := p.uidToNode.Read(accessor.GetUID())
+	switch {
+	case (event.eventType == addEvent || event.eventType == updateEvent) && !found:
+		newNode := &node{
+			identity: objectReference{
+				OwnerReference: metav1.OwnerReference{
+					APIVersion: typeAccessor.GetAPIVersion(),
+					Kind:       typeAccessor.GetKind(),
+					UID:        accessor.GetUID(),
+					Name:       accessor.GetName(),
+				},
+				Namespace: accessor.GetNamespace(),
+			},
+			dependents: make(map[*node]struct{}),
+			owners:     accessor.GetOwnerReferences(),
+		}
+		p.insertNode(newNode)
+		// the underlying delta_fifo may combine a creation and deletion into one event
+		if shouldOrphanDependents(event, accessor) {
+			glog.V(6).Infof("add %s to the orphanQueue", newNode.identity)
+			p.gc.orphanQueue.Add(&workqueue.TimedWorkQueueItem{StartTime: p.gc.clock.Now(), Object: newNode})
+		}
+	case (event.eventType == addEvent || event.eventType == updateEvent) && found:
+		// caveat: if GC observes the creation of the dependents later than the
+		// deletion of the owner, then the orphaning finalizer won't be effective.
+		if shouldOrphanDependents(event, accessor) {
+			glog.V(6).Infof("add %s to the orphanQueue", existingNode.identity)
+			p.gc.orphanQueue.Add(&workqueue.TimedWorkQueueItem{StartTime: p.gc.clock.Now(), Object: existingNode})
+		}
+		// add/remove owner refs
+		added, removed := referencesDiffs(existingNode.owners, accessor.GetOwnerReferences())
+		if len(added) == 0 && len(removed) == 0 {
+			glog.V(6).Infof("The updateEvent %#v doesn't change node references, ignore", event)
+			return
+		}
+		// update the node itself
+		existingNode.owners = accessor.GetOwnerReferences()
+		// Add the node to its new owners' dependent lists.
+		p.addDependentToOwners(existingNode, added)
+		// remove the node from the dependent list of node that are no long in
+		// the node's owners list.
+		p.removeDependentFromOwners(existingNode, removed)
+	case event.eventType == deleteEvent:
+		if !found {
+			glog.V(6).Infof("%v doesn't exist in the graph, this shouldn't happen", accessor.GetUID())
+			return
+		}
+		p.removeNode(existingNode)
+		existingNode.dependentsLock.RLock()
+		defer existingNode.dependentsLock.RUnlock()
+		if len(existingNode.dependents) > 0 {
+			p.gc.absentOwnerCache.Add(accessor.GetUID())
+		}
+		for dep := range existingNode.dependents {
+			p.gc.dirtyQueue.Add(&workqueue.TimedWorkQueueItem{StartTime: p.gc.clock.Now(), Object: dep})
+		}
+	}
+	EventProcessingLatency.Observe(sinceInMicroseconds(p.gc.clock, timedItem.StartTime))
+}
+
+// GarbageCollector is responsible for carrying out cascading deletion, and
+// removing ownerReferences from the dependents if the owner is deleted with
+// DeleteOptions.OrphanDependents=true.
+type GarbageCollector struct {
+	restMapper meta.RESTMapper
+	// metaOnlyClientPool uses a special codec, which removes fields except for
+	// apiVersion, kind, and metadata during decoding.
+	metaOnlyClientPool dynamic.ClientPool
+	// clientPool uses the regular dynamicCodec. We need it to update
+	// finalizers. It can be removed if we support patching finalizers.
+	clientPool                       dynamic.ClientPool
+	dirtyQueue                       *workqueue.TimedWorkQueue
+	orphanQueue                      *workqueue.TimedWorkQueue
+	monitors                         []monitor
+	propagator                       *Propagator
+	clock                            clock.Clock
+	registeredRateLimiter            *RegisteredRateLimiter
+	registeredRateLimiterForMonitors *RegisteredRateLimiter
+	// GC caches the owners that do not exist according to the API server.
+	absentOwnerCache *UIDCache
+}
+
+func gcListWatcher(client *dynamic.Client, resource schema.GroupVersionResource) *cache.ListWatch {
+	return &cache.ListWatch{
+		ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+			// APIResource.Kind is not used by the dynamic client, so
+			// leave it empty. We want to list this resource in all
+			// namespaces if it's namespace scoped, so leave
+			// APIResource.Namespaced as false is all right.
+			apiResource := metav1.APIResource{Name: resource.Resource}
+			return client.ParameterCodec(dynamic.VersionedParameterEncoderWithV1Fallback).
+				Resource(&apiResource, v1.NamespaceAll).
+				List(&options)
+		},
+		WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+			// APIResource.Kind is not used by the dynamic client, so
+			// leave it empty. We want to list this resource in all
+			// namespaces if it's namespace scoped, so leave
+			// APIResource.Namespaced as false is all right.
+			apiResource := metav1.APIResource{Name: resource.Resource}
+			return client.ParameterCodec(dynamic.VersionedParameterEncoderWithV1Fallback).
+				Resource(&apiResource, v1.NamespaceAll).
+				Watch(&options)
+		},
+	}
+}
+
+func (gc *GarbageCollector) monitorFor(resource schema.GroupVersionResource, kind schema.GroupVersionKind) (monitor, error) {
+	// TODO: consider store in one storage.
+	glog.V(6).Infof("create storage for resource %s", resource)
+	var monitor monitor
+	client, err := gc.metaOnlyClientPool.ClientForGroupVersionKind(kind)
+	if err != nil {
+		return monitor, err
+	}
+	gc.registeredRateLimiterForMonitors.registerIfNotPresent(resource.GroupVersion(), client, "garbage_collector_monitoring")
+	setObjectTypeMeta := func(obj interface{}) {
+		runtimeObject, ok := obj.(runtime.Object)
+		if !ok {
+			utilruntime.HandleError(fmt.Errorf("expected runtime.Object, got %#v", obj))
+		}
+		runtimeObject.GetObjectKind().SetGroupVersionKind(kind)
+	}
+	monitor.store, monitor.controller = cache.NewInformer(
+		gcListWatcher(client, resource),
+		nil,
+		ResourceResyncTime,
+		cache.ResourceEventHandlerFuncs{
+			// add the event to the propagator's eventQueue.
+			AddFunc: func(obj interface{}) {
+				setObjectTypeMeta(obj)
+				event := &event{
+					eventType: addEvent,
+					obj:       obj,
+				}
+				gc.propagator.eventQueue.Add(&workqueue.TimedWorkQueueItem{StartTime: gc.clock.Now(), Object: event})
+			},
+			UpdateFunc: func(oldObj, newObj interface{}) {
+				setObjectTypeMeta(newObj)
+				event := &event{updateEvent, newObj, oldObj}
+				gc.propagator.eventQueue.Add(&workqueue.TimedWorkQueueItem{StartTime: gc.clock.Now(), Object: event})
+			},
+			DeleteFunc: func(obj interface{}) {
+				// delta fifo may wrap the object in a cache.DeletedFinalStateUnknown, unwrap it
+				if deletedFinalStateUnknown, ok := obj.(cache.DeletedFinalStateUnknown); ok {
+					obj = deletedFinalStateUnknown.Obj
+				}
+				setObjectTypeMeta(obj)
+				event := &event{
+					eventType: deleteEvent,
+					obj:       obj,
+				}
+				gc.propagator.eventQueue.Add(&workqueue.TimedWorkQueueItem{StartTime: gc.clock.Now(), Object: event})
+			},
+		},
+	)
+	return monitor, nil
+}
+
+var ignoredResources = map[schema.GroupVersionResource]struct{}{
+	schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "replicationcontrollers"}:              {},
+	schema.GroupVersionResource{Group: "", Version: "v1", Resource: "bindings"}:                                           {},
+	schema.GroupVersionResource{Group: "", Version: "v1", Resource: "componentstatuses"}:                                  {},
+	schema.GroupVersionResource{Group: "", Version: "v1", Resource: "events"}:                                             {},
+	schema.GroupVersionResource{Group: "authentication.k8s.io", Version: "v1beta1", Resource: "tokenreviews"}:             {},
+	schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1beta1", Resource: "subjectaccessreviews"}:      {},
+	schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1beta1", Resource: "selfsubjectaccessreviews"}:  {},
+	schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1beta1", Resource: "localsubjectaccessreviews"}: {},
+}
+
+func NewGarbageCollector(metaOnlyClientPool dynamic.ClientPool, clientPool dynamic.ClientPool, mapper meta.RESTMapper, deletableResources map[schema.GroupVersionResource]struct{}) (*GarbageCollector, error) {
+	gc := &GarbageCollector{
+		metaOnlyClientPool:               metaOnlyClientPool,
+		clientPool:                       clientPool,
+		restMapper:                       mapper,
+		clock:                            clock.RealClock{},
+		dirtyQueue:                       workqueue.NewTimedWorkQueue(),
+		orphanQueue:                      workqueue.NewTimedWorkQueue(),
+		registeredRateLimiter:            NewRegisteredRateLimiter(deletableResources),
+		registeredRateLimiterForMonitors: NewRegisteredRateLimiter(deletableResources),
+		absentOwnerCache:                 NewUIDCache(500),
+	}
+	gc.propagator = &Propagator{
+		eventQueue: workqueue.NewTimedWorkQueue(),
+		uidToNode: &concurrentUIDToNode{
+			RWMutex:   &sync.RWMutex{},
+			uidToNode: make(map[types.UID]*node),
+		},
+		gc: gc,
+	}
+	for resource := range deletableResources {
+		if _, ok := ignoredResources[resource]; ok {
+			glog.V(6).Infof("ignore resource %#v", resource)
+			continue
+		}
+		kind, err := gc.restMapper.KindFor(resource)
+		if err != nil {
+			if _, ok := err.(*meta.NoResourceMatchError); ok {
+				// ignore NoResourceMatchErrors for now because TPRs won't be registered
+				// and hence the RestMapper does not know about them. The deletableResources
+				// though are using discovery which included TPRs.
+				// TODO: use dynamic discovery for RestMapper and deletableResources
+				glog.Warningf("ignore NoResourceMatchError for %v", resource)
+				continue
+			}
+			return nil, err
+		}
+		monitor, err := gc.monitorFor(resource, kind)
+		if err != nil {
+			return nil, err
+		}
+		gc.monitors = append(gc.monitors, monitor)
+	}
+	return gc, nil
+}
+
+func (gc *GarbageCollector) worker() {
+	timedItem, quit := gc.dirtyQueue.Get()
+	if quit {
+		return
+	}
+	defer gc.dirtyQueue.Done(timedItem)
+	err := gc.processItem(timedItem.Object.(*node))
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("Error syncing item %#v: %v", timedItem.Object, err))
+		// retry if garbage collection of an object failed.
+		gc.dirtyQueue.Add(timedItem)
+		return
+	}
+	DirtyProcessingLatency.Observe(sinceInMicroseconds(gc.clock, timedItem.StartTime))
+}
+
+// apiResource consults the REST mapper to translate an <apiVersion, kind,
+// namespace> tuple to a metav1.APIResource struct.
+func (gc *GarbageCollector) apiResource(apiVersion, kind string, namespaced bool) (*metav1.APIResource, error) {
+	fqKind := schema.FromAPIVersionAndKind(apiVersion, kind)
+	mapping, err := gc.restMapper.RESTMapping(fqKind.GroupKind(), apiVersion)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get REST mapping for kind: %s, version: %s", kind, apiVersion)
+	}
+	glog.V(6).Infof("map kind %s, version %s to resource %s", kind, apiVersion, mapping.Resource)
+	resource := metav1.APIResource{
+		Name:       mapping.Resource,
+		Namespaced: namespaced,
+		Kind:       kind,
+	}
+	return &resource, nil
+}
+
+func (gc *GarbageCollector) deleteObject(item objectReference) error {
+	fqKind := schema.FromAPIVersionAndKind(item.APIVersion, item.Kind)
+	client, err := gc.clientPool.ClientForGroupVersionKind(fqKind)
+	gc.registeredRateLimiter.registerIfNotPresent(fqKind.GroupVersion(), client, "garbage_collector_operation")
+	resource, err := gc.apiResource(item.APIVersion, item.Kind, len(item.Namespace) != 0)
+	if err != nil {
+		return err
+	}
+	uid := item.UID
+	preconditions := v1.Preconditions{UID: &uid}
+	deleteOptions := v1.DeleteOptions{Preconditions: &preconditions}
+	return client.Resource(resource, item.Namespace).Delete(item.Name, &deleteOptions)
+}
+
+func (gc *GarbageCollector) getObject(item objectReference) (*unstructured.Unstructured, error) {
+	fqKind := schema.FromAPIVersionAndKind(item.APIVersion, item.Kind)
+	client, err := gc.clientPool.ClientForGroupVersionKind(fqKind)
+	gc.registeredRateLimiter.registerIfNotPresent(fqKind.GroupVersion(), client, "garbage_collector_operation")
+	resource, err := gc.apiResource(item.APIVersion, item.Kind, len(item.Namespace) != 0)
+	if err != nil {
+		return nil, err
+	}
+	return client.Resource(resource, item.Namespace).Get(item.Name)
+}
+
+func (gc *GarbageCollector) updateObject(item objectReference, obj *unstructured.Unstructured) (*unstructured.Unstructured, error) {
+	fqKind := schema.FromAPIVersionAndKind(item.APIVersion, item.Kind)
+	client, err := gc.clientPool.ClientForGroupVersionKind(fqKind)
+	gc.registeredRateLimiter.registerIfNotPresent(fqKind.GroupVersion(), client, "garbage_collector_operation")
+	resource, err := gc.apiResource(item.APIVersion, item.Kind, len(item.Namespace) != 0)
+	if err != nil {
+		return nil, err
+	}
+	return client.Resource(resource, item.Namespace).Update(obj)
+}
+
+func (gc *GarbageCollector) patchObject(item objectReference, patch []byte) (*unstructured.Unstructured, error) {
+	fqKind := schema.FromAPIVersionAndKind(item.APIVersion, item.Kind)
+	client, err := gc.clientPool.ClientForGroupVersionKind(fqKind)
+	gc.registeredRateLimiter.registerIfNotPresent(fqKind.GroupVersion(), client, "garbage_collector_operation")
+	resource, err := gc.apiResource(item.APIVersion, item.Kind, len(item.Namespace) != 0)
+	if err != nil {
+		return nil, err
+	}
+	return client.Resource(resource, item.Namespace).Patch(item.Name, api.StrategicMergePatchType, patch)
+}
+
+func objectReferenceToUnstructured(ref objectReference) *unstructured.Unstructured {
+	ret := &unstructured.Unstructured{}
+	ret.SetKind(ref.Kind)
+	ret.SetAPIVersion(ref.APIVersion)
+	ret.SetUID(ref.UID)
+	ret.SetNamespace(ref.Namespace)
+	ret.SetName(ref.Name)
+	return ret
+}
+
+func objectReferenceToMetadataOnlyObject(ref objectReference) *metaonly.MetadataOnlyObject {
+	return &metaonly.MetadataOnlyObject{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: ref.APIVersion,
+			Kind:       ref.Kind,
+		},
+		ObjectMeta: v1.ObjectMeta{
+			Namespace: ref.Namespace,
+			UID:       ref.UID,
+			Name:      ref.Name,
+		},
+	}
+}
+
+func (gc *GarbageCollector) processItem(item *node) error {
+	// Get the latest item from the API server
+	latest, err := gc.getObject(item.identity)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			// the Propagator can add "virtual" node for an owner that doesn't
+			// exist yet, so we need to enqueue a virtual Delete event to remove
+			// the virtual node from Propagator.uidToNode.
+			glog.V(6).Infof("item %v not found, generating a virtual delete event", item.identity)
+			event := &event{
+				eventType: deleteEvent,
+				obj:       objectReferenceToMetadataOnlyObject(item.identity),
+			}
+			glog.V(6).Infof("generating virtual delete event for %s\n\n", event.obj)
+			gc.propagator.eventQueue.Add(&workqueue.TimedWorkQueueItem{StartTime: gc.clock.Now(), Object: event})
+			return nil
+		}
+		return err
+	}
+	if latest.GetUID() != item.identity.UID {
+		glog.V(6).Infof("UID doesn't match, item %v not found, generating a virtual delete event", item.identity)
+		event := &event{
+			eventType: deleteEvent,
+			obj:       objectReferenceToMetadataOnlyObject(item.identity),
+		}
+		glog.V(6).Infof("generating virtual delete event for %s\n\n", event.obj)
+		gc.propagator.eventQueue.Add(&workqueue.TimedWorkQueueItem{StartTime: gc.clock.Now(), Object: event})
+		return nil
+	}
+	ownerReferences := latest.GetOwnerReferences()
+	if len(ownerReferences) == 0 {
+		glog.V(6).Infof("object %s's doesn't have an owner, continue on next item", item.identity)
+		return nil
+	}
+	// TODO: we need to remove dangling references if the object is not to be
+	// deleted.
+	for _, reference := range ownerReferences {
+		if gc.absentOwnerCache.Has(reference.UID) {
+			glog.V(6).Infof("according to the absentOwnerCache, object %s's owner %s/%s, %s does not exist", item.identity.UID, reference.APIVersion, reference.Kind, reference.Name)
+			continue
+		}
+		// TODO: we need to verify the reference resource is supported by the
+		// system. If it's not a valid resource, the garbage collector should i)
+		// ignore the reference when decide if the object should be deleted, and
+		// ii) should update the object to remove such references. This is to
+		// prevent objects having references to an old resource from being
+		// deleted during a cluster upgrade.
+		fqKind := schema.FromAPIVersionAndKind(reference.APIVersion, reference.Kind)
+		client, err := gc.clientPool.ClientForGroupVersionKind(fqKind)
+		if err != nil {
+			return err
+		}
+		resource, err := gc.apiResource(reference.APIVersion, reference.Kind, len(item.identity.Namespace) != 0)
+		if err != nil {
+			return err
+		}
+		owner, err := client.Resource(resource, item.identity.Namespace).Get(reference.Name)
+		if err == nil {
+			if owner.GetUID() != reference.UID {
+				glog.V(6).Infof("object %s's owner %s/%s, %s is not found, UID mismatch", item.identity.UID, reference.APIVersion, reference.Kind, reference.Name)
+				gc.absentOwnerCache.Add(reference.UID)
+				continue
+			}
+			glog.V(6).Infof("object %s has at least an existing owner, will not garbage collect", item.identity.UID)
+			return nil
+		} else if errors.IsNotFound(err) {
+			gc.absentOwnerCache.Add(reference.UID)
+			glog.V(6).Infof("object %s's owner %s/%s, %s is not found", item.identity.UID, reference.APIVersion, reference.Kind, reference.Name)
+		} else {
+			return err
+		}
+	}
+	glog.V(2).Infof("none of object %s's owners exist any more, will garbage collect it", item.identity)
+	return gc.deleteObject(item.identity)
+}
+
+func (gc *GarbageCollector) Run(workers int, stopCh <-chan struct{}) {
+	glog.Infof("Garbage Collector: Initializing")
+	for _, monitor := range gc.monitors {
+		go monitor.controller.Run(stopCh)
+	}
+
+	wait.PollInfinite(10*time.Second, func() (bool, error) {
+		for _, monitor := range gc.monitors {
+			if !monitor.controller.HasSynced() {
+				glog.Infof("Garbage Collector: Waiting for resource monitors to be synced...")
+				return false, nil
+			}
+		}
+		return true, nil
+	})
+	glog.Infof("Garbage Collector: All monitored resources synced. Proceeding to collect garbage")
+
+	// worker
+	go wait.Until(gc.propagator.processEvent, 0, stopCh)
+
+	for i := 0; i < workers; i++ {
+		go wait.Until(gc.worker, 0, stopCh)
+		go wait.Until(gc.orphanFinalizer, 0, stopCh)
+	}
+	Register()
+	<-stopCh
+	glog.Infof("Garbage Collector: Shutting down")
+	gc.dirtyQueue.ShutDown()
+	gc.orphanQueue.ShutDown()
+	gc.propagator.eventQueue.ShutDown()
+}
+
+// *FOR TEST USE ONLY* It's not safe to call this function when the GC is still
+// busy.
+// GraphHasUID returns if the Propagator has a particular UID store in its
+// uidToNode graph. It's useful for debugging.
+func (gc *GarbageCollector) GraphHasUID(UIDs []types.UID) bool {
+	for _, u := range UIDs {
+		if _, ok := gc.propagator.uidToNode.Read(u); ok {
+			return true
+		}
+	}
+	return false
+}

vendor/k8s.io/kubernetes/pkg/controller/garbagecollector/garbagecollector_test.go

@@ -0,0 +1,476 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package garbagecollector
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	_ "k8s.io/kubernetes/pkg/api/install"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/restclient"
+	"k8s.io/kubernetes/pkg/client/typed/dynamic"
+	"k8s.io/kubernetes/pkg/controller/garbagecollector/metaonly"
+	"k8s.io/kubernetes/pkg/util/clock"
+	"k8s.io/kubernetes/pkg/util/workqueue"
+)
+
+func TestNewGarbageCollector(t *testing.T) {
+	config := &restclient.Config{}
+	config.ContentConfig.NegotiatedSerializer = serializer.DirectCodecFactory{CodecFactory: metaonly.NewMetadataCodecFactory()}
+	metaOnlyClientPool := dynamic.NewClientPool(config, api.Registry.RESTMapper(), dynamic.LegacyAPIPathResolverFunc)
+	config.ContentConfig.NegotiatedSerializer = nil
+	clientPool := dynamic.NewClientPool(config, api.Registry.RESTMapper(), dynamic.LegacyAPIPathResolverFunc)
+	podResource := map[schema.GroupVersionResource]struct{}{schema.GroupVersionResource{Version: "v1", Resource: "pods"}: {}}
+	gc, err := NewGarbageCollector(metaOnlyClientPool, clientPool, api.Registry.RESTMapper(), podResource)
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, 1, len(gc.monitors))
+}
+
+// fakeAction records information about requests to aid in testing.
+type fakeAction struct {
+	method string
+	path   string
+	query  string
+}
+
+// String returns method=path to aid in testing
+func (f *fakeAction) String() string {
+	return strings.Join([]string{f.method, f.path}, "=")
+}
+
+type FakeResponse struct {
+	statusCode int
+	content    []byte
+}
+
+// fakeActionHandler holds a list of fakeActions received
+type fakeActionHandler struct {
+	// statusCode and content returned by this handler for different method + path.
+	response map[string]FakeResponse
+
+	lock    sync.Mutex
+	actions []fakeAction
+}
+
+// ServeHTTP logs the action that occurred and always returns the associated status code
+func (f *fakeActionHandler) ServeHTTP(response http.ResponseWriter, request *http.Request) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	f.actions = append(f.actions, fakeAction{method: request.Method, path: request.URL.Path, query: request.URL.RawQuery})
+	fakeResponse, ok := f.response[request.Method+request.URL.Path]
+	if !ok {
+		fakeResponse.statusCode = 200
+		fakeResponse.content = []byte("{\"kind\": \"List\"}")
+	}
+	response.Header().Set("Content-Type", "application/json")
+	response.WriteHeader(fakeResponse.statusCode)
+	response.Write(fakeResponse.content)
+}
+
+// testServerAndClientConfig returns a server that listens and a config that can reference it
+func testServerAndClientConfig(handler func(http.ResponseWriter, *http.Request)) (*httptest.Server, *restclient.Config) {
+	srv := httptest.NewServer(http.HandlerFunc(handler))
+	config := &restclient.Config{
+		Host: srv.URL,
+	}
+	return srv, config
+}
+
+func setupGC(t *testing.T, config *restclient.Config) *GarbageCollector {
+	config.ContentConfig.NegotiatedSerializer = serializer.DirectCodecFactory{CodecFactory: metaonly.NewMetadataCodecFactory()}
+	metaOnlyClientPool := dynamic.NewClientPool(config, api.Registry.RESTMapper(), dynamic.LegacyAPIPathResolverFunc)
+	config.ContentConfig.NegotiatedSerializer = nil
+	clientPool := dynamic.NewClientPool(config, api.Registry.RESTMapper(), dynamic.LegacyAPIPathResolverFunc)
+	podResource := map[schema.GroupVersionResource]struct{}{schema.GroupVersionResource{Version: "v1", Resource: "pods"}: {}}
+	gc, err := NewGarbageCollector(metaOnlyClientPool, clientPool, api.Registry.RESTMapper(), podResource)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return gc
+}
+
+func getPod(podName string, ownerReferences []metav1.OwnerReference) *v1.Pod {
+	return &v1.Pod{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Pod",
+			APIVersion: "v1",
+		},
+		ObjectMeta: v1.ObjectMeta{
+			Name:            podName,
+			Namespace:       "ns1",
+			OwnerReferences: ownerReferences,
+		},
+	}
+}
+
+func serilizeOrDie(t *testing.T, object interface{}) []byte {
+	data, err := json.Marshal(object)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
+
+// test the processItem function making the expected actions.
+func TestProcessItem(t *testing.T) {
+	pod := getPod("ToBeDeletedPod", []metav1.OwnerReference{
+		{
+			Kind:       "ReplicationController",
+			Name:       "owner1",
+			UID:        "123",
+			APIVersion: "v1",
+		},
+	})
+	testHandler := &fakeActionHandler{
+		response: map[string]FakeResponse{
+			"GET" + "/api/v1/namespaces/ns1/replicationcontrollers/owner1": {
+				404,
+				[]byte{},
+			},
+			"GET" + "/api/v1/namespaces/ns1/pods/ToBeDeletedPod": {
+				200,
+				serilizeOrDie(t, pod),
+			},
+		},
+	}
+	srv, clientConfig := testServerAndClientConfig(testHandler.ServeHTTP)
+	defer srv.Close()
+	gc := setupGC(t, clientConfig)
+	item := &node{
+		identity: objectReference{
+			OwnerReference: metav1.OwnerReference{
+				Kind:       pod.Kind,
+				APIVersion: pod.APIVersion,
+				Name:       pod.Name,
+				UID:        pod.UID,
+			},
+			Namespace: pod.Namespace,
+		},
+		// owners are intentionally left empty. The processItem routine should get the latest item from the server.
+		owners: nil,
+	}
+	err := gc.processItem(item)
+	if err != nil {
+		t.Errorf("Unexpected Error: %v", err)
+	}
+	expectedActionSet := sets.NewString()
+	expectedActionSet.Insert("GET=/api/v1/namespaces/ns1/replicationcontrollers/owner1")
+	expectedActionSet.Insert("DELETE=/api/v1/namespaces/ns1/pods/ToBeDeletedPod")
+	expectedActionSet.Insert("GET=/api/v1/namespaces/ns1/pods/ToBeDeletedPod")
+
+	actualActionSet := sets.NewString()
+	for _, action := range testHandler.actions {
+		actualActionSet.Insert(action.String())
+	}
+	if !expectedActionSet.Equal(actualActionSet) {
+		t.Errorf("expected actions:\n%v\n but got:\n%v\nDifference:\n%v", expectedActionSet,
+			actualActionSet, expectedActionSet.Difference(actualActionSet))
+	}
+}
+
+// verifyGraphInvariants verifies that all of a node's owners list the node as a
+// dependent and vice versa. uidToNode has all the nodes in the graph.
+func verifyGraphInvariants(scenario string, uidToNode map[types.UID]*node, t *testing.T) {
+	for myUID, node := range uidToNode {
+		for dependentNode := range node.dependents {
+			found := false
+			for _, owner := range dependentNode.owners {
+				if owner.UID == myUID {
+					found = true
+					break
+				}
+			}
+			if !found {
+				t.Errorf("scenario: %s: node %s has node %s as a dependent, but it's not present in the latter node's owners list", scenario, node.identity, dependentNode.identity)
+			}
+		}
+
+		for _, owner := range node.owners {
+			ownerNode, ok := uidToNode[owner.UID]
+			if !ok {
+				// It's possible that the owner node doesn't exist
+				continue
+			}
+			if _, ok := ownerNode.dependents[node]; !ok {
+				t.Errorf("node %s has node %s as an owner, but it's not present in the latter node's dependents list", node.identity, ownerNode.identity)
+			}
+		}
+	}
+}
+
+func createEvent(eventType eventType, selfUID string, owners []string) event {
+	var ownerReferences []metav1.OwnerReference
+	for i := 0; i < len(owners); i++ {
+		ownerReferences = append(ownerReferences, metav1.OwnerReference{UID: types.UID(owners[i])})
+	}
+	return event{
+		eventType: eventType,
+		obj: &v1.Pod{
+			ObjectMeta: v1.ObjectMeta{
+				UID:             types.UID(selfUID),
+				OwnerReferences: ownerReferences,
+			},
+		},
+	}
+}
+
+func TestProcessEvent(t *testing.T) {
+	var testScenarios = []struct {
+		name string
+		// a series of events that will be supplied to the
+		// Propagator.eventQueue.
+		events []event
+	}{
+		{
+			name: "test1",
+			events: []event{
+				createEvent(addEvent, "1", []string{}),
+				createEvent(addEvent, "2", []string{"1"}),
+				createEvent(addEvent, "3", []string{"1", "2"}),
+			},
+		},
+		{
+			name: "test2",
+			events: []event{
+				createEvent(addEvent, "1", []string{}),
+				createEvent(addEvent, "2", []string{"1"}),
+				createEvent(addEvent, "3", []string{"1", "2"}),
+				createEvent(addEvent, "4", []string{"2"}),
+				createEvent(deleteEvent, "2", []string{"doesn't matter"}),
+			},
+		},
+		{
+			name: "test3",
+			events: []event{
+				createEvent(addEvent, "1", []string{}),
+				createEvent(addEvent, "2", []string{"1"}),
+				createEvent(addEvent, "3", []string{"1", "2"}),
+				createEvent(addEvent, "4", []string{"3"}),
+				createEvent(updateEvent, "2", []string{"4"}),
+			},
+		},
+		{
+			name: "reverse test2",
+			events: []event{
+				createEvent(addEvent, "4", []string{"2"}),
+				createEvent(addEvent, "3", []string{"1", "2"}),
+				createEvent(addEvent, "2", []string{"1"}),
+				createEvent(addEvent, "1", []string{}),
+				createEvent(deleteEvent, "2", []string{"doesn't matter"}),
+			},
+		},
+	}
+
+	for _, scenario := range testScenarios {
+		propagator := &Propagator{
+			eventQueue: workqueue.NewTimedWorkQueue(),
+			uidToNode: &concurrentUIDToNode{
+				RWMutex:   &sync.RWMutex{},
+				uidToNode: make(map[types.UID]*node),
+			},
+			gc: &GarbageCollector{
+				dirtyQueue:       workqueue.NewTimedWorkQueue(),
+				clock:            clock.RealClock{},
+				absentOwnerCache: NewUIDCache(2),
+			},
+		}
+		for i := 0; i < len(scenario.events); i++ {
+			propagator.eventQueue.Add(&workqueue.TimedWorkQueueItem{StartTime: propagator.gc.clock.Now(), Object: &scenario.events[i]})
+			propagator.processEvent()
+			verifyGraphInvariants(scenario.name, propagator.uidToNode.uidToNode, t)
+		}
+	}
+}
+
+// TestDependentsRace relies on golang's data race detector to check if there is
+// data race among in the dependents field.
+func TestDependentsRace(t *testing.T) {
+	gc := setupGC(t, &restclient.Config{})
+
+	const updates = 100
+	owner := &node{dependents: make(map[*node]struct{})}
+	ownerUID := types.UID("owner")
+	gc.propagator.uidToNode.Write(owner)
+	go func() {
+		for i := 0; i < updates; i++ {
+			dependent := &node{}
+			gc.propagator.addDependentToOwners(dependent, []metav1.OwnerReference{{UID: ownerUID}})
+			gc.propagator.removeDependentFromOwners(dependent, []metav1.OwnerReference{{UID: ownerUID}})
+		}
+	}()
+	go func() {
+		gc.orphanQueue.Add(&workqueue.TimedWorkQueueItem{StartTime: gc.clock.Now(), Object: owner})
+		for i := 0; i < updates; i++ {
+			gc.orphanFinalizer()
+		}
+	}()
+}
+
+// test the list and watch functions correctly converts the ListOptions
+func TestGCListWatcher(t *testing.T) {
+	testHandler := &fakeActionHandler{}
+	srv, clientConfig := testServerAndClientConfig(testHandler.ServeHTTP)
+	defer srv.Close()
+	clientPool := dynamic.NewClientPool(clientConfig, api.Registry.RESTMapper(), dynamic.LegacyAPIPathResolverFunc)
+	podResource := schema.GroupVersionResource{Version: "v1", Resource: "pods"}
+	client, err := clientPool.ClientForGroupVersionResource(podResource)
+	if err != nil {
+		t.Fatal(err)
+	}
+	lw := gcListWatcher(client, podResource)
+	lw.Watch(v1.ListOptions{ResourceVersion: "1"})
+	lw.List(v1.ListOptions{ResourceVersion: "1"})
+	if e, a := 2, len(testHandler.actions); e != a {
+		t.Errorf("expect %d requests, got %d", e, a)
+	}
+	if e, a := "resourceVersion=1", testHandler.actions[0].query; e != a {
+		t.Errorf("expect %s, got %s", e, a)
+	}
+	if e, a := "resourceVersion=1", testHandler.actions[1].query; e != a {
+		t.Errorf("expect %s, got %s", e, a)
+	}
+}
+
+func podToGCNode(pod *v1.Pod) *node {
+	return &node{
+		identity: objectReference{
+			OwnerReference: metav1.OwnerReference{
+				Kind:       pod.Kind,
+				APIVersion: pod.APIVersion,
+				Name:       pod.Name,
+				UID:        pod.UID,
+			},
+			Namespace: pod.Namespace,
+		},
+		// owners are intentionally left empty. The processItem routine should get the latest item from the server.
+		owners: nil,
+	}
+}
+
+func TestAbsentUIDCache(t *testing.T) {
+	rc1Pod1 := getPod("rc1Pod1", []metav1.OwnerReference{
+		{
+			Kind:       "ReplicationController",
+			Name:       "rc1",
+			UID:        "1",
+			APIVersion: "v1",
+		},
+	})
+	rc1Pod2 := getPod("rc1Pod2", []metav1.OwnerReference{
+		{
+			Kind:       "ReplicationController",
+			Name:       "rc1",
+			UID:        "1",
+			APIVersion: "v1",
+		},
+	})
+	rc2Pod1 := getPod("rc2Pod1", []metav1.OwnerReference{
+		{
+			Kind:       "ReplicationController",
+			Name:       "rc2",
+			UID:        "2",
+			APIVersion: "v1",
+		},
+	})
+	rc3Pod1 := getPod("rc3Pod1", []metav1.OwnerReference{
+		{
+			Kind:       "ReplicationController",
+			Name:       "rc3",
+			UID:        "3",
+			APIVersion: "v1",
+		},
+	})
+	testHandler := &fakeActionHandler{
+		response: map[string]FakeResponse{
+			"GET" + "/api/v1/namespaces/ns1/pods/rc1Pod1": {
+				200,
+				serilizeOrDie(t, rc1Pod1),
+			},
+			"GET" + "/api/v1/namespaces/ns1/pods/rc1Pod2": {
+				200,
+				serilizeOrDie(t, rc1Pod2),
+			},
+			"GET" + "/api/v1/namespaces/ns1/pods/rc2Pod1": {
+				200,
+				serilizeOrDie(t, rc2Pod1),
+			},
+			"GET" + "/api/v1/namespaces/ns1/pods/rc3Pod1": {
+				200,
+				serilizeOrDie(t, rc3Pod1),
+			},
+			"GET" + "/api/v1/namespaces/ns1/replicationcontrollers/rc1": {
+				404,
+				[]byte{},
+			},
+			"GET" + "/api/v1/namespaces/ns1/replicationcontrollers/rc2": {
+				404,
+				[]byte{},
+			},
+			"GET" + "/api/v1/namespaces/ns1/replicationcontrollers/rc3": {
+				404,
+				[]byte{},
+			},
+		},
+	}
+	srv, clientConfig := testServerAndClientConfig(testHandler.ServeHTTP)
+	defer srv.Close()
+	gc := setupGC(t, clientConfig)
+	gc.absentOwnerCache = NewUIDCache(2)
+	gc.processItem(podToGCNode(rc1Pod1))
+	gc.processItem(podToGCNode(rc2Pod1))
+	// rc1 should already be in the cache, no request should be sent. rc1 should be promoted in the UIDCache
+	gc.processItem(podToGCNode(rc1Pod2))
+	// after this call, rc2 should be evicted from the UIDCache
+	gc.processItem(podToGCNode(rc3Pod1))
+	// check cache
+	if !gc.absentOwnerCache.Has(types.UID("1")) {
+		t.Errorf("expected rc1 to be in the cache")
+	}
+	if gc.absentOwnerCache.Has(types.UID("2")) {
+		t.Errorf("expected rc2 to not exist in the cache")
+	}
+	if !gc.absentOwnerCache.Has(types.UID("3")) {
+		t.Errorf("expected rc3 to be in the cache")
+	}
+	// check the request sent to the server
+	count := 0
+	for _, action := range testHandler.actions {
+		if action.String() == "GET=/api/v1/namespaces/ns1/replicationcontrollers/rc1" {
+			count++
+		}
+	}
+	if count != 1 {
+		t.Errorf("expected only 1 GET rc1 request, got %d", count)
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/garbagecollector/metaonly/BUILD

@@ -0,0 +1,58 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "metaonly.go",
+        "types.generated.go",
+        "types.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//vendor:github.com/ugorji/go/codec",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/serializer",
+        "//vendor:k8s.io/apimachinery/pkg/types",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["metaonly_test.go"],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api/install:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/api/meta",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/serializer",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/garbagecollector/metaonly/metaonly.go

@@ -0,0 +1,65 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package metaonly
+
+import (
+	"fmt"
+	"strings"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/kubernetes/pkg/api"
+)
+
+func (obj *MetadataOnlyObject) GetObjectKind() schema.ObjectKind     { return obj }
+func (obj *MetadataOnlyObjectList) GetObjectKind() schema.ObjectKind { return obj }
+
+type metaOnlyJSONScheme struct{}
+
+// This function can be extended to mapping different gvk to different MetadataOnlyObject,
+// which embedded with different version of ObjectMeta. Currently the system
+// only supports v1.ObjectMeta.
+func gvkToMetadataOnlyObject(gvk schema.GroupVersionKind) runtime.Object {
+	if strings.HasSuffix(gvk.Kind, "List") {
+		return &MetadataOnlyObjectList{}
+	} else {
+		return &MetadataOnlyObject{}
+	}
+}
+
+func NewMetadataCodecFactory() serializer.CodecFactory {
+	// populating another scheme from api.Scheme, registering every kind with
+	// MetadataOnlyObject (or MetadataOnlyObjectList).
+	scheme := runtime.NewScheme()
+	allTypes := api.Scheme.AllKnownTypes()
+	for kind := range allTypes {
+		if kind.Version == runtime.APIVersionInternal {
+			continue
+		}
+		metaOnlyObject := gvkToMetadataOnlyObject(kind)
+		scheme.AddKnownTypeWithName(kind, metaOnlyObject)
+	}
+	scheme.AddUnversionedTypes(api.Unversioned, &metav1.Status{})
+	return serializer.NewCodecFactory(scheme)
+}
+
+// String converts a MetadataOnlyObject to a human-readable string.
+func (metaOnly MetadataOnlyObject) String() string {
+	return fmt.Sprintf("%s/%s, name: %s, DeletionTimestamp:%v", metaOnly.TypeMeta.APIVersion, metaOnly.TypeMeta.Kind, metaOnly.ObjectMeta.Name, metaOnly.ObjectMeta.DeletionTimestamp)
+}

vendor/k8s.io/kubernetes/pkg/controller/garbagecollector/metaonly/metaonly_test.go

@@ -0,0 +1,164 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package metaonly
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	_ "k8s.io/kubernetes/pkg/api/install"
+	"k8s.io/kubernetes/pkg/api/v1"
+)
+
+func getPod() *v1.Pod {
+	return &v1.Pod{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Pod",
+			APIVersion: "v1",
+		},
+		ObjectMeta: v1.ObjectMeta{
+			Name: "pod",
+			OwnerReferences: []metav1.OwnerReference{
+				{UID: "1234"},
+			},
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name:  "fake-name",
+					Image: "fakeimage",
+				},
+			},
+		},
+	}
+}
+
+func getPodJson(t *testing.T) []byte {
+	data, err := json.Marshal(getPod())
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
+
+func getPodListJson(t *testing.T) []byte {
+	data, err := json.Marshal(&v1.PodList{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "PodList",
+			APIVersion: "v1",
+		},
+		Items: []v1.Pod{
+			*getPod(),
+			*getPod(),
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
+
+func verfiyMetadata(description string, t *testing.T, in *MetadataOnlyObject) {
+	pod := getPod()
+	if e, a := pod.ObjectMeta, in.ObjectMeta; !reflect.DeepEqual(e, a) {
+		t.Errorf("%s: expected %#v, got %#v", description, e, a)
+	}
+}
+
+func TestDecodeToMetadataOnlyObject(t *testing.T) {
+	data := getPodJson(t)
+	cf := serializer.DirectCodecFactory{CodecFactory: NewMetadataCodecFactory()}
+	info, ok := runtime.SerializerInfoForMediaType(cf.SupportedMediaTypes(), runtime.ContentTypeJSON)
+	if !ok {
+		t.Fatalf("expected to get a JSON serializer")
+	}
+	codec := cf.DecoderToVersion(info.Serializer, schema.GroupVersion{Group: "SOMEGROUP", Version: "SOMEVERSION"})
+	// decode with into
+	into := &MetadataOnlyObject{}
+	ret, _, err := codec.Decode(data, nil, into)
+	if err != nil {
+		t.Fatal(err)
+	}
+	metaOnly, ok := ret.(*MetadataOnlyObject)
+	if !ok {
+		t.Fatalf("expected ret to be *runtime.MetadataOnlyObject")
+	}
+	verfiyMetadata("check returned metaonly with into", t, metaOnly)
+	verfiyMetadata("check into", t, into)
+	// decode without into
+	ret, _, err = codec.Decode(data, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	metaOnly, ok = ret.(*MetadataOnlyObject)
+	if !ok {
+		t.Fatalf("expected ret to be *runtime.MetadataOnlyObject")
+	}
+	verfiyMetadata("check returned metaonly without into", t, metaOnly)
+}
+
+func verifyListMetadata(t *testing.T, metaOnlyList *MetadataOnlyObjectList) {
+	items, err := meta.ExtractList(metaOnlyList)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, item := range items {
+		metaOnly, ok := item.(*MetadataOnlyObject)
+		if !ok {
+			t.Fatalf("expected item to be *MetadataOnlyObject")
+		}
+		verfiyMetadata("check list", t, metaOnly)
+	}
+}
+
+func TestDecodeToMetadataOnlyObjectList(t *testing.T) {
+	data := getPodListJson(t)
+	cf := serializer.DirectCodecFactory{CodecFactory: NewMetadataCodecFactory()}
+	info, ok := runtime.SerializerInfoForMediaType(cf.SupportedMediaTypes(), runtime.ContentTypeJSON)
+	if !ok {
+		t.Fatalf("expected to get a JSON serializer")
+	}
+	codec := cf.DecoderToVersion(info.Serializer, schema.GroupVersion{Group: "SOMEGROUP", Version: "SOMEVERSION"})
+	// decode with into
+	into := &MetadataOnlyObjectList{}
+	ret, _, err := codec.Decode(data, nil, into)
+	if err != nil {
+		t.Fatal(err)
+	}
+	metaOnlyList, ok := ret.(*MetadataOnlyObjectList)
+	if !ok {
+		t.Fatalf("expected ret to be *runtime.UnstructuredList")
+	}
+	verifyListMetadata(t, metaOnlyList)
+	verifyListMetadata(t, into)
+	// decode without into
+	ret, _, err = codec.Decode(data, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	metaOnlyList, ok = ret.(*MetadataOnlyObjectList)
+	if !ok {
+		t.Fatalf("expected ret to be *runtime.UnstructuredList")
+	}
+	verifyListMetadata(t, metaOnlyList)
+}

vendor/k8s.io/kubernetes/pkg/controller/garbagecollector/metaonly/types.generated.go

@@ -0,0 +1,842 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// ************************************************************
+// DO NOT EDIT.
+// THIS FILE IS AUTO-GENERATED BY codecgen.
+// ************************************************************
+
+package metaonly
+
+import (
+	"errors"
+	"fmt"
+	codec1978 "github.com/ugorji/go/codec"
+	pkg1_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	pkg3_types "k8s.io/apimachinery/pkg/types"
+	pkg2_v1 "k8s.io/kubernetes/pkg/api/v1"
+	"reflect"
+	"runtime"
+	time "time"
+)
+
+const (
+	// ----- content types ----
+	codecSelferC_UTF81234 = 1
+	codecSelferC_RAW1234  = 0
+	// ----- value types used ----
+	codecSelferValueTypeArray1234 = 10
+	codecSelferValueTypeMap1234   = 9
+	// ----- containerStateValues ----
+	codecSelfer_containerMapKey1234    = 2
+	codecSelfer_containerMapValue1234  = 3
+	codecSelfer_containerMapEnd1234    = 4
+	codecSelfer_containerArrayElem1234 = 6
+	codecSelfer_containerArrayEnd1234  = 7
+)
+
+var (
+	codecSelferBitsize1234                         = uint8(reflect.TypeOf(uint(0)).Bits())
+	codecSelferOnlyMapOrArrayEncodeToStructErr1234 = errors.New(`only encoded map or array can be decoded into a struct`)
+)
+
+type codecSelfer1234 struct{}
+
+func init() {
+	if codec1978.GenVersion != 5 {
+		_, file, _, _ := runtime.Caller(0)
+		err := fmt.Errorf("codecgen version mismatch: current: %v, need %v. Re-generate file: %v",
+			5, codec1978.GenVersion, file)
+		panic(err)
+	}
+	if false { // reference the types, but skip this branch at build/run time
+		var v0 pkg1_v1.TypeMeta
+		var v1 pkg3_types.UID
+		var v2 pkg2_v1.ObjectMeta
+		var v3 time.Time
+		_, _, _, _ = v0, v1, v2, v3
+	}
+}
+
+func (x *MetadataOnlyObject) CodecEncodeSelf(e *codec1978.Encoder) {
+	var h codecSelfer1234
+	z, r := codec1978.GenHelperEncoder(e)
+	_, _, _ = h, z, r
+	if x == nil {
+		r.EncodeNil()
+	} else {
+		yym1 := z.EncBinary()
+		_ = yym1
+		if false {
+		} else if z.HasExtensions() && z.EncExt(x) {
+		} else {
+			yysep2 := !z.EncBinary()
+			yy2arr2 := z.EncBasicHandle().StructToArray
+			var yyq2 [3]bool
+			_, _, _ = yysep2, yyq2, yy2arr2
+			const yyr2 bool = false
+			yyq2[0] = x.Kind != ""
+			yyq2[1] = x.APIVersion != ""
+			yyq2[2] = true
+			var yynn2 int
+			if yyr2 || yy2arr2 {
+				r.EncodeArrayStart(3)
+			} else {
+				yynn2 = 0
+				for _, b := range yyq2 {
+					if b {
+						yynn2++
+					}
+				}
+				r.EncodeMapStart(yynn2)
+				yynn2 = 0
+			}
+			if yyr2 || yy2arr2 {
+				z.EncSendContainerState(codecSelfer_containerArrayElem1234)
+				if yyq2[0] {
+					yym4 := z.EncBinary()
+					_ = yym4
+					if false {
+					} else {
+						r.EncodeString(codecSelferC_UTF81234, string(x.Kind))
+					}
+				} else {
+					r.EncodeString(codecSelferC_UTF81234, "")
+				}
+			} else {
+				if yyq2[0] {
+					z.EncSendContainerState(codecSelfer_containerMapKey1234)
+					r.EncodeString(codecSelferC_UTF81234, string("kind"))
+					z.EncSendContainerState(codecSelfer_containerMapValue1234)
+					yym5 := z.EncBinary()
+					_ = yym5
+					if false {
+					} else {
+						r.EncodeString(codecSelferC_UTF81234, string(x.Kind))
+					}
+				}
+			}
+			if yyr2 || yy2arr2 {
+				z.EncSendContainerState(codecSelfer_containerArrayElem1234)
+				if yyq2[1] {
+					yym7 := z.EncBinary()
+					_ = yym7
+					if false {
+					} else {
+						r.EncodeString(codecSelferC_UTF81234, string(x.APIVersion))
+					}
+				} else {
+					r.EncodeString(codecSelferC_UTF81234, "")
+				}
+			} else {
+				if yyq2[1] {
+					z.EncSendContainerState(codecSelfer_containerMapKey1234)
+					r.EncodeString(codecSelferC_UTF81234, string("apiVersion"))
+					z.EncSendContainerState(codecSelfer_containerMapValue1234)
+					yym8 := z.EncBinary()
+					_ = yym8
+					if false {
+					} else {
+						r.EncodeString(codecSelferC_UTF81234, string(x.APIVersion))
+					}
+				}
+			}
+			if yyr2 || yy2arr2 {
+				z.EncSendContainerState(codecSelfer_containerArrayElem1234)
+				if yyq2[2] {
+					yy10 := &x.ObjectMeta
+					yy10.CodecEncodeSelf(e)
+				} else {
+					r.EncodeNil()
+				}
+			} else {
+				if yyq2[2] {
+					z.EncSendContainerState(codecSelfer_containerMapKey1234)
+					r.EncodeString(codecSelferC_UTF81234, string("metadata"))
+					z.EncSendContainerState(codecSelfer_containerMapValue1234)
+					yy12 := &x.ObjectMeta
+					yy12.CodecEncodeSelf(e)
+				}
+			}
+			if yyr2 || yy2arr2 {
+				z.EncSendContainerState(codecSelfer_containerArrayEnd1234)
+			} else {
+				z.EncSendContainerState(codecSelfer_containerMapEnd1234)
+			}
+		}
+	}
+}
+
+func (x *MetadataOnlyObject) CodecDecodeSelf(d *codec1978.Decoder) {
+	var h codecSelfer1234
+	z, r := codec1978.GenHelperDecoder(d)
+	_, _, _ = h, z, r
+	yym1 := z.DecBinary()
+	_ = yym1
+	if false {
+	} else if z.HasExtensions() && z.DecExt(x) {
+	} else {
+		yyct2 := r.ContainerType()
+		if yyct2 == codecSelferValueTypeMap1234 {
+			yyl2 := r.ReadMapStart()
+			if yyl2 == 0 {
+				z.DecSendContainerState(codecSelfer_containerMapEnd1234)
+			} else {
+				x.codecDecodeSelfFromMap(yyl2, d)
+			}
+		} else if yyct2 == codecSelferValueTypeArray1234 {
+			yyl2 := r.ReadArrayStart()
+			if yyl2 == 0 {
+				z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
+			} else {
+				x.codecDecodeSelfFromArray(yyl2, d)
+			}
+		} else {
+			panic(codecSelferOnlyMapOrArrayEncodeToStructErr1234)
+		}
+	}
+}
+
+func (x *MetadataOnlyObject) codecDecodeSelfFromMap(l int, d *codec1978.Decoder) {
+	var h codecSelfer1234
+	z, r := codec1978.GenHelperDecoder(d)
+	_, _, _ = h, z, r
+	var yys3Slc = z.DecScratchBuffer() // default slice to decode into
+	_ = yys3Slc
+	var yyhl3 bool = l >= 0
+	for yyj3 := 0; ; yyj3++ {
+		if yyhl3 {
+			if yyj3 >= l {
+				break
+			}
+		} else {
+			if r.CheckBreak() {
+				break
+			}
+		}
+		z.DecSendContainerState(codecSelfer_containerMapKey1234)
+		yys3Slc = r.DecodeBytes(yys3Slc, true, true)
+		yys3 := string(yys3Slc)
+		z.DecSendContainerState(codecSelfer_containerMapValue1234)
+		switch yys3 {
+		case "kind":
+			if r.TryDecodeAsNil() {
+				x.Kind = ""
+			} else {
+				yyv4 := &x.Kind
+				yym5 := z.DecBinary()
+				_ = yym5
+				if false {
+				} else {
+					*((*string)(yyv4)) = r.DecodeString()
+				}
+			}
+		case "apiVersion":
+			if r.TryDecodeAsNil() {
+				x.APIVersion = ""
+			} else {
+				yyv6 := &x.APIVersion
+				yym7 := z.DecBinary()
+				_ = yym7
+				if false {
+				} else {
+					*((*string)(yyv6)) = r.DecodeString()
+				}
+			}
+		case "metadata":
+			if r.TryDecodeAsNil() {
+				x.ObjectMeta = pkg2_v1.ObjectMeta{}
+			} else {
+				yyv8 := &x.ObjectMeta
+				yyv8.CodecDecodeSelf(d)
+			}
+		default:
+			z.DecStructFieldNotFound(-1, yys3)
+		} // end switch yys3
+	} // end for yyj3
+	z.DecSendContainerState(codecSelfer_containerMapEnd1234)
+}
+
+func (x *MetadataOnlyObject) codecDecodeSelfFromArray(l int, d *codec1978.Decoder) {
+	var h codecSelfer1234
+	z, r := codec1978.GenHelperDecoder(d)
+	_, _, _ = h, z, r
+	var yyj9 int
+	var yyb9 bool
+	var yyhl9 bool = l >= 0
+	yyj9++
+	if yyhl9 {
+		yyb9 = yyj9 > l
+	} else {
+		yyb9 = r.CheckBreak()
+	}
+	if yyb9 {
+		z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
+		return
+	}
+	z.DecSendContainerState(codecSelfer_containerArrayElem1234)
+	if r.TryDecodeAsNil() {
+		x.Kind = ""
+	} else {
+		yyv10 := &x.Kind
+		yym11 := z.DecBinary()
+		_ = yym11
+		if false {
+		} else {
+			*((*string)(yyv10)) = r.DecodeString()
+		}
+	}
+	yyj9++
+	if yyhl9 {
+		yyb9 = yyj9 > l
+	} else {
+		yyb9 = r.CheckBreak()
+	}
+	if yyb9 {
+		z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
+		return
+	}
+	z.DecSendContainerState(codecSelfer_containerArrayElem1234)
+	if r.TryDecodeAsNil() {
+		x.APIVersion = ""
+	} else {
+		yyv12 := &x.APIVersion
+		yym13 := z.DecBinary()
+		_ = yym13
+		if false {
+		} else {
+			*((*string)(yyv12)) = r.DecodeString()
+		}
+	}
+	yyj9++
+	if yyhl9 {
+		yyb9 = yyj9 > l
+	} else {
+		yyb9 = r.CheckBreak()
+	}
+	if yyb9 {
+		z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
+		return
+	}
+	z.DecSendContainerState(codecSelfer_containerArrayElem1234)
+	if r.TryDecodeAsNil() {
+		x.ObjectMeta = pkg2_v1.ObjectMeta{}
+	} else {
+		yyv14 := &x.ObjectMeta
+		yyv14.CodecDecodeSelf(d)
+	}
+	for {
+		yyj9++
+		if yyhl9 {
+			yyb9 = yyj9 > l
+		} else {
+			yyb9 = r.CheckBreak()
+		}
+		if yyb9 {
+			break
+		}
+		z.DecSendContainerState(codecSelfer_containerArrayElem1234)
+		z.DecStructFieldNotFound(yyj9-1, "")
+	}
+	z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
+}
+
+func (x *MetadataOnlyObjectList) CodecEncodeSelf(e *codec1978.Encoder) {
+	var h codecSelfer1234
+	z, r := codec1978.GenHelperEncoder(e)
+	_, _, _ = h, z, r
+	if x == nil {
+		r.EncodeNil()
+	} else {
+		yym1 := z.EncBinary()
+		_ = yym1
+		if false {
+		} else if z.HasExtensions() && z.EncExt(x) {
+		} else {
+			yysep2 := !z.EncBinary()
+			yy2arr2 := z.EncBasicHandle().StructToArray
+			var yyq2 [4]bool
+			_, _, _ = yysep2, yyq2, yy2arr2
+			const yyr2 bool = false
+			yyq2[0] = x.Kind != ""
+			yyq2[1] = x.APIVersion != ""
+			yyq2[2] = true
+			var yynn2 int
+			if yyr2 || yy2arr2 {
+				r.EncodeArrayStart(4)
+			} else {
+				yynn2 = 1
+				for _, b := range yyq2 {
+					if b {
+						yynn2++
+					}
+				}
+				r.EncodeMapStart(yynn2)
+				yynn2 = 0
+			}
+			if yyr2 || yy2arr2 {
+				z.EncSendContainerState(codecSelfer_containerArrayElem1234)
+				if yyq2[0] {
+					yym4 := z.EncBinary()
+					_ = yym4
+					if false {
+					} else {
+						r.EncodeString(codecSelferC_UTF81234, string(x.Kind))
+					}
+				} else {
+					r.EncodeString(codecSelferC_UTF81234, "")
+				}
+			} else {
+				if yyq2[0] {
+					z.EncSendContainerState(codecSelfer_containerMapKey1234)
+					r.EncodeString(codecSelferC_UTF81234, string("kind"))
+					z.EncSendContainerState(codecSelfer_containerMapValue1234)
+					yym5 := z.EncBinary()
+					_ = yym5
+					if false {
+					} else {
+						r.EncodeString(codecSelferC_UTF81234, string(x.Kind))
+					}
+				}
+			}
+			if yyr2 || yy2arr2 {
+				z.EncSendContainerState(codecSelfer_containerArrayElem1234)
+				if yyq2[1] {
+					yym7 := z.EncBinary()
+					_ = yym7
+					if false {
+					} else {
+						r.EncodeString(codecSelferC_UTF81234, string(x.APIVersion))
+					}
+				} else {
+					r.EncodeString(codecSelferC_UTF81234, "")
+				}
+			} else {
+				if yyq2[1] {
+					z.EncSendContainerState(codecSelfer_containerMapKey1234)
+					r.EncodeString(codecSelferC_UTF81234, string("apiVersion"))
+					z.EncSendContainerState(codecSelfer_containerMapValue1234)
+					yym8 := z.EncBinary()
+					_ = yym8
+					if false {
+					} else {
+						r.EncodeString(codecSelferC_UTF81234, string(x.APIVersion))
+					}
+				}
+			}
+			if yyr2 || yy2arr2 {
+				z.EncSendContainerState(codecSelfer_containerArrayElem1234)
+				if yyq2[2] {
+					yy10 := &x.ListMeta
+					yym11 := z.EncBinary()
+					_ = yym11
+					if false {
+					} else if z.HasExtensions() && z.EncExt(yy10) {
+					} else {
+						z.EncFallback(yy10)
+					}
+				} else {
+					r.EncodeNil()
+				}
+			} else {
+				if yyq2[2] {
+					z.EncSendContainerState(codecSelfer_containerMapKey1234)
+					r.EncodeString(codecSelferC_UTF81234, string("metadata"))
+					z.EncSendContainerState(codecSelfer_containerMapValue1234)
+					yy12 := &x.ListMeta
+					yym13 := z.EncBinary()
+					_ = yym13
+					if false {
+					} else if z.HasExtensions() && z.EncExt(yy12) {
+					} else {
+						z.EncFallback(yy12)
+					}
+				}
+			}
+			if yyr2 || yy2arr2 {
+				z.EncSendContainerState(codecSelfer_containerArrayElem1234)
+				if x.Items == nil {
+					r.EncodeNil()
+				} else {
+					yym15 := z.EncBinary()
+					_ = yym15
+					if false {
+					} else {
+						h.encSliceMetadataOnlyObject(([]MetadataOnlyObject)(x.Items), e)
+					}
+				}
+			} else {
+				z.EncSendContainerState(codecSelfer_containerMapKey1234)
+				r.EncodeString(codecSelferC_UTF81234, string("items"))
+				z.EncSendContainerState(codecSelfer_containerMapValue1234)
+				if x.Items == nil {
+					r.EncodeNil()
+				} else {
+					yym16 := z.EncBinary()
+					_ = yym16
+					if false {
+					} else {
+						h.encSliceMetadataOnlyObject(([]MetadataOnlyObject)(x.Items), e)
+					}
+				}
+			}
+			if yyr2 || yy2arr2 {
+				z.EncSendContainerState(codecSelfer_containerArrayEnd1234)
+			} else {
+				z.EncSendContainerState(codecSelfer_containerMapEnd1234)
+			}
+		}
+	}
+}
+
+func (x *MetadataOnlyObjectList) CodecDecodeSelf(d *codec1978.Decoder) {
+	var h codecSelfer1234
+	z, r := codec1978.GenHelperDecoder(d)
+	_, _, _ = h, z, r
+	yym1 := z.DecBinary()
+	_ = yym1
+	if false {
+	} else if z.HasExtensions() && z.DecExt(x) {
+	} else {
+		yyct2 := r.ContainerType()
+		if yyct2 == codecSelferValueTypeMap1234 {
+			yyl2 := r.ReadMapStart()
+			if yyl2 == 0 {
+				z.DecSendContainerState(codecSelfer_containerMapEnd1234)
+			} else {
+				x.codecDecodeSelfFromMap(yyl2, d)
+			}
+		} else if yyct2 == codecSelferValueTypeArray1234 {
+			yyl2 := r.ReadArrayStart()
+			if yyl2 == 0 {
+				z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
+			} else {
+				x.codecDecodeSelfFromArray(yyl2, d)
+			}
+		} else {
+			panic(codecSelferOnlyMapOrArrayEncodeToStructErr1234)
+		}
+	}
+}
+
+func (x *MetadataOnlyObjectList) codecDecodeSelfFromMap(l int, d *codec1978.Decoder) {
+	var h codecSelfer1234
+	z, r := codec1978.GenHelperDecoder(d)
+	_, _, _ = h, z, r
+	var yys3Slc = z.DecScratchBuffer() // default slice to decode into
+	_ = yys3Slc
+	var yyhl3 bool = l >= 0
+	for yyj3 := 0; ; yyj3++ {
+		if yyhl3 {
+			if yyj3 >= l {
+				break
+			}
+		} else {
+			if r.CheckBreak() {
+				break
+			}
+		}
+		z.DecSendContainerState(codecSelfer_containerMapKey1234)
+		yys3Slc = r.DecodeBytes(yys3Slc, true, true)
+		yys3 := string(yys3Slc)
+		z.DecSendContainerState(codecSelfer_containerMapValue1234)
+		switch yys3 {
+		case "kind":
+			if r.TryDecodeAsNil() {
+				x.Kind = ""
+			} else {
+				yyv4 := &x.Kind
+				yym5 := z.DecBinary()
+				_ = yym5
+				if false {
+				} else {
+					*((*string)(yyv4)) = r.DecodeString()
+				}
+			}
+		case "apiVersion":
+			if r.TryDecodeAsNil() {
+				x.APIVersion = ""
+			} else {
+				yyv6 := &x.APIVersion
+				yym7 := z.DecBinary()
+				_ = yym7
+				if false {
+				} else {
+					*((*string)(yyv6)) = r.DecodeString()
+				}
+			}
+		case "metadata":
+			if r.TryDecodeAsNil() {
+				x.ListMeta = pkg1_v1.ListMeta{}
+			} else {
+				yyv8 := &x.ListMeta
+				yym9 := z.DecBinary()
+				_ = yym9
+				if false {
+				} else if z.HasExtensions() && z.DecExt(yyv8) {
+				} else {
+					z.DecFallback(yyv8, false)
+				}
+			}
+		case "items":
+			if r.TryDecodeAsNil() {
+				x.Items = nil
+			} else {
+				yyv10 := &x.Items
+				yym11 := z.DecBinary()
+				_ = yym11
+				if false {
+				} else {
+					h.decSliceMetadataOnlyObject((*[]MetadataOnlyObject)(yyv10), d)
+				}
+			}
+		default:
+			z.DecStructFieldNotFound(-1, yys3)
+		} // end switch yys3
+	} // end for yyj3
+	z.DecSendContainerState(codecSelfer_containerMapEnd1234)
+}
+
+func (x *MetadataOnlyObjectList) codecDecodeSelfFromArray(l int, d *codec1978.Decoder) {
+	var h codecSelfer1234
+	z, r := codec1978.GenHelperDecoder(d)
+	_, _, _ = h, z, r
+	var yyj12 int
+	var yyb12 bool
+	var yyhl12 bool = l >= 0
+	yyj12++
+	if yyhl12 {
+		yyb12 = yyj12 > l
+	} else {
+		yyb12 = r.CheckBreak()
+	}
+	if yyb12 {
+		z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
+		return
+	}
+	z.DecSendContainerState(codecSelfer_containerArrayElem1234)
+	if r.TryDecodeAsNil() {
+		x.Kind = ""
+	} else {
+		yyv13 := &x.Kind
+		yym14 := z.DecBinary()
+		_ = yym14
+		if false {
+		} else {
+			*((*string)(yyv13)) = r.DecodeString()
+		}
+	}
+	yyj12++
+	if yyhl12 {
+		yyb12 = yyj12 > l
+	} else {
+		yyb12 = r.CheckBreak()
+	}
+	if yyb12 {
+		z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
+		return
+	}
+	z.DecSendContainerState(codecSelfer_containerArrayElem1234)
+	if r.TryDecodeAsNil() {
+		x.APIVersion = ""
+	} else {
+		yyv15 := &x.APIVersion
+		yym16 := z.DecBinary()
+		_ = yym16
+		if false {
+		} else {
+			*((*string)(yyv15)) = r.DecodeString()
+		}
+	}
+	yyj12++
+	if yyhl12 {
+		yyb12 = yyj12 > l
+	} else {
+		yyb12 = r.CheckBreak()
+	}
+	if yyb12 {
+		z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
+		return
+	}
+	z.DecSendContainerState(codecSelfer_containerArrayElem1234)
+	if r.TryDecodeAsNil() {
+		x.ListMeta = pkg1_v1.ListMeta{}
+	} else {
+		yyv17 := &x.ListMeta
+		yym18 := z.DecBinary()
+		_ = yym18
+		if false {
+		} else if z.HasExtensions() && z.DecExt(yyv17) {
+		} else {
+			z.DecFallback(yyv17, false)
+		}
+	}
+	yyj12++
+	if yyhl12 {
+		yyb12 = yyj12 > l
+	} else {
+		yyb12 = r.CheckBreak()
+	}
+	if yyb12 {
+		z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
+		return
+	}
+	z.DecSendContainerState(codecSelfer_containerArrayElem1234)
+	if r.TryDecodeAsNil() {
+		x.Items = nil
+	} else {
+		yyv19 := &x.Items
+		yym20 := z.DecBinary()
+		_ = yym20
+		if false {
+		} else {
+			h.decSliceMetadataOnlyObject((*[]MetadataOnlyObject)(yyv19), d)
+		}
+	}
+	for {
+		yyj12++
+		if yyhl12 {
+			yyb12 = yyj12 > l
+		} else {
+			yyb12 = r.CheckBreak()
+		}
+		if yyb12 {
+			break
+		}
+		z.DecSendContainerState(codecSelfer_containerArrayElem1234)
+		z.DecStructFieldNotFound(yyj12-1, "")
+	}
+	z.DecSendContainerState(codecSelfer_containerArrayEnd1234)
+}
+
+func (x codecSelfer1234) encSliceMetadataOnlyObject(v []MetadataOnlyObject, e *codec1978.Encoder) {
+	var h codecSelfer1234
+	z, r := codec1978.GenHelperEncoder(e)
+	_, _, _ = h, z, r
+	r.EncodeArrayStart(len(v))
+	for _, yyv1 := range v {
+		z.EncSendContainerState(codecSelfer_containerArrayElem1234)
+		yy2 := &yyv1
+		yy2.CodecEncodeSelf(e)
+	}
+	z.EncSendContainerState(codecSelfer_containerArrayEnd1234)
+}
+
+func (x codecSelfer1234) decSliceMetadataOnlyObject(v *[]MetadataOnlyObject, d *codec1978.Decoder) {
+	var h codecSelfer1234
+	z, r := codec1978.GenHelperDecoder(d)
+	_, _, _ = h, z, r
+
+	yyv1 := *v
+	yyh1, yyl1 := z.DecSliceHelperStart()
+	var yyc1 bool
+	_ = yyc1
+	if yyl1 == 0 {
+		if yyv1 == nil {
+			yyv1 = []MetadataOnlyObject{}
+			yyc1 = true
+		} else if len(yyv1) != 0 {
+			yyv1 = yyv1[:0]
+			yyc1 = true
+		}
+	} else if yyl1 > 0 {
+		var yyrr1, yyrl1 int
+		var yyrt1 bool
+		_, _ = yyrl1, yyrt1
+		yyrr1 = yyl1 // len(yyv1)
+		if yyl1 > cap(yyv1) {
+
+			yyrg1 := len(yyv1) > 0
+			yyv21 := yyv1
+			yyrl1, yyrt1 = z.DecInferLen(yyl1, z.DecBasicHandle().MaxInitLen, 256)
+			if yyrt1 {
+				if yyrl1 <= cap(yyv1) {
+					yyv1 = yyv1[:yyrl1]
+				} else {
+					yyv1 = make([]MetadataOnlyObject, yyrl1)
+				}
+			} else {
+				yyv1 = make([]MetadataOnlyObject, yyrl1)
+			}
+			yyc1 = true
+			yyrr1 = len(yyv1)
+			if yyrg1 {
+				copy(yyv1, yyv21)
+			}
+		} else if yyl1 != len(yyv1) {
+			yyv1 = yyv1[:yyl1]
+			yyc1 = true
+		}
+		yyj1 := 0
+		for ; yyj1 < yyrr1; yyj1++ {
+			yyh1.ElemContainerState(yyj1)
+			if r.TryDecodeAsNil() {
+				yyv1[yyj1] = MetadataOnlyObject{}
+			} else {
+				yyv2 := &yyv1[yyj1]
+				yyv2.CodecDecodeSelf(d)
+			}
+
+		}
+		if yyrt1 {
+			for ; yyj1 < yyl1; yyj1++ {
+				yyv1 = append(yyv1, MetadataOnlyObject{})
+				yyh1.ElemContainerState(yyj1)
+				if r.TryDecodeAsNil() {
+					yyv1[yyj1] = MetadataOnlyObject{}
+				} else {
+					yyv3 := &yyv1[yyj1]
+					yyv3.CodecDecodeSelf(d)
+				}
+
+			}
+		}
+
+	} else {
+		yyj1 := 0
+		for ; !r.CheckBreak(); yyj1++ {
+
+			if yyj1 >= len(yyv1) {
+				yyv1 = append(yyv1, MetadataOnlyObject{}) // var yyz1 MetadataOnlyObject
+				yyc1 = true
+			}
+			yyh1.ElemContainerState(yyj1)
+			if yyj1 < len(yyv1) {
+				if r.TryDecodeAsNil() {
+					yyv1[yyj1] = MetadataOnlyObject{}
+				} else {
+					yyv4 := &yyv1[yyj1]
+					yyv4.CodecDecodeSelf(d)
+				}
+
+			} else {
+				z.DecSwallow()
+			}
+
+		}
+		if yyj1 < len(yyv1) {
+			yyv1 = yyv1[:yyj1]
+			yyc1 = true
+		} else if yyj1 == 0 && yyv1 == nil {
+			yyv1 = []MetadataOnlyObject{}
+			yyc1 = true
+		}
+	}
+	yyh1.End()
+	if yyc1 {
+		*v = yyv1
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/garbagecollector/metaonly/types.go

@@ -0,0 +1,42 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package metaonly
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api/v1"
+)
+
+// MetadataOnlyObject allows decoding only the apiVersion, kind, and metadata fields of
+// JSON data.
+// TODO: enable meta-only decoding for protobuf.
+type MetadataOnlyObject struct {
+	metav1.TypeMeta `json:",inline"`
+	// +optional
+	v1.ObjectMeta `json:"metadata,omitempty"`
+}
+
+// MetadataOnlyObjectList allows decoding from JSON data only the typemeta and metadata of
+// a list, and those of the enclosing objects.
+// TODO: enable meta-only decoding for protobuf.
+type MetadataOnlyObjectList struct {
+	metav1.TypeMeta `json:",inline"`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []MetadataOnlyObject `json:"items"`
+}

vendor/k8s.io/kubernetes/pkg/controller/garbagecollector/metrics.go

@@ -0,0 +1,73 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package garbagecollector
+
+import (
+	"sync"
+	"time"
+
+	"k8s.io/kubernetes/pkg/util/clock"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+const (
+	GarbageCollectSubsystem    = "garbage_collector"
+	EventProcessingLatencyKey  = "event_processing_latency_microseconds"
+	DirtyProcessingLatencyKey  = "dirty_processing_latency_microseconds"
+	OrphanProcessingLatencyKey = "orphan_processing_latency_microseconds"
+)
+
+var (
+	EventProcessingLatency = prometheus.NewSummary(
+		prometheus.SummaryOpts{
+			Subsystem: GarbageCollectSubsystem,
+			Name:      EventProcessingLatencyKey,
+			Help:      "Time in microseconds of an event spend in the eventQueue",
+		},
+	)
+	DirtyProcessingLatency = prometheus.NewSummary(
+		prometheus.SummaryOpts{
+			Subsystem: GarbageCollectSubsystem,
+			Name:      DirtyProcessingLatencyKey,
+			Help:      "Time in microseconds of an item spend in the dirtyQueue",
+		},
+	)
+	OrphanProcessingLatency = prometheus.NewSummary(
+		prometheus.SummaryOpts{
+			Subsystem: GarbageCollectSubsystem,
+			Name:      OrphanProcessingLatencyKey,
+			Help:      "Time in microseconds of an item spend in the orphanQueue",
+		},
+	)
+)
+
+var registerMetrics sync.Once
+
+// Register all metrics.
+func Register() {
+	// Register the metrics.
+	registerMetrics.Do(func() {
+		prometheus.MustRegister(EventProcessingLatency)
+		prometheus.MustRegister(DirtyProcessingLatency)
+		prometheus.MustRegister(OrphanProcessingLatency)
+	})
+}
+
+func sinceInMicroseconds(clock clock.Clock, start time.Time) float64 {
+	return float64(clock.Since(start).Nanoseconds() / time.Microsecond.Nanoseconds())
+}

vendor/k8s.io/kubernetes/pkg/controller/garbagecollector/rate_limiter_helper.go

@@ -0,0 +1,60 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package garbagecollector
+
+import (
+	"fmt"
+	"strings"
+	"sync"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/client/typed/dynamic"
+	"k8s.io/kubernetes/pkg/util/metrics"
+)
+
+// RegisteredRateLimiter records the registered RateLimters to avoid
+// duplication.
+type RegisteredRateLimiter struct {
+	rateLimiters map[schema.GroupVersion]*sync.Once
+}
+
+// NewRegisteredRateLimiter returns a new RegisteredRateLimiater.
+// TODO: NewRegisteredRateLimiter is not dynamic. We need to find a better way
+// when GC dynamically change the resources it monitors.
+func NewRegisteredRateLimiter(resources map[schema.GroupVersionResource]struct{}) *RegisteredRateLimiter {
+	rateLimiters := make(map[schema.GroupVersion]*sync.Once)
+	for resource := range resources {
+		gv := resource.GroupVersion()
+		if _, found := rateLimiters[gv]; !found {
+			rateLimiters[gv] = &sync.Once{}
+		}
+	}
+	return &RegisteredRateLimiter{rateLimiters: rateLimiters}
+}
+
+func (r *RegisteredRateLimiter) registerIfNotPresent(gv schema.GroupVersion, client *dynamic.Client, prefix string) {
+	once, found := r.rateLimiters[gv]
+	if !found {
+		return
+	}
+	once.Do(func() {
+		if rateLimiter := client.GetRateLimiter(); rateLimiter != nil {
+			group := strings.Replace(gv.Group, ".", ":", -1)
+			metrics.RegisterMetricAndTrackRateLimiterUsage(fmt.Sprintf("%s_%s_%s", prefix, group, gv.Version), rateLimiter)
+		}
+	})
+}

vendor/k8s.io/kubernetes/pkg/controller/garbagecollector/uid_cache.go

@@ -0,0 +1,52 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package garbagecollector
+
+import (
+	"sync"
+
+	"github.com/golang/groupcache/lru"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// UIDCache is an LRU cache for uid.
+type UIDCache struct {
+	mutex sync.Mutex
+	cache *lru.Cache
+}
+
+// NewUIDCache returns a UIDCache.
+func NewUIDCache(maxCacheEntries int) *UIDCache {
+	return &UIDCache{
+		cache: lru.New(maxCacheEntries),
+	}
+}
+
+// Add adds a uid to the cache.
+func (c *UIDCache) Add(uid types.UID) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+	c.cache.Add(uid, nil)
+}
+
+// Has returns if a uid is in the cache.
+func (c *UIDCache) Has(uid types.UID) bool {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+	_, found := c.cache.Get(uid)
+	return found
+}

vendor/k8s.io/kubernetes/pkg/controller/informers/BUILD

@@ -0,0 +1,54 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "batch.go",
+        "core.go",
+        "extensions.go",
+        "factory.go",
+        "generic.go",
+        "rbac.go",
+        "storage.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/batch:go_default_library",
+        "//pkg/apis/batch/v1:go_default_library",
+        "//pkg/apis/extensions:go_default_library",
+        "//pkg/apis/extensions/v1beta1:go_default_library",
+        "//pkg/apis/rbac:go_default_library",
+        "//pkg/apis/storage/v1beta1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset:go_default_library",
+        "//pkg/client/listers/batch/v1:go_default_library",
+        "//pkg/client/listers/core/internalversion:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/watch",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/informers/OWNERS

@@ -0,0 +1,6 @@
+reviewers:
+- derekwaynecarr
+- caesarxuchao
+- wojtek-t
+- lavalamp
+- deads2k

vendor/k8s.io/kubernetes/pkg/controller/informers/batch.go

@@ -0,0 +1,83 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package informers
+
+import (
+	"reflect"
+	"time"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api/v1"
+	batch "k8s.io/kubernetes/pkg/apis/batch/v1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	batchv1listers "k8s.io/kubernetes/pkg/client/listers/batch/v1"
+)
+
+// JobInformer is type of SharedIndexInformer which watches and lists all jobs.
+// Interface provides constructor for informer and lister for jobs
+type JobInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() batchv1listers.JobLister
+}
+
+type jobInformer struct {
+	*sharedInformerFactory
+}
+
+// Informer checks whether jobInformer exists in sharedInformerFactory and if not, it creates new informer of type
+// jobInformer and connects it to sharedInformerFactory
+func (f *jobInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&batch.Job{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = NewJobInformer(f.client, f.defaultResync)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// NewJobInformer returns a SharedIndexInformer that lists and watches all jobs
+func NewJobInformer(client clientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	sharedIndexInformer := cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return client.Batch().Jobs(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return client.Batch().Jobs(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&batch.Job{},
+		resyncPeriod,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+
+	return sharedIndexInformer
+}
+
+// Lister returns lister for jobInformer
+func (f *jobInformer) Lister() batchv1listers.JobLister {
+	informer := f.Informer()
+	return batchv1listers.NewJobLister(informer.GetIndexer())
+}

vendor/k8s.io/kubernetes/pkg/controller/informers/core.go

@@ -0,0 +1,582 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package informers
+
+import (
+	"reflect"
+	"time"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
+	coreinternallisters "k8s.io/kubernetes/pkg/client/listers/core/internalversion"
+)
+
+// PodInformer is type of SharedIndexInformer which watches and lists all pods.
+// Interface provides constructor for informer and lister for pods
+type PodInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() *cache.StoreToPodLister
+}
+
+type podInformer struct {
+	*sharedInformerFactory
+}
+
+// Informer checks whether podInformer exists in sharedInformerFactory and if not, it creates new informer of type
+// podInformer and connects it to sharedInformerFactory
+func (f *podInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&v1.Pod{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = NewPodInformer(f.client, f.defaultResync)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// Lister returns lister for podInformer
+func (f *podInformer) Lister() *cache.StoreToPodLister {
+	informer := f.Informer()
+	return &cache.StoreToPodLister{Indexer: informer.GetIndexer()}
+}
+
+//*****************************************************************************
+
+// NamespaceInformer is type of SharedIndexInformer which watches and lists all namespaces.
+// Interface provides constructor for informer and lister for namsespaces
+type NamespaceInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() *cache.IndexerToNamespaceLister
+}
+
+type namespaceInformer struct {
+	*sharedInformerFactory
+}
+
+// Informer checks whether namespaceInformer exists in sharedInformerFactory and if not, it creates new informer of type
+// namespaceInformer and connects it to sharedInformerFactory
+func (f *namespaceInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&v1.Namespace{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = NewNamespaceInformer(f.client, f.defaultResync)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// Lister returns lister for namespaceInformer
+func (f *namespaceInformer) Lister() *cache.IndexerToNamespaceLister {
+	informer := f.Informer()
+	return &cache.IndexerToNamespaceLister{Indexer: informer.GetIndexer()}
+}
+
+//*****************************************************************************
+
+// InternalNamespaceInformer is type of SharedIndexInformer which watches and lists all namespaces.
+// Interface provides constructor for informer and lister for namsespaces
+type InternalNamespaceInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() coreinternallisters.NamespaceLister
+}
+
+type internalNamespaceInformer struct {
+	*sharedInformerFactory
+}
+
+// Informer checks whether internalNamespaceInformer exists in sharedInformerFactory and if not, it creates new informer of type
+// internalNamespaceInformer and connects it to sharedInformerFactory
+func (f *internalNamespaceInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&api.Namespace{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = NewInternalNamespaceInformer(f.internalclient, f.defaultResync)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// Lister returns lister for internalNamespaceInformer
+func (f *internalNamespaceInformer) Lister() coreinternallisters.NamespaceLister {
+	informer := f.Informer()
+	return coreinternallisters.NewNamespaceLister(informer.GetIndexer())
+}
+
+//*****************************************************************************
+
+// NodeInformer is type of SharedIndexInformer which watches and lists all nodes.
+// Interface provides constructor for informer and lister for nodes
+type NodeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() *cache.StoreToNodeLister
+}
+
+type nodeInformer struct {
+	*sharedInformerFactory
+}
+
+// Informer checks whether nodeInformer exists in sharedInformerFactory and if not, it creates new informer of type
+// nodeInformer and connects it to sharedInformerFactory
+func (f *nodeInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&v1.Node{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = NewNodeInformer(f.client, f.defaultResync)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// Lister returns lister for nodeInformer
+func (f *nodeInformer) Lister() *cache.StoreToNodeLister {
+	informer := f.Informer()
+	return &cache.StoreToNodeLister{Store: informer.GetStore()}
+}
+
+//*****************************************************************************
+
+// PVCInformer is type of SharedIndexInformer which watches and lists all persistent volume claims.
+// Interface provides constructor for informer and lister for persistent volume claims
+type PVCInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() *cache.StoreToPersistentVolumeClaimLister
+}
+
+type pvcInformer struct {
+	*sharedInformerFactory
+}
+
+// Informer checks whether pvcInformer exists in sharedInformerFactory and if not, it creates new informer of type
+// pvcInformer and connects it to sharedInformerFactory
+func (f *pvcInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&v1.PersistentVolumeClaim{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = NewPVCInformer(f.client, f.defaultResync)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// Lister returns lister for pvcInformer
+func (f *pvcInformer) Lister() *cache.StoreToPersistentVolumeClaimLister {
+	informer := f.Informer()
+	return &cache.StoreToPersistentVolumeClaimLister{Indexer: informer.GetIndexer()}
+}
+
+//*****************************************************************************
+
+// PVInformer is type of SharedIndexInformer which watches and lists all persistent volumes.
+// Interface provides constructor for informer and lister for persistent volumes
+type PVInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() *cache.StoreToPVFetcher
+}
+
+type pvInformer struct {
+	*sharedInformerFactory
+}
+
+// Informer checks whether pvInformer exists in sharedInformerFactory and if not, it creates new informer of type
+// pvInformer and connects it to sharedInformerFactory
+func (f *pvInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&v1.PersistentVolume{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = NewPVInformer(f.client, f.defaultResync)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// Lister returns lister for pvInformer
+func (f *pvInformer) Lister() *cache.StoreToPVFetcher {
+	informer := f.Informer()
+	return &cache.StoreToPVFetcher{Store: informer.GetStore()}
+}
+
+//*****************************************************************************
+
+// LimitRangeInformer is type of SharedIndexInformer which watches and lists all limit ranges.
+// Interface provides constructor for informer and lister for limit ranges.
+type LimitRangeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() *cache.StoreToLimitRangeLister
+}
+
+type limitRangeInformer struct {
+	*sharedInformerFactory
+}
+
+// Informer checks whether pvcInformer exists in sharedInformerFactory and if not, it creates new informer of type
+// limitRangeInformer and connects it to sharedInformerFactory
+func (f *limitRangeInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&v1.LimitRange{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = NewLimitRangeInformer(f.client, f.defaultResync)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// Lister returns lister for limitRangeInformer
+func (f *limitRangeInformer) Lister() *cache.StoreToLimitRangeLister {
+	informer := f.Informer()
+	return &cache.StoreToLimitRangeLister{Indexer: informer.GetIndexer()}
+}
+
+//*****************************************************************************
+
+// InternalLimitRangeInformer is type of SharedIndexInformer which watches and lists all limit ranges.
+// Interface provides constructor for informer and lister for limit ranges.
+type InternalLimitRangeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() coreinternallisters.LimitRangeLister
+}
+
+type internalLimitRangeInformer struct {
+	*sharedInformerFactory
+}
+
+// Informer checks whether pvcInformer exists in sharedInformerFactory and if not, it creates new informer of type
+// internalLimitRangeInformer and connects it to sharedInformerFactory
+func (f *internalLimitRangeInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&api.LimitRange{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = NewInternalLimitRangeInformer(f.internalclient, f.defaultResync)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// Lister returns lister for internalLimitRangeInformer
+func (f *internalLimitRangeInformer) Lister() coreinternallisters.LimitRangeLister {
+	informer := f.Informer()
+	return coreinternallisters.NewLimitRangeLister(informer.GetIndexer())
+}
+
+//*****************************************************************************
+
+// ReplicationControllerInformer is type of SharedIndexInformer which watches and lists all replication controllers.
+// Interface provides constructor for informer and lister for replication controllers.
+type ReplicationControllerInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() *cache.StoreToReplicationControllerLister
+}
+
+type replicationControllerInformer struct {
+	*sharedInformerFactory
+}
+
+// Informer checks whether replicationControllerInformer exists in sharedInformerFactory and if not, it creates new informer of type
+// replicationControllerInformer and connects it to sharedInformerFactory
+func (f *replicationControllerInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&v1.ReplicationController{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = NewReplicationControllerInformer(f.client, f.defaultResync)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// Lister returns lister for replicationControllerInformer
+func (f *replicationControllerInformer) Lister() *cache.StoreToReplicationControllerLister {
+	informer := f.Informer()
+	return &cache.StoreToReplicationControllerLister{Indexer: informer.GetIndexer()}
+}
+
+//*****************************************************************************
+
+// NewPodInformer returns a SharedIndexInformer that lists and watches all pods
+func NewPodInformer(client clientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	sharedIndexInformer := cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return client.Core().Pods(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return client.Core().Pods(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&v1.Pod{},
+		resyncPeriod,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+
+	return sharedIndexInformer
+}
+
+// NewNodeInformer returns a SharedIndexInformer that lists and watches all nodes
+func NewNodeInformer(client clientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	sharedIndexInformer := cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return client.Core().Nodes().List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return client.Core().Nodes().Watch(options)
+			},
+		},
+		&v1.Node{},
+		resyncPeriod,
+		cache.Indexers{})
+
+	return sharedIndexInformer
+}
+
+// NewPVCInformer returns a SharedIndexInformer that lists and watches all PVCs
+func NewPVCInformer(client clientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	sharedIndexInformer := cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return client.Core().PersistentVolumeClaims(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return client.Core().PersistentVolumeClaims(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&v1.PersistentVolumeClaim{},
+		resyncPeriod,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+
+	return sharedIndexInformer
+}
+
+// NewPVInformer returns a SharedIndexInformer that lists and watches all PVs
+func NewPVInformer(client clientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	sharedIndexInformer := cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return client.Core().PersistentVolumes().List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return client.Core().PersistentVolumes().Watch(options)
+			},
+		},
+		&v1.PersistentVolume{},
+		resyncPeriod,
+		cache.Indexers{})
+
+	return sharedIndexInformer
+}
+
+// NewNamespaceInformer returns a SharedIndexInformer that lists and watches namespaces
+func NewNamespaceInformer(client clientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	sharedIndexInformer := cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return client.Core().Namespaces().List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return client.Core().Namespaces().Watch(options)
+			},
+		},
+		&v1.Namespace{},
+		resyncPeriod,
+		cache.Indexers{})
+
+	return sharedIndexInformer
+}
+
+// NewInternalNamespaceInformer returns a SharedIndexInformer that lists and watches namespaces
+func NewInternalNamespaceInformer(client internalclientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	sharedIndexInformer := cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				internalOptions := api.ListOptions{}
+				v1.Convert_v1_ListOptions_To_api_ListOptions(&options, &internalOptions, nil)
+				return client.Core().Namespaces().List(internalOptions)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				internalOptions := api.ListOptions{}
+				v1.Convert_v1_ListOptions_To_api_ListOptions(&options, &internalOptions, nil)
+				return client.Core().Namespaces().Watch(internalOptions)
+			},
+		},
+		&api.Namespace{},
+		resyncPeriod,
+		cache.Indexers{})
+
+	return sharedIndexInformer
+}
+
+// NewLimitRangeInformer returns a SharedIndexInformer that lists and watches all LimitRanges
+func NewLimitRangeInformer(client clientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	sharedIndexInformer := cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return client.Core().LimitRanges(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return client.Core().LimitRanges(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&v1.LimitRange{},
+		resyncPeriod,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc})
+
+	return sharedIndexInformer
+}
+
+// NewInternalLimitRangeInformer returns a SharedIndexInformer that lists and watches all LimitRanges
+func NewInternalLimitRangeInformer(internalclient internalclientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	sharedIndexInformer := cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				internalOptions := api.ListOptions{}
+				v1.Convert_v1_ListOptions_To_api_ListOptions(&options, &internalOptions, nil)
+				return internalclient.Core().LimitRanges(v1.NamespaceAll).List(internalOptions)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				internalOptions := api.ListOptions{}
+				v1.Convert_v1_ListOptions_To_api_ListOptions(&options, &internalOptions, nil)
+				return internalclient.Core().LimitRanges(v1.NamespaceAll).Watch(internalOptions)
+			},
+		},
+		&api.LimitRange{},
+		resyncPeriod,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc})
+
+	return sharedIndexInformer
+}
+
+// NewReplicationControllerInformer returns a SharedIndexInformer that lists and watches all replication controllers.
+func NewReplicationControllerInformer(client clientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	sharedIndexInformer := cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return client.Core().ReplicationControllers(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return client.Core().ReplicationControllers(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&v1.ReplicationController{},
+		resyncPeriod,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+
+	return sharedIndexInformer
+}
+
+/*****************************************************************************/
+
+// ServiceAccountInformer is type of SharedIndexInformer which watches and lists all ServiceAccounts.
+// Interface provides constructor for informer and lister for ServiceAccounts
+type ServiceAccountInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() *cache.StoreToServiceAccountLister
+}
+
+type serviceAccountInformer struct {
+	*sharedInformerFactory
+}
+
+// Informer checks whether ServiceAccountInformer exists in sharedInformerFactory and if not, it creates new informer of type
+// ServiceAccountInformer and connects it to sharedInformerFactory
+func (f *serviceAccountInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&v1.ServiceAccount{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = NewServiceAccountInformer(f.client, f.defaultResync)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// Lister returns lister for ServiceAccountInformer
+func (f *serviceAccountInformer) Lister() *cache.StoreToServiceAccountLister {
+	informer := f.Informer()
+	return &cache.StoreToServiceAccountLister{Indexer: informer.GetIndexer()}
+}
+
+// NewServiceAccountInformer returns a SharedIndexInformer that lists and watches all ServiceAccounts
+func NewServiceAccountInformer(client clientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	sharedIndexInformer := cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return client.Core().ServiceAccounts(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return client.Core().ServiceAccounts(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&v1.ServiceAccount{},
+		resyncPeriod,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc})
+
+	return sharedIndexInformer
+}

vendor/k8s.io/kubernetes/pkg/controller/informers/extensions.go

@@ -0,0 +1,154 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package informers
+
+import (
+	"reflect"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api/v1"
+	extensions "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	"k8s.io/kubernetes/pkg/client/cache"
+)
+
+// DaemonSetInformer is type of SharedIndexInformer which watches and lists all pods.
+// Interface provides constructor for informer and lister for pods
+type DaemonSetInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() *cache.StoreToDaemonSetLister
+}
+
+type daemonSetInformer struct {
+	*sharedInformerFactory
+}
+
+func (f *daemonSetInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&extensions.DaemonSet{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return f.client.Extensions().DaemonSets(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return f.client.Extensions().DaemonSets(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&extensions.DaemonSet{},
+		f.defaultResync,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+func (f *daemonSetInformer) Lister() *cache.StoreToDaemonSetLister {
+	informer := f.Informer()
+	return &cache.StoreToDaemonSetLister{Store: informer.GetIndexer()}
+}
+
+// DeploymentInformer is a type of SharedIndexInformer which watches and lists all deployments.
+type DeploymentInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() *cache.StoreToDeploymentLister
+}
+
+type deploymentInformer struct {
+	*sharedInformerFactory
+}
+
+func (f *deploymentInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&extensions.Deployment{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return f.client.Extensions().Deployments(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return f.client.Extensions().Deployments(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&extensions.Deployment{},
+		f.defaultResync,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+func (f *deploymentInformer) Lister() *cache.StoreToDeploymentLister {
+	informer := f.Informer()
+	return &cache.StoreToDeploymentLister{Indexer: informer.GetIndexer()}
+}
+
+// ReplicaSetInformer is a type of SharedIndexInformer which watches and lists all replicasets.
+type ReplicaSetInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() *cache.StoreToReplicaSetLister
+}
+
+type replicaSetInformer struct {
+	*sharedInformerFactory
+}
+
+func (f *replicaSetInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&extensions.ReplicaSet{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return f.client.Extensions().ReplicaSets(v1.NamespaceAll).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return f.client.Extensions().ReplicaSets(v1.NamespaceAll).Watch(options)
+			},
+		},
+		&extensions.ReplicaSet{},
+		f.defaultResync,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+func (f *replicaSetInformer) Lister() *cache.StoreToReplicaSetLister {
+	informer := f.Informer()
+	return &cache.StoreToReplicaSetLister{Indexer: informer.GetIndexer()}
+}

vendor/k8s.io/kubernetes/pkg/controller/informers/factory.go

@@ -0,0 +1,193 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package informers
+
+import (
+	"reflect"
+	"sync"
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
+)
+
+// SharedInformerFactory provides interface which holds unique informers for pods, nodes, namespaces, persistent volume
+// claims and persistent volumes
+type SharedInformerFactory interface {
+	// Start starts informers that can start AFTER the API server and controllers have started
+	Start(stopCh <-chan struct{})
+
+	ForResource(schema.GroupResource) (GenericInformer, error)
+
+	// when you update these, update generic.go/ForResource, same package
+
+	Pods() PodInformer
+	LimitRanges() LimitRangeInformer
+	InternalLimitRanges() InternalLimitRangeInformer
+	Namespaces() NamespaceInformer
+	InternalNamespaces() InternalNamespaceInformer
+	Nodes() NodeInformer
+	PersistentVolumeClaims() PVCInformer
+	PersistentVolumes() PVInformer
+	ServiceAccounts() ServiceAccountInformer
+
+	DaemonSets() DaemonSetInformer
+	Deployments() DeploymentInformer
+	ReplicaSets() ReplicaSetInformer
+	ReplicationControllers() ReplicationControllerInformer
+
+	ClusterRoleBindings() ClusterRoleBindingInformer
+	ClusterRoles() ClusterRoleInformer
+	RoleBindings() RoleBindingInformer
+	Roles() RoleInformer
+
+	StorageClasses() StorageClassInformer
+
+	Jobs() JobInformer
+}
+
+type sharedInformerFactory struct {
+	client clientset.Interface
+	// for admission plugins etc.
+	internalclient internalclientset.Interface
+	lock           sync.Mutex
+	defaultResync  time.Duration
+
+	informers map[reflect.Type]cache.SharedIndexInformer
+	// startedInformers is used for tracking which informers have been started
+	// this allows calling of Start method multiple times
+	startedInformers map[reflect.Type]bool
+}
+
+// NewSharedInformerFactory constructs a new instance of sharedInformerFactory
+func NewSharedInformerFactory(client clientset.Interface, internalclient internalclientset.Interface, defaultResync time.Duration) SharedInformerFactory {
+	return &sharedInformerFactory{
+		client:           client,
+		internalclient:   internalclient,
+		defaultResync:    defaultResync,
+		informers:        make(map[reflect.Type]cache.SharedIndexInformer),
+		startedInformers: make(map[reflect.Type]bool),
+	}
+}
+
+// Start initializes all requested informers.
+func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	glog.V(1).Infoln("Starting informer factory")
+
+	for informerType, informer := range f.informers {
+		if !f.startedInformers[informerType] {
+			glog.V(2).Infof("Starting informer for %v", informerType)
+			go informer.Run(stopCh)
+			f.startedInformers[informerType] = true
+		}
+	}
+}
+
+// Pods returns a SharedIndexInformer that lists and watches all pods
+func (f *sharedInformerFactory) Pods() PodInformer {
+	return &podInformer{sharedInformerFactory: f}
+}
+
+// Nodes returns a SharedIndexInformer that lists and watches all nodes
+func (f *sharedInformerFactory) Nodes() NodeInformer {
+	return &nodeInformer{sharedInformerFactory: f}
+}
+
+// Namespaces returns a SharedIndexInformer that lists and watches all namespaces
+func (f *sharedInformerFactory) Namespaces() NamespaceInformer {
+	return &namespaceInformer{sharedInformerFactory: f}
+}
+
+// InternalNamespaces returns a SharedIndexInformer that lists and watches all namespaces
+func (f *sharedInformerFactory) InternalNamespaces() InternalNamespaceInformer {
+	return &internalNamespaceInformer{sharedInformerFactory: f}
+}
+
+// PersistentVolumeClaims returns a SharedIndexInformer that lists and watches all persistent volume claims
+func (f *sharedInformerFactory) PersistentVolumeClaims() PVCInformer {
+	return &pvcInformer{sharedInformerFactory: f}
+}
+
+// PersistentVolumes returns a SharedIndexInformer that lists and watches all persistent volumes
+func (f *sharedInformerFactory) PersistentVolumes() PVInformer {
+	return &pvInformer{sharedInformerFactory: f}
+}
+
+// ServiceAccounts returns a SharedIndexInformer that lists and watches all service accounts.
+func (f *sharedInformerFactory) ServiceAccounts() ServiceAccountInformer {
+	return &serviceAccountInformer{sharedInformerFactory: f}
+}
+
+// DaemonSets returns a SharedIndexInformer that lists and watches all daemon sets.
+func (f *sharedInformerFactory) DaemonSets() DaemonSetInformer {
+	return &daemonSetInformer{sharedInformerFactory: f}
+}
+
+func (f *sharedInformerFactory) Deployments() DeploymentInformer {
+	return &deploymentInformer{sharedInformerFactory: f}
+}
+
+func (f *sharedInformerFactory) ReplicaSets() ReplicaSetInformer {
+	return &replicaSetInformer{sharedInformerFactory: f}
+}
+
+func (f *sharedInformerFactory) ReplicationControllers() ReplicationControllerInformer {
+	return &replicationControllerInformer{sharedInformerFactory: f}
+}
+
+func (f *sharedInformerFactory) ClusterRoles() ClusterRoleInformer {
+	return &clusterRoleInformer{sharedInformerFactory: f}
+}
+
+func (f *sharedInformerFactory) ClusterRoleBindings() ClusterRoleBindingInformer {
+	return &clusterRoleBindingInformer{sharedInformerFactory: f}
+}
+
+func (f *sharedInformerFactory) Roles() RoleInformer {
+	return &roleInformer{sharedInformerFactory: f}
+}
+
+func (f *sharedInformerFactory) RoleBindings() RoleBindingInformer {
+	return &roleBindingInformer{sharedInformerFactory: f}
+}
+
+// LimitRanges returns a SharedIndexInformer that lists and watches all limit ranges.
+func (f *sharedInformerFactory) LimitRanges() LimitRangeInformer {
+	return &limitRangeInformer{sharedInformerFactory: f}
+}
+
+// InternalLimitRanges returns a SharedIndexInformer that lists and watches all limit ranges.
+func (f *sharedInformerFactory) InternalLimitRanges() InternalLimitRangeInformer {
+	return &internalLimitRangeInformer{sharedInformerFactory: f}
+}
+
+// StorageClasses returns a SharedIndexInformer that lists and watches all storage classes
+func (f *sharedInformerFactory) StorageClasses() StorageClassInformer {
+	return &storageClassInformer{sharedInformerFactory: f}
+}
+
+// Jobs returns a SharedIndexInformer that lists and watches all storage jobs
+func (f *sharedInformerFactory) Jobs() JobInformer {
+	return &jobInformer{sharedInformerFactory: f}
+}

vendor/k8s.io/kubernetes/pkg/controller/informers/generic.go

@@ -0,0 +1,90 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package informers
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/apis/batch"
+	extensionsinternal "k8s.io/kubernetes/pkg/apis/extensions"
+	rbacinternal "k8s.io/kubernetes/pkg/apis/rbac"
+	"k8s.io/kubernetes/pkg/client/cache"
+)
+
+// GenericInformer is type of SharedIndexInformer which will locate and delegate to other
+// sharedInformers based on type
+type GenericInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.GenericLister
+}
+
+// ForResource gives generic access to a shared informer of the matching type
+// TODO extend this to unknown resources with a client pool
+func (f *sharedInformerFactory) ForResource(resource schema.GroupResource) (GenericInformer, error) {
+	switch resource {
+	case api.Resource("pods"):
+		return &genericInformer{resource: resource, informer: f.Pods().Informer()}, nil
+	case api.Resource("limitranges"):
+		return &genericInformer{resource: resource, informer: f.LimitRanges().Informer()}, nil
+	case api.Resource("namespaces"):
+		return &genericInformer{resource: resource, informer: f.Namespaces().Informer()}, nil
+	case api.Resource("nodes"):
+		return &genericInformer{resource: resource, informer: f.Nodes().Informer()}, nil
+	case api.Resource("persistentvolumeclaims"):
+		return &genericInformer{resource: resource, informer: f.PersistentVolumeClaims().Informer()}, nil
+	case api.Resource("persistentvolumes"):
+		return &genericInformer{resource: resource, informer: f.PersistentVolumes().Informer()}, nil
+	case api.Resource("serviceaccounts"):
+		return &genericInformer{resource: resource, informer: f.ServiceAccounts().Informer()}, nil
+
+	case extensionsinternal.Resource("daemonsets"):
+		return &genericInformer{resource: resource, informer: f.DaemonSets().Informer()}, nil
+	case extensionsinternal.Resource("deployments"):
+		return &genericInformer{resource: resource, informer: f.Deployments().Informer()}, nil
+	case extensionsinternal.Resource("replicasets"):
+		return &genericInformer{resource: resource, informer: f.ReplicaSets().Informer()}, nil
+
+	case rbacinternal.Resource("clusterrolebindings"):
+		return &genericInformer{resource: resource, informer: f.ClusterRoleBindings().Informer()}, nil
+	case rbacinternal.Resource("clusterroles"):
+		return &genericInformer{resource: resource, informer: f.ClusterRoles().Informer()}, nil
+	case rbacinternal.Resource("rolebindings"):
+		return &genericInformer{resource: resource, informer: f.RoleBindings().Informer()}, nil
+	case rbacinternal.Resource("roles"):
+		return &genericInformer{resource: resource, informer: f.Roles().Informer()}, nil
+
+	case batch.Resource("jobs"):
+		return &genericInformer{resource: resource, informer: f.Jobs().Informer()}, nil
+	}
+
+	return nil, fmt.Errorf("no informer found for %v", resource)
+}
+
+type genericInformer struct {
+	informer cache.SharedIndexInformer
+	resource schema.GroupResource
+}
+
+func (f *genericInformer) Informer() cache.SharedIndexInformer {
+	return f.informer
+}
+
+func (f *genericInformer) Lister() cache.GenericLister {
+	return cache.NewGenericLister(f.Informer().GetIndexer(), f.resource)
+}

vendor/k8s.io/kubernetes/pkg/controller/informers/rbac.go

@@ -0,0 +1,196 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package informers
+
+import (
+	"reflect"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/apis/rbac"
+	"k8s.io/kubernetes/pkg/client/cache"
+)
+
+type ClusterRoleInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.ClusterRoleLister
+}
+
+type clusterRoleInformer struct {
+	*sharedInformerFactory
+}
+
+func (f *clusterRoleInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&rbac.ClusterRole{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return f.internalclient.Rbac().ClusterRoles().List(convertListOptionsOrDie(options))
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return f.internalclient.Rbac().ClusterRoles().Watch(convertListOptionsOrDie(options))
+			},
+		},
+		&rbac.ClusterRole{},
+		f.defaultResync,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+func (f *clusterRoleInformer) Lister() cache.ClusterRoleLister {
+	return cache.NewClusterRoleLister(f.Informer().GetIndexer())
+}
+
+type ClusterRoleBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.ClusterRoleBindingLister
+}
+
+type clusterRoleBindingInformer struct {
+	*sharedInformerFactory
+}
+
+func (f *clusterRoleBindingInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&rbac.ClusterRoleBinding{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return f.internalclient.Rbac().ClusterRoleBindings().List(convertListOptionsOrDie(options))
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return f.internalclient.Rbac().ClusterRoleBindings().Watch(convertListOptionsOrDie(options))
+			},
+		},
+		&rbac.ClusterRoleBinding{},
+		f.defaultResync,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+func (f *clusterRoleBindingInformer) Lister() cache.ClusterRoleBindingLister {
+	return cache.NewClusterRoleBindingLister(f.Informer().GetIndexer())
+}
+
+type RoleInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.RoleLister
+}
+
+type roleInformer struct {
+	*sharedInformerFactory
+}
+
+func (f *roleInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&rbac.Role{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return f.internalclient.Rbac().Roles(v1.NamespaceAll).List(convertListOptionsOrDie(options))
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return f.internalclient.Rbac().Roles(v1.NamespaceAll).Watch(convertListOptionsOrDie(options))
+			},
+		},
+		&rbac.Role{},
+		f.defaultResync,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+func (f *roleInformer) Lister() cache.RoleLister {
+	return cache.NewRoleLister(f.Informer().GetIndexer())
+}
+
+type RoleBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.RoleBindingLister
+}
+
+type roleBindingInformer struct {
+	*sharedInformerFactory
+}
+
+func (f *roleBindingInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&rbac.RoleBinding{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return f.internalclient.Rbac().RoleBindings(v1.NamespaceAll).List(convertListOptionsOrDie(options))
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return f.internalclient.Rbac().RoleBindings(v1.NamespaceAll).Watch(convertListOptionsOrDie(options))
+			},
+		},
+		&rbac.RoleBinding{},
+		f.defaultResync,
+		cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
+	)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+func (f *roleBindingInformer) Lister() cache.RoleBindingLister {
+	return cache.NewRoleBindingLister(f.Informer().GetIndexer())
+}
+
+func convertListOptionsOrDie(in v1.ListOptions) api.ListOptions {
+	out := api.ListOptions{}
+	if err := api.Scheme.Convert(&in, &out, nil); err != nil {
+		panic(err)
+	}
+	return out
+}

vendor/k8s.io/kubernetes/pkg/controller/informers/storage.go

@@ -0,0 +1,70 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package informers
+
+import (
+	"reflect"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api/v1"
+	storage "k8s.io/kubernetes/pkg/apis/storage/v1beta1"
+	"k8s.io/kubernetes/pkg/client/cache"
+)
+
+// StorageClassInformer is type of SharedIndexInformer which watches and lists all storage classes.
+// Interface provides constructor for informer and lister for storage classes
+type StorageClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.StorageClassLister
+}
+
+type storageClassInformer struct {
+	*sharedInformerFactory
+}
+
+func (f *storageClassInformer) Informer() cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(&storage.StorageClass{})
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+	informer = cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return f.client.Storage().StorageClasses().List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return f.client.Storage().StorageClasses().Watch(options)
+			},
+		},
+		&storage.StorageClass{},
+		f.defaultResync,
+		cache.Indexers{},
+	)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+func (f *storageClassInformer) Lister() cache.StorageClassLister {
+	informer := f.Informer()
+	return cache.NewStorageClassLister(informer.GetIndexer())
+}

vendor/k8s.io/kubernetes/pkg/controller/job/BUILD

@@ -0,0 +1,76 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "jobcontroller.go",
+        "utils.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/batch/v1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/core/v1:go_default_library",
+        "//pkg/client/listers/batch/v1:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/util/metrics:go_default_library",
+        "//pkg/util/workqueue:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/api/errors",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/util/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "jobcontroller_test.go",
+        "utils_test.go",
+    ],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/batch/v1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/fake:go_default_library",
+        "//pkg/client/restclient:go_default_library",
+        "//pkg/client/testing/core:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/util/rand",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+        "//vendor:k8s.io/apimachinery/pkg/watch",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/job/OWNERS

@@ -0,0 +1,3 @@
+reviewers:
+- erictune
+- soltysh

vendor/k8s.io/kubernetes/pkg/controller/job/doc.go

@@ -0,0 +1,18 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package job contains logic for watching and synchronizing jobs.
+package job // import "k8s.io/kubernetes/pkg/controller/job"

vendor/k8s.io/kubernetes/pkg/controller/job/jobcontroller.go

@@ -0,0 +1,547 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package job
+
+import (
+	"fmt"
+	"reflect"
+	"sort"
+	"sync"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/kubernetes/pkg/api/v1"
+	batch "k8s.io/kubernetes/pkg/apis/batch/v1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	v1core "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/core/v1"
+	batchv1listers "k8s.io/kubernetes/pkg/client/listers/batch/v1"
+	"k8s.io/kubernetes/pkg/client/record"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/util/metrics"
+	"k8s.io/kubernetes/pkg/util/workqueue"
+
+	"github.com/golang/glog"
+)
+
+type JobController struct {
+	kubeClient clientset.Interface
+	podControl controller.PodControlInterface
+
+	// To allow injection of updateJobStatus for testing.
+	updateHandler func(job *batch.Job) error
+	syncHandler   func(jobKey string) error
+	// podStoreSynced returns true if the pod store has been synced at least once.
+	// Added as a member to the struct to allow injection for testing.
+	podStoreSynced cache.InformerSynced
+	// jobStoreSynced returns true if the job store has been synced at least once.
+	// Added as a member to the struct to allow injection for testing.
+	jobStoreSynced cache.InformerSynced
+
+	// A TTLCache of pod creates/deletes each rc expects to see
+	expectations controller.ControllerExpectationsInterface
+
+	// A store of jobs
+	jobLister batchv1listers.JobLister
+
+	// A store of pods, populated by the podController
+	podStore cache.StoreToPodLister
+
+	// Jobs that need to be updated
+	queue workqueue.RateLimitingInterface
+
+	recorder record.EventRecorder
+}
+
+func NewJobController(podInformer cache.SharedIndexInformer, jobInformer informers.JobInformer, kubeClient clientset.Interface) *JobController {
+	eventBroadcaster := record.NewBroadcaster()
+	eventBroadcaster.StartLogging(glog.Infof)
+	// TODO: remove the wrapper when every clients have moved to use the clientset.
+	eventBroadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: kubeClient.Core().Events("")})
+
+	if kubeClient != nil && kubeClient.Core().RESTClient().GetRateLimiter() != nil {
+		metrics.RegisterMetricAndTrackRateLimiterUsage("job_controller", kubeClient.Core().RESTClient().GetRateLimiter())
+	}
+
+	jm := &JobController{
+		kubeClient: kubeClient,
+		podControl: controller.RealPodControl{
+			KubeClient: kubeClient,
+			Recorder:   eventBroadcaster.NewRecorder(v1.EventSource{Component: "job-controller"}),
+		},
+		expectations: controller.NewControllerExpectations(),
+		queue:        workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "job"),
+		recorder:     eventBroadcaster.NewRecorder(v1.EventSource{Component: "job-controller"}),
+	}
+
+	jobInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc: jm.enqueueController,
+		UpdateFunc: func(old, cur interface{}) {
+			if job := cur.(*batch.Job); !IsJobFinished(job) {
+				jm.enqueueController(job)
+			}
+		},
+		DeleteFunc: jm.enqueueController,
+	})
+	jm.jobLister = jobInformer.Lister()
+	jm.jobStoreSynced = jobInformer.Informer().HasSynced
+
+	podInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    jm.addPod,
+		UpdateFunc: jm.updatePod,
+		DeleteFunc: jm.deletePod,
+	})
+	jm.podStore.Indexer = podInformer.GetIndexer()
+	jm.podStoreSynced = podInformer.HasSynced
+
+	jm.updateHandler = jm.updateJobStatus
+	jm.syncHandler = jm.syncJob
+	return jm
+}
+
+// Run the main goroutine responsible for watching and syncing jobs.
+func (jm *JobController) Run(workers int, stopCh <-chan struct{}) {
+	defer utilruntime.HandleCrash()
+	defer jm.queue.ShutDown()
+
+	if !cache.WaitForCacheSync(stopCh, jm.podStoreSynced, jm.jobStoreSynced) {
+		return
+	}
+
+	for i := 0; i < workers; i++ {
+		go wait.Until(jm.worker, time.Second, stopCh)
+	}
+
+	<-stopCh
+	glog.Infof("Shutting down Job Manager")
+}
+
+// getPodJob returns the job managing the given pod.
+func (jm *JobController) getPodJob(pod *v1.Pod) *batch.Job {
+	jobs, err := jm.jobLister.GetPodJobs(pod)
+	if err != nil {
+		glog.V(4).Infof("No jobs found for pod %v, job controller will avoid syncing", pod.Name)
+		return nil
+	}
+	if len(jobs) > 1 {
+		utilruntime.HandleError(fmt.Errorf("user error! more than one job is selecting pods with labels: %+v", pod.Labels))
+		sort.Sort(byCreationTimestamp(jobs))
+	}
+	return &jobs[0]
+}
+
+// When a pod is created, enqueue the controller that manages it and update it's expectations.
+func (jm *JobController) addPod(obj interface{}) {
+	pod := obj.(*v1.Pod)
+	if pod.DeletionTimestamp != nil {
+		// on a restart of the controller controller, it's possible a new pod shows up in a state that
+		// is already pending deletion. Prevent the pod from being a creation observation.
+		jm.deletePod(pod)
+		return
+	}
+	if job := jm.getPodJob(pod); job != nil {
+		jobKey, err := controller.KeyFunc(job)
+		if err != nil {
+			utilruntime.HandleError(fmt.Errorf("Couldn't get key for job %#v: %v", job, err))
+			return
+		}
+		jm.expectations.CreationObserved(jobKey)
+		jm.enqueueController(job)
+	}
+}
+
+// When a pod is updated, figure out what job/s manage it and wake them up.
+// If the labels of the pod have changed we need to awaken both the old
+// and new job. old and cur must be *v1.Pod types.
+func (jm *JobController) updatePod(old, cur interface{}) {
+	curPod := cur.(*v1.Pod)
+	oldPod := old.(*v1.Pod)
+	if curPod.ResourceVersion == oldPod.ResourceVersion {
+		// Periodic resync will send update events for all known pods.
+		// Two different versions of the same pod will always have different RVs.
+		return
+	}
+	if curPod.DeletionTimestamp != nil {
+		// when a pod is deleted gracefully it's deletion timestamp is first modified to reflect a grace period,
+		// and after such time has passed, the kubelet actually deletes it from the store. We receive an update
+		// for modification of the deletion timestamp and expect an job to create more pods asap, not wait
+		// until the kubelet actually deletes the pod.
+		jm.deletePod(curPod)
+		return
+	}
+	if job := jm.getPodJob(curPod); job != nil {
+		jm.enqueueController(job)
+	}
+	// Only need to get the old job if the labels changed.
+	if !reflect.DeepEqual(curPod.Labels, oldPod.Labels) {
+		// If the old and new job are the same, the first one that syncs
+		// will set expectations preventing any damage from the second.
+		if oldJob := jm.getPodJob(oldPod); oldJob != nil {
+			jm.enqueueController(oldJob)
+		}
+	}
+}
+
+// When a pod is deleted, enqueue the job that manages the pod and update its expectations.
+// obj could be an *v1.Pod, or a DeletionFinalStateUnknown marker item.
+func (jm *JobController) deletePod(obj interface{}) {
+	pod, ok := obj.(*v1.Pod)
+
+	// When a delete is dropped, the relist will notice a pod in the store not
+	// in the list, leading to the insertion of a tombstone object which contains
+	// the deleted key/value. Note that this value might be stale. If the pod
+	// changed labels the new job will not be woken up till the periodic resync.
+	if !ok {
+		tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+		if !ok {
+			utilruntime.HandleError(fmt.Errorf("Couldn't get object from tombstone %+v", obj))
+			return
+		}
+		pod, ok = tombstone.Obj.(*v1.Pod)
+		if !ok {
+			utilruntime.HandleError(fmt.Errorf("Tombstone contained object that is not a pod %+v", obj))
+			return
+		}
+	}
+	if job := jm.getPodJob(pod); job != nil {
+		jobKey, err := controller.KeyFunc(job)
+		if err != nil {
+			utilruntime.HandleError(fmt.Errorf("Couldn't get key for job %#v: %v", job, err))
+			return
+		}
+		jm.expectations.DeletionObserved(jobKey)
+		jm.enqueueController(job)
+	}
+}
+
+// obj could be an *batch.Job, or a DeletionFinalStateUnknown marker item.
+func (jm *JobController) enqueueController(obj interface{}) {
+	key, err := controller.KeyFunc(obj)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("Couldn't get key for object %+v: %v", obj, err))
+		return
+	}
+
+	// TODO: Handle overlapping controllers better. Either disallow them at admission time or
+	// deterministically avoid syncing controllers that fight over pods. Currently, we only
+	// ensure that the same controller is synced for a given pod. When we periodically relist
+	// all controllers there will still be some replica instability. One way to handle this is
+	// by querying the store for all controllers that this rc overlaps, as well as all
+	// controllers that overlap this rc, and sorting them.
+	jm.queue.Add(key)
+}
+
+// worker runs a worker thread that just dequeues items, processes them, and marks them done.
+// It enforces that the syncHandler is never invoked concurrently with the same key.
+func (jm *JobController) worker() {
+	for jm.processNextWorkItem() {
+	}
+}
+
+func (jm *JobController) processNextWorkItem() bool {
+	key, quit := jm.queue.Get()
+	if quit {
+		return false
+	}
+	defer jm.queue.Done(key)
+
+	err := jm.syncHandler(key.(string))
+	if err == nil {
+		jm.queue.Forget(key)
+		return true
+	}
+
+	utilruntime.HandleError(fmt.Errorf("Error syncing job: %v", err))
+	jm.queue.AddRateLimited(key)
+
+	return true
+}
+
+// syncJob will sync the job with the given key if it has had its expectations fulfilled, meaning
+// it did not expect to see any more of its pods created or deleted. This function is not meant to be invoked
+// concurrently with the same key.
+func (jm *JobController) syncJob(key string) error {
+	startTime := time.Now()
+	defer func() {
+		glog.V(4).Infof("Finished syncing job %q (%v)", key, time.Now().Sub(startTime))
+	}()
+
+	ns, name, err := cache.SplitMetaNamespaceKey(key)
+	if err != nil {
+		return err
+	}
+	if len(ns) == 0 || len(name) == 0 {
+		return fmt.Errorf("invalid job key %q: either namespace or name is missing", key)
+	}
+	sharedJob, err := jm.jobLister.Jobs(ns).Get(name)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			glog.V(4).Infof("Job has been deleted: %v", key)
+			jm.expectations.DeleteExpectations(key)
+			return nil
+		}
+		return err
+	}
+	job := *sharedJob
+
+	// Check the expectations of the job before counting active pods, otherwise a new pod can sneak in
+	// and update the expectations after we've retrieved active pods from the store. If a new pod enters
+	// the store after we've checked the expectation, the job sync is just deferred till the next relist.
+	jobNeedsSync := jm.expectations.SatisfiedExpectations(key)
+	selector, _ := metav1.LabelSelectorAsSelector(job.Spec.Selector)
+	pods, err := jm.podStore.Pods(job.Namespace).List(selector)
+	if err != nil {
+		return err
+	}
+
+	activePods := controller.FilterActivePods(pods)
+	active := int32(len(activePods))
+	succeeded, failed := getStatus(pods)
+	conditions := len(job.Status.Conditions)
+	if job.Status.StartTime == nil {
+		now := metav1.Now()
+		job.Status.StartTime = &now
+	}
+	// if job was finished previously, we don't want to redo the termination
+	if IsJobFinished(&job) {
+		return nil
+	}
+	if pastActiveDeadline(&job) {
+		// TODO: below code should be replaced with pod termination resulting in
+		// pod failures, rather than killing pods. Unfortunately none such solution
+		// exists ATM. There's an open discussion in the topic in
+		// https://github.com/kubernetes/kubernetes/issues/14602 which might give
+		// some sort of solution to above problem.
+		// kill remaining active pods
+		wait := sync.WaitGroup{}
+		wait.Add(int(active))
+		for i := int32(0); i < active; i++ {
+			go func(ix int32) {
+				defer wait.Done()
+				if err := jm.podControl.DeletePod(job.Namespace, activePods[ix].Name, &job); err != nil {
+					defer utilruntime.HandleError(err)
+				}
+			}(i)
+		}
+		wait.Wait()
+		// update status values accordingly
+		failed += active
+		active = 0
+		job.Status.Conditions = append(job.Status.Conditions, newCondition(batch.JobFailed, "DeadlineExceeded", "Job was active longer than specified deadline"))
+		jm.recorder.Event(&job, v1.EventTypeNormal, "DeadlineExceeded", "Job was active longer than specified deadline")
+	} else {
+		if jobNeedsSync && job.DeletionTimestamp == nil {
+			active = jm.manageJob(activePods, succeeded, &job)
+		}
+		completions := succeeded
+		complete := false
+		if job.Spec.Completions == nil {
+			// This type of job is complete when any pod exits with success.
+			// Each pod is capable of
+			// determining whether or not the entire Job is done.  Subsequent pods are
+			// not expected to fail, but if they do, the failure is ignored.  Once any
+			// pod succeeds, the controller waits for remaining pods to finish, and
+			// then the job is complete.
+			if succeeded > 0 && active == 0 {
+				complete = true
+			}
+		} else {
+			// Job specifies a number of completions.  This type of job signals
+			// success by having that number of successes.  Since we do not
+			// start more pods than there are remaining completions, there should
+			// not be any remaining active pods once this count is reached.
+			if completions >= *job.Spec.Completions {
+				complete = true
+				if active > 0 {
+					jm.recorder.Event(&job, v1.EventTypeWarning, "TooManyActivePods", "Too many active pods running after completion count reached")
+				}
+				if completions > *job.Spec.Completions {
+					jm.recorder.Event(&job, v1.EventTypeWarning, "TooManySucceededPods", "Too many succeeded pods running after completion count reached")
+				}
+			}
+		}
+		if complete {
+			job.Status.Conditions = append(job.Status.Conditions, newCondition(batch.JobComplete, "", ""))
+			now := metav1.Now()
+			job.Status.CompletionTime = &now
+		}
+	}
+
+	// no need to update the job if the status hasn't changed since last time
+	if job.Status.Active != active || job.Status.Succeeded != succeeded || job.Status.Failed != failed || len(job.Status.Conditions) != conditions {
+		job.Status.Active = active
+		job.Status.Succeeded = succeeded
+		job.Status.Failed = failed
+
+		if err := jm.updateHandler(&job); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// pastActiveDeadline checks if job has ActiveDeadlineSeconds field set and if it is exceeded.
+func pastActiveDeadline(job *batch.Job) bool {
+	if job.Spec.ActiveDeadlineSeconds == nil || job.Status.StartTime == nil {
+		return false
+	}
+	now := metav1.Now()
+	start := job.Status.StartTime.Time
+	duration := now.Time.Sub(start)
+	allowedDuration := time.Duration(*job.Spec.ActiveDeadlineSeconds) * time.Second
+	return duration >= allowedDuration
+}
+
+func newCondition(conditionType batch.JobConditionType, reason, message string) batch.JobCondition {
+	return batch.JobCondition{
+		Type:               conditionType,
+		Status:             v1.ConditionTrue,
+		LastProbeTime:      metav1.Now(),
+		LastTransitionTime: metav1.Now(),
+		Reason:             reason,
+		Message:            message,
+	}
+}
+
+// getStatus returns no of succeeded and failed pods running a job
+func getStatus(pods []*v1.Pod) (succeeded, failed int32) {
+	succeeded = int32(filterPods(pods, v1.PodSucceeded))
+	failed = int32(filterPods(pods, v1.PodFailed))
+	return
+}
+
+// manageJob is the core method responsible for managing the number of running
+// pods according to what is specified in the job.Spec.
+// Does NOT modify <activePods>.
+func (jm *JobController) manageJob(activePods []*v1.Pod, succeeded int32, job *batch.Job) int32 {
+	var activeLock sync.Mutex
+	active := int32(len(activePods))
+	parallelism := *job.Spec.Parallelism
+	jobKey, err := controller.KeyFunc(job)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("Couldn't get key for job %#v: %v", job, err))
+		return 0
+	}
+
+	if active > parallelism {
+		diff := active - parallelism
+		jm.expectations.ExpectDeletions(jobKey, int(diff))
+		glog.V(4).Infof("Too many pods running job %q, need %d, deleting %d", jobKey, parallelism, diff)
+		// Sort the pods in the order such that not-ready < ready, unscheduled
+		// < scheduled, and pending < running. This ensures that we delete pods
+		// in the earlier stages whenever possible.
+		sort.Sort(controller.ActivePods(activePods))
+
+		active -= diff
+		wait := sync.WaitGroup{}
+		wait.Add(int(diff))
+		for i := int32(0); i < diff; i++ {
+			go func(ix int32) {
+				defer wait.Done()
+				if err := jm.podControl.DeletePod(job.Namespace, activePods[ix].Name, job); err != nil {
+					defer utilruntime.HandleError(err)
+					// Decrement the expected number of deletes because the informer won't observe this deletion
+					jm.expectations.DeletionObserved(jobKey)
+					activeLock.Lock()
+					active++
+					activeLock.Unlock()
+				}
+			}(i)
+		}
+		wait.Wait()
+
+	} else if active < parallelism {
+		wantActive := int32(0)
+		if job.Spec.Completions == nil {
+			// Job does not specify a number of completions.  Therefore, number active
+			// should be equal to parallelism, unless the job has seen at least
+			// once success, in which leave whatever is running, running.
+			if succeeded > 0 {
+				wantActive = active
+			} else {
+				wantActive = parallelism
+			}
+		} else {
+			// Job specifies a specific number of completions.  Therefore, number
+			// active should not ever exceed number of remaining completions.
+			wantActive = *job.Spec.Completions - succeeded
+			if wantActive > parallelism {
+				wantActive = parallelism
+			}
+		}
+		diff := wantActive - active
+		if diff < 0 {
+			utilruntime.HandleError(fmt.Errorf("More active than wanted: job %q, want %d, have %d", jobKey, wantActive, active))
+			diff = 0
+		}
+		jm.expectations.ExpectCreations(jobKey, int(diff))
+		glog.V(4).Infof("Too few pods running job %q, need %d, creating %d", jobKey, wantActive, diff)
+
+		active += diff
+		wait := sync.WaitGroup{}
+		wait.Add(int(diff))
+		for i := int32(0); i < diff; i++ {
+			go func() {
+				defer wait.Done()
+				if err := jm.podControl.CreatePods(job.Namespace, &job.Spec.Template, job); err != nil {
+					defer utilruntime.HandleError(err)
+					// Decrement the expected number of creates because the informer won't observe this pod
+					jm.expectations.CreationObserved(jobKey)
+					activeLock.Lock()
+					active--
+					activeLock.Unlock()
+				}
+			}()
+		}
+		wait.Wait()
+	}
+
+	return active
+}
+
+func (jm *JobController) updateJobStatus(job *batch.Job) error {
+	_, err := jm.kubeClient.Batch().Jobs(job.Namespace).UpdateStatus(job)
+	return err
+}
+
+// filterPods returns pods based on their phase.
+func filterPods(pods []*v1.Pod, phase v1.PodPhase) int {
+	result := 0
+	for i := range pods {
+		if phase == pods[i].Status.Phase {
+			result++
+		}
+	}
+	return result
+}
+
+// byCreationTimestamp sorts a list by creation timestamp, using their names as a tie breaker.
+type byCreationTimestamp []batch.Job
+
+func (o byCreationTimestamp) Len() int      { return len(o) }
+func (o byCreationTimestamp) Swap(i, j int) { o[i], o[j] = o[j], o[i] }
+
+func (o byCreationTimestamp) Less(i, j int) bool {
+	if o[i].CreationTimestamp.Equal(o[j].CreationTimestamp) {
+		return o[i].Name < o[j].Name
+	}
+	return o[i].CreationTimestamp.Before(o[j].CreationTimestamp)
+}

vendor/k8s.io/kubernetes/pkg/controller/job/jobcontroller_test.go

@@ -0,0 +1,724 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package job
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/rand"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	batch "k8s.io/kubernetes/pkg/apis/batch/v1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/fake"
+	"k8s.io/kubernetes/pkg/client/restclient"
+	"k8s.io/kubernetes/pkg/client/testing/core"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/controller/informers"
+)
+
+var alwaysReady = func() bool { return true }
+
+func newJob(parallelism, completions int32) *batch.Job {
+	j := &batch.Job{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "foobar",
+			Namespace: v1.NamespaceDefault,
+		},
+		Spec: batch.JobSpec{
+			Selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{"foo": "bar"},
+			},
+			Template: v1.PodTemplateSpec{
+				ObjectMeta: v1.ObjectMeta{
+					Labels: map[string]string{
+						"foo": "bar",
+					},
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{Image: "foo/bar"},
+					},
+				},
+			},
+		},
+	}
+	// Special case: -1 for either completions or parallelism means leave nil (negative is not allowed
+	// in practice by validation.
+	if completions >= 0 {
+		j.Spec.Completions = &completions
+	} else {
+		j.Spec.Completions = nil
+	}
+	if parallelism >= 0 {
+		j.Spec.Parallelism = &parallelism
+	} else {
+		j.Spec.Parallelism = nil
+	}
+	return j
+}
+
+func getKey(job *batch.Job, t *testing.T) string {
+	if key, err := controller.KeyFunc(job); err != nil {
+		t.Errorf("Unexpected error getting key for job %v: %v", job.Name, err)
+		return ""
+	} else {
+		return key
+	}
+}
+
+func newJobControllerFromClient(kubeClient clientset.Interface, resyncPeriod controller.ResyncPeriodFunc) (*JobController, informers.SharedInformerFactory) {
+	sharedInformers := informers.NewSharedInformerFactory(kubeClient, nil, resyncPeriod())
+	jm := NewJobController(sharedInformers.Pods().Informer(), sharedInformers.Jobs(), kubeClient)
+
+	return jm, sharedInformers
+}
+
+// create count pods with the given phase for the given job
+func newPodList(count int32, status v1.PodPhase, job *batch.Job) []v1.Pod {
+	pods := []v1.Pod{}
+	for i := int32(0); i < count; i++ {
+		newPod := v1.Pod{
+			ObjectMeta: v1.ObjectMeta{
+				Name:      fmt.Sprintf("pod-%v", rand.String(10)),
+				Labels:    job.Spec.Selector.MatchLabels,
+				Namespace: job.Namespace,
+			},
+			Status: v1.PodStatus{Phase: status},
+		}
+		pods = append(pods, newPod)
+	}
+	return pods
+}
+
+func TestControllerSyncJob(t *testing.T) {
+	testCases := map[string]struct {
+		// job setup
+		parallelism int32
+		completions int32
+		deleting    bool
+
+		// pod setup
+		podControllerError error
+		pendingPods        int32
+		activePods         int32
+		succeededPods      int32
+		failedPods         int32
+
+		// expectations
+		expectedCreations int32
+		expectedDeletions int32
+		expectedActive    int32
+		expectedSucceeded int32
+		expectedFailed    int32
+		expectedComplete  bool
+	}{
+		"job start": {
+			2, 5, false,
+			nil, 0, 0, 0, 0,
+			2, 0, 2, 0, 0, false,
+		},
+		"WQ job start": {
+			2, -1, false,
+			nil, 0, 0, 0, 0,
+			2, 0, 2, 0, 0, false,
+		},
+		"pending pods": {
+			2, 5, false,
+			nil, 2, 0, 0, 0,
+			0, 0, 2, 0, 0, false,
+		},
+		"correct # of pods": {
+			2, 5, false,
+			nil, 0, 2, 0, 0,
+			0, 0, 2, 0, 0, false,
+		},
+		"WQ job: correct # of pods": {
+			2, -1, false,
+			nil, 0, 2, 0, 0,
+			0, 0, 2, 0, 0, false,
+		},
+		"too few active pods": {
+			2, 5, false,
+			nil, 0, 1, 1, 0,
+			1, 0, 2, 1, 0, false,
+		},
+		"too few active pods with a dynamic job": {
+			2, -1, false,
+			nil, 0, 1, 0, 0,
+			1, 0, 2, 0, 0, false,
+		},
+		"too few active pods, with controller error": {
+			2, 5, false,
+			fmt.Errorf("Fake error"), 0, 1, 1, 0,
+			1, 0, 1, 1, 0, false,
+		},
+		"too many active pods": {
+			2, 5, false,
+			nil, 0, 3, 0, 0,
+			0, 1, 2, 0, 0, false,
+		},
+		"too many active pods, with controller error": {
+			2, 5, false,
+			fmt.Errorf("Fake error"), 0, 3, 0, 0,
+			0, 1, 3, 0, 0, false,
+		},
+		"failed pod": {
+			2, 5, false,
+			nil, 0, 1, 1, 1,
+			1, 0, 2, 1, 1, false,
+		},
+		"job finish": {
+			2, 5, false,
+			nil, 0, 0, 5, 0,
+			0, 0, 0, 5, 0, true,
+		},
+		"WQ job finishing": {
+			2, -1, false,
+			nil, 0, 1, 1, 0,
+			0, 0, 1, 1, 0, false,
+		},
+		"WQ job all finished": {
+			2, -1, false,
+			nil, 0, 0, 2, 0,
+			0, 0, 0, 2, 0, true,
+		},
+		"WQ job all finished despite one failure": {
+			2, -1, false,
+			nil, 0, 0, 1, 1,
+			0, 0, 0, 1, 1, true,
+		},
+		"more active pods than completions": {
+			2, 5, false,
+			nil, 0, 10, 0, 0,
+			0, 8, 2, 0, 0, false,
+		},
+		"status change": {
+			2, 5, false,
+			nil, 0, 2, 2, 0,
+			0, 0, 2, 2, 0, false,
+		},
+		"deleting job": {
+			2, 5, true,
+			nil, 1, 1, 1, 0,
+			0, 0, 2, 1, 0, false,
+		},
+	}
+
+	for name, tc := range testCases {
+		// job manager setup
+		clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: "", ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+		manager, sharedInformerFactory := newJobControllerFromClient(clientset, controller.NoResyncPeriodFunc)
+		fakePodControl := controller.FakePodControl{Err: tc.podControllerError}
+		manager.podControl = &fakePodControl
+		manager.podStoreSynced = alwaysReady
+		manager.jobStoreSynced = alwaysReady
+		var actual *batch.Job
+		manager.updateHandler = func(job *batch.Job) error {
+			actual = job
+			return nil
+		}
+
+		// job & pods setup
+		job := newJob(tc.parallelism, tc.completions)
+		if tc.deleting {
+			now := metav1.Now()
+			job.DeletionTimestamp = &now
+		}
+		sharedInformerFactory.Jobs().Informer().GetIndexer().Add(job)
+		podIndexer := sharedInformerFactory.Pods().Informer().GetIndexer()
+		for _, pod := range newPodList(tc.pendingPods, v1.PodPending, job) {
+			podIndexer.Add(&pod)
+		}
+		for _, pod := range newPodList(tc.activePods, v1.PodRunning, job) {
+			podIndexer.Add(&pod)
+		}
+		for _, pod := range newPodList(tc.succeededPods, v1.PodSucceeded, job) {
+			podIndexer.Add(&pod)
+		}
+		for _, pod := range newPodList(tc.failedPods, v1.PodFailed, job) {
+			podIndexer.Add(&pod)
+		}
+
+		// run
+		err := manager.syncJob(getKey(job, t))
+		if err != nil {
+			t.Errorf("%s: unexpected error when syncing jobs %v", name, err)
+		}
+
+		// validate created/deleted pods
+		if int32(len(fakePodControl.Templates)) != tc.expectedCreations {
+			t.Errorf("%s: unexpected number of creates.  Expected %d, saw %d\n", name, tc.expectedCreations, len(fakePodControl.Templates))
+		}
+		if int32(len(fakePodControl.DeletePodName)) != tc.expectedDeletions {
+			t.Errorf("%s: unexpected number of deletes.  Expected %d, saw %d\n", name, tc.expectedDeletions, len(fakePodControl.DeletePodName))
+		}
+		// validate status
+		if actual.Status.Active != tc.expectedActive {
+			t.Errorf("%s: unexpected number of active pods.  Expected %d, saw %d\n", name, tc.expectedActive, actual.Status.Active)
+		}
+		if actual.Status.Succeeded != tc.expectedSucceeded {
+			t.Errorf("%s: unexpected number of succeeded pods.  Expected %d, saw %d\n", name, tc.expectedSucceeded, actual.Status.Succeeded)
+		}
+		if actual.Status.Failed != tc.expectedFailed {
+			t.Errorf("%s: unexpected number of failed pods.  Expected %d, saw %d\n", name, tc.expectedFailed, actual.Status.Failed)
+		}
+		if actual.Status.StartTime == nil {
+			t.Errorf("%s: .status.startTime was not set", name)
+		}
+		// validate conditions
+		if tc.expectedComplete && !getCondition(actual, batch.JobComplete) {
+			t.Errorf("%s: expected completion condition.  Got %#v", name, actual.Status.Conditions)
+		}
+	}
+}
+
+func TestSyncJobPastDeadline(t *testing.T) {
+	testCases := map[string]struct {
+		// job setup
+		parallelism           int32
+		completions           int32
+		activeDeadlineSeconds int64
+		startTime             int64
+
+		// pod setup
+		activePods    int32
+		succeededPods int32
+		failedPods    int32
+
+		// expectations
+		expectedDeletions int32
+		expectedActive    int32
+		expectedSucceeded int32
+		expectedFailed    int32
+	}{
+		"activeDeadlineSeconds less than single pod execution": {
+			1, 1, 10, 15,
+			1, 0, 0,
+			1, 0, 0, 1,
+		},
+		"activeDeadlineSeconds bigger than single pod execution": {
+			1, 2, 10, 15,
+			1, 1, 0,
+			1, 0, 1, 1,
+		},
+		"activeDeadlineSeconds times-out before any pod starts": {
+			1, 1, 10, 10,
+			0, 0, 0,
+			0, 0, 0, 0,
+		},
+	}
+
+	for name, tc := range testCases {
+		// job manager setup
+		clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: "", ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+		manager, sharedInformerFactory := newJobControllerFromClient(clientset, controller.NoResyncPeriodFunc)
+		fakePodControl := controller.FakePodControl{}
+		manager.podControl = &fakePodControl
+		manager.podStoreSynced = alwaysReady
+		manager.jobStoreSynced = alwaysReady
+		var actual *batch.Job
+		manager.updateHandler = func(job *batch.Job) error {
+			actual = job
+			return nil
+		}
+
+		// job & pods setup
+		job := newJob(tc.parallelism, tc.completions)
+		job.Spec.ActiveDeadlineSeconds = &tc.activeDeadlineSeconds
+		start := metav1.Unix(metav1.Now().Time.Unix()-tc.startTime, 0)
+		job.Status.StartTime = &start
+		sharedInformerFactory.Jobs().Informer().GetIndexer().Add(job)
+		podIndexer := sharedInformerFactory.Pods().Informer().GetIndexer()
+		for _, pod := range newPodList(tc.activePods, v1.PodRunning, job) {
+			podIndexer.Add(&pod)
+		}
+		for _, pod := range newPodList(tc.succeededPods, v1.PodSucceeded, job) {
+			podIndexer.Add(&pod)
+		}
+		for _, pod := range newPodList(tc.failedPods, v1.PodFailed, job) {
+			podIndexer.Add(&pod)
+		}
+
+		// run
+		err := manager.syncJob(getKey(job, t))
+		if err != nil {
+			t.Errorf("%s: unexpected error when syncing jobs %v", name, err)
+		}
+
+		// validate created/deleted pods
+		if int32(len(fakePodControl.Templates)) != 0 {
+			t.Errorf("%s: unexpected number of creates.  Expected 0, saw %d\n", name, len(fakePodControl.Templates))
+		}
+		if int32(len(fakePodControl.DeletePodName)) != tc.expectedDeletions {
+			t.Errorf("%s: unexpected number of deletes.  Expected %d, saw %d\n", name, tc.expectedDeletions, len(fakePodControl.DeletePodName))
+		}
+		// validate status
+		if actual.Status.Active != tc.expectedActive {
+			t.Errorf("%s: unexpected number of active pods.  Expected %d, saw %d\n", name, tc.expectedActive, actual.Status.Active)
+		}
+		if actual.Status.Succeeded != tc.expectedSucceeded {
+			t.Errorf("%s: unexpected number of succeeded pods.  Expected %d, saw %d\n", name, tc.expectedSucceeded, actual.Status.Succeeded)
+		}
+		if actual.Status.Failed != tc.expectedFailed {
+			t.Errorf("%s: unexpected number of failed pods.  Expected %d, saw %d\n", name, tc.expectedFailed, actual.Status.Failed)
+		}
+		if actual.Status.StartTime == nil {
+			t.Errorf("%s: .status.startTime was not set", name)
+		}
+		// validate conditions
+		if !getCondition(actual, batch.JobFailed) {
+			t.Errorf("%s: expected fail condition.  Got %#v", name, actual.Status.Conditions)
+		}
+	}
+}
+
+func getCondition(job *batch.Job, condition batch.JobConditionType) bool {
+	for _, v := range job.Status.Conditions {
+		if v.Type == condition && v.Status == v1.ConditionTrue {
+			return true
+		}
+	}
+	return false
+}
+
+func TestSyncPastDeadlineJobFinished(t *testing.T) {
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: "", ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	manager, sharedInformerFactory := newJobControllerFromClient(clientset, controller.NoResyncPeriodFunc)
+	fakePodControl := controller.FakePodControl{}
+	manager.podControl = &fakePodControl
+	manager.podStoreSynced = alwaysReady
+	manager.jobStoreSynced = alwaysReady
+	var actual *batch.Job
+	manager.updateHandler = func(job *batch.Job) error {
+		actual = job
+		return nil
+	}
+
+	job := newJob(1, 1)
+	activeDeadlineSeconds := int64(10)
+	job.Spec.ActiveDeadlineSeconds = &activeDeadlineSeconds
+	start := metav1.Unix(metav1.Now().Time.Unix()-15, 0)
+	job.Status.StartTime = &start
+	job.Status.Conditions = append(job.Status.Conditions, newCondition(batch.JobFailed, "DeadlineExceeded", "Job was active longer than specified deadline"))
+	sharedInformerFactory.Jobs().Informer().GetIndexer().Add(job)
+	err := manager.syncJob(getKey(job, t))
+	if err != nil {
+		t.Errorf("Unexpected error when syncing jobs %v", err)
+	}
+	if len(fakePodControl.Templates) != 0 {
+		t.Errorf("Unexpected number of creates.  Expected %d, saw %d\n", 0, len(fakePodControl.Templates))
+	}
+	if len(fakePodControl.DeletePodName) != 0 {
+		t.Errorf("Unexpected number of deletes.  Expected %d, saw %d\n", 0, len(fakePodControl.DeletePodName))
+	}
+	if actual != nil {
+		t.Error("Unexpected job modification")
+	}
+}
+
+func TestSyncJobComplete(t *testing.T) {
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: "", ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	manager, sharedInformerFactory := newJobControllerFromClient(clientset, controller.NoResyncPeriodFunc)
+	fakePodControl := controller.FakePodControl{}
+	manager.podControl = &fakePodControl
+	manager.podStoreSynced = alwaysReady
+	manager.jobStoreSynced = alwaysReady
+
+	job := newJob(1, 1)
+	job.Status.Conditions = append(job.Status.Conditions, newCondition(batch.JobComplete, "", ""))
+	sharedInformerFactory.Jobs().Informer().GetIndexer().Add(job)
+	err := manager.syncJob(getKey(job, t))
+	if err != nil {
+		t.Fatalf("Unexpected error when syncing jobs %v", err)
+	}
+	actual, err := manager.jobLister.Jobs(job.Namespace).Get(job.Name)
+	if err != nil {
+		t.Fatalf("Unexpected error when trying to get job from the store: %v", err)
+	}
+	// Verify that after syncing a complete job, the conditions are the same.
+	if got, expected := len(actual.Status.Conditions), 1; got != expected {
+		t.Fatalf("Unexpected job status conditions amount; expected %d, got %d", expected, got)
+	}
+}
+
+func TestSyncJobDeleted(t *testing.T) {
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: "", ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	manager, _ := newJobControllerFromClient(clientset, controller.NoResyncPeriodFunc)
+	fakePodControl := controller.FakePodControl{}
+	manager.podControl = &fakePodControl
+	manager.podStoreSynced = alwaysReady
+	manager.jobStoreSynced = alwaysReady
+	manager.updateHandler = func(job *batch.Job) error { return nil }
+	job := newJob(2, 2)
+	err := manager.syncJob(getKey(job, t))
+	if err != nil {
+		t.Errorf("Unexpected error when syncing jobs %v", err)
+	}
+	if len(fakePodControl.Templates) != 0 {
+		t.Errorf("Unexpected number of creates.  Expected %d, saw %d\n", 0, len(fakePodControl.Templates))
+	}
+	if len(fakePodControl.DeletePodName) != 0 {
+		t.Errorf("Unexpected number of deletes.  Expected %d, saw %d\n", 0, len(fakePodControl.DeletePodName))
+	}
+}
+
+func TestSyncJobUpdateRequeue(t *testing.T) {
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: "", ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	manager, sharedInformerFactory := newJobControllerFromClient(clientset, controller.NoResyncPeriodFunc)
+	fakePodControl := controller.FakePodControl{}
+	manager.podControl = &fakePodControl
+	manager.podStoreSynced = alwaysReady
+	manager.jobStoreSynced = alwaysReady
+	updateError := fmt.Errorf("Update error")
+	manager.updateHandler = func(job *batch.Job) error {
+		manager.queue.AddRateLimited(getKey(job, t))
+		return updateError
+	}
+	job := newJob(2, 2)
+	sharedInformerFactory.Jobs().Informer().GetIndexer().Add(job)
+	err := manager.syncJob(getKey(job, t))
+	if err == nil || err != updateError {
+		t.Errorf("Expected error %v when syncing jobs, got %v", updateError, err)
+	}
+	t.Log("Waiting for a job in the queue")
+	key, _ := manager.queue.Get()
+	expectedKey := getKey(job, t)
+	if key != expectedKey {
+		t.Errorf("Expected requeue of job with key %s got %s", expectedKey, key)
+	}
+}
+
+func TestJobPodLookup(t *testing.T) {
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: "", ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	manager, sharedInformerFactory := newJobControllerFromClient(clientset, controller.NoResyncPeriodFunc)
+	manager.podStoreSynced = alwaysReady
+	manager.jobStoreSynced = alwaysReady
+	testCases := []struct {
+		job *batch.Job
+		pod *v1.Pod
+
+		expectedName string
+	}{
+		// pods without labels don't match any job
+		{
+			job: &batch.Job{
+				ObjectMeta: v1.ObjectMeta{Name: "basic"},
+			},
+			pod: &v1.Pod{
+				ObjectMeta: v1.ObjectMeta{Name: "foo1", Namespace: v1.NamespaceAll},
+			},
+			expectedName: "",
+		},
+		// matching labels, different namespace
+		{
+			job: &batch.Job{
+				ObjectMeta: v1.ObjectMeta{Name: "foo"},
+				Spec: batch.JobSpec{
+					Selector: &metav1.LabelSelector{
+						MatchLabels: map[string]string{"foo": "bar"},
+					},
+				},
+			},
+			pod: &v1.Pod{
+				ObjectMeta: v1.ObjectMeta{
+					Name:      "foo2",
+					Namespace: "ns",
+					Labels:    map[string]string{"foo": "bar"},
+				},
+			},
+			expectedName: "",
+		},
+		// matching ns and labels returns
+		{
+			job: &batch.Job{
+				ObjectMeta: v1.ObjectMeta{Name: "bar", Namespace: "ns"},
+				Spec: batch.JobSpec{
+					Selector: &metav1.LabelSelector{
+						MatchExpressions: []metav1.LabelSelectorRequirement{
+							{
+								Key:      "foo",
+								Operator: metav1.LabelSelectorOpIn,
+								Values:   []string{"bar"},
+							},
+						},
+					},
+				},
+			},
+			pod: &v1.Pod{
+				ObjectMeta: v1.ObjectMeta{
+					Name:      "foo3",
+					Namespace: "ns",
+					Labels:    map[string]string{"foo": "bar"},
+				},
+			},
+			expectedName: "bar",
+		},
+	}
+	for _, tc := range testCases {
+		sharedInformerFactory.Jobs().Informer().GetIndexer().Add(tc.job)
+		if job := manager.getPodJob(tc.pod); job != nil {
+			if tc.expectedName != job.Name {
+				t.Errorf("Got job %+v expected %+v", job.Name, tc.expectedName)
+			}
+		} else if tc.expectedName != "" {
+			t.Errorf("Expected a job %v pod %v, found none", tc.expectedName, tc.pod.Name)
+		}
+	}
+}
+
+type FakeJobExpectations struct {
+	*controller.ControllerExpectations
+	satisfied    bool
+	expSatisfied func()
+}
+
+func (fe FakeJobExpectations) SatisfiedExpectations(controllerKey string) bool {
+	fe.expSatisfied()
+	return fe.satisfied
+}
+
+// TestSyncJobExpectations tests that a pod cannot sneak in between counting active pods
+// and checking expectations.
+func TestSyncJobExpectations(t *testing.T) {
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: "", ContentConfig: restclient.ContentConfig{GroupVersion: &api.Registry.GroupOrDie(v1.GroupName).GroupVersion}})
+	manager, sharedInformerFactory := newJobControllerFromClient(clientset, controller.NoResyncPeriodFunc)
+	fakePodControl := controller.FakePodControl{}
+	manager.podControl = &fakePodControl
+	manager.podStoreSynced = alwaysReady
+	manager.jobStoreSynced = alwaysReady
+	manager.updateHandler = func(job *batch.Job) error { return nil }
+
+	job := newJob(2, 2)
+	sharedInformerFactory.Jobs().Informer().GetIndexer().Add(job)
+	pods := newPodList(2, v1.PodPending, job)
+	podIndexer := sharedInformerFactory.Pods().Informer().GetIndexer()
+	podIndexer.Add(&pods[0])
+
+	manager.expectations = FakeJobExpectations{
+		controller.NewControllerExpectations(), true, func() {
+			// If we check active pods before checking expectataions, the job
+			// will create a new replica because it doesn't see this pod, but
+			// has fulfilled its expectations.
+			podIndexer.Add(&pods[1])
+		},
+	}
+	manager.syncJob(getKey(job, t))
+	if len(fakePodControl.Templates) != 0 {
+		t.Errorf("Unexpected number of creates.  Expected %d, saw %d\n", 0, len(fakePodControl.Templates))
+	}
+	if len(fakePodControl.DeletePodName) != 0 {
+		t.Errorf("Unexpected number of deletes.  Expected %d, saw %d\n", 0, len(fakePodControl.DeletePodName))
+	}
+}
+
+func TestWatchJobs(t *testing.T) {
+	clientset := fake.NewSimpleClientset()
+	fakeWatch := watch.NewFake()
+	clientset.PrependWatchReactor("jobs", core.DefaultWatchReactor(fakeWatch, nil))
+	manager, sharedInformerFactory := newJobControllerFromClient(clientset, controller.NoResyncPeriodFunc)
+	manager.podStoreSynced = alwaysReady
+	manager.jobStoreSynced = alwaysReady
+
+	var testJob batch.Job
+	received := make(chan struct{})
+
+	// The update sent through the fakeWatcher should make its way into the workqueue,
+	// and eventually into the syncHandler.
+	manager.syncHandler = func(key string) error {
+		defer close(received)
+		ns, name, err := cache.SplitMetaNamespaceKey(key)
+		if err != nil {
+			t.Errorf("Error getting namespace/name from key %v: %v", key, err)
+		}
+		job, err := manager.jobLister.Jobs(ns).Get(name)
+		if err != nil || job == nil {
+			t.Errorf("Expected to find job under key %v: %v", key, err)
+			return nil
+		}
+		if !api.Semantic.DeepDerivative(*job, testJob) {
+			t.Errorf("Expected %#v, but got %#v", testJob, *job)
+		}
+		return nil
+	}
+	// Start only the job watcher and the workqueue, send a watch event,
+	// and make sure it hits the sync method.
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+	sharedInformerFactory.Start(stopCh)
+	go manager.Run(1, stopCh)
+
+	// We're sending new job to see if it reaches syncHandler.
+	testJob.Namespace = "bar"
+	testJob.Name = "foo"
+	fakeWatch.Add(&testJob)
+	t.Log("Waiting for job to reach syncHandler")
+	<-received
+}
+
+func TestWatchPods(t *testing.T) {
+	testJob := newJob(2, 2)
+	clientset := fake.NewSimpleClientset(testJob)
+	fakeWatch := watch.NewFake()
+	clientset.PrependWatchReactor("pods", core.DefaultWatchReactor(fakeWatch, nil))
+	manager, sharedInformerFactory := newJobControllerFromClient(clientset, controller.NoResyncPeriodFunc)
+	manager.podStoreSynced = alwaysReady
+	manager.jobStoreSynced = alwaysReady
+
+	// Put one job and one pod into the store
+	sharedInformerFactory.Jobs().Informer().GetIndexer().Add(testJob)
+	received := make(chan struct{})
+	// The pod update sent through the fakeWatcher should figure out the managing job and
+	// send it into the syncHandler.
+	manager.syncHandler = func(key string) error {
+		ns, name, err := cache.SplitMetaNamespaceKey(key)
+		if err != nil {
+			t.Errorf("Error getting namespace/name from key %v: %v", key, err)
+		}
+		job, err := manager.jobLister.Jobs(ns).Get(name)
+		if err != nil {
+			t.Errorf("Expected to find job under key %v: %v", key, err)
+		}
+		if !api.Semantic.DeepDerivative(job, testJob) {
+			t.Errorf("\nExpected %#v,\nbut got %#v", testJob, job)
+			close(received)
+			return nil
+		}
+		close(received)
+		return nil
+	}
+	// Start only the pod watcher and the workqueue, send a watch event,
+	// and make sure it hits the sync method for the right job.
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+	go sharedInformerFactory.Pods().Informer().Run(stopCh)
+	go wait.Until(manager.worker, 10*time.Millisecond, stopCh)
+
+	pods := newPodList(1, v1.PodRunning, testJob)
+	testPod := pods[0]
+	testPod.Status.Phase = v1.PodFailed
+	fakeWatch.Add(&testPod)
+
+	t.Log("Waiting for pod to reach syncHandler")
+	<-received
+}

vendor/k8s.io/kubernetes/pkg/controller/job/utils.go

@@ -0,0 +1,31 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package job
+
+import (
+	"k8s.io/kubernetes/pkg/api/v1"
+	batch "k8s.io/kubernetes/pkg/apis/batch/v1"
+)
+
+func IsJobFinished(j *batch.Job) bool {
+	for _, c := range j.Status.Conditions {
+		if (c.Type == batch.JobComplete || c.Type == batch.JobFailed) && c.Status == v1.ConditionTrue {
+			return true
+		}
+	}
+	return false
+}

vendor/k8s.io/kubernetes/pkg/controller/job/utils_test.go

@@ -0,0 +1,49 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package job
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/pkg/api/v1"
+	batch "k8s.io/kubernetes/pkg/apis/batch/v1"
+)
+
+func TestIsJobFinished(t *testing.T) {
+	job := &batch.Job{
+		Status: batch.JobStatus{
+			Conditions: []batch.JobCondition{{
+				Type:   batch.JobComplete,
+				Status: v1.ConditionTrue,
+			}},
+		},
+	}
+
+	if !IsJobFinished(job) {
+		t.Error("Job was expected to be finished")
+	}
+
+	job.Status.Conditions[0].Status = v1.ConditionFalse
+	if IsJobFinished(job) {
+		t.Error("Job was not expected to be finished")
+	}
+
+	job.Status.Conditions[0].Status = v1.ConditionUnknown
+	if IsJobFinished(job) {
+		t.Error("Job was not expected to be finished")
+	}
+}

vendor/k8s.io/kubernetes/pkg/controller/lookup_cache.go

@@ -0,0 +1,92 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"hash/adler32"
+	"sync"
+
+	"github.com/golang/groupcache/lru"
+	"k8s.io/apimachinery/pkg/api/meta"
+	hashutil "k8s.io/kubernetes/pkg/util/hash"
+)
+
+type objectWithMeta interface {
+	meta.Object
+}
+
+// keyFunc returns the key of an object, which is used to look up in the cache for it's matching object.
+// Since we match objects by namespace and Labels/Selector, so if two objects have the same namespace and labels,
+// they will have the same key.
+func keyFunc(obj objectWithMeta) uint64 {
+	hash := adler32.New()
+	hashutil.DeepHashObject(hash, &equivalenceLabelObj{
+		namespace: obj.GetNamespace(),
+		labels:    obj.GetLabels(),
+	})
+	return uint64(hash.Sum32())
+}
+
+type equivalenceLabelObj struct {
+	namespace string
+	labels    map[string]string
+}
+
+// MatchingCache save label and selector matching relationship
+type MatchingCache struct {
+	mutex sync.RWMutex
+	cache *lru.Cache
+}
+
+// NewMatchingCache return a NewMatchingCache, which save label and selector matching relationship.
+func NewMatchingCache(maxCacheEntries int) *MatchingCache {
+	return &MatchingCache{
+		cache: lru.New(maxCacheEntries),
+	}
+}
+
+// Add will add matching information to the cache.
+func (c *MatchingCache) Add(labelObj objectWithMeta, selectorObj objectWithMeta) {
+	key := keyFunc(labelObj)
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+	c.cache.Add(key, selectorObj)
+}
+
+// GetMatchingObject lookup the matching object for a given object.
+// Note: the cache information may be invalid since the controller may be deleted or updated,
+// we need check in the external request to ensure the cache data is not dirty.
+func (c *MatchingCache) GetMatchingObject(labelObj objectWithMeta) (controller interface{}, exists bool) {
+	key := keyFunc(labelObj)
+	// NOTE: we use Lock() instead of RLock() here because lru's Get() method also modifies state(
+	// it need update the least recently usage information). So we can not call it concurrently.
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+	return c.cache.Get(key)
+}
+
+// Update update the cached matching information.
+func (c *MatchingCache) Update(labelObj objectWithMeta, selectorObj objectWithMeta) {
+	c.Add(labelObj, selectorObj)
+}
+
+// InvalidateAll invalidate the whole cache.
+func (c *MatchingCache) InvalidateAll() {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+	c.cache = lru.New(c.cache.MaxEntries)
+}

vendor/k8s.io/kubernetes/pkg/controller/namespace/BUILD

@@ -0,0 +1,74 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "namespace_controller.go",
+        "namespace_controller_utils.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api/v1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/typed/discovery:go_default_library",
+        "//pkg/client/typed/dynamic:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/util/metrics:go_default_library",
+        "//pkg/util/workqueue:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/api/errors",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1/unstructured",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/util/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/sets",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+        "//vendor:k8s.io/apimachinery/pkg/watch",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["namespace_controller_test.go"],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/fake:go_default_library",
+        "//pkg/client/restclient:go_default_library",
+        "//pkg/client/testing/core:go_default_library",
+        "//pkg/client/typed/discovery:go_default_library",
+        "//pkg/client/typed/dynamic:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/api/errors",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/util/sets",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/namespace/OWNERS

@@ -0,0 +1,3 @@
+reviewers:
+- derekwaynecarr
+- smarterclayton

vendor/k8s.io/kubernetes/pkg/controller/namespace/doc.go

@@ -0,0 +1,18 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// namespace contains a controller that handles namespace lifecycle
+package namespace // import "k8s.io/kubernetes/pkg/controller/namespace"

vendor/k8s.io/kubernetes/pkg/controller/namespace/namespace_controller.go

@@ -0,0 +1,240 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package namespace
+
+import (
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/client/typed/dynamic"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/util/metrics"
+	"k8s.io/kubernetes/pkg/util/workqueue"
+
+	"github.com/golang/glog"
+)
+
+const (
+	// namespaceDeletionGracePeriod is the time period to wait before processing a received namespace event.
+	// This allows time for the following to occur:
+	// * lifecycle admission plugins on HA apiservers to also observe a namespace
+	//   deletion and prevent new objects from being created in the terminating namespace
+	// * non-leader etcd servers to observe last-minute object creations in a namespace
+	//   so this controller's cleanup can actually clean up all objects
+	namespaceDeletionGracePeriod = 5 * time.Second
+)
+
+// NamespaceController is responsible for performing actions dependent upon a namespace phase
+type NamespaceController struct {
+	// client that purges namespace content, must have list/delete privileges on all content
+	kubeClient clientset.Interface
+	// clientPool manages a pool of dynamic clients
+	clientPool dynamic.ClientPool
+	// store that holds the namespaces
+	store cache.Store
+	// controller that observes the namespaces
+	controller cache.Controller
+	// namespaces that have been queued up for processing by workers
+	queue workqueue.RateLimitingInterface
+	// function to list of preferred resources for namespace deletion
+	discoverResourcesFn func() ([]*metav1.APIResourceList, error)
+	// opCache is a cache to remember if a particular operation is not supported to aid dynamic client.
+	opCache *operationNotSupportedCache
+	// finalizerToken is the finalizer token managed by this controller
+	finalizerToken v1.FinalizerName
+}
+
+// NewNamespaceController creates a new NamespaceController
+func NewNamespaceController(
+	kubeClient clientset.Interface,
+	clientPool dynamic.ClientPool,
+	discoverResourcesFn func() ([]*metav1.APIResourceList, error),
+	resyncPeriod time.Duration,
+	finalizerToken v1.FinalizerName) *NamespaceController {
+
+	opCache := &operationNotSupportedCache{
+		m: make(map[operationKey]bool),
+	}
+
+	// pre-fill opCache with the discovery info
+	//
+	// TODO(sttts): get rid of opCache and http 405 logic around it and trust discovery info
+	resources, err := discoverResourcesFn()
+	if err != nil {
+		glog.Fatalf("Failed to get supported resources: %v", err)
+	}
+	deletableGroupVersionResources := []schema.GroupVersionResource{}
+	for _, rl := range resources {
+		gv, err := schema.ParseGroupVersion(rl.GroupVersion)
+		if err != nil {
+			glog.Errorf("Failed to parse GroupVersion %q, skipping: %v", rl.GroupVersion, err)
+			continue
+		}
+
+		for _, r := range rl.APIResources {
+			gvr := schema.GroupVersionResource{Group: gv.Group, Version: gv.Version, Resource: r.Name}
+			verbs := sets.NewString([]string(r.Verbs)...)
+
+			if !verbs.Has("delete") {
+				glog.V(6).Infof("Skipping resource %v because it cannot be deleted.", gvr)
+			}
+
+			for _, op := range []operation{operationList, operationDeleteCollection} {
+				if !verbs.Has(string(op)) {
+					opCache.setNotSupported(operationKey{op: op, gvr: gvr})
+				}
+			}
+
+			deletableGroupVersionResources = append(deletableGroupVersionResources, gvr)
+		}
+	}
+
+	// create the controller so we can inject the enqueue function
+	namespaceController := &NamespaceController{
+		kubeClient:          kubeClient,
+		clientPool:          clientPool,
+		queue:               workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "namespace"),
+		discoverResourcesFn: discoverResourcesFn,
+		opCache:             opCache,
+		finalizerToken:      finalizerToken,
+	}
+
+	if kubeClient != nil && kubeClient.Core().RESTClient().GetRateLimiter() != nil {
+		metrics.RegisterMetricAndTrackRateLimiterUsage("namespace_controller", kubeClient.Core().RESTClient().GetRateLimiter())
+	}
+
+	// configure the backing store/controller
+	store, controller := cache.NewInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				return kubeClient.Core().Namespaces().List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				return kubeClient.Core().Namespaces().Watch(options)
+			},
+		},
+		&v1.Namespace{},
+		resyncPeriod,
+		cache.ResourceEventHandlerFuncs{
+			AddFunc: func(obj interface{}) {
+				namespace := obj.(*v1.Namespace)
+				namespaceController.enqueueNamespace(namespace)
+			},
+			UpdateFunc: func(oldObj, newObj interface{}) {
+				namespace := newObj.(*v1.Namespace)
+				namespaceController.enqueueNamespace(namespace)
+			},
+		},
+	)
+
+	namespaceController.store = store
+	namespaceController.controller = controller
+	return namespaceController
+}
+
+// enqueueNamespace adds an object to the controller work queue
+// obj could be an *v1.Namespace, or a DeletionFinalStateUnknown item.
+func (nm *NamespaceController) enqueueNamespace(obj interface{}) {
+	key, err := controller.KeyFunc(obj)
+	if err != nil {
+		glog.Errorf("Couldn't get key for object %+v: %v", obj, err)
+		return
+	}
+	// delay processing namespace events to allow HA api servers to observe namespace deletion,
+	// and HA etcd servers to observe last minute object creations inside the namespace
+	nm.queue.AddAfter(key, namespaceDeletionGracePeriod)
+}
+
+// worker processes the queue of namespace objects.
+// Each namespace can be in the queue at most once.
+// The system ensures that no two workers can process
+// the same namespace at the same time.
+func (nm *NamespaceController) worker() {
+	workFunc := func() bool {
+		key, quit := nm.queue.Get()
+		if quit {
+			return true
+		}
+		defer nm.queue.Done(key)
+
+		err := nm.syncNamespaceFromKey(key.(string))
+		if err == nil {
+			// no error, forget this entry and return
+			nm.queue.Forget(key)
+			return false
+		}
+
+		if estimate, ok := err.(*contentRemainingError); ok {
+			t := estimate.Estimate/2 + 1
+			glog.V(4).Infof("Content remaining in namespace %s, waiting %d seconds", key, t)
+			nm.queue.AddAfter(key, time.Duration(t)*time.Second)
+		} else {
+			// rather than wait for a full resync, re-add the namespace to the queue to be processed
+			nm.queue.AddRateLimited(key)
+			utilruntime.HandleError(err)
+		}
+		return false
+	}
+
+	for {
+		quit := workFunc()
+
+		if quit {
+			return
+		}
+	}
+}
+
+// syncNamespaceFromKey looks for a namespace with the specified key in its store and synchronizes it
+func (nm *NamespaceController) syncNamespaceFromKey(key string) (err error) {
+	startTime := time.Now()
+	defer glog.V(4).Infof("Finished syncing namespace %q (%v)", key, time.Now().Sub(startTime))
+
+	obj, exists, err := nm.store.GetByKey(key)
+	if !exists {
+		glog.Infof("Namespace has been deleted %v", key)
+		return nil
+	}
+	if err != nil {
+		glog.Errorf("Unable to retrieve namespace %v from store: %v", key, err)
+		nm.queue.Add(key)
+		return err
+	}
+	namespace := obj.(*v1.Namespace)
+	return syncNamespace(nm.kubeClient, nm.clientPool, nm.opCache, nm.discoverResourcesFn, namespace, nm.finalizerToken)
+}
+
+// Run starts observing the system with the specified number of workers.
+func (nm *NamespaceController) Run(workers int, stopCh <-chan struct{}) {
+	defer utilruntime.HandleCrash()
+	go nm.controller.Run(stopCh)
+	for i := 0; i < workers; i++ {
+		go wait.Until(nm.worker, time.Second, stopCh)
+	}
+	<-stopCh
+	glog.Infof("Shutting down NamespaceController")
+	nm.queue.ShutDown()
+}

vendor/k8s.io/kubernetes/pkg/controller/namespace/namespace_controller_test.go

@@ -0,0 +1,332 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package namespace
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"path"
+	"strings"
+	"sync"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/fake"
+	"k8s.io/kubernetes/pkg/client/restclient"
+	"k8s.io/kubernetes/pkg/client/testing/core"
+	"k8s.io/kubernetes/pkg/client/typed/discovery"
+	"k8s.io/kubernetes/pkg/client/typed/dynamic"
+)
+
+func TestFinalized(t *testing.T) {
+	testNamespace := &v1.Namespace{
+		Spec: v1.NamespaceSpec{
+			Finalizers: []v1.FinalizerName{"a", "b"},
+		},
+	}
+	if finalized(testNamespace) {
+		t.Errorf("Unexpected result, namespace is not finalized")
+	}
+	testNamespace.Spec.Finalizers = []v1.FinalizerName{}
+	if !finalized(testNamespace) {
+		t.Errorf("Expected object to be finalized")
+	}
+}
+
+func TestFinalizeNamespaceFunc(t *testing.T) {
+	mockClient := &fake.Clientset{}
+	testNamespace := &v1.Namespace{
+		ObjectMeta: v1.ObjectMeta{
+			Name:            "test",
+			ResourceVersion: "1",
+		},
+		Spec: v1.NamespaceSpec{
+			Finalizers: []v1.FinalizerName{"kubernetes", "other"},
+		},
+	}
+	finalizeNamespace(mockClient, testNamespace, v1.FinalizerKubernetes)
+	actions := mockClient.Actions()
+	if len(actions) != 1 {
+		t.Errorf("Expected 1 mock client action, but got %v", len(actions))
+	}
+	if !actions[0].Matches("create", "namespaces") || actions[0].GetSubresource() != "finalize" {
+		t.Errorf("Expected finalize-namespace action %v", actions[0])
+	}
+	finalizers := actions[0].(core.CreateAction).GetObject().(*v1.Namespace).Spec.Finalizers
+	if len(finalizers) != 1 {
+		t.Errorf("There should be a single finalizer remaining")
+	}
+	if "other" != string(finalizers[0]) {
+		t.Errorf("Unexpected finalizer value, %v", finalizers[0])
+	}
+}
+
+func testSyncNamespaceThatIsTerminating(t *testing.T, versions *metav1.APIVersions) {
+	now := metav1.Now()
+	namespaceName := "test"
+	testNamespacePendingFinalize := &v1.Namespace{
+		ObjectMeta: v1.ObjectMeta{
+			Name:              namespaceName,
+			ResourceVersion:   "1",
+			DeletionTimestamp: &now,
+		},
+		Spec: v1.NamespaceSpec{
+			Finalizers: []v1.FinalizerName{"kubernetes"},
+		},
+		Status: v1.NamespaceStatus{
+			Phase: v1.NamespaceTerminating,
+		},
+	}
+	testNamespaceFinalizeComplete := &v1.Namespace{
+		ObjectMeta: v1.ObjectMeta{
+			Name:              namespaceName,
+			ResourceVersion:   "1",
+			DeletionTimestamp: &now,
+		},
+		Spec: v1.NamespaceSpec{},
+		Status: v1.NamespaceStatus{
+			Phase: v1.NamespaceTerminating,
+		},
+	}
+
+	// when doing a delete all of content, we will do a GET of a collection, and DELETE of a collection by default
+	dynamicClientActionSet := sets.NewString()
+	resources := testResources()
+	groupVersionResources, _ := discovery.GroupVersionResources(resources)
+	for groupVersionResource := range groupVersionResources {
+		urlPath := path.Join([]string{
+			dynamic.LegacyAPIPathResolverFunc(schema.GroupVersionKind{Group: groupVersionResource.Group, Version: groupVersionResource.Version}),
+			groupVersionResource.Group,
+			groupVersionResource.Version,
+			"namespaces",
+			namespaceName,
+			groupVersionResource.Resource,
+		}...)
+		dynamicClientActionSet.Insert((&fakeAction{method: "GET", path: urlPath}).String())
+		dynamicClientActionSet.Insert((&fakeAction{method: "DELETE", path: urlPath}).String())
+	}
+
+	scenarios := map[string]struct {
+		testNamespace          *v1.Namespace
+		kubeClientActionSet    sets.String
+		dynamicClientActionSet sets.String
+		gvrError               error
+	}{
+		"pending-finalize": {
+			testNamespace: testNamespacePendingFinalize,
+			kubeClientActionSet: sets.NewString(
+				strings.Join([]string{"get", "namespaces", ""}, "-"),
+				strings.Join([]string{"create", "namespaces", "finalize"}, "-"),
+				strings.Join([]string{"list", "pods", ""}, "-"),
+				strings.Join([]string{"delete", "namespaces", ""}, "-"),
+			),
+			dynamicClientActionSet: dynamicClientActionSet,
+		},
+		"complete-finalize": {
+			testNamespace: testNamespaceFinalizeComplete,
+			kubeClientActionSet: sets.NewString(
+				strings.Join([]string{"get", "namespaces", ""}, "-"),
+				strings.Join([]string{"delete", "namespaces", ""}, "-"),
+			),
+			dynamicClientActionSet: sets.NewString(),
+		},
+		"groupVersionResourceErr": {
+			testNamespace: testNamespaceFinalizeComplete,
+			kubeClientActionSet: sets.NewString(
+				strings.Join([]string{"get", "namespaces", ""}, "-"),
+				strings.Join([]string{"delete", "namespaces", ""}, "-"),
+			),
+			dynamicClientActionSet: sets.NewString(),
+			gvrError:               fmt.Errorf("test error"),
+		},
+	}
+
+	for scenario, testInput := range scenarios {
+		testHandler := &fakeActionHandler{statusCode: 200}
+		srv, clientConfig := testServerAndClientConfig(testHandler.ServeHTTP)
+		defer srv.Close()
+
+		mockClient := fake.NewSimpleClientset(testInput.testNamespace)
+		clientPool := dynamic.NewClientPool(clientConfig, api.Registry.RESTMapper(), dynamic.LegacyAPIPathResolverFunc)
+
+		fn := func() ([]*metav1.APIResourceList, error) {
+			return resources, nil
+		}
+
+		err := syncNamespace(mockClient, clientPool, &operationNotSupportedCache{m: make(map[operationKey]bool)}, fn, testInput.testNamespace, v1.FinalizerKubernetes)
+		if err != nil {
+			t.Errorf("scenario %s - Unexpected error when synching namespace %v", scenario, err)
+		}
+
+		// validate traffic from kube client
+		actionSet := sets.NewString()
+		for _, action := range mockClient.Actions() {
+			actionSet.Insert(strings.Join([]string{action.GetVerb(), action.GetResource().Resource, action.GetSubresource()}, "-"))
+		}
+		if !actionSet.Equal(testInput.kubeClientActionSet) {
+			t.Errorf("scenario %s - mock client expected actions:\n%v\n but got:\n%v\nDifference:\n%v", scenario,
+				testInput.kubeClientActionSet, actionSet, testInput.kubeClientActionSet.Difference(actionSet))
+		}
+
+		// validate traffic from dynamic client
+		actionSet = sets.NewString()
+		for _, action := range testHandler.actions {
+			actionSet.Insert(action.String())
+		}
+		if !actionSet.Equal(testInput.dynamicClientActionSet) {
+			t.Errorf("scenario %s - dynamic client expected actions:\n%v\n but got:\n%v\nDifference:\n%v", scenario,
+				testInput.dynamicClientActionSet, actionSet, testInput.dynamicClientActionSet.Difference(actionSet))
+		}
+	}
+}
+
+func TestRetryOnConflictError(t *testing.T) {
+	mockClient := &fake.Clientset{}
+	numTries := 0
+	retryOnce := func(kubeClient clientset.Interface, namespace *v1.Namespace) (*v1.Namespace, error) {
+		numTries++
+		if numTries <= 1 {
+			return namespace, errors.NewConflict(api.Resource("namespaces"), namespace.Name, fmt.Errorf("ERROR!"))
+		}
+		return namespace, nil
+	}
+	namespace := &v1.Namespace{}
+	_, err := retryOnConflictError(mockClient, namespace, retryOnce)
+	if err != nil {
+		t.Errorf("Unexpected error %v", err)
+	}
+	if numTries != 2 {
+		t.Errorf("Expected %v, but got %v", 2, numTries)
+	}
+}
+
+func TestSyncNamespaceThatIsTerminatingNonExperimental(t *testing.T) {
+	testSyncNamespaceThatIsTerminating(t, &metav1.APIVersions{})
+}
+
+func TestSyncNamespaceThatIsTerminatingV1Beta1(t *testing.T) {
+	testSyncNamespaceThatIsTerminating(t, &metav1.APIVersions{Versions: []string{"extensions/v1beta1"}})
+}
+
+func TestSyncNamespaceThatIsActive(t *testing.T) {
+	mockClient := &fake.Clientset{}
+	testNamespace := &v1.Namespace{
+		ObjectMeta: v1.ObjectMeta{
+			Name:            "test",
+			ResourceVersion: "1",
+		},
+		Spec: v1.NamespaceSpec{
+			Finalizers: []v1.FinalizerName{"kubernetes"},
+		},
+		Status: v1.NamespaceStatus{
+			Phase: v1.NamespaceActive,
+		},
+	}
+	fn := func() ([]*metav1.APIResourceList, error) {
+		return testResources(), nil
+	}
+	err := syncNamespace(mockClient, nil, &operationNotSupportedCache{m: make(map[operationKey]bool)}, fn, testNamespace, v1.FinalizerKubernetes)
+	if err != nil {
+		t.Errorf("Unexpected error when synching namespace %v", err)
+	}
+	if len(mockClient.Actions()) != 0 {
+		t.Errorf("Expected no action from controller, but got: %v", mockClient.Actions())
+	}
+}
+
+// testServerAndClientConfig returns a server that listens and a config that can reference it
+func testServerAndClientConfig(handler func(http.ResponseWriter, *http.Request)) (*httptest.Server, *restclient.Config) {
+	srv := httptest.NewServer(http.HandlerFunc(handler))
+	config := &restclient.Config{
+		Host: srv.URL,
+	}
+	return srv, config
+}
+
+// fakeAction records information about requests to aid in testing.
+type fakeAction struct {
+	method string
+	path   string
+}
+
+// String returns method=path to aid in testing
+func (f *fakeAction) String() string {
+	return strings.Join([]string{f.method, f.path}, "=")
+}
+
+// fakeActionHandler holds a list of fakeActions received
+type fakeActionHandler struct {
+	// statusCode returned by this handler
+	statusCode int
+
+	lock    sync.Mutex
+	actions []fakeAction
+}
+
+// ServeHTTP logs the action that occurred and always returns the associated status code
+func (f *fakeActionHandler) ServeHTTP(response http.ResponseWriter, request *http.Request) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	f.actions = append(f.actions, fakeAction{method: request.Method, path: request.URL.Path})
+	response.Header().Set("Content-Type", runtime.ContentTypeJSON)
+	response.WriteHeader(f.statusCode)
+	response.Write([]byte("{\"kind\": \"List\",\"items\":null}"))
+}
+
+// testResources returns a mocked up set of resources across different api groups for testing namespace controller.
+func testResources() []*metav1.APIResourceList {
+	results := []*metav1.APIResourceList{
+		{
+			GroupVersion: "v1",
+			APIResources: []metav1.APIResource{
+				{
+					Name:       "pods",
+					Namespaced: true,
+					Kind:       "Pod",
+					Verbs:      []string{"get", "list", "delete", "deletecollection", "create", "update"},
+				},
+				{
+					Name:       "services",
+					Namespaced: true,
+					Kind:       "Service",
+					Verbs:      []string{"get", "list", "delete", "deletecollection", "create", "update"},
+				},
+			},
+		},
+		{
+			GroupVersion: "extensions/v1beta1",
+			APIResources: []metav1.APIResource{
+				{
+					Name:       "deployments",
+					Namespaced: true,
+					Kind:       "Deployment",
+					Verbs:      []string{"get", "list", "delete", "deletecollection", "create", "update"},
+				},
+			},
+		},
+	}
+	return results
+}

vendor/k8s.io/kubernetes/pkg/controller/namespace/namespace_controller_utils.go

@@ -0,0 +1,507 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package namespace
+
+import (
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/client/typed/discovery"
+	"k8s.io/kubernetes/pkg/client/typed/dynamic"
+)
+
+// contentRemainingError is used to inform the caller that content is not fully removed from the namespace
+type contentRemainingError struct {
+	Estimate int64
+}
+
+func (e *contentRemainingError) Error() string {
+	return fmt.Sprintf("some content remains in the namespace, estimate %d seconds before it is removed", e.Estimate)
+}
+
+// operation is used for caching if an operation is supported on a dynamic client.
+type operation string
+
+const (
+	operationDeleteCollection operation = "deleteCollection"
+	operationList             operation = "list"
+	// assume a default estimate for finalizers to complete when found on items pending deletion.
+	finalizerEstimateSeconds int64 = int64(15)
+)
+
+// operationKey is an entry in a cache.
+type operationKey struct {
+	op  operation
+	gvr schema.GroupVersionResource
+}
+
+// operationNotSupportedCache is a simple cache to remember if an operation is not supported for a resource.
+// if the operationKey maps to true, it means the operation is not supported.
+type operationNotSupportedCache struct {
+	lock sync.RWMutex
+	m    map[operationKey]bool
+}
+
+// isSupported returns true if the operation is supported
+func (o *operationNotSupportedCache) isSupported(key operationKey) bool {
+	o.lock.RLock()
+	defer o.lock.RUnlock()
+	return !o.m[key]
+}
+
+func (o *operationNotSupportedCache) setNotSupported(key operationKey) {
+	o.lock.Lock()
+	defer o.lock.Unlock()
+	o.m[key] = true
+}
+
+// updateNamespaceFunc is a function that makes an update to a namespace
+type updateNamespaceFunc func(kubeClient clientset.Interface, namespace *v1.Namespace) (*v1.Namespace, error)
+
+// retryOnConflictError retries the specified fn if there was a conflict error
+// it will return an error if the UID for an object changes across retry operations.
+// TODO RetryOnConflict should be a generic concept in client code
+func retryOnConflictError(kubeClient clientset.Interface, namespace *v1.Namespace, fn updateNamespaceFunc) (result *v1.Namespace, err error) {
+	latestNamespace := namespace
+	for {
+		result, err = fn(kubeClient, latestNamespace)
+		if err == nil {
+			return result, nil
+		}
+		if !errors.IsConflict(err) {
+			return nil, err
+		}
+		prevNamespace := latestNamespace
+		latestNamespace, err = kubeClient.Core().Namespaces().Get(latestNamespace.Name, metav1.GetOptions{})
+		if err != nil {
+			return nil, err
+		}
+		if prevNamespace.UID != latestNamespace.UID {
+			return nil, fmt.Errorf("namespace uid has changed across retries")
+		}
+	}
+}
+
+// updateNamespaceStatusFunc will verify that the status of the namespace is correct
+func updateNamespaceStatusFunc(kubeClient clientset.Interface, namespace *v1.Namespace) (*v1.Namespace, error) {
+	if namespace.DeletionTimestamp.IsZero() || namespace.Status.Phase == v1.NamespaceTerminating {
+		return namespace, nil
+	}
+	newNamespace := v1.Namespace{}
+	newNamespace.ObjectMeta = namespace.ObjectMeta
+	newNamespace.Status = namespace.Status
+	newNamespace.Status.Phase = v1.NamespaceTerminating
+	return kubeClient.Core().Namespaces().UpdateStatus(&newNamespace)
+}
+
+// finalized returns true if the namespace.Spec.Finalizers is an empty list
+func finalized(namespace *v1.Namespace) bool {
+	return len(namespace.Spec.Finalizers) == 0
+}
+
+// finalizeNamespaceFunc returns a function that knows how to finalize a namespace for specified token.
+func finalizeNamespaceFunc(finalizerToken v1.FinalizerName) updateNamespaceFunc {
+	return func(kubeClient clientset.Interface, namespace *v1.Namespace) (*v1.Namespace, error) {
+		return finalizeNamespace(kubeClient, namespace, finalizerToken)
+	}
+}
+
+// finalizeNamespace removes the specified finalizerToken and finalizes the namespace
+func finalizeNamespace(kubeClient clientset.Interface, namespace *v1.Namespace, finalizerToken v1.FinalizerName) (*v1.Namespace, error) {
+	namespaceFinalize := v1.Namespace{}
+	namespaceFinalize.ObjectMeta = namespace.ObjectMeta
+	namespaceFinalize.Spec = namespace.Spec
+	finalizerSet := sets.NewString()
+	for i := range namespace.Spec.Finalizers {
+		if namespace.Spec.Finalizers[i] != finalizerToken {
+			finalizerSet.Insert(string(namespace.Spec.Finalizers[i]))
+		}
+	}
+	namespaceFinalize.Spec.Finalizers = make([]v1.FinalizerName, 0, len(finalizerSet))
+	for _, value := range finalizerSet.List() {
+		namespaceFinalize.Spec.Finalizers = append(namespaceFinalize.Spec.Finalizers, v1.FinalizerName(value))
+	}
+	namespace, err := kubeClient.Core().Namespaces().Finalize(&namespaceFinalize)
+	if err != nil {
+		// it was removed already, so life is good
+		if errors.IsNotFound(err) {
+			return namespace, nil
+		}
+	}
+	return namespace, err
+}
+
+// deleteCollection is a helper function that will delete the collection of resources
+// it returns true if the operation was supported on the server.
+// it returns an error if the operation was supported on the server but was unable to complete.
+func deleteCollection(
+	dynamicClient *dynamic.Client,
+	opCache *operationNotSupportedCache,
+	gvr schema.GroupVersionResource,
+	namespace string,
+) (bool, error) {
+	glog.V(5).Infof("namespace controller - deleteCollection - namespace: %s, gvr: %v", namespace, gvr)
+
+	key := operationKey{op: operationDeleteCollection, gvr: gvr}
+	if !opCache.isSupported(key) {
+		glog.V(5).Infof("namespace controller - deleteCollection ignored since not supported - namespace: %s, gvr: %v", namespace, gvr)
+		return false, nil
+	}
+
+	apiResource := metav1.APIResource{Name: gvr.Resource, Namespaced: true}
+
+	// namespace controller does not want the garbage collector to insert the orphan finalizer since it calls
+	// resource deletions generically.  it will ensure all resources in the namespace are purged prior to releasing
+	// namespace itself.
+	orphanDependents := false
+	err := dynamicClient.Resource(&apiResource, namespace).DeleteCollection(&v1.DeleteOptions{OrphanDependents: &orphanDependents}, &v1.ListOptions{})
+
+	if err == nil {
+		return true, nil
+	}
+
+	// this is strange, but we need to special case for both MethodNotSupported and NotFound errors
+	// TODO: https://github.com/kubernetes/kubernetes/issues/22413
+	// we have a resource returned in the discovery API that supports no top-level verbs:
+	//  /apis/extensions/v1beta1/namespaces/default/replicationcontrollers
+	// when working with this resource type, we will get a literal not found error rather than expected method not supported
+	// remember next time that this resource does not support delete collection...
+	if errors.IsMethodNotSupported(err) || errors.IsNotFound(err) {
+		glog.V(5).Infof("namespace controller - deleteCollection not supported - namespace: %s, gvr: %v", namespace, gvr)
+		opCache.setNotSupported(key)
+		return false, nil
+	}
+
+	glog.V(5).Infof("namespace controller - deleteCollection unexpected error - namespace: %s, gvr: %v, error: %v", namespace, gvr, err)
+	return true, err
+}
+
+// listCollection will list the items in the specified namespace
+// it returns the following:
+//  the list of items in the collection (if found)
+//  a boolean if the operation is supported
+//  an error if the operation is supported but could not be completed.
+func listCollection(
+	dynamicClient *dynamic.Client,
+	opCache *operationNotSupportedCache,
+	gvr schema.GroupVersionResource,
+	namespace string,
+) (*unstructured.UnstructuredList, bool, error) {
+	glog.V(5).Infof("namespace controller - listCollection - namespace: %s, gvr: %v", namespace, gvr)
+
+	key := operationKey{op: operationList, gvr: gvr}
+	if !opCache.isSupported(key) {
+		glog.V(5).Infof("namespace controller - listCollection ignored since not supported - namespace: %s, gvr: %v", namespace, gvr)
+		return nil, false, nil
+	}
+
+	apiResource := metav1.APIResource{Name: gvr.Resource, Namespaced: true}
+	obj, err := dynamicClient.Resource(&apiResource, namespace).List(&v1.ListOptions{})
+	if err == nil {
+		unstructuredList, ok := obj.(*unstructured.UnstructuredList)
+		if !ok {
+			return nil, false, fmt.Errorf("resource: %s, expected *unstructured.UnstructuredList, got %#v", apiResource.Name, obj)
+		}
+		return unstructuredList, true, nil
+	}
+
+	// this is strange, but we need to special case for both MethodNotSupported and NotFound errors
+	// TODO: https://github.com/kubernetes/kubernetes/issues/22413
+	// we have a resource returned in the discovery API that supports no top-level verbs:
+	//  /apis/extensions/v1beta1/namespaces/default/replicationcontrollers
+	// when working with this resource type, we will get a literal not found error rather than expected method not supported
+	// remember next time that this resource does not support delete collection...
+	if errors.IsMethodNotSupported(err) || errors.IsNotFound(err) {
+		glog.V(5).Infof("namespace controller - listCollection not supported - namespace: %s, gvr: %v", namespace, gvr)
+		opCache.setNotSupported(key)
+		return nil, false, nil
+	}
+
+	return nil, true, err
+}
+
+// deleteEachItem is a helper function that will list the collection of resources and delete each item 1 by 1.
+func deleteEachItem(
+	dynamicClient *dynamic.Client,
+	opCache *operationNotSupportedCache,
+	gvr schema.GroupVersionResource,
+	namespace string,
+) error {
+	glog.V(5).Infof("namespace controller - deleteEachItem - namespace: %s, gvr: %v", namespace, gvr)
+
+	unstructuredList, listSupported, err := listCollection(dynamicClient, opCache, gvr, namespace)
+	if err != nil {
+		return err
+	}
+	if !listSupported {
+		return nil
+	}
+	apiResource := metav1.APIResource{Name: gvr.Resource, Namespaced: true}
+	for _, item := range unstructuredList.Items {
+		if err = dynamicClient.Resource(&apiResource, namespace).Delete(item.GetName(), nil); err != nil && !errors.IsNotFound(err) && !errors.IsMethodNotSupported(err) {
+			return err
+		}
+	}
+	return nil
+}
+
+// deleteAllContentForGroupVersionResource will use the dynamic client to delete each resource identified in gvr.
+// It returns an estimate of the time remaining before the remaining resources are deleted.
+// If estimate > 0, not all resources are guaranteed to be gone.
+func deleteAllContentForGroupVersionResource(
+	kubeClient clientset.Interface,
+	clientPool dynamic.ClientPool,
+	opCache *operationNotSupportedCache,
+	gvr schema.GroupVersionResource,
+	namespace string,
+	namespaceDeletedAt metav1.Time,
+) (int64, error) {
+	glog.V(5).Infof("namespace controller - deleteAllContentForGroupVersionResource - namespace: %s, gvr: %v", namespace, gvr)
+
+	// estimate how long it will take for the resource to be deleted (needed for objects that support graceful delete)
+	estimate, err := estimateGracefulTermination(kubeClient, gvr, namespace, namespaceDeletedAt)
+	if err != nil {
+		glog.V(5).Infof("namespace controller - deleteAllContentForGroupVersionResource - unable to estimate - namespace: %s, gvr: %v, err: %v", namespace, gvr, err)
+		return estimate, err
+	}
+	glog.V(5).Infof("namespace controller - deleteAllContentForGroupVersionResource - estimate - namespace: %s, gvr: %v, estimate: %v", namespace, gvr, estimate)
+
+	// get a client for this group version...
+	dynamicClient, err := clientPool.ClientForGroupVersionResource(gvr)
+	if err != nil {
+		glog.V(5).Infof("namespace controller - deleteAllContentForGroupVersionResource - unable to get client - namespace: %s, gvr: %v, err: %v", namespace, gvr, err)
+		return estimate, err
+	}
+
+	// first try to delete the entire collection
+	deleteCollectionSupported, err := deleteCollection(dynamicClient, opCache, gvr, namespace)
+	if err != nil {
+		return estimate, err
+	}
+
+	// delete collection was not supported, so we list and delete each item...
+	if !deleteCollectionSupported {
+		err = deleteEachItem(dynamicClient, opCache, gvr, namespace)
+		if err != nil {
+			return estimate, err
+		}
+	}
+
+	// verify there are no more remaining items
+	// it is not an error condition for there to be remaining items if local estimate is non-zero
+	glog.V(5).Infof("namespace controller - deleteAllContentForGroupVersionResource - checking for no more items in namespace: %s, gvr: %v", namespace, gvr)
+	unstructuredList, listSupported, err := listCollection(dynamicClient, opCache, gvr, namespace)
+	if err != nil {
+		glog.V(5).Infof("namespace controller - deleteAllContentForGroupVersionResource - error verifying no items in namespace: %s, gvr: %v, err: %v", namespace, gvr, err)
+		return estimate, err
+	}
+	if !listSupported {
+		return estimate, nil
+	}
+	glog.V(5).Infof("namespace controller - deleteAllContentForGroupVersionResource - items remaining - namespace: %s, gvr: %v, items: %v", namespace, gvr, len(unstructuredList.Items))
+	if len(unstructuredList.Items) != 0 && estimate == int64(0) {
+		// if any item has a finalizer, we treat that as a normal condition, and use a default estimation to allow for GC to complete.
+		for _, item := range unstructuredList.Items {
+			if len(item.GetFinalizers()) > 0 {
+				glog.V(5).Infof("namespace controller - deleteAllContentForGroupVersionResource - items remaining with finalizers - namespace: %s, gvr: %v, finalizers: %v", namespace, gvr, item.GetFinalizers())
+				return finalizerEstimateSeconds, nil
+			}
+		}
+		// nothing reported a finalizer, so something was unexpected as it should have been deleted.
+		return estimate, fmt.Errorf("unexpected items still remain in namespace: %s for gvr: %v", namespace, gvr)
+	}
+	return estimate, nil
+}
+
+// deleteAllContent will use the dynamic client to delete each resource identified in groupVersionResources.
+// It returns an estimate of the time remaining before the remaining resources are deleted.
+// If estimate > 0, not all resources are guaranteed to be gone.
+func deleteAllContent(
+	kubeClient clientset.Interface,
+	clientPool dynamic.ClientPool,
+	opCache *operationNotSupportedCache,
+	groupVersionResources map[schema.GroupVersionResource]struct{},
+	namespace string,
+	namespaceDeletedAt metav1.Time,
+) (int64, error) {
+	estimate := int64(0)
+	glog.V(4).Infof("namespace controller - deleteAllContent - namespace: %s, gvrs: %v", namespace, groupVersionResources)
+	for gvr := range groupVersionResources {
+		gvrEstimate, err := deleteAllContentForGroupVersionResource(kubeClient, clientPool, opCache, gvr, namespace, namespaceDeletedAt)
+		if err != nil {
+			return estimate, err
+		}
+		if gvrEstimate > estimate {
+			estimate = gvrEstimate
+		}
+	}
+	glog.V(4).Infof("namespace controller - deleteAllContent - namespace: %s, estimate: %v", namespace, estimate)
+	return estimate, nil
+}
+
+// syncNamespace orchestrates deletion of a Namespace and its associated content.
+func syncNamespace(
+	kubeClient clientset.Interface,
+	clientPool dynamic.ClientPool,
+	opCache *operationNotSupportedCache,
+	discoverResourcesFn func() ([]*metav1.APIResourceList, error),
+	namespace *v1.Namespace,
+	finalizerToken v1.FinalizerName,
+) error {
+	if namespace.DeletionTimestamp == nil {
+		return nil
+	}
+
+	// multiple controllers may edit a namespace during termination
+	// first get the latest state of the namespace before proceeding
+	// if the namespace was deleted already, don't do anything
+	namespace, err := kubeClient.Core().Namespaces().Get(namespace.Name, metav1.GetOptions{})
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return nil
+		}
+		return err
+	}
+
+	glog.V(5).Infof("namespace controller - syncNamespace - namespace: %s, finalizerToken: %s", namespace.Name, finalizerToken)
+
+	// ensure that the status is up to date on the namespace
+	// if we get a not found error, we assume the namespace is truly gone
+	namespace, err = retryOnConflictError(kubeClient, namespace, updateNamespaceStatusFunc)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return nil
+		}
+		return err
+	}
+
+	// the latest view of the namespace asserts that namespace is no longer deleting..
+	if namespace.DeletionTimestamp.IsZero() {
+		return nil
+	}
+
+	// if the namespace is already finalized, delete it
+	if finalized(namespace) {
+		var opts *v1.DeleteOptions
+		uid := namespace.UID
+		if len(uid) > 0 {
+			opts = &v1.DeleteOptions{Preconditions: &v1.Preconditions{UID: &uid}}
+		}
+		err = kubeClient.Core().Namespaces().Delete(namespace.Name, opts)
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+		return nil
+	}
+
+	// there may still be content for us to remove
+	resources, err := discoverResourcesFn()
+	if err != nil {
+		return err
+	}
+	// TODO(sttts): get rid of opCache and pass the verbs (especially "deletecollection") down into the deleter
+	deletableResources := discovery.FilteredBy(discovery.SupportsAllVerbs{Verbs: []string{"delete"}}, resources)
+	groupVersionResources, err := discovery.GroupVersionResources(deletableResources)
+	if err != nil {
+		return err
+	}
+	estimate, err := deleteAllContent(kubeClient, clientPool, opCache, groupVersionResources, namespace.Name, *namespace.DeletionTimestamp)
+	if err != nil {
+		return err
+	}
+	if estimate > 0 {
+		return &contentRemainingError{estimate}
+	}
+
+	// we have removed content, so mark it finalized by us
+	result, err := retryOnConflictError(kubeClient, namespace, finalizeNamespaceFunc(finalizerToken))
+	if err != nil {
+		// in normal practice, this should not be possible, but if a deployment is running
+		// two controllers to do namespace deletion that share a common finalizer token it's
+		// possible that a not found could occur since the other controller would have finished the delete.
+		if errors.IsNotFound(err) {
+			return nil
+		}
+		return err
+	}
+
+	// now check if all finalizers have reported that we delete now
+	if finalized(result) {
+		err = kubeClient.Core().Namespaces().Delete(namespace.Name, nil)
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// estimateGrracefulTermination will estimate the graceful termination required for the specific entity in the namespace
+func estimateGracefulTermination(kubeClient clientset.Interface, groupVersionResource schema.GroupVersionResource, ns string, namespaceDeletedAt metav1.Time) (int64, error) {
+	groupResource := groupVersionResource.GroupResource()
+	glog.V(5).Infof("namespace controller - estimateGracefulTermination - group %s, resource: %s", groupResource.Group, groupResource.Resource)
+	estimate := int64(0)
+	var err error
+	switch groupResource {
+	case schema.GroupResource{Group: "", Resource: "pods"}:
+		estimate, err = estimateGracefulTerminationForPods(kubeClient, ns)
+	}
+	if err != nil {
+		return estimate, err
+	}
+	// determine if the estimate is greater than the deletion timestamp
+	duration := time.Since(namespaceDeletedAt.Time)
+	allowedEstimate := time.Duration(estimate) * time.Second
+	if duration >= allowedEstimate {
+		estimate = int64(0)
+	}
+	return estimate, nil
+}
+
+// estimateGracefulTerminationForPods determines the graceful termination period for pods in the namespace
+func estimateGracefulTerminationForPods(kubeClient clientset.Interface, ns string) (int64, error) {
+	glog.V(5).Infof("namespace controller - estimateGracefulTerminationForPods - namespace %s", ns)
+	estimate := int64(0)
+	items, err := kubeClient.Core().Pods(ns).List(v1.ListOptions{})
+	if err != nil {
+		return estimate, err
+	}
+	for i := range items.Items {
+		// filter out terminal pods
+		phase := items.Items[i].Status.Phase
+		if v1.PodSucceeded == phase || v1.PodFailed == phase {
+			continue
+		}
+		if items.Items[i].Spec.TerminationGracePeriodSeconds != nil {
+			grace := *items.Items[i].Spec.TerminationGracePeriodSeconds
+			if grace > estimate {
+				estimate = grace
+			}
+		}
+	}
+	return estimate, nil
+}

vendor/k8s.io/kubernetes/pkg/controller/node/BUILD

@@ -0,0 +1,101 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "cidr_allocator.go",
+        "cidr_set.go",
+        "controller_utils.go",
+        "doc.go",
+        "metrics.go",
+        "nodecontroller.go",
+        "rate_limited_queue.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/typed/core/v1:go_default_library",
+        "//pkg/client/record:go_default_library",
+        "//pkg/cloudprovider:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/fields:go_default_library",
+        "//pkg/kubelet/util/format:go_default_library",
+        "//pkg/util/flowcontrol:go_default_library",
+        "//pkg/util/metrics:go_default_library",
+        "//pkg/util/node:go_default_library",
+        "//pkg/util/system:go_default_library",
+        "//pkg/util/version:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/prometheus/client_golang/prometheus",
+        "//vendor:k8s.io/apimachinery/pkg/api/errors",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/labels",
+        "//vendor:k8s.io/apimachinery/pkg/types",
+        "//vendor:k8s.io/apimachinery/pkg/util/errors",
+        "//vendor:k8s.io/apimachinery/pkg/util/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/sets",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "cidr_allocator_test.go",
+        "cidr_set_test.go",
+        "nodecontroller_test.go",
+        "rate_limited_queue_test.go",
+    ],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/resource:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/extensions/v1beta1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/clientset_generated/clientset/fake:go_default_library",
+        "//pkg/client/testing/core:go_default_library",
+        "//pkg/cloudprovider:go_default_library",
+        "//pkg/cloudprovider/providers/fake:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/controller/node/testutil:go_default_library",
+        "//pkg/util/flowcontrol:go_default_library",
+        "//pkg/util/node:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/types",
+        "//vendor:k8s.io/apimachinery/pkg/util/diff",
+        "//vendor:k8s.io/apimachinery/pkg/util/sets",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//pkg/controller/node/testutil:all-srcs",
+    ],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/controller/node/OWNERS

@@ -0,0 +1,5 @@
+reviewers:
+- gmarek
+- smarterclayton
+- ingvagabund
+- aveshagarwal

vendor/k8s.io/kubernetes/pkg/controller/node/cidr_allocator.go

@@ -0,0 +1,267 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package node
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"sync"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/client/record"
+
+	"github.com/golang/glog"
+)
+
+// TODO: figure out the good setting for those constants.
+const (
+	// controls how many NodeSpec updates NC can process concurrently.
+	cidrUpdateWorkers   = 10
+	cidrUpdateQueueSize = 5000
+	// podCIDRUpdateRetry controls the number of retries of writing Node.Spec.PodCIDR update.
+	podCIDRUpdateRetry = 5
+)
+
+var errCIDRRangeNoCIDRsRemaining = errors.New("CIDR allocation failed; there are no remaining CIDRs left to allocate in the accepted range")
+
+type nodeAndCIDR struct {
+	cidr     *net.IPNet
+	nodeName string
+}
+
+// CIDRAllocator is an interface implemented by things that know how to allocate/occupy/recycle CIDR for nodes.
+type CIDRAllocator interface {
+	AllocateOrOccupyCIDR(node *v1.Node) error
+	ReleaseCIDR(node *v1.Node) error
+}
+
+type rangeAllocator struct {
+	client      clientset.Interface
+	cidrs       *cidrSet
+	clusterCIDR *net.IPNet
+	maxCIDRs    int
+	// Channel that is used to pass updating Nodes with assigned CIDRs to the background
+	// This increases a throughput of CIDR assignment by not blocking on long operations.
+	nodeCIDRUpdateChannel chan nodeAndCIDR
+	recorder              record.EventRecorder
+	// Keep a set of nodes that are currectly being processed to avoid races in CIDR allocation
+	sync.Mutex
+	nodesInProcessing sets.String
+}
+
+// NewCIDRRangeAllocator returns a CIDRAllocator to allocate CIDR for node
+// Caller must ensure subNetMaskSize is not less than cluster CIDR mask size.
+// Caller must always pass in a list of existing nodes so the new allocator
+// can initialize its CIDR map. NodeList is only nil in testing.
+func NewCIDRRangeAllocator(client clientset.Interface, clusterCIDR *net.IPNet, serviceCIDR *net.IPNet, subNetMaskSize int, nodeList *v1.NodeList) (CIDRAllocator, error) {
+	eventBroadcaster := record.NewBroadcaster()
+	recorder := eventBroadcaster.NewRecorder(v1.EventSource{Component: "cidrAllocator"})
+	eventBroadcaster.StartLogging(glog.Infof)
+
+	ra := &rangeAllocator{
+		client:                client,
+		cidrs:                 newCIDRSet(clusterCIDR, subNetMaskSize),
+		clusterCIDR:           clusterCIDR,
+		nodeCIDRUpdateChannel: make(chan nodeAndCIDR, cidrUpdateQueueSize),
+		recorder:              recorder,
+		nodesInProcessing:     sets.NewString(),
+	}
+
+	if serviceCIDR != nil {
+		ra.filterOutServiceRange(serviceCIDR)
+	} else {
+		glog.V(0).Info("No Service CIDR provided. Skipping filtering out service addresses.")
+	}
+
+	if nodeList != nil {
+		for _, node := range nodeList.Items {
+			if node.Spec.PodCIDR == "" {
+				glog.Infof("Node %v has no CIDR, ignoring", node.Name)
+				continue
+			} else {
+				glog.Infof("Node %v has CIDR %s, occupying it in CIDR map", node.Name, node.Spec.PodCIDR)
+			}
+			if err := ra.occupyCIDR(&node); err != nil {
+				// This will happen if:
+				// 1. We find garbage in the podCIDR field. Retrying is useless.
+				// 2. CIDR out of range: This means a node CIDR has changed.
+				// This error will keep crashing controller-manager.
+				return nil, err
+			}
+		}
+	}
+	for i := 0; i < cidrUpdateWorkers; i++ {
+		go func(stopChan <-chan struct{}) {
+			for {
+				select {
+				case workItem, ok := <-ra.nodeCIDRUpdateChannel:
+					if !ok {
+						glog.Warning("NodeCIDRUpdateChannel read returned false.")
+						return
+					}
+					ra.updateCIDRAllocation(workItem)
+				case <-stopChan:
+					return
+				}
+			}
+		}(wait.NeverStop)
+	}
+
+	return ra, nil
+}
+
+func (r *rangeAllocator) insertNodeToProcessing(nodeName string) bool {
+	r.Lock()
+	defer r.Unlock()
+	if r.nodesInProcessing.Has(nodeName) {
+		return false
+	}
+	r.nodesInProcessing.Insert(nodeName)
+	return true
+}
+
+func (r *rangeAllocator) removeNodeFromProcessing(nodeName string) {
+	r.Lock()
+	defer r.Unlock()
+	r.nodesInProcessing.Delete(nodeName)
+}
+
+func (r *rangeAllocator) occupyCIDR(node *v1.Node) error {
+	defer r.removeNodeFromProcessing(node.Name)
+	if node.Spec.PodCIDR == "" {
+		return nil
+	}
+	_, podCIDR, err := net.ParseCIDR(node.Spec.PodCIDR)
+	if err != nil {
+		return fmt.Errorf("failed to parse node %s, CIDR %s", node.Name, node.Spec.PodCIDR)
+	}
+	if err := r.cidrs.occupy(podCIDR); err != nil {
+		return fmt.Errorf("failed to mark cidr as occupied: %v", err)
+	}
+	return nil
+}
+
+// AllocateOrOccupyCIDR looks at the given node, assigns it a valid CIDR
+// if it doesn't currently have one or mark the CIDR as used if the node already have one.
+// WARNING: If you're adding any return calls or defer any more work from this function
+// you have to handle correctly nodesInProcessing.
+func (r *rangeAllocator) AllocateOrOccupyCIDR(node *v1.Node) error {
+	if node == nil {
+		return nil
+	}
+	if !r.insertNodeToProcessing(node.Name) {
+		glog.V(2).Infof("Node %v is already in a process of CIDR assignment.", node.Name)
+		return nil
+	}
+	if node.Spec.PodCIDR != "" {
+		return r.occupyCIDR(node)
+	}
+	podCIDR, err := r.cidrs.allocateNext()
+	if err != nil {
+		r.removeNodeFromProcessing(node.Name)
+		recordNodeStatusChange(r.recorder, node, "CIDRNotAvailable")
+		return fmt.Errorf("failed to allocate cidr: %v", err)
+	}
+
+	glog.V(10).Infof("Putting node %s with CIDR %s into the work queue", node.Name, podCIDR)
+	r.nodeCIDRUpdateChannel <- nodeAndCIDR{
+		nodeName: node.Name,
+		cidr:     podCIDR,
+	}
+	return nil
+}
+
+// ReleaseCIDR releases the CIDR of the removed node
+func (r *rangeAllocator) ReleaseCIDR(node *v1.Node) error {
+	if node == nil || node.Spec.PodCIDR == "" {
+		return nil
+	}
+	_, podCIDR, err := net.ParseCIDR(node.Spec.PodCIDR)
+	if err != nil {
+		return fmt.Errorf("Failed to parse CIDR %s on Node %v: %v", node.Spec.PodCIDR, node.Name, err)
+	}
+
+	glog.V(4).Infof("release CIDR %s", node.Spec.PodCIDR)
+	if err = r.cidrs.release(podCIDR); err != nil {
+		return fmt.Errorf("Error when releasing CIDR %v: %v", node.Spec.PodCIDR, err)
+	}
+	return err
+}
+
+// Marks all CIDRs with subNetMaskSize that belongs to serviceCIDR as used,
+// so that they won't be assignable.
+func (r *rangeAllocator) filterOutServiceRange(serviceCIDR *net.IPNet) {
+	// Checks if service CIDR has a nonempty intersection with cluster CIDR. It is the case if either
+	// clusterCIDR contains serviceCIDR with clusterCIDR's Mask applied (this means that clusterCIDR contains serviceCIDR)
+	// or vice versa (which means that serviceCIDR contains clusterCIDR).
+	if !r.clusterCIDR.Contains(serviceCIDR.IP.Mask(r.clusterCIDR.Mask)) && !serviceCIDR.Contains(r.clusterCIDR.IP.Mask(serviceCIDR.Mask)) {
+		return
+	}
+
+	if err := r.cidrs.occupy(serviceCIDR); err != nil {
+		glog.Errorf("Error filtering out service cidr %v: %v", serviceCIDR, err)
+	}
+}
+
+// Assigns CIDR to Node and sends an update to the API server.
+func (r *rangeAllocator) updateCIDRAllocation(data nodeAndCIDR) error {
+	var err error
+	var node *v1.Node
+	defer r.removeNodeFromProcessing(data.nodeName)
+	for rep := 0; rep < podCIDRUpdateRetry; rep++ {
+		// TODO: change it to using PATCH instead of full Node updates.
+		node, err = r.client.Core().Nodes().Get(data.nodeName, metav1.GetOptions{})
+		if err != nil {
+			glog.Errorf("Failed while getting node %v to retry updating Node.Spec.PodCIDR: %v", data.nodeName, err)
+			continue
+		}
+		if node.Spec.PodCIDR != "" {
+			glog.Errorf("Node %v already has allocated CIDR %v. Releasing assigned one if different.", node.Name, node.Spec.PodCIDR)
+			if node.Spec.PodCIDR != data.cidr.String() {
+				if err := r.cidrs.release(data.cidr); err != nil {
+					glog.Errorf("Error when releasing CIDR %v", data.cidr.String())
+				}
+			}
+			return nil
+		}
+		node.Spec.PodCIDR = data.cidr.String()
+		if _, err := r.client.Core().Nodes().Update(node); err != nil {
+			glog.Errorf("Failed while updating Node.Spec.PodCIDR (%d retries left): %v", podCIDRUpdateRetry-rep-1, err)
+		} else {
+			break
+		}
+	}
+	if err != nil {
+		recordNodeStatusChange(r.recorder, node, "CIDRAssignmentFailed")
+		// We accept the fact that we may leek CIDRs here. This is safer than releasing
+		// them in case when we don't know if request went through.
+		// NodeController restart will return all falsely allocated CIDRs to the pool.
+		if !apierrors.IsServerTimeout(err) {
+			glog.Errorf("CIDR assignment for node %v failed: %v. Releasing allocated CIDR", data.nodeName, err)
+			if releaseErr := r.cidrs.release(data.cidr); releaseErr != nil {
+				glog.Errorf("Error releasing allocated CIDR for node %v: %v", data.nodeName, releaseErr)
+			}
+		}
+	}
+	return err
+}