Switch to github.com/golang/dep for vendoring

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

vendor/k8s.io/kubernetes/pkg/quota/BUILD

@@ -0,0 +1,56 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "interfaces.go",
+        "resources.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/admission:go_default_library",
+        "//pkg/api:go_default_library",
+        "//pkg/api/resource:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/util/sets",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["resources_test.go"],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/resource:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//pkg/quota/evaluator/core:all-srcs",
+        "//pkg/quota/generic:all-srcs",
+        "//pkg/quota/install:all-srcs",
+    ],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/quota/OWNERS

@@ -0,0 +1,8 @@
+approvers:
+- derekwaynecarr
+- vishh
+reviewers:
+- smarterclayton
+- deads2k
+- derekwaynecarr
+- vishh

vendor/k8s.io/kubernetes/pkg/quota/evaluator/OWNERS

@@ -0,0 +1,5 @@
+reviewers:
+- smarterclayton
+- deads2k
+- derekwaynecarr
+- vishh

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/BUILD

@@ -0,0 +1,74 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "configmap.go",
+        "doc.go",
+        "persistent_volume_claims.go",
+        "pods.go",
+        "registry.go",
+        "replication_controllers.go",
+        "resource_quotas.go",
+        "secrets.go",
+        "services.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/admission:go_default_library",
+        "//pkg/api:go_default_library",
+        "//pkg/api/resource:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/api/validation:go_default_library",
+        "//pkg/apis/storage/util:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/kubelet/qos:go_default_library",
+        "//pkg/quota:go_default_library",
+        "//pkg/quota/generic:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/util/sets",
+        "//vendor:k8s.io/apimachinery/pkg/util/validation/field",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "persistent_volume_claims_test.go",
+        "pods_test.go",
+        "services_test.go",
+    ],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/resource:go_default_library",
+        "//pkg/apis/storage/util:go_default_library",
+        "//pkg/client/clientset_generated/clientset/fake:go_default_library",
+        "//pkg/quota:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/configmap.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// NewConfigMapEvaluator returns an evaluator that can evaluate configMaps
+func NewConfigMapEvaluator(kubeClient clientset.Interface) quota.Evaluator {
+	return &generic.ObjectCountEvaluator{
+		AllowCreateOnUpdate: false,
+		InternalGroupKind:   api.Kind("ConfigMap"),
+		ResourceName:        api.ResourceConfigMaps,
+		ListFuncByNamespace: func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
+			itemList, err := kubeClient.Core().ConfigMaps(namespace).List(options)
+			if err != nil {
+				return nil, err
+			}
+			results := make([]runtime.Object, 0, len(itemList.Items))
+			for i := range itemList.Items {
+				results = append(results, &itemList.Items[i])
+			}
+			return results, nil
+		},
+	}
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/doc.go

@@ -0,0 +1,18 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// core contains modules that interface with the core api group
+package core // import "k8s.io/kubernetes/pkg/quota/evaluator/core"

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/persistent_volume_claims.go

@@ -0,0 +1,220 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/admission"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/apis/storage/util"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// pvcResources are the set of static resources managed by quota associated with pvcs.
+// for each resouce in this list, it may be refined dynamically based on storage class.
+var pvcResources = []api.ResourceName{
+	api.ResourcePersistentVolumeClaims,
+	api.ResourceRequestsStorage,
+}
+
+// storageClassSuffix is the suffix to the qualified portion of storage class resource name.
+// For example, if you want to quota storage by storage class, you would have a declaration
+// that follows <storage-class>.storageclass.storage.k8s.io/<resource>.
+// For example:
+// * gold.storageclass.storage.k8s.io/: 500Gi
+// * bronze.storageclass.storage.k8s.io/requests.storage: 500Gi
+const storageClassSuffix string = ".storageclass.storage.k8s.io/"
+
+// ResourceByStorageClass returns a quota resource name by storage class.
+func ResourceByStorageClass(storageClass string, resourceName api.ResourceName) api.ResourceName {
+	return api.ResourceName(string(storageClass + storageClassSuffix + string(resourceName)))
+}
+
+// V1ResourceByStorageClass returns a quota resource name by storage class.
+func V1ResourceByStorageClass(storageClass string, resourceName v1.ResourceName) v1.ResourceName {
+	return v1.ResourceName(string(storageClass + storageClassSuffix + string(resourceName)))
+}
+
+// listPersistentVolumeClaimsByNamespaceFuncUsingClient returns a pvc listing function based on the provided client.
+func listPersistentVolumeClaimsByNamespaceFuncUsingClient(kubeClient clientset.Interface) generic.ListFuncByNamespace {
+	// TODO: ideally, we could pass dynamic client pool down into this code, and have one way of doing this.
+	// unfortunately, dynamic client works with Unstructured objects, and when we calculate Usage, we require
+	// structured objects.
+	return func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
+		itemList, err := kubeClient.Core().PersistentVolumeClaims(namespace).List(options)
+		if err != nil {
+			return nil, err
+		}
+		results := make([]runtime.Object, 0, len(itemList.Items))
+		for i := range itemList.Items {
+			results = append(results, &itemList.Items[i])
+		}
+		return results, nil
+	}
+}
+
+// NewPersistentVolumeClaimEvaluator returns an evaluator that can evaluate persistent volume claims
+// if the specified shared informer factory is not nil, evaluator may use it to support listing functions.
+func NewPersistentVolumeClaimEvaluator(kubeClient clientset.Interface, f informers.SharedInformerFactory) quota.Evaluator {
+	listFuncByNamespace := listPersistentVolumeClaimsByNamespaceFuncUsingClient(kubeClient)
+	if f != nil {
+		listFuncByNamespace = generic.ListResourceUsingInformerFunc(f, schema.GroupResource{Resource: "persistentvolumeclaims"})
+	}
+	return &pvcEvaluator{
+		listFuncByNamespace: listFuncByNamespace,
+	}
+}
+
+// pvcEvaluator knows how to evaluate quota usage for persistent volume claims
+type pvcEvaluator struct {
+	// listFuncByNamespace knows how to list pvc claims
+	listFuncByNamespace generic.ListFuncByNamespace
+}
+
+// Constraints verifies that all required resources are present on the item.
+func (p *pvcEvaluator) Constraints(required []api.ResourceName, item runtime.Object) error {
+	pvc, ok := item.(*api.PersistentVolumeClaim)
+	if !ok {
+		return fmt.Errorf("unexpected input object %v", item)
+	}
+
+	// these are the items that we will be handling based on the objects actual storage-class
+	pvcRequiredSet := append([]api.ResourceName{}, pvcResources...)
+	if storageClassRef := util.GetClaimStorageClass(pvc); len(storageClassRef) > 0 {
+		pvcRequiredSet = append(pvcRequiredSet, ResourceByStorageClass(storageClassRef, api.ResourcePersistentVolumeClaims))
+		pvcRequiredSet = append(pvcRequiredSet, ResourceByStorageClass(storageClassRef, api.ResourceRequestsStorage))
+	}
+
+	// in effect, this will remove things from the required set that are not tied to this pvcs storage class
+	// for example, if a quota has bronze and gold storage class items defined, we should not error a bronze pvc for not being gold.
+	// but we should error a bronze pvc if it doesn't make a storage request size...
+	requiredResources := quota.Intersection(required, pvcRequiredSet)
+	requiredSet := quota.ToSet(requiredResources)
+
+	// usage for this pvc will only include global pvc items + this storage class specific items
+	pvcUsage, err := p.Usage(item)
+	if err != nil {
+		return err
+	}
+
+	// determine what required resources were not tracked by usage.
+	missingSet := sets.NewString()
+	pvcSet := quota.ToSet(quota.ResourceNames(pvcUsage))
+	if diff := requiredSet.Difference(pvcSet); len(diff) > 0 {
+		missingSet.Insert(diff.List()...)
+	}
+	if len(missingSet) == 0 {
+		return nil
+	}
+	return fmt.Errorf("must specify %s", strings.Join(missingSet.List(), ","))
+}
+
+// GroupKind that this evaluator tracks
+func (p *pvcEvaluator) GroupKind() schema.GroupKind {
+	return api.Kind("PersistentVolumeClaim")
+}
+
+// Handles returns true if the evalutor should handle the specified operation.
+func (p *pvcEvaluator) Handles(operation admission.Operation) bool {
+	return admission.Create == operation
+}
+
+// Matches returns true if the evaluator matches the specified quota with the provided input item
+func (p *pvcEvaluator) Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error) {
+	return generic.Matches(resourceQuota, item, p.MatchingResources, generic.MatchesNoScopeFunc)
+}
+
+// MatchingResources takes the input specified list of resources and returns the set of resources it matches.
+func (p *pvcEvaluator) MatchingResources(items []api.ResourceName) []api.ResourceName {
+	result := []api.ResourceName{}
+	for _, item := range items {
+		if quota.Contains(pvcResources, item) {
+			result = append(result, item)
+			continue
+		}
+		// match pvc resources scoped by storage class (<storage-class-name>.storage-class.kubernetes.io/<resource>)
+		for _, resource := range pvcResources {
+			byStorageClass := storageClassSuffix + string(resource)
+			if strings.HasSuffix(string(item), byStorageClass) {
+				result = append(result, item)
+				break
+			}
+		}
+	}
+	return result
+}
+
+// Usage knows how to measure usage associated with item.
+func (p *pvcEvaluator) Usage(item runtime.Object) (api.ResourceList, error) {
+	result := api.ResourceList{}
+	pvc, err := toInternalPersistentVolumeClaimOrError(item)
+	if err != nil {
+		return result, err
+	}
+	storageClassRef := util.GetClaimStorageClass(pvc)
+
+	// charge for claim
+	result[api.ResourcePersistentVolumeClaims] = resource.MustParse("1")
+	if len(storageClassRef) > 0 {
+		storageClassClaim := api.ResourceName(storageClassRef + storageClassSuffix + string(api.ResourcePersistentVolumeClaims))
+		result[storageClassClaim] = resource.MustParse("1")
+	}
+
+	// charge for storage
+	if request, found := pvc.Spec.Resources.Requests[api.ResourceStorage]; found {
+		result[api.ResourceRequestsStorage] = request
+		// charge usage to the storage class (if present)
+		if len(storageClassRef) > 0 {
+			storageClassStorage := api.ResourceName(storageClassRef + storageClassSuffix + string(api.ResourceRequestsStorage))
+			result[storageClassStorage] = request
+		}
+	}
+	return result, nil
+}
+
+// UsageStats calculates aggregate usage for the object.
+func (p *pvcEvaluator) UsageStats(options quota.UsageStatsOptions) (quota.UsageStats, error) {
+	return generic.CalculateUsageStats(options, p.listFuncByNamespace, generic.MatchesNoScopeFunc, p.Usage)
+}
+
+// ensure we implement required interface
+var _ quota.Evaluator = &pvcEvaluator{}
+
+func toInternalPersistentVolumeClaimOrError(obj runtime.Object) (*api.PersistentVolumeClaim, error) {
+	pvc := &api.PersistentVolumeClaim{}
+	switch t := obj.(type) {
+	case *v1.PersistentVolumeClaim:
+		if err := v1.Convert_v1_PersistentVolumeClaim_To_api_PersistentVolumeClaim(t, pvc, nil); err != nil {
+			return nil, err
+		}
+	case *api.PersistentVolumeClaim:
+		pvc = t
+	default:
+		return nil, fmt.Errorf("expect *api.PersistentVolumeClaim or *v1.PersistentVolumeClaim, got %v", t)
+	}
+	return pvc, nil
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/persistent_volume_claims_test.go

@@ -0,0 +1,278 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/apis/storage/util"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/fake"
+	"k8s.io/kubernetes/pkg/quota"
+)
+
+func testVolumeClaim(name string, namespace string, spec api.PersistentVolumeClaimSpec) *api.PersistentVolumeClaim {
+	return &api.PersistentVolumeClaim{
+		ObjectMeta: api.ObjectMeta{Name: name, Namespace: namespace},
+		Spec:       spec,
+	}
+}
+
+func TestPersistentVolumeClaimsConstraintsFunc(t *testing.T) {
+	validClaim := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{
+				api.ResourceName(api.ResourceStorage): resource.MustParse("10G"),
+			},
+		},
+	})
+	validClaimGoldStorageClass := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{
+				api.ResourceName(api.ResourceStorage): resource.MustParse("10Gi"),
+			},
+		},
+	})
+	validClaimGoldStorageClass.Annotations = map[string]string{
+		util.StorageClassAnnotation: "gold",
+	}
+
+	validClaimBronzeStorageClass := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{
+				api.ResourceName(api.ResourceStorage): resource.MustParse("10Gi"),
+			},
+		},
+	})
+	validClaimBronzeStorageClass.Annotations = map[string]string{
+		util.StorageClassAnnotation: "bronze",
+	}
+
+	missingStorage := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{},
+		},
+	})
+
+	missingGoldStorage := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{},
+		},
+	})
+	missingGoldStorage.Annotations = map[string]string{
+		util.StorageClassAnnotation: "gold",
+	}
+
+	testCases := map[string]struct {
+		pvc      *api.PersistentVolumeClaim
+		required []api.ResourceName
+		err      string
+	}{
+		"missing storage": {
+			pvc:      missingStorage,
+			required: []api.ResourceName{api.ResourceRequestsStorage},
+			err:      `must specify requests.storage`,
+		},
+		"missing gold storage": {
+			pvc:      missingGoldStorage,
+			required: []api.ResourceName{ResourceByStorageClass("gold", api.ResourceRequestsStorage)},
+			err:      `must specify gold.storageclass.storage.k8s.io/requests.storage`,
+		},
+		"valid-claim-quota-storage": {
+			pvc:      validClaim,
+			required: []api.ResourceName{api.ResourceRequestsStorage},
+		},
+		"valid-claim-quota-pvc": {
+			pvc:      validClaim,
+			required: []api.ResourceName{api.ResourcePersistentVolumeClaims},
+		},
+		"valid-claim-quota-storage-and-pvc": {
+			pvc:      validClaim,
+			required: []api.ResourceName{api.ResourceRequestsStorage, api.ResourcePersistentVolumeClaims},
+		},
+		"valid-claim-gold-quota-gold": {
+			pvc: validClaimGoldStorageClass,
+			required: []api.ResourceName{
+				api.ResourceRequestsStorage,
+				api.ResourcePersistentVolumeClaims,
+				ResourceByStorageClass("gold", api.ResourceRequestsStorage),
+				ResourceByStorageClass("gold", api.ResourcePersistentVolumeClaims),
+			},
+		},
+		"valid-claim-bronze-with-quota-gold": {
+			pvc: validClaimBronzeStorageClass,
+			required: []api.ResourceName{
+				api.ResourceRequestsStorage,
+				api.ResourcePersistentVolumeClaims,
+				ResourceByStorageClass("gold", api.ResourceRequestsStorage),
+				ResourceByStorageClass("gold", api.ResourcePersistentVolumeClaims),
+			},
+		},
+	}
+
+	kubeClient := fake.NewSimpleClientset()
+	evaluator := NewPersistentVolumeClaimEvaluator(kubeClient, nil)
+	for testName, test := range testCases {
+		err := evaluator.Constraints(test.required, test.pvc)
+		switch {
+		case err != nil && len(test.err) == 0,
+			err == nil && len(test.err) != 0,
+			err != nil && test.err != err.Error():
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
+	}
+}
+
+func TestPersistentVolumeClaimEvaluatorUsage(t *testing.T) {
+	validClaim := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{
+				api.ResourceName(api.ResourceStorage): resource.MustParse("10Gi"),
+			},
+		},
+	})
+	validClaimByStorageClass := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{
+				api.ResourceName(api.ResourceStorage): resource.MustParse("10Gi"),
+			},
+		},
+	})
+	storageClassName := "gold"
+	validClaimByStorageClass.Annotations = map[string]string{
+		util.StorageClassAnnotation: storageClassName,
+	}
+
+	kubeClient := fake.NewSimpleClientset()
+	evaluator := NewPersistentVolumeClaimEvaluator(kubeClient, nil)
+	testCases := map[string]struct {
+		pvc   *api.PersistentVolumeClaim
+		usage api.ResourceList
+	}{
+		"pvc-usage": {
+			pvc: validClaim,
+			usage: api.ResourceList{
+				api.ResourceRequestsStorage:        resource.MustParse("10Gi"),
+				api.ResourcePersistentVolumeClaims: resource.MustParse("1"),
+			},
+		},
+		"pvc-usage-by-class": {
+			pvc: validClaimByStorageClass,
+			usage: api.ResourceList{
+				api.ResourceRequestsStorage:                                                  resource.MustParse("10Gi"),
+				api.ResourcePersistentVolumeClaims:                                           resource.MustParse("1"),
+				ResourceByStorageClass(storageClassName, api.ResourceRequestsStorage):        resource.MustParse("10Gi"),
+				ResourceByStorageClass(storageClassName, api.ResourcePersistentVolumeClaims): resource.MustParse("1"),
+			},
+		},
+	}
+	for testName, testCase := range testCases {
+		actual, err := evaluator.Usage(testCase.pvc)
+		if err != nil {
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
+		if !quota.Equals(testCase.usage, actual) {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.usage, actual)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/pods.go

@@ -0,0 +1,278 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/kubernetes/pkg/admission"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/api/validation"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/kubelet/qos"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// podResources are the set of resources managed by quota associated with pods.
+var podResources = []api.ResourceName{
+	api.ResourceCPU,
+	api.ResourceMemory,
+	api.ResourceRequestsCPU,
+	api.ResourceRequestsMemory,
+	api.ResourceLimitsCPU,
+	api.ResourceLimitsMemory,
+	api.ResourcePods,
+}
+
+// listPodsByNamespaceFuncUsingClient returns a pod listing function based on the provided client.
+func listPodsByNamespaceFuncUsingClient(kubeClient clientset.Interface) generic.ListFuncByNamespace {
+	// TODO: ideally, we could pass dynamic client pool down into this code, and have one way of doing this.
+	// unfortunately, dynamic client works with Unstructured objects, and when we calculate Usage, we require
+	// structured objects.
+	return func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
+		itemList, err := kubeClient.Core().Pods(namespace).List(options)
+		if err != nil {
+			return nil, err
+		}
+		results := make([]runtime.Object, 0, len(itemList.Items))
+		for i := range itemList.Items {
+			results = append(results, &itemList.Items[i])
+		}
+		return results, nil
+	}
+}
+
+// NewPodEvaluator returns an evaluator that can evaluate pods
+// if the specified shared informer factory is not nil, evaluator may use it to support listing functions.
+func NewPodEvaluator(kubeClient clientset.Interface, f informers.SharedInformerFactory) quota.Evaluator {
+	listFuncByNamespace := listPodsByNamespaceFuncUsingClient(kubeClient)
+	if f != nil {
+		listFuncByNamespace = generic.ListResourceUsingInformerFunc(f, schema.GroupResource{Resource: "pods"})
+	}
+	return &podEvaluator{
+		listFuncByNamespace: listFuncByNamespace,
+	}
+}
+
+// podEvaluator knows how to measure usage of pods.
+type podEvaluator struct {
+	// knows how to list pods
+	listFuncByNamespace generic.ListFuncByNamespace
+}
+
+// Constraints verifies that all required resources are present on the pod
+// In addition, it validates that the resources are valid (i.e. requests < limits)
+func (p *podEvaluator) Constraints(required []api.ResourceName, item runtime.Object) error {
+	pod, ok := item.(*api.Pod)
+	if !ok {
+		return fmt.Errorf("Unexpected input object %v", item)
+	}
+
+	// Pod level resources are often set during admission control
+	// As a consequence, we want to verify that resources are valid prior
+	// to ever charging quota prematurely in case they are not.
+	allErrs := field.ErrorList{}
+	fldPath := field.NewPath("spec").Child("containers")
+	for i, ctr := range pod.Spec.Containers {
+		allErrs = append(allErrs, validation.ValidateResourceRequirements(&ctr.Resources, fldPath.Index(i).Child("resources"))...)
+	}
+	fldPath = field.NewPath("spec").Child("initContainers")
+	for i, ctr := range pod.Spec.InitContainers {
+		allErrs = append(allErrs, validation.ValidateResourceRequirements(&ctr.Resources, fldPath.Index(i).Child("resources"))...)
+	}
+	if len(allErrs) > 0 {
+		return allErrs.ToAggregate()
+	}
+
+	// TODO: fix this when we have pod level resource requirements
+	// since we do not yet pod level requests/limits, we need to ensure each
+	// container makes an explict request or limit for a quota tracked resource
+	requiredSet := quota.ToSet(required)
+	missingSet := sets.NewString()
+	for i := range pod.Spec.Containers {
+		enforcePodContainerConstraints(&pod.Spec.Containers[i], requiredSet, missingSet)
+	}
+	for i := range pod.Spec.InitContainers {
+		enforcePodContainerConstraints(&pod.Spec.InitContainers[i], requiredSet, missingSet)
+	}
+	if len(missingSet) == 0 {
+		return nil
+	}
+	return fmt.Errorf("must specify %s", strings.Join(missingSet.List(), ","))
+}
+
+// GroupKind that this evaluator tracks
+func (p *podEvaluator) GroupKind() schema.GroupKind {
+	return api.Kind("Pod")
+}
+
+// Handles returns true of the evalutor should handle the specified operation.
+func (p *podEvaluator) Handles(operation admission.Operation) bool {
+	// TODO: update this if/when pods support resizing resource requirements.
+	return admission.Create == operation
+}
+
+// Matches returns true if the evaluator matches the specified quota with the provided input item
+func (p *podEvaluator) Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error) {
+	return generic.Matches(resourceQuota, item, p.MatchingResources, podMatchesScopeFunc)
+}
+
+// MatchingResources takes the input specified list of resources and returns the set of resources it matches.
+func (p *podEvaluator) MatchingResources(input []api.ResourceName) []api.ResourceName {
+	return quota.Intersection(input, podResources)
+}
+
+// Usage knows how to measure usage associated with pods
+func (p *podEvaluator) Usage(item runtime.Object) (api.ResourceList, error) {
+	return PodUsageFunc(item)
+}
+
+// UsageStats calculates aggregate usage for the object.
+func (p *podEvaluator) UsageStats(options quota.UsageStatsOptions) (quota.UsageStats, error) {
+	return generic.CalculateUsageStats(options, p.listFuncByNamespace, podMatchesScopeFunc, p.Usage)
+}
+
+// verifies we implement the required interface.
+var _ quota.Evaluator = &podEvaluator{}
+
+// enforcePodContainerConstraints checks for required resources that are not set on this container and
+// adds them to missingSet.
+func enforcePodContainerConstraints(container *api.Container, requiredSet, missingSet sets.String) {
+	requests := container.Resources.Requests
+	limits := container.Resources.Limits
+	containerUsage := podUsageHelper(requests, limits)
+	containerSet := quota.ToSet(quota.ResourceNames(containerUsage))
+	if !containerSet.Equal(requiredSet) {
+		difference := requiredSet.Difference(containerSet)
+		missingSet.Insert(difference.List()...)
+	}
+}
+
+// podUsageHelper can summarize the pod quota usage based on requests and limits
+func podUsageHelper(requests api.ResourceList, limits api.ResourceList) api.ResourceList {
+	result := api.ResourceList{}
+	result[api.ResourcePods] = resource.MustParse("1")
+	if request, found := requests[api.ResourceCPU]; found {
+		result[api.ResourceCPU] = request
+		result[api.ResourceRequestsCPU] = request
+	}
+	if limit, found := limits[api.ResourceCPU]; found {
+		result[api.ResourceLimitsCPU] = limit
+	}
+	if request, found := requests[api.ResourceMemory]; found {
+		result[api.ResourceMemory] = request
+		result[api.ResourceRequestsMemory] = request
+	}
+	if limit, found := limits[api.ResourceMemory]; found {
+		result[api.ResourceLimitsMemory] = limit
+	}
+	return result
+}
+
+func toInternalPodOrError(obj runtime.Object) (*api.Pod, error) {
+	pod := &api.Pod{}
+	switch t := obj.(type) {
+	case *v1.Pod:
+		if err := v1.Convert_v1_Pod_To_api_Pod(t, pod, nil); err != nil {
+			return nil, err
+		}
+	case *api.Pod:
+		pod = t
+	default:
+		return nil, fmt.Errorf("expect *api.Pod or *v1.Pod, got %v", t)
+	}
+	return pod, nil
+}
+
+// podMatchesScopeFunc is a function that knows how to evaluate if a pod matches a scope
+func podMatchesScopeFunc(scope api.ResourceQuotaScope, object runtime.Object) (bool, error) {
+	pod, err := toInternalPodOrError(object)
+	if err != nil {
+		return false, err
+	}
+	switch scope {
+	case api.ResourceQuotaScopeTerminating:
+		return isTerminating(pod), nil
+	case api.ResourceQuotaScopeNotTerminating:
+		return !isTerminating(pod), nil
+	case api.ResourceQuotaScopeBestEffort:
+		return isBestEffort(pod), nil
+	case api.ResourceQuotaScopeNotBestEffort:
+		return !isBestEffort(pod), nil
+	}
+	return false, nil
+}
+
+// PodUsageFunc knows how to measure usage associated with pods
+func PodUsageFunc(obj runtime.Object) (api.ResourceList, error) {
+	pod, err := toInternalPodOrError(obj)
+	if err != nil {
+		return api.ResourceList{}, err
+	}
+	// by convention, we do not quota pods that have reached an end-of-life state
+	if !QuotaPod(pod) {
+		return api.ResourceList{}, nil
+	}
+	requests := api.ResourceList{}
+	limits := api.ResourceList{}
+	// TODO: fix this when we have pod level cgroups
+	// when we have pod level cgroups, we can just read pod level requests/limits
+	for i := range pod.Spec.Containers {
+		requests = quota.Add(requests, pod.Spec.Containers[i].Resources.Requests)
+		limits = quota.Add(limits, pod.Spec.Containers[i].Resources.Limits)
+	}
+	// InitContainers are run sequentially before other containers start, so the highest
+	// init container resource is compared against the sum of app containers to determine
+	// the effective usage for both requests and limits.
+	for i := range pod.Spec.InitContainers {
+		requests = quota.Max(requests, pod.Spec.InitContainers[i].Resources.Requests)
+		limits = quota.Max(limits, pod.Spec.InitContainers[i].Resources.Limits)
+	}
+
+	return podUsageHelper(requests, limits), nil
+}
+
+func isBestEffort(pod *api.Pod) bool {
+	return qos.InternalGetPodQOS(pod) == api.PodQOSBestEffort
+}
+
+func isTerminating(pod *api.Pod) bool {
+	if pod.Spec.ActiveDeadlineSeconds != nil && *pod.Spec.ActiveDeadlineSeconds >= int64(0) {
+		return true
+	}
+	return false
+}
+
+// QuotaPod returns true if the pod is eligible to track against a quota
+func QuotaPod(pod *api.Pod) bool {
+	return !(api.PodFailed == pod.Status.Phase || api.PodSucceeded == pod.Status.Phase)
+}
+
+// QuotaV1Pod returns true if the pod is eligible to track against a quota
+// if it's not in a terminal state according to its phase.
+func QuotaV1Pod(pod *v1.Pod) bool {
+	return !(v1.PodFailed == pod.Status.Phase || v1.PodSucceeded == pod.Status.Phase)
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/pods_test.go

@@ -0,0 +1,258 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/fake"
+	"k8s.io/kubernetes/pkg/quota"
+)
+
+func TestPodConstraintsFunc(t *testing.T) {
+	testCases := map[string]struct {
+		pod      *api.Pod
+		required []api.ResourceName
+		err      string
+	}{
+		"init container resource invalid": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					InitContainers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceCPU: resource.MustParse("2m")},
+							Limits:   api.ResourceList{api.ResourceCPU: resource.MustParse("1m")},
+						},
+					}},
+				},
+			},
+			err: `spec.initContainers[0].resources.limits: Invalid value: "1m": must be greater than or equal to cpu request`,
+		},
+		"container resource invalid": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					Containers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceCPU: resource.MustParse("2m")},
+							Limits:   api.ResourceList{api.ResourceCPU: resource.MustParse("1m")},
+						},
+					}},
+				},
+			},
+			err: `spec.containers[0].resources.limits: Invalid value: "1m": must be greater than or equal to cpu request`,
+		},
+		"init container resource missing": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					InitContainers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceCPU: resource.MustParse("1m")},
+							Limits:   api.ResourceList{api.ResourceCPU: resource.MustParse("2m")},
+						},
+					}},
+				},
+			},
+			required: []api.ResourceName{api.ResourceMemory},
+			err:      `must specify memory`,
+		},
+		"container resource missing": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					Containers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceCPU: resource.MustParse("1m")},
+							Limits:   api.ResourceList{api.ResourceCPU: resource.MustParse("2m")},
+						},
+					}},
+				},
+			},
+			required: []api.ResourceName{api.ResourceMemory},
+			err:      `must specify memory`,
+		},
+	}
+	kubeClient := fake.NewSimpleClientset()
+	evaluator := NewPodEvaluator(kubeClient, nil)
+	for testName, test := range testCases {
+		err := evaluator.Constraints(test.required, test.pod)
+		switch {
+		case err != nil && len(test.err) == 0,
+			err == nil && len(test.err) != 0,
+			err != nil && test.err != err.Error():
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
+	}
+}
+
+func TestPodEvaluatorUsage(t *testing.T) {
+	kubeClient := fake.NewSimpleClientset()
+	evaluator := NewPodEvaluator(kubeClient, nil)
+	testCases := map[string]struct {
+		pod   *api.Pod
+		usage api.ResourceList
+	}{
+		"init container CPU": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					InitContainers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceCPU: resource.MustParse("1m")},
+							Limits:   api.ResourceList{api.ResourceCPU: resource.MustParse("2m")},
+						},
+					}},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceRequestsCPU: resource.MustParse("1m"),
+				api.ResourceLimitsCPU:   resource.MustParse("2m"),
+				api.ResourcePods:        resource.MustParse("1"),
+				api.ResourceCPU:         resource.MustParse("1m"),
+			},
+		},
+		"init container MEM": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					InitContainers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceMemory: resource.MustParse("1m")},
+							Limits:   api.ResourceList{api.ResourceMemory: resource.MustParse("2m")},
+						},
+					}},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceRequestsMemory: resource.MustParse("1m"),
+				api.ResourceLimitsMemory:   resource.MustParse("2m"),
+				api.ResourcePods:           resource.MustParse("1"),
+				api.ResourceMemory:         resource.MustParse("1m"),
+			},
+		},
+		"container CPU": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					Containers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceCPU: resource.MustParse("1m")},
+							Limits:   api.ResourceList{api.ResourceCPU: resource.MustParse("2m")},
+						},
+					}},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceRequestsCPU: resource.MustParse("1m"),
+				api.ResourceLimitsCPU:   resource.MustParse("2m"),
+				api.ResourcePods:        resource.MustParse("1"),
+				api.ResourceCPU:         resource.MustParse("1m"),
+			},
+		},
+		"container MEM": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					Containers: []api.Container{{
+						Resources: api.ResourceRequirements{
+							Requests: api.ResourceList{api.ResourceMemory: resource.MustParse("1m")},
+							Limits:   api.ResourceList{api.ResourceMemory: resource.MustParse("2m")},
+						},
+					}},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceRequestsMemory: resource.MustParse("1m"),
+				api.ResourceLimitsMemory:   resource.MustParse("2m"),
+				api.ResourcePods:           resource.MustParse("1"),
+				api.ResourceMemory:         resource.MustParse("1m"),
+			},
+		},
+		"init container maximums override sum of containers": {
+			pod: &api.Pod{
+				Spec: api.PodSpec{
+					InitContainers: []api.Container{
+						{
+							Resources: api.ResourceRequirements{
+								Requests: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("4"),
+									api.ResourceMemory: resource.MustParse("100M"),
+								},
+								Limits: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("8"),
+									api.ResourceMemory: resource.MustParse("200M"),
+								},
+							},
+						},
+						{
+							Resources: api.ResourceRequirements{
+								Requests: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("1"),
+									api.ResourceMemory: resource.MustParse("50M"),
+								},
+								Limits: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("2"),
+									api.ResourceMemory: resource.MustParse("100M"),
+								},
+							},
+						},
+					},
+					Containers: []api.Container{
+						{
+							Resources: api.ResourceRequirements{
+								Requests: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("1"),
+									api.ResourceMemory: resource.MustParse("50M"),
+								},
+								Limits: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("2"),
+									api.ResourceMemory: resource.MustParse("100M"),
+								},
+							},
+						},
+						{
+							Resources: api.ResourceRequirements{
+								Requests: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("2"),
+									api.ResourceMemory: resource.MustParse("25M"),
+								},
+								Limits: api.ResourceList{
+									api.ResourceCPU:    resource.MustParse("5"),
+									api.ResourceMemory: resource.MustParse("50M"),
+								},
+							},
+						},
+					},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceRequestsCPU:    resource.MustParse("4"),
+				api.ResourceRequestsMemory: resource.MustParse("100M"),
+				api.ResourceLimitsCPU:      resource.MustParse("8"),
+				api.ResourceLimitsMemory:   resource.MustParse("200M"),
+				api.ResourcePods:           resource.MustParse("1"),
+				api.ResourceCPU:            resource.MustParse("4"),
+				api.ResourceMemory:         resource.MustParse("100M"),
+			},
+		},
+	}
+	for testName, testCase := range testCases {
+		actual, err := evaluator.Usage(testCase.pod)
+		if err != nil {
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
+		if !quota.Equals(testCase.usage, actual) {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.usage, actual)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/registry.go

@@ -0,0 +1,48 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// NewRegistry returns a registry that knows how to deal with core kubernetes resources
+// If an informer factory is provided, evaluators will use them.
+func NewRegistry(kubeClient clientset.Interface, f informers.SharedInformerFactory) quota.Registry {
+	pod := NewPodEvaluator(kubeClient, f)
+	service := NewServiceEvaluator(kubeClient)
+	replicationController := NewReplicationControllerEvaluator(kubeClient)
+	resourceQuota := NewResourceQuotaEvaluator(kubeClient)
+	secret := NewSecretEvaluator(kubeClient)
+	configMap := NewConfigMapEvaluator(kubeClient)
+	persistentVolumeClaim := NewPersistentVolumeClaimEvaluator(kubeClient, f)
+	return &generic.GenericRegistry{
+		InternalEvaluators: map[schema.GroupKind]quota.Evaluator{
+			pod.GroupKind():                   pod,
+			service.GroupKind():               service,
+			replicationController.GroupKind(): replicationController,
+			secret.GroupKind():                secret,
+			configMap.GroupKind():             configMap,
+			resourceQuota.GroupKind():         resourceQuota,
+			persistentVolumeClaim.GroupKind(): persistentVolumeClaim,
+		},
+	}
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/replication_controllers.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// NewReplicationControllerEvaluator returns an evaluator that can evaluate replication controllers
+func NewReplicationControllerEvaluator(kubeClient clientset.Interface) quota.Evaluator {
+	return &generic.ObjectCountEvaluator{
+		AllowCreateOnUpdate: false,
+		InternalGroupKind:   api.Kind("ReplicationController"),
+		ResourceName:        api.ResourceReplicationControllers,
+		ListFuncByNamespace: func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
+			itemList, err := kubeClient.Core().ReplicationControllers(namespace).List(options)
+			if err != nil {
+				return nil, err
+			}
+			results := make([]runtime.Object, 0, len(itemList.Items))
+			for i := range itemList.Items {
+				results = append(results, &itemList.Items[i])
+			}
+			return results, nil
+		},
+	}
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/resource_quotas.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// NewResourceQuotaEvaluator returns an evaluator that can evaluate resource quotas
+func NewResourceQuotaEvaluator(kubeClient clientset.Interface) quota.Evaluator {
+	return &generic.ObjectCountEvaluator{
+		AllowCreateOnUpdate: false,
+		InternalGroupKind:   api.Kind("ResourceQuota"),
+		ResourceName:        api.ResourceQuotas,
+		ListFuncByNamespace: func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
+			itemList, err := kubeClient.Core().ResourceQuotas(namespace).List(options)
+			if err != nil {
+				return nil, err
+			}
+			results := make([]runtime.Object, 0, len(itemList.Items))
+			for i := range itemList.Items {
+				results = append(results, &itemList.Items[i])
+			}
+			return results, nil
+		},
+	}
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/secrets.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// NewSecretEvaluator returns an evaluator that can evaluate secrets
+func NewSecretEvaluator(kubeClient clientset.Interface) quota.Evaluator {
+	return &generic.ObjectCountEvaluator{
+		AllowCreateOnUpdate: false,
+		InternalGroupKind:   api.Kind("Secret"),
+		ResourceName:        api.ResourceSecrets,
+		ListFuncByNamespace: func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
+			itemList, err := kubeClient.Core().Secrets(namespace).List(options)
+			if err != nil {
+				return nil, err
+			}
+			results := make([]runtime.Object, 0, len(itemList.Items))
+			for i := range itemList.Items {
+				results = append(results, &itemList.Items[i])
+			}
+			return results, nil
+		},
+	}
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/services.go

@@ -0,0 +1,175 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/admission"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/generic"
+)
+
+// serviceResources are the set of resources managed by quota associated with services.
+var serviceResources = []api.ResourceName{
+	api.ResourceServices,
+	api.ResourceServicesNodePorts,
+	api.ResourceServicesLoadBalancers,
+}
+
+// NewServiceEvaluator returns an evaluator that can evaluate service quotas
+func NewServiceEvaluator(kubeClient clientset.Interface) quota.Evaluator {
+	return &serviceEvaluator{
+		listFuncByNamespace: func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
+			itemList, err := kubeClient.Core().Services(namespace).List(options)
+			if err != nil {
+				return nil, err
+			}
+			results := make([]runtime.Object, 0, len(itemList.Items))
+			for i := range itemList.Items {
+				results = append(results, &itemList.Items[i])
+			}
+			return results, nil
+		},
+	}
+}
+
+// serviceEvaluator knows how to measure usage for services.
+type serviceEvaluator struct {
+	// knows how to list items by namespace
+	listFuncByNamespace generic.ListFuncByNamespace
+}
+
+// Constraints verifies that all required resources are present on the item
+func (p *serviceEvaluator) Constraints(required []api.ResourceName, item runtime.Object) error {
+	service, ok := item.(*api.Service)
+	if !ok {
+		return fmt.Errorf("unexpected input object %v", item)
+	}
+
+	requiredSet := quota.ToSet(required)
+	missingSet := sets.NewString()
+	serviceUsage, err := p.Usage(service)
+	if err != nil {
+		return err
+	}
+	serviceSet := quota.ToSet(quota.ResourceNames(serviceUsage))
+	if diff := requiredSet.Difference(serviceSet); len(diff) > 0 {
+		missingSet.Insert(diff.List()...)
+	}
+
+	if len(missingSet) == 0 {
+		return nil
+	}
+	return fmt.Errorf("must specify %s", strings.Join(missingSet.List(), ","))
+}
+
+// GroupKind that this evaluator tracks
+func (p *serviceEvaluator) GroupKind() schema.GroupKind {
+	return api.Kind("Service")
+}
+
+// Handles returns true of the evalutor should handle the specified operation.
+func (p *serviceEvaluator) Handles(operation admission.Operation) bool {
+	// We handle create and update because a service type can change.
+	return admission.Create == operation || admission.Update == operation
+}
+
+// Matches returns true if the evaluator matches the specified quota with the provided input item
+func (p *serviceEvaluator) Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error) {
+	return generic.Matches(resourceQuota, item, p.MatchingResources, generic.MatchesNoScopeFunc)
+}
+
+// MatchingResources takes the input specified list of resources and returns the set of resources it matches.
+func (p *serviceEvaluator) MatchingResources(input []api.ResourceName) []api.ResourceName {
+	return quota.Intersection(input, serviceResources)
+}
+
+// convert the input object to an internal service object or error.
+func toInternalServiceOrError(obj runtime.Object) (*api.Service, error) {
+	svc := &api.Service{}
+	switch t := obj.(type) {
+	case *v1.Service:
+		if err := v1.Convert_v1_Service_To_api_Service(t, svc, nil); err != nil {
+			return nil, err
+		}
+	case *api.Service:
+		svc = t
+	default:
+		return nil, fmt.Errorf("expect *api.Service or *v1.Service, got %v", t)
+	}
+	return svc, nil
+}
+
+// Usage knows how to measure usage associated with pods
+func (p *serviceEvaluator) Usage(item runtime.Object) (api.ResourceList, error) {
+	result := api.ResourceList{}
+	svc, err := toInternalServiceOrError(item)
+	if err != nil {
+		return result, err
+	}
+	ports := len(svc.Spec.Ports)
+	// default service usage
+	result[api.ResourceServices] = *(resource.NewQuantity(1, resource.DecimalSI))
+	result[api.ResourceServicesLoadBalancers] = resource.Quantity{Format: resource.DecimalSI}
+	result[api.ResourceServicesNodePorts] = resource.Quantity{Format: resource.DecimalSI}
+	switch svc.Spec.Type {
+	case api.ServiceTypeNodePort:
+		// node port services need to count node ports
+		value := resource.NewQuantity(int64(ports), resource.DecimalSI)
+		result[api.ResourceServicesNodePorts] = *value
+	case api.ServiceTypeLoadBalancer:
+		// load balancer services need to count load balancers
+		result[api.ResourceServicesLoadBalancers] = *(resource.NewQuantity(1, resource.DecimalSI))
+	}
+	return result, nil
+}
+
+// UsageStats calculates aggregate usage for the object.
+func (p *serviceEvaluator) UsageStats(options quota.UsageStatsOptions) (quota.UsageStats, error) {
+	return generic.CalculateUsageStats(options, p.listFuncByNamespace, generic.MatchesNoScopeFunc, p.Usage)
+}
+
+var _ quota.Evaluator = &serviceEvaluator{}
+
+// QuotaServiceType returns true if the service type is eligible to track against a quota
+func QuotaServiceType(service *v1.Service) bool {
+	switch service.Spec.Type {
+	case v1.ServiceTypeNodePort, v1.ServiceTypeLoadBalancer:
+		return true
+	}
+	return false
+}
+
+//GetQuotaServiceType returns ServiceType if the service type is eligible to track against a quota, nor return ""
+func GetQuotaServiceType(service *v1.Service) v1.ServiceType {
+	switch service.Spec.Type {
+	case v1.ServiceTypeNodePort:
+		return v1.ServiceTypeNodePort
+	case v1.ServiceTypeLoadBalancer:
+		return v1.ServiceTypeLoadBalancer
+	}
+	return v1.ServiceType("")
+}

vendor/k8s.io/kubernetes/pkg/quota/evaluator/core/services_test.go

@@ -0,0 +1,195 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/fake"
+	"k8s.io/kubernetes/pkg/quota"
+)
+
+func TestServiceEvaluatorMatchesResources(t *testing.T) {
+	kubeClient := fake.NewSimpleClientset()
+	evaluator := NewServiceEvaluator(kubeClient)
+	// we give a lot of resources
+	input := []api.ResourceName{
+		api.ResourceConfigMaps,
+		api.ResourceCPU,
+		api.ResourceServices,
+		api.ResourceServicesNodePorts,
+		api.ResourceServicesLoadBalancers,
+	}
+	// but we only match these...
+	expected := quota.ToSet([]api.ResourceName{
+		api.ResourceServices,
+		api.ResourceServicesNodePorts,
+		api.ResourceServicesLoadBalancers,
+	})
+	actual := quota.ToSet(evaluator.MatchingResources(input))
+	if !expected.Equal(actual) {
+		t.Errorf("expected: %v, actual: %v", expected, actual)
+	}
+}
+
+func TestServiceEvaluatorUsage(t *testing.T) {
+	kubeClient := fake.NewSimpleClientset()
+	evaluator := NewServiceEvaluator(kubeClient)
+	testCases := map[string]struct {
+		service *api.Service
+		usage   api.ResourceList
+	}{
+		"loadbalancer": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeLoadBalancer,
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceServicesNodePorts:     resource.MustParse("0"),
+				api.ResourceServicesLoadBalancers: resource.MustParse("1"),
+				api.ResourceServices:              resource.MustParse("1"),
+			},
+		},
+		"clusterip": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeClusterIP,
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceServices:              resource.MustParse("1"),
+				api.ResourceServicesNodePorts:     resource.MustParse("0"),
+				api.ResourceServicesLoadBalancers: resource.MustParse("0"),
+			},
+		},
+		"nodeports": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeNodePort,
+					Ports: []api.ServicePort{
+						{
+							Port: 27443,
+						},
+					},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceServices:              resource.MustParse("1"),
+				api.ResourceServicesNodePorts:     resource.MustParse("1"),
+				api.ResourceServicesLoadBalancers: resource.MustParse("0"),
+			},
+		},
+		"multi-nodeports": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeNodePort,
+					Ports: []api.ServicePort{
+						{
+							Port: 27443,
+						},
+						{
+							Port: 27444,
+						},
+					},
+				},
+			},
+			usage: api.ResourceList{
+				api.ResourceServices:              resource.MustParse("1"),
+				api.ResourceServicesNodePorts:     resource.MustParse("2"),
+				api.ResourceServicesLoadBalancers: resource.MustParse("0"),
+			},
+		},
+	}
+	for testName, testCase := range testCases {
+		actual, err := evaluator.Usage(testCase.service)
+		if err != nil {
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
+		if !quota.Equals(testCase.usage, actual) {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.usage, actual)
+		}
+	}
+}
+
+func TestServiceConstraintsFunc(t *testing.T) {
+	testCases := map[string]struct {
+		service  *api.Service
+		required []api.ResourceName
+		err      string
+	}{
+		"loadbalancer": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeLoadBalancer,
+				},
+			},
+			required: []api.ResourceName{api.ResourceServicesLoadBalancers},
+		},
+		"clusterip": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeClusterIP,
+				},
+			},
+			required: []api.ResourceName{api.ResourceServicesLoadBalancers, api.ResourceServices},
+		},
+		"nodeports": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeNodePort,
+					Ports: []api.ServicePort{
+						{
+							Port: 27443,
+						},
+					},
+				},
+			},
+			required: []api.ResourceName{api.ResourceServicesNodePorts},
+		},
+		"multi-nodeports": {
+			service: &api.Service{
+				Spec: api.ServiceSpec{
+					Type: api.ServiceTypeNodePort,
+					Ports: []api.ServicePort{
+						{
+							Port: 27443,
+						},
+						{
+							Port: 27444,
+						},
+					},
+				},
+			},
+			required: []api.ResourceName{api.ResourceServicesNodePorts},
+		},
+	}
+
+	kubeClient := fake.NewSimpleClientset()
+	evaluator := NewServiceEvaluator(kubeClient)
+	for testName, test := range testCases {
+		err := evaluator.Constraints(test.required, test.service)
+		switch {
+		case err != nil && len(test.err) == 0,
+			err == nil && len(test.err) != 0,
+			err != nil && test.err != err.Error():
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/quota/generic/BUILD

@@ -0,0 +1,41 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "evaluator.go",
+        "registry.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/admission:go_default_library",
+        "//pkg/api:go_default_library",
+        "//pkg/api/resource:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/quota:go_default_library",
+        "//vendor:k8s.io/apimachinery/pkg/labels",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/quota/generic/OWNERS

@@ -0,0 +1,5 @@
+reviewers:
+- smarterclayton
+- derekwaynecarr
+- david-mcmahon
+- goltermann

vendor/k8s.io/kubernetes/pkg/quota/generic/evaluator.go

@@ -0,0 +1,182 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generic
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/admission"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/quota"
+)
+
+// ListResourceUsingInformerFunc returns a listing function based on the shared informer factory for the specified resource.
+func ListResourceUsingInformerFunc(f informers.SharedInformerFactory, groupResource schema.GroupResource) ListFuncByNamespace {
+	return func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
+		labelSelector, err := labels.Parse(options.LabelSelector)
+		if err != nil {
+			return nil, err
+		}
+		informer, err := f.ForResource(groupResource)
+		if err != nil {
+			return nil, err
+		}
+		return informer.Lister().ByNamespace(namespace).List(labelSelector)
+	}
+}
+
+// ListFuncByNamespace knows how to list resources in a namespace
+type ListFuncByNamespace func(namespace string, options v1.ListOptions) ([]runtime.Object, error)
+
+// MatchesScopeFunc knows how to evaluate if an object matches a scope
+type MatchesScopeFunc func(scope api.ResourceQuotaScope, object runtime.Object) (bool, error)
+
+// UsageFunc knows how to measure usage associated with an object
+type UsageFunc func(object runtime.Object) (api.ResourceList, error)
+
+// MatchingResourceNamesFunc is a function that returns the list of resources matched
+type MatchingResourceNamesFunc func(input []api.ResourceName) []api.ResourceName
+
+// MatchesNoScopeFunc returns false on all match checks
+func MatchesNoScopeFunc(scope api.ResourceQuotaScope, object runtime.Object) (bool, error) {
+	return false, nil
+}
+
+// Matches returns true if the quota matches the specified item.
+func Matches(resourceQuota *api.ResourceQuota, item runtime.Object, matchFunc MatchingResourceNamesFunc, scopeFunc MatchesScopeFunc) (bool, error) {
+	if resourceQuota == nil {
+		return false, fmt.Errorf("expected non-nil quota")
+	}
+	// verify the quota matches on at least one resource
+	matchResource := len(matchFunc(quota.ResourceNames(resourceQuota.Status.Hard))) > 0
+	// by default, no scopes matches all
+	matchScope := true
+	for _, scope := range resourceQuota.Spec.Scopes {
+		innerMatch, err := scopeFunc(scope, item)
+		if err != nil {
+			return false, err
+		}
+		matchScope = matchScope && innerMatch
+	}
+	return matchResource && matchScope, nil
+}
+
+// CalculateUsageStats is a utility function that knows how to calculate aggregate usage.
+func CalculateUsageStats(options quota.UsageStatsOptions,
+	listFunc ListFuncByNamespace,
+	scopeFunc MatchesScopeFunc,
+	usageFunc UsageFunc) (quota.UsageStats, error) {
+	// default each tracked resource to zero
+	result := quota.UsageStats{Used: api.ResourceList{}}
+	for _, resourceName := range options.Resources {
+		result.Used[resourceName] = resource.Quantity{Format: resource.DecimalSI}
+	}
+	items, err := listFunc(options.Namespace, v1.ListOptions{
+		LabelSelector: labels.Everything().String(),
+	})
+	if err != nil {
+		return result, fmt.Errorf("failed to list content: %v", err)
+	}
+	for _, item := range items {
+		// need to verify that the item matches the set of scopes
+		matchesScopes := true
+		for _, scope := range options.Scopes {
+			innerMatch, err := scopeFunc(scope, item)
+			if err != nil {
+				return result, nil
+			}
+			if !innerMatch {
+				matchesScopes = false
+			}
+		}
+		// only count usage if there was a match
+		if matchesScopes {
+			usage, err := usageFunc(item)
+			if err != nil {
+				return result, err
+			}
+			result.Used = quota.Add(result.Used, usage)
+		}
+	}
+	return result, nil
+}
+
+// ObjectCountEvaluator provides an implementation for quota.Evaluator
+// that associates usage of the specified resource based on the number of items
+// returned by the specified listing function.
+type ObjectCountEvaluator struct {
+	// AllowCreateOnUpdate if true will ensure the evaluator tracks create
+	// and update operations.
+	AllowCreateOnUpdate bool
+	// GroupKind that this evaluator tracks.
+	InternalGroupKind schema.GroupKind
+	// A function that knows how to list resources by namespace.
+	// TODO move to dynamic client in future
+	ListFuncByNamespace ListFuncByNamespace
+	// Name associated with this resource in the quota.
+	ResourceName api.ResourceName
+}
+
+// Constraints returns an error if the configured resource name is not in the required set.
+func (o *ObjectCountEvaluator) Constraints(required []api.ResourceName, item runtime.Object) error {
+	if !quota.Contains(required, o.ResourceName) {
+		return fmt.Errorf("missing %s", o.ResourceName)
+	}
+	return nil
+}
+
+// GroupKind that this evaluator tracks
+func (o *ObjectCountEvaluator) GroupKind() schema.GroupKind {
+	return o.InternalGroupKind
+}
+
+// Handles returns true if the object count evaluator needs to track this operation.
+func (o *ObjectCountEvaluator) Handles(operation admission.Operation) bool {
+	return operation == admission.Create || (o.AllowCreateOnUpdate && operation == admission.Update)
+}
+
+// Matches returns true if the evaluator matches the specified quota with the provided input item
+func (o *ObjectCountEvaluator) Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error) {
+	return Matches(resourceQuota, item, o.MatchingResources, MatchesNoScopeFunc)
+}
+
+// MatchingResources takes the input specified list of resources and returns the set of resources it matches.
+func (o *ObjectCountEvaluator) MatchingResources(input []api.ResourceName) []api.ResourceName {
+	return quota.Intersection(input, []api.ResourceName{o.ResourceName})
+}
+
+// Usage returns the resource usage for the specified object
+func (o *ObjectCountEvaluator) Usage(object runtime.Object) (api.ResourceList, error) {
+	quantity := resource.NewQuantity(1, resource.DecimalSI)
+	return api.ResourceList{
+		o.ResourceName: *quantity,
+	}, nil
+}
+
+// UsageStats calculates aggregate usage for the object.
+func (o *ObjectCountEvaluator) UsageStats(options quota.UsageStatsOptions) (quota.UsageStats, error) {
+	return CalculateUsageStats(options, o.ListFuncByNamespace, MatchesNoScopeFunc, o.Usage)
+}
+
+// Verify implementation of interface at compile time.
+var _ quota.Evaluator = &ObjectCountEvaluator{}

vendor/k8s.io/kubernetes/pkg/quota/generic/registry.go

@@ -0,0 +1,36 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generic
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/quota"
+)
+
+// Ensure it implements the required interface
+var _ quota.Registry = &GenericRegistry{}
+
+// GenericRegistry implements Registry
+type GenericRegistry struct {
+	// internal evaluators by group kind
+	InternalEvaluators map[schema.GroupKind]quota.Evaluator
+}
+
+// Evaluators returns the map of evaluators by groupKind
+func (r *GenericRegistry) Evaluators() map[schema.GroupKind]quota.Evaluator {
+	return r.InternalEvaluators
+}

vendor/k8s.io/kubernetes/pkg/quota/install/BUILD

@@ -0,0 +1,33 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["registry.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/controller/informers:go_default_library",
+        "//pkg/quota:go_default_library",
+        "//pkg/quota/evaluator/core:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/quota/install/OWNERS

@@ -0,0 +1,2 @@
+reviewers:
+- derekwaynecarr

vendor/k8s.io/kubernetes/pkg/quota/install/registry.go

@@ -0,0 +1,31 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package install
+
+import (
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/controller/informers"
+	"k8s.io/kubernetes/pkg/quota"
+	"k8s.io/kubernetes/pkg/quota/evaluator/core"
+)
+
+// NewRegistry returns a registry of quota evaluators.
+// If a shared informer factory is provided, it is used by evaluators rather than performing direct queries.
+func NewRegistry(kubeClient clientset.Interface, f informers.SharedInformerFactory) quota.Registry {
+	// TODO: when quota supports resources in other api groups, we will need to merge
+	return core.NewRegistry(kubeClient, f)
+}

vendor/k8s.io/kubernetes/pkg/quota/interfaces.go

@@ -0,0 +1,82 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package quota
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/admission"
+	"k8s.io/kubernetes/pkg/api"
+)
+
+// UsageStatsOptions is an options structs that describes how stats should be calculated
+type UsageStatsOptions struct {
+	// Namespace where stats should be calculate
+	Namespace string
+	// Scopes that must match counted objects
+	Scopes []api.ResourceQuotaScope
+	// Resources are the set of resources to include in the measurement
+	Resources []api.ResourceName
+}
+
+// UsageStats is result of measuring observed resource use in the system
+type UsageStats struct {
+	// Used maps resource to quantity used
+	Used api.ResourceList
+}
+
+// Evaluator knows how to evaluate quota usage for a particular group kind
+type Evaluator interface {
+	// Constraints ensures that each required resource is present on item
+	Constraints(required []api.ResourceName, item runtime.Object) error
+	// GroupKind returns the groupKind that this object knows how to evaluate
+	GroupKind() schema.GroupKind
+	// Handles determines if quota could be impacted by the specified operation.
+	// If true, admission control must perform quota processing for the operation, otherwise it is safe to ignore quota.
+	Handles(operation admission.Operation) bool
+	// Matches returns true if the specified quota matches the input item
+	Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error)
+	// MatchingResources takes the input specified list of resources and returns the set of resources evaluator matches.
+	MatchingResources(input []api.ResourceName) []api.ResourceName
+	// Usage returns the resource usage for the specified object
+	Usage(item runtime.Object) (api.ResourceList, error)
+	// UsageStats calculates latest observed usage stats for all objects
+	UsageStats(options UsageStatsOptions) (UsageStats, error)
+}
+
+// Registry holds the list of evaluators associated to a particular group kind
+type Registry interface {
+	// Evaluators returns the set Evaluator objects registered to a groupKind
+	Evaluators() map[schema.GroupKind]Evaluator
+}
+
+// UnionRegistry combines multiple registries.  Order matters because first registry to claim a GroupKind
+// is the "winner"
+type UnionRegistry []Registry
+
+// Evaluators returns a mapping of evaluators by group kind.
+func (r UnionRegistry) Evaluators() map[schema.GroupKind]Evaluator {
+	ret := map[schema.GroupKind]Evaluator{}
+
+	for i := len(r) - 1; i >= 0; i-- {
+		for k, v := range r[i].Evaluators() {
+			ret[k] = v
+		}
+	}
+
+	return ret
+}

vendor/k8s.io/kubernetes/pkg/quota/resources.go

@@ -0,0 +1,253 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package quota
+
+import (
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/api/v1"
+)
+
+// Equals returns true if the two lists are equivalent
+func Equals(a api.ResourceList, b api.ResourceList) bool {
+	for key, value1 := range a {
+		value2, found := b[key]
+		if !found {
+			return false
+		}
+		if value1.Cmp(value2) != 0 {
+			return false
+		}
+	}
+	for key, value1 := range b {
+		value2, found := a[key]
+		if !found {
+			return false
+		}
+		if value1.Cmp(value2) != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// V1Equals returns true if the two lists are equivalent
+func V1Equals(a v1.ResourceList, b v1.ResourceList) bool {
+	for key, value1 := range a {
+		value2, found := b[key]
+		if !found {
+			return false
+		}
+		if value1.Cmp(value2) != 0 {
+			return false
+		}
+	}
+	for key, value1 := range b {
+		value2, found := a[key]
+		if !found {
+			return false
+		}
+		if value1.Cmp(value2) != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// LessThanOrEqual returns true if a < b for each key in b
+// If false, it returns the keys in a that exceeded b
+func LessThanOrEqual(a api.ResourceList, b api.ResourceList) (bool, []api.ResourceName) {
+	result := true
+	resourceNames := []api.ResourceName{}
+	for key, value := range b {
+		if other, found := a[key]; found {
+			if other.Cmp(value) > 0 {
+				result = false
+				resourceNames = append(resourceNames, key)
+			}
+		}
+	}
+	return result, resourceNames
+}
+
+// Max returns the result of Max(a, b) for each named resource
+func Max(a api.ResourceList, b api.ResourceList) api.ResourceList {
+	result := api.ResourceList{}
+	for key, value := range a {
+		if other, found := b[key]; found {
+			if value.Cmp(other) <= 0 {
+				result[key] = *other.Copy()
+				continue
+			}
+		}
+		result[key] = *value.Copy()
+	}
+	for key, value := range b {
+		if _, found := result[key]; !found {
+			result[key] = *value.Copy()
+		}
+	}
+	return result
+}
+
+// Add returns the result of a + b for each named resource
+func Add(a api.ResourceList, b api.ResourceList) api.ResourceList {
+	result := api.ResourceList{}
+	for key, value := range a {
+		quantity := *value.Copy()
+		if other, found := b[key]; found {
+			quantity.Add(other)
+		}
+		result[key] = quantity
+	}
+	for key, value := range b {
+		if _, found := result[key]; !found {
+			quantity := *value.Copy()
+			result[key] = quantity
+		}
+	}
+	return result
+}
+
+// Subtract returns the result of a - b for each named resource
+func Subtract(a api.ResourceList, b api.ResourceList) api.ResourceList {
+	result := api.ResourceList{}
+	for key, value := range a {
+		quantity := *value.Copy()
+		if other, found := b[key]; found {
+			quantity.Sub(other)
+		}
+		result[key] = quantity
+	}
+	for key, value := range b {
+		if _, found := result[key]; !found {
+			quantity := *value.Copy()
+			quantity.Neg()
+			result[key] = quantity
+		}
+	}
+	return result
+}
+
+// Mask returns a new resource list that only has the values with the specified names
+func Mask(resources api.ResourceList, names []api.ResourceName) api.ResourceList {
+	nameSet := ToSet(names)
+	result := api.ResourceList{}
+	for key, value := range resources {
+		if nameSet.Has(string(key)) {
+			result[key] = *value.Copy()
+		}
+	}
+	return result
+}
+
+// ResourceNames returns a list of all resource names in the ResourceList
+func ResourceNames(resources api.ResourceList) []api.ResourceName {
+	result := []api.ResourceName{}
+	for resourceName := range resources {
+		result = append(result, resourceName)
+	}
+	return result
+}
+
+// Contains returns true if the specified item is in the list of items
+func Contains(items []api.ResourceName, item api.ResourceName) bool {
+	return ToSet(items).Has(string(item))
+}
+
+// Intersection returns the intersection of both list of resources
+func Intersection(a []api.ResourceName, b []api.ResourceName) []api.ResourceName {
+	setA := ToSet(a)
+	setB := ToSet(b)
+	setC := setA.Intersection(setB)
+	result := []api.ResourceName{}
+	for _, resourceName := range setC.List() {
+		result = append(result, api.ResourceName(resourceName))
+	}
+	return result
+}
+
+// IsZero returns true if each key maps to the quantity value 0
+func IsZero(a api.ResourceList) bool {
+	zero := resource.MustParse("0")
+	for _, v := range a {
+		if v.Cmp(zero) != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// IsNegative returns the set of resource names that have a negative value.
+func IsNegative(a api.ResourceList) []api.ResourceName {
+	results := []api.ResourceName{}
+	zero := resource.MustParse("0")
+	for k, v := range a {
+		if v.Cmp(zero) < 0 {
+			results = append(results, k)
+		}
+	}
+	return results
+}
+
+// ToSet takes a list of resource names and converts to a string set
+func ToSet(resourceNames []api.ResourceName) sets.String {
+	result := sets.NewString()
+	for _, resourceName := range resourceNames {
+		result.Insert(string(resourceName))
+	}
+	return result
+}
+
+// CalculateUsage calculates and returns the requested ResourceList usage
+func CalculateUsage(namespaceName string, scopes []api.ResourceQuotaScope, hardLimits api.ResourceList, registry Registry) (api.ResourceList, error) {
+	// find the intersection between the hard resources on the quota
+	// and the resources this controller can track to know what we can
+	// look to measure updated usage stats for
+	hardResources := ResourceNames(hardLimits)
+	potentialResources := []api.ResourceName{}
+	evaluators := registry.Evaluators()
+	for _, evaluator := range evaluators {
+		potentialResources = append(potentialResources, evaluator.MatchingResources(hardResources)...)
+	}
+	// NOTE: the intersection just removes duplicates since the evaluator match intersects wtih hard
+	matchedResources := Intersection(hardResources, potentialResources)
+
+	// sum the observed usage from each evaluator
+	newUsage := api.ResourceList{}
+	for _, evaluator := range evaluators {
+		// only trigger the evaluator if it matches a resource in the quota, otherwise, skip calculating anything
+		intersection := evaluator.MatchingResources(matchedResources)
+		if len(intersection) == 0 {
+			continue
+		}
+
+		usageStatsOptions := UsageStatsOptions{Namespace: namespaceName, Scopes: scopes, Resources: intersection}
+		stats, err := evaluator.UsageStats(usageStatsOptions)
+		if err != nil {
+			return nil, err
+		}
+		newUsage = Add(newUsage, stats.Used)
+	}
+
+	// mask the observed usage to only the set of resources tracked by this quota
+	// merge our observed usage with the quota usage status
+	// if the new usage is different than the last usage, we will need to do an update
+	newUsage = Mask(newUsage, matchedResources)
+	return newUsage, nil
+}

vendor/k8s.io/kubernetes/pkg/quota/resources_test.go

@@ -0,0 +1,292 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package quota
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/resource"
+)
+
+func TestEquals(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		b        api.ResourceList
+		expected bool
+	}{
+		"isEqual": {
+			a:        api.ResourceList{},
+			b:        api.ResourceList{},
+			expected: true,
+		},
+		"isEqualWithKeys": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("100m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			b: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("100m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			expected: true,
+		},
+		"isNotEqualSameKeys": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("200m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			b: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("100m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			expected: false,
+		},
+		"isNotEqualDiffKeys": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("100m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			b: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("100m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+				api.ResourcePods:   resource.MustParse("1"),
+			},
+			expected: false,
+		},
+	}
+	for testName, testCase := range testCases {
+		if result := Equals(testCase.a, testCase.b); result != testCase.expected {
+			t.Errorf("%s expected: %v, actual: %v, a=%v, b=%v", testName, testCase.expected, result, testCase.a, testCase.b)
+		}
+	}
+}
+
+func TestMax(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		b        api.ResourceList
+		expected api.ResourceList
+	}{
+		"noKeys": {
+			a:        api.ResourceList{},
+			b:        api.ResourceList{},
+			expected: api.ResourceList{},
+		},
+		"toEmpty": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			b:        api.ResourceList{},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+		},
+		"matching": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			b:        api.ResourceList{api.ResourceCPU: resource.MustParse("150m")},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("150m")},
+		},
+		"matching(reverse)": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("150m")},
+			b:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("150m")},
+		},
+	}
+	for testName, testCase := range testCases {
+		sum := Max(testCase.a, testCase.b)
+		if result := Equals(testCase.expected, sum); !result {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.expected, sum)
+		}
+	}
+}
+
+func TestAdd(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		b        api.ResourceList
+		expected api.ResourceList
+	}{
+		"noKeys": {
+			a:        api.ResourceList{},
+			b:        api.ResourceList{},
+			expected: api.ResourceList{},
+		},
+		"toEmpty": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			b:        api.ResourceList{},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+		},
+		"matching": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			b:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("200m")},
+		},
+	}
+	for testName, testCase := range testCases {
+		sum := Add(testCase.a, testCase.b)
+		if result := Equals(testCase.expected, sum); !result {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.expected, sum)
+		}
+	}
+}
+
+func TestSubtract(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		b        api.ResourceList
+		expected api.ResourceList
+	}{
+		"noKeys": {
+			a:        api.ResourceList{},
+			b:        api.ResourceList{},
+			expected: api.ResourceList{},
+		},
+		"value-empty": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			b:        api.ResourceList{},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+		},
+		"empty-value": {
+			a:        api.ResourceList{},
+			b:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("-100m")},
+		},
+		"value-value": {
+			a:        api.ResourceList{api.ResourceCPU: resource.MustParse("200m")},
+			b:        api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+			expected: api.ResourceList{api.ResourceCPU: resource.MustParse("100m")},
+		},
+	}
+	for testName, testCase := range testCases {
+		sub := Subtract(testCase.a, testCase.b)
+		if result := Equals(testCase.expected, sub); !result {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.expected, sub)
+		}
+	}
+}
+
+func TestResourceNames(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		expected []api.ResourceName
+	}{
+		"empty": {
+			a:        api.ResourceList{},
+			expected: []api.ResourceName{},
+		},
+		"values": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("100m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			expected: []api.ResourceName{api.ResourceMemory, api.ResourceCPU},
+		},
+	}
+	for testName, testCase := range testCases {
+		actualSet := ToSet(ResourceNames(testCase.a))
+		expectedSet := ToSet(testCase.expected)
+		if !actualSet.Equal(expectedSet) {
+			t.Errorf("%s expected: %v, actual: %v", testName, expectedSet, actualSet)
+		}
+	}
+}
+
+func TestContains(t *testing.T) {
+	testCases := map[string]struct {
+		a        []api.ResourceName
+		b        api.ResourceName
+		expected bool
+	}{
+		"does-not-contain": {
+			a:        []api.ResourceName{api.ResourceMemory},
+			b:        api.ResourceCPU,
+			expected: false,
+		},
+		"does-contain": {
+			a:        []api.ResourceName{api.ResourceMemory, api.ResourceCPU},
+			b:        api.ResourceCPU,
+			expected: true,
+		},
+	}
+	for testName, testCase := range testCases {
+		if actual := Contains(testCase.a, testCase.b); actual != testCase.expected {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.expected, actual)
+		}
+	}
+}
+
+func TestIsZero(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		expected bool
+	}{
+		"empty": {
+			a:        api.ResourceList{},
+			expected: true,
+		},
+		"zero": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("0"),
+				api.ResourceMemory: resource.MustParse("0"),
+			},
+			expected: true,
+		},
+		"non-zero": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("200m"),
+				api.ResourceMemory: resource.MustParse("1Gi"),
+			},
+			expected: false,
+		},
+	}
+	for testName, testCase := range testCases {
+		if result := IsZero(testCase.a); result != testCase.expected {
+			t.Errorf("%s expected: %v, actual: %v", testName, testCase.expected, result)
+		}
+	}
+}
+
+func TestIsNegative(t *testing.T) {
+	testCases := map[string]struct {
+		a        api.ResourceList
+		expected []api.ResourceName
+	}{
+		"empty": {
+			a:        api.ResourceList{},
+			expected: []api.ResourceName{},
+		},
+		"some-negative": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("-10"),
+				api.ResourceMemory: resource.MustParse("0"),
+			},
+			expected: []api.ResourceName{api.ResourceCPU},
+		},
+		"all-negative": {
+			a: api.ResourceList{
+				api.ResourceCPU:    resource.MustParse("-200m"),
+				api.ResourceMemory: resource.MustParse("-1Gi"),
+			},
+			expected: []api.ResourceName{api.ResourceCPU, api.ResourceMemory},
+		},
+	}
+	for testName, testCase := range testCases {
+		actual := IsNegative(testCase.a)
+		actualSet := ToSet(actual)
+		expectedSet := ToSet(testCase.expected)
+		if !actualSet.Equal(expectedSet) {
+			t.Errorf("%s expected: %v, actual: %v", testName, expectedSet, actualSet)
+		}
+	}
+}