Merge pull request #34554 from derekwaynecarr/quota-storage-class

hack/.linted_packages

@@ -197,6 +197,7 @@ pkg/kubelet/volumemanager/populator
 pkg/kubelet/volumemanager/reconciler
 pkg/proxy/config
 pkg/proxy/healthcheck
+pkg/quota
 pkg/quota/install
 pkg/registry
 pkg/registry/authorization/util

pkg/controller/resourcequota/resource_quota_controller.go

@@ -182,9 +182,8 @@ func (rq *ResourceQuotaController) addQuota(obj interface{}) {
 	for constraint := range resourceQuota.Status.Hard {
 		if _, usageFound := resourceQuota.Status.Used[constraint]; !usageFound {
 			matchedResources := []api.ResourceName{api.ResourceName(constraint)}
-
 			for _, evaluator := range rq.registry.Evaluators() {
-				if intersection := quota.Intersection(evaluator.MatchesResources(), matchedResources); len(intersection) != 0 {
+				if intersection := evaluator.MatchingResources(matchedResources); len(intersection) > 0 {
 					rq.missingUsageQueue.Add(key)
 					return
 				}
@@ -348,7 +347,6 @@ func (rq *ResourceQuotaController) replenishQuota(groupKind schema.GroupKind, na
 	}
 
 	// only queue those quotas that are tracking a resource associated with this kind.
-	matchedResources := evaluator.MatchesResources()
 	for i := range resourceQuotas {
 		resourceQuota := resourceQuotas[i].(*v1.ResourceQuota)
 		internalResourceQuota := &api.ResourceQuota{}
@@ -357,7 +355,7 @@ func (rq *ResourceQuotaController) replenishQuota(groupKind schema.GroupKind, na
 			continue
 		}
 		resourceQuotaResources := quota.ResourceNames(internalResourceQuota.Status.Hard)
-		if len(quota.Intersection(matchedResources, resourceQuotaResources)) > 0 {
+		if intersection := evaluator.MatchingResources(resourceQuotaResources); len(intersection) > 0 {
 			// TODO: make this support targeted replenishment to a specific kind, right now it does a full recalc on that quota.
 			rq.enqueueResourceQuota(resourceQuota)
 		}

pkg/kubelet/eviction/helpers.go

@@ -533,12 +533,18 @@ func memory(stats statsFunc) cmpFunc {
 
 		// adjust p1, p2 usage relative to the request (if any)
 		p1Memory := p1Usage[v1.ResourceMemory]
-		p1Spec := core.PodUsageFunc(p1)
+		p1Spec, err := core.PodUsageFunc(p1)
+		if err != nil {
+			return -1
+		}
 		p1Request := p1Spec[api.ResourceRequestsMemory]
 		p1Memory.Sub(p1Request)
 
 		p2Memory := p2Usage[v1.ResourceMemory]
-		p2Spec := core.PodUsageFunc(p2)
+		p2Spec, err := core.PodUsageFunc(p2)
+		if err != nil {
+			return 1
+		}
 		p2Request := p2Spec[api.ResourceRequestsMemory]
 		p2Memory.Sub(p2Request)
 

pkg/quota/evaluator/core/BUILD

@@ -30,7 +30,7 @@ go_library(
         "//pkg/api/resource:go_default_library",
         "//pkg/api/v1:go_default_library",
         "//pkg/api/validation:go_default_library",
-        "//pkg/apis/meta/v1:go_default_library",
+        "//pkg/apis/storage/util:go_default_library",
         "//pkg/client/clientset_generated/release_1_5:go_default_library",
         "//pkg/controller/informers:go_default_library",
         "//pkg/kubelet/qos:go_default_library",
@@ -56,6 +56,7 @@ go_test(
         "//pkg/api:go_default_library",
         "//pkg/api/resource:go_default_library",
         "//pkg/apis/meta/v1:go_default_library",
+        "//pkg/apis/storage/util:go_default_library",
         "//pkg/client/clientset_generated/release_1_5/fake:go_default_library",
         "//pkg/quota:go_default_library",
     ],

pkg/quota/evaluator/core/configmap.go

@@ -17,7 +17,6 @@ limitations under the License.
 package core
 
 import (
-	"k8s.io/kubernetes/pkg/admission"
 	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/v1"
 	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
@@ -28,17 +27,10 @@ import (
 
 // NewConfigMapEvaluator returns an evaluator that can evaluate configMaps
 func NewConfigMapEvaluator(kubeClient clientset.Interface) quota.Evaluator {
-	allResources := []api.ResourceName{api.ResourceConfigMaps}
-	return &generic.GenericEvaluator{
-		Name:              "Evaluator.ConfigMap",
-		InternalGroupKind: api.Kind("ConfigMap"),
-		InternalOperationResources: map[admission.Operation][]api.ResourceName{
-			admission.Create: allResources,
-		},
-		MatchedResourceNames: allResources,
-		MatchesScopeFunc:     generic.MatchesNoScopeFunc,
-		ConstraintsFunc:      generic.ObjectCountConstraintsFunc(api.ResourceConfigMaps),
-		UsageFunc:            generic.ObjectCountUsageFunc(api.ResourceConfigMaps),
+	return &generic.ObjectCountEvaluator{
+		AllowCreateOnUpdate: false,
+		InternalGroupKind:   api.Kind("ConfigMap"),
+		ResourceName:        api.ResourceConfigMaps,
 		ListFuncByNamespace: func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
 			itemList, err := kubeClient.Core().ConfigMaps(namespace).List(options)
 			if err != nil {

pkg/quota/evaluator/core/persistent_volume_claims.go

@@ -24,6 +24,7 @@ import (
 	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/resource"
 	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/apis/storage/util"
 	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
 	"k8s.io/kubernetes/pkg/controller/informers"
 	"k8s.io/kubernetes/pkg/quota"
@@ -33,6 +34,31 @@ import (
 	"k8s.io/kubernetes/pkg/util/sets"
 )
 
+// pvcResources are the set of static resources managed by quota associated with pvcs.
+// for each resouce in this list, it may be refined dynamically based on storage class.
+var pvcResources = []api.ResourceName{
+	api.ResourcePersistentVolumeClaims,
+	api.ResourceRequestsStorage,
+}
+
+// storageClassSuffix is the suffix to the qualified portion of storage class resource name.
+// For example, if you want to quota storage by storage class, you would have a declaration
+// that follows <storage-class>.storageclass.storage.k8s.io/<resource>.
+// For example:
+// * gold.storageclass.storage.k8s.io/: 500Gi
+// * bronze.storageclass.storage.k8s.io/requests.storage: 500Gi
+const storageClassSuffix string = ".storageclass.storage.k8s.io/"
+
+// ResourceByStorageClass returns a quota resource name by storage class.
+func ResourceByStorageClass(storageClass string, resourceName api.ResourceName) api.ResourceName {
+	return api.ResourceName(string(storageClass + storageClassSuffix + string(resourceName)))
+}
+
+// V1ResourceByStorageClass returns a quota resource name by storage class.
+func V1ResourceByStorageClass(storageClass string, resourceName v1.ResourceName) v1.ResourceName {
+	return v1.ResourceName(string(storageClass + storageClassSuffix + string(resourceName)))
+}
+
 // listPersistentVolumeClaimsByNamespaceFuncUsingClient returns a pvc listing function based on the provided client.
 func listPersistentVolumeClaimsByNamespaceFuncUsingClient(kubeClient clientset.Interface) generic.ListFuncByNamespace {
 	// TODO: ideally, we could pass dynamic client pool down into this code, and have one way of doing this.
@@ -54,59 +80,49 @@ func listPersistentVolumeClaimsByNamespaceFuncUsingClient(kubeClient clientset.I
 // NewPersistentVolumeClaimEvaluator returns an evaluator that can evaluate persistent volume claims
 // if the specified shared informer factory is not nil, evaluator may use it to support listing functions.
 func NewPersistentVolumeClaimEvaluator(kubeClient clientset.Interface, f informers.SharedInformerFactory) quota.Evaluator {
-	allResources := []api.ResourceName{api.ResourcePersistentVolumeClaims, api.ResourceRequestsStorage}
 	listFuncByNamespace := listPersistentVolumeClaimsByNamespaceFuncUsingClient(kubeClient)
 	if f != nil {
 		listFuncByNamespace = generic.ListResourceUsingInformerFunc(f, schema.GroupResource{Resource: "persistentvolumeclaims"})
 	}
-
-	return &generic.GenericEvaluator{
-		Name:              "Evaluator.PersistentVolumeClaim",
-		InternalGroupKind: api.Kind("PersistentVolumeClaim"),
-		InternalOperationResources: map[admission.Operation][]api.ResourceName{
-			admission.Create: allResources,
-		},
-		MatchedResourceNames: allResources,
-		MatchesScopeFunc:     generic.MatchesNoScopeFunc,
-		ConstraintsFunc:      PersistentVolumeClaimConstraintsFunc,
-		UsageFunc:            PersistentVolumeClaimUsageFunc,
-		ListFuncByNamespace:  listFuncByNamespace,
+	return &pvcEvaluator{
+		listFuncByNamespace: listFuncByNamespace,
 	}
 }
 
-// PersistentVolumeClaimUsageFunc knows how to measure usage associated with persistent volume claims
-func PersistentVolumeClaimUsageFunc(object runtime.Object) api.ResourceList {
-	result := api.ResourceList{}
-	var found bool
-	var request resource.Quantity
+// pvcEvaluator knows how to evaluate quota usage for persistent volume claims
+type pvcEvaluator struct {
+	// listFuncByNamespace knows how to list pvc claims
+	listFuncByNamespace generic.ListFuncByNamespace
+}
 
-	switch t := object.(type) {
-	case *v1.PersistentVolumeClaim:
-		request, found = t.Spec.Resources.Requests[v1.ResourceStorage]
-	case *api.PersistentVolumeClaim:
-		request, found = t.Spec.Resources.Requests[api.ResourceStorage]
-	default:
-		panic(fmt.Sprintf("expect *api.PersistenVolumeClaim or *v1.PersistentVolumeClaim, got %v", t))
+// Constraints verifies that all required resources are present on the item.
+func (p *pvcEvaluator) Constraints(required []api.ResourceName, item runtime.Object) error {
+	pvc, ok := item.(*api.PersistentVolumeClaim)
+	if !ok {
+		return fmt.Errorf("unexpected input object %v", item)
 	}
 
-	result[api.ResourcePersistentVolumeClaims] = resource.MustParse("1")
-	if found {
-		result[api.ResourceRequestsStorage] = request
+	// these are the items that we will be handling based on the objects actual storage-class
+	pvcRequiredSet := append([]api.ResourceName{}, pvcResources...)
+	if storageClassRef := util.GetClaimStorageClass(pvc); len(storageClassRef) > 0 {
+		pvcRequiredSet = append(pvcRequiredSet, ResourceByStorageClass(storageClassRef, api.ResourcePersistentVolumeClaims))
+		pvcRequiredSet = append(pvcRequiredSet, ResourceByStorageClass(storageClassRef, api.ResourceRequestsStorage))
 	}
-	return result
-}
 
-// PersistentVolumeClaimConstraintsFunc verifies that all required resources are present on the claim
-// In addition, it validates that the resources are valid (i.e. requests < limits)
-func PersistentVolumeClaimConstraintsFunc(required []api.ResourceName, object runtime.Object) error {
-	pvc, ok := object.(*api.PersistentVolumeClaim)
-	if !ok {
-		return fmt.Errorf("unexpected input object %v", object)
+	// in effect, this will remove things from the required set that are not tied to this pvcs storage class
+	// for example, if a quota has bronze and gold storage class items defined, we should not error a bronze pvc for not being gold.
+	// but we should error a bronze pvc if it doesn't make a storage request size...
+	requiredResources := quota.Intersection(required, pvcRequiredSet)
+	requiredSet := quota.ToSet(requiredResources)
+
+	// usage for this pvc will only include global pvc items + this storage class specific items
+	pvcUsage, err := p.Usage(item)
+	if err != nil {
+		return err
 	}
 
-	requiredSet := quota.ToSet(required)
+	// determine what required resources were not tracked by usage.
 	missingSet := sets.NewString()
-	pvcUsage := PersistentVolumeClaimUsageFunc(pvc)
 	pvcSet := quota.ToSet(quota.ResourceNames(pvcUsage))
 	if diff := requiredSet.Difference(pvcSet); len(diff) > 0 {
 		missingSet.Insert(diff.List()...)
@@ -116,3 +132,89 @@ func PersistentVolumeClaimConstraintsFunc(required []api.ResourceName, object ru
 	}
 	return fmt.Errorf("must specify %s", strings.Join(missingSet.List(), ","))
 }
+
+// GroupKind that this evaluator tracks
+func (p *pvcEvaluator) GroupKind() schema.GroupKind {
+	return api.Kind("PersistentVolumeClaim")
+}
+
+// Handles returns true if the evalutor should handle the specified operation.
+func (p *pvcEvaluator) Handles(operation admission.Operation) bool {
+	return admission.Create == operation
+}
+
+// Matches returns true if the evaluator matches the specified quota with the provided input item
+func (p *pvcEvaluator) Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error) {
+	return generic.Matches(resourceQuota, item, p.MatchingResources, generic.MatchesNoScopeFunc)
+}
+
+// MatchingResources takes the input specified list of resources and returns the set of resources it matches.
+func (p *pvcEvaluator) MatchingResources(items []api.ResourceName) []api.ResourceName {
+	result := []api.ResourceName{}
+	for _, item := range items {
+		if quota.Contains(pvcResources, item) {
+			result = append(result, item)
+			continue
+		}
+		// match pvc resources scoped by storage class (<storage-class-name>.storage-class.kubernetes.io/<resource>)
+		for _, resource := range pvcResources {
+			byStorageClass := storageClassSuffix + string(resource)
+			if strings.HasSuffix(string(item), byStorageClass) {
+				result = append(result, item)
+				break
+			}
+		}
+	}
+	return result
+}
+
+// Usage knows how to measure usage associated with item.
+func (p *pvcEvaluator) Usage(item runtime.Object) (api.ResourceList, error) {
+	result := api.ResourceList{}
+	pvc, err := toInternalPersistentVolumeClaimOrError(item)
+	if err != nil {
+		return result, err
+	}
+	storageClassRef := util.GetClaimStorageClass(pvc)
+
+	// charge for claim
+	result[api.ResourcePersistentVolumeClaims] = resource.MustParse("1")
+	if len(storageClassRef) > 0 {
+		storageClassClaim := api.ResourceName(storageClassRef + storageClassSuffix + string(api.ResourcePersistentVolumeClaims))
+		result[storageClassClaim] = resource.MustParse("1")
+	}
+
+	// charge for storage
+	if request, found := pvc.Spec.Resources.Requests[api.ResourceStorage]; found {
+		result[api.ResourceRequestsStorage] = request
+		// charge usage to the storage class (if present)
+		if len(storageClassRef) > 0 {
+			storageClassStorage := api.ResourceName(storageClassRef + storageClassSuffix + string(api.ResourceRequestsStorage))
+			result[storageClassStorage] = request
+		}
+	}
+	return result, nil
+}
+
+// UsageStats calculates aggregate usage for the object.
+func (p *pvcEvaluator) UsageStats(options quota.UsageStatsOptions) (quota.UsageStats, error) {
+	return generic.CalculateUsageStats(options, p.listFuncByNamespace, generic.MatchesNoScopeFunc, p.Usage)
+}
+
+// ensure we implement required interface
+var _ quota.Evaluator = &pvcEvaluator{}
+
+func toInternalPersistentVolumeClaimOrError(obj runtime.Object) (*api.PersistentVolumeClaim, error) {
+	pvc := &api.PersistentVolumeClaim{}
+	switch t := obj.(type) {
+	case *v1.PersistentVolumeClaim:
+		if err := v1.Convert_v1_PersistentVolumeClaim_To_api_PersistentVolumeClaim(t, pvc, nil); err != nil {
+			return nil, err
+		}
+	case *api.PersistentVolumeClaim:
+		pvc = t
+	default:
+		return nil, fmt.Errorf("expect *api.PersistentVolumeClaim or *v1.PersistentVolumeClaim, got %v", t)
+	}
+	return pvc, nil
+}

pkg/quota/evaluator/core/persistent_volume_claims_test.go

@@ -22,6 +22,7 @@ import (
 	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/resource"
 	metav1 "k8s.io/kubernetes/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/apis/storage/util"
 	"k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5/fake"
 	"k8s.io/kubernetes/pkg/quota"
 )
@@ -53,6 +54,52 @@ func TestPersistentVolumeClaimsConstraintsFunc(t *testing.T) {
 			},
 		},
 	})
+	validClaimGoldStorageClass := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{
+				api.ResourceName(api.ResourceStorage): resource.MustParse("10Gi"),
+			},
+		},
+	})
+	validClaimGoldStorageClass.Annotations = map[string]string{
+		util.StorageClassAnnotation: "gold",
+	}
+
+	validClaimBronzeStorageClass := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{
+				api.ResourceName(api.ResourceStorage): resource.MustParse("10Gi"),
+			},
+		},
+	})
+	validClaimBronzeStorageClass.Annotations = map[string]string{
+		util.StorageClassAnnotation: "bronze",
+	}
+
 	missingStorage := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
 		Selector: &metav1.LabelSelector{
 			MatchExpressions: []metav1.LabelSelectorRequirement{
@@ -71,6 +118,27 @@ func TestPersistentVolumeClaimsConstraintsFunc(t *testing.T) {
 		},
 	})
 
+	missingGoldStorage := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{},
+		},
+	})
+	missingGoldStorage.Annotations = map[string]string{
+		util.StorageClassAnnotation: "gold",
+	}
+
 	testCases := map[string]struct {
 		pvc      *api.PersistentVolumeClaim
 		required []api.ResourceName
@@ -81,6 +149,11 @@ func TestPersistentVolumeClaimsConstraintsFunc(t *testing.T) {
 			required: []api.ResourceName{api.ResourceRequestsStorage},
 			err:      `must specify requests.storage`,
 		},
+		"missing gold storage": {
+			pvc:      missingGoldStorage,
+			required: []api.ResourceName{ResourceByStorageClass("gold", api.ResourceRequestsStorage)},
+			err:      `must specify gold.storageclass.storage.k8s.io/requests.storage`,
+		},
 		"valid-claim-quota-storage": {
 			pvc:      validClaim,
 			required: []api.ResourceName{api.ResourceRequestsStorage},
@@ -93,9 +166,30 @@ func TestPersistentVolumeClaimsConstraintsFunc(t *testing.T) {
 			pvc:      validClaim,
 			required: []api.ResourceName{api.ResourceRequestsStorage, api.ResourcePersistentVolumeClaims},
 		},
+		"valid-claim-gold-quota-gold": {
+			pvc: validClaimGoldStorageClass,
+			required: []api.ResourceName{
+				api.ResourceRequestsStorage,
+				api.ResourcePersistentVolumeClaims,
+				ResourceByStorageClass("gold", api.ResourceRequestsStorage),
+				ResourceByStorageClass("gold", api.ResourcePersistentVolumeClaims),
+			},
+		},
+		"valid-claim-bronze-with-quota-gold": {
+			pvc: validClaimBronzeStorageClass,
+			required: []api.ResourceName{
+				api.ResourceRequestsStorage,
+				api.ResourcePersistentVolumeClaims,
+				ResourceByStorageClass("gold", api.ResourceRequestsStorage),
+				ResourceByStorageClass("gold", api.ResourcePersistentVolumeClaims),
+			},
+		},
 	}
+
+	kubeClient := fake.NewSimpleClientset()
+	evaluator := NewPersistentVolumeClaimEvaluator(kubeClient, nil)
 	for testName, test := range testCases {
-		err := PersistentVolumeClaimConstraintsFunc(test.required, test.pvc)
+		err := evaluator.Constraints(test.required, test.pvc)
 		switch {
 		case err != nil && len(test.err) == 0,
 			err == nil && len(test.err) != 0,
@@ -125,6 +219,29 @@ func TestPersistentVolumeClaimEvaluatorUsage(t *testing.T) {
 			},
 		},
 	})
+	validClaimByStorageClass := testVolumeClaim("foo", "ns", api.PersistentVolumeClaimSpec{
+		Selector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "key2",
+					Operator: "Exists",
+				},
+			},
+		},
+		AccessModes: []api.PersistentVolumeAccessMode{
+			api.ReadWriteOnce,
+			api.ReadOnlyMany,
+		},
+		Resources: api.ResourceRequirements{
+			Requests: api.ResourceList{
+				api.ResourceName(api.ResourceStorage): resource.MustParse("10Gi"),
+			},
+		},
+	})
+	storageClassName := "gold"
+	validClaimByStorageClass.Annotations = map[string]string{
+		util.StorageClassAnnotation: storageClassName,
+	}
 
 	kubeClient := fake.NewSimpleClientset()
 	evaluator := NewPersistentVolumeClaimEvaluator(kubeClient, nil)
@@ -139,9 +256,21 @@ func TestPersistentVolumeClaimEvaluatorUsage(t *testing.T) {
 				api.ResourcePersistentVolumeClaims: resource.MustParse("1"),
 			},
 		},
+		"pvc-usage-by-class": {
+			pvc: validClaimByStorageClass,
+			usage: api.ResourceList{
+				api.ResourceRequestsStorage:                                                  resource.MustParse("10Gi"),
+				api.ResourcePersistentVolumeClaims:                                           resource.MustParse("1"),
+				ResourceByStorageClass(storageClassName, api.ResourceRequestsStorage):        resource.MustParse("10Gi"),
+				ResourceByStorageClass(storageClassName, api.ResourcePersistentVolumeClaims): resource.MustParse("1"),
+			},
+		},
 	}
 	for testName, testCase := range testCases {
-		actual := evaluator.Usage(testCase.pvc)
+		actual, err := evaluator.Usage(testCase.pvc)
+		if err != nil {
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
 		if !quota.Equals(testCase.usage, actual) {
 			t.Errorf("%s expected: %v, actual: %v", testName, testCase.usage, actual)
 		}

pkg/quota/evaluator/core/pods.go

@@ -25,7 +25,6 @@ import (
 	"k8s.io/kubernetes/pkg/api/resource"
 	"k8s.io/kubernetes/pkg/api/v1"
 	"k8s.io/kubernetes/pkg/api/validation"
-	metav1 "k8s.io/kubernetes/pkg/apis/meta/v1"
 	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
 	"k8s.io/kubernetes/pkg/controller/informers"
 	"k8s.io/kubernetes/pkg/kubelet/qos"
@@ -37,6 +36,17 @@ import (
 	"k8s.io/kubernetes/pkg/util/validation/field"
 )
 
+// podResources are the set of resources managed by quota associated with pods.
+var podResources = []api.ResourceName{
+	api.ResourceCPU,
+	api.ResourceMemory,
+	api.ResourceRequestsCPU,
+	api.ResourceRequestsMemory,
+	api.ResourceLimitsCPU,
+	api.ResourceLimitsMemory,
+	api.ResourcePods,
+}
+
 // listPodsByNamespaceFuncUsingClient returns a pod listing function based on the provided client.
 func listPodsByNamespaceFuncUsingClient(kubeClient clientset.Interface) generic.ListFuncByNamespace {
 	// TODO: ideally, we could pass dynamic client pool down into this code, and have one way of doing this.
@@ -58,44 +68,27 @@ func listPodsByNamespaceFuncUsingClient(kubeClient clientset.Interface) generic.
 // NewPodEvaluator returns an evaluator that can evaluate pods
 // if the specified shared informer factory is not nil, evaluator may use it to support listing functions.
 func NewPodEvaluator(kubeClient clientset.Interface, f informers.SharedInformerFactory) quota.Evaluator {
-	computeResources := []api.ResourceName{
-		api.ResourceCPU,
-		api.ResourceMemory,
-		api.ResourceRequestsCPU,
-		api.ResourceRequestsMemory,
-		api.ResourceLimitsCPU,
-		api.ResourceLimitsMemory,
-	}
-	allResources := append(computeResources, api.ResourcePods)
 	listFuncByNamespace := listPodsByNamespaceFuncUsingClient(kubeClient)
 	if f != nil {
 		listFuncByNamespace = generic.ListResourceUsingInformerFunc(f, schema.GroupResource{Resource: "pods"})
 	}
-	return &generic.GenericEvaluator{
-		Name:              "Evaluator.Pod",
-		InternalGroupKind: api.Kind("Pod"),
-		InternalOperationResources: map[admission.Operation][]api.ResourceName{
-			admission.Create: allResources,
-			// TODO: the quota system can only charge for deltas on compute resources when pods support updates.
-			// admission.Update: computeResources,
-		},
-		GetFuncByNamespace: func(namespace, name string) (runtime.Object, error) {
-			return kubeClient.Core().Pods(namespace).Get(name, metav1.GetOptions{})
-		},
-		ConstraintsFunc:      PodConstraintsFunc,
-		MatchedResourceNames: allResources,
-		MatchesScopeFunc:     PodMatchesScopeFunc,
-		UsageFunc:            PodUsageFunc,
-		ListFuncByNamespace:  listFuncByNamespace,
-	}
-}
-
-// PodConstraintsFunc verifies that all required resources are present on the pod
+	return &podEvaluator{
+		listFuncByNamespace: listFuncByNamespace,
+	}
+}
+
+// podEvaluator knows how to measure usage of pods.
+type podEvaluator struct {
+	// knows how to list pods
+	listFuncByNamespace generic.ListFuncByNamespace
+}
+
+// Constraints verifies that all required resources are present on the pod
 // In addition, it validates that the resources are valid (i.e. requests < limits)
-func PodConstraintsFunc(required []api.ResourceName, object runtime.Object) error {
-	pod, ok := object.(*api.Pod)
+func (p *podEvaluator) Constraints(required []api.ResourceName, item runtime.Object) error {
+	pod, ok := item.(*api.Pod)
 	if !ok {
-		return fmt.Errorf("Unexpected input object %v", object)
+		return fmt.Errorf("Unexpected input object %v", item)
 	}
 
 	// Pod level resources are often set during admission control
@@ -114,7 +107,7 @@ func PodConstraintsFunc(required []api.ResourceName, object runtime.Object) erro
 		return allErrs.ToAggregate()
 	}
 
-	// TODO: fix this when we have pod level cgroups
+	// TODO: fix this when we have pod level resource requirements
 	// since we do not yet pod level requests/limits, we need to ensure each
 	// container makes an explict request or limit for a quota tracked resource
 	requiredSet := quota.ToSet(required)
@@ -131,6 +124,40 @@ func PodConstraintsFunc(required []api.ResourceName, object runtime.Object) erro
 	return fmt.Errorf("must specify %s", strings.Join(missingSet.List(), ","))
 }
 
+// GroupKind that this evaluator tracks
+func (p *podEvaluator) GroupKind() schema.GroupKind {
+	return api.Kind("Pod")
+}
+
+// Handles returns true of the evalutor should handle the specified operation.
+func (p *podEvaluator) Handles(operation admission.Operation) bool {
+	// TODO: update this if/when pods support resizing resource requirements.
+	return admission.Create == operation
+}
+
+// Matches returns true if the evaluator matches the specified quota with the provided input item
+func (p *podEvaluator) Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error) {
+	return generic.Matches(resourceQuota, item, p.MatchingResources, podMatchesScopeFunc)
+}
+
+// MatchingResources takes the input specified list of resources and returns the set of resources it matches.
+func (p *podEvaluator) MatchingResources(input []api.ResourceName) []api.ResourceName {
+	return quota.Intersection(input, podResources)
+}
+
+// Usage knows how to measure usage associated with pods
+func (p *podEvaluator) Usage(item runtime.Object) (api.ResourceList, error) {
+	return PodUsageFunc(item)
+}
+
+// UsageStats calculates aggregate usage for the object.
+func (p *podEvaluator) UsageStats(options quota.UsageStatsOptions) (quota.UsageStats, error) {
+	return generic.CalculateUsageStats(options, p.listFuncByNamespace, podMatchesScopeFunc, p.Usage)
+}
+
+// verifies we implement the required interface.
+var _ quota.Evaluator = &podEvaluator{}
+
 // enforcePodContainerConstraints checks for required resources that are not set on this container and
 // adds them to missingSet.
 func enforcePodContainerConstraints(container *api.Container, requiredSet, missingSet sets.String) {
@@ -165,27 +192,49 @@ func podUsageHelper(requests api.ResourceList, limits api.ResourceList) api.Reso
 	return result
 }
 
-func toInternalPodOrDie(obj runtime.Object) *api.Pod {
+func toInternalPodOrError(obj runtime.Object) (*api.Pod, error) {
 	pod := &api.Pod{}
 	switch t := obj.(type) {
 	case *v1.Pod:
 		if err := v1.Convert_v1_Pod_To_api_Pod(t, pod, nil); err != nil {
-			panic(err)
+			return nil, err
 		}
 	case *api.Pod:
 		pod = t
 	default:
-		panic(fmt.Sprintf("expect *api.Pod or *v1.Pod, got %v", t))
+		return nil, fmt.Errorf("expect *api.Pod or *v1.Pod, got %v", t)
 	}
-	return pod
+	return pod, nil
+}
+
+// podMatchesScopeFunc is a function that knows how to evaluate if a pod matches a scope
+func podMatchesScopeFunc(scope api.ResourceQuotaScope, object runtime.Object) (bool, error) {
+	pod, err := toInternalPodOrError(object)
+	if err != nil {
+		return false, err
+	}
+	switch scope {
+	case api.ResourceQuotaScopeTerminating:
+		return isTerminating(pod), nil
+	case api.ResourceQuotaScopeNotTerminating:
+		return !isTerminating(pod), nil
+	case api.ResourceQuotaScopeBestEffort:
+		return isBestEffort(pod), nil
+	case api.ResourceQuotaScopeNotBestEffort:
+		return !isBestEffort(pod), nil
+	}
+	return false, nil
 }
 
 // PodUsageFunc knows how to measure usage associated with pods
-func PodUsageFunc(obj runtime.Object) api.ResourceList {
-	pod := toInternalPodOrDie(obj)
+func PodUsageFunc(obj runtime.Object) (api.ResourceList, error) {
+	pod, err := toInternalPodOrError(obj)
+	if err != nil {
+		return api.ResourceList{}, err
+	}
 	// by convention, we do not quota pods that have reached an end-of-life state
 	if !QuotaPod(pod) {
-		return api.ResourceList{}
+		return api.ResourceList{}, nil
 	}
 	requests := api.ResourceList{}
 	limits := api.ResourceList{}
@@ -203,23 +252,7 @@ func PodUsageFunc(obj runtime.Object) api.ResourceList {
 		limits = quota.Max(limits, pod.Spec.InitContainers[i].Resources.Limits)
 	}
 
-	return podUsageHelper(requests, limits)
-}
-
-// PodMatchesScopeFunc is a function that knows how to evaluate if a pod matches a scope
-func PodMatchesScopeFunc(scope api.ResourceQuotaScope, object runtime.Object) bool {
-	pod := toInternalPodOrDie(object)
-	switch scope {
-	case api.ResourceQuotaScopeTerminating:
-		return isTerminating(pod)
-	case api.ResourceQuotaScopeNotTerminating:
-		return !isTerminating(pod)
-	case api.ResourceQuotaScopeBestEffort:
-		return isBestEffort(pod)
-	case api.ResourceQuotaScopeNotBestEffort:
-		return !isBestEffort(pod)
-	}
-	return false
+	return podUsageHelper(requests, limits), nil
 }
 
 func isBestEffort(pod *api.Pod) bool {
@@ -234,7 +267,6 @@ func isTerminating(pod *api.Pod) bool {
 }
 
 // QuotaPod returns true if the pod is eligible to track against a quota
-// if it's not in a terminal state according to its phase.
 func QuotaPod(pod *api.Pod) bool {
 	return !(api.PodFailed == pod.Status.Phase || api.PodSucceeded == pod.Status.Phase)
 }

pkg/quota/evaluator/core/pods_test.go

@@ -86,8 +86,10 @@ func TestPodConstraintsFunc(t *testing.T) {
 			err:      `must specify memory`,
 		},
 	}
+	kubeClient := fake.NewSimpleClientset()
+	evaluator := NewPodEvaluator(kubeClient, nil)
 	for testName, test := range testCases {
-		err := PodConstraintsFunc(test.required, test.pod)
+		err := evaluator.Constraints(test.required, test.pod)
 		switch {
 		case err != nil && len(test.err) == 0,
 			err == nil && len(test.err) != 0,
@@ -245,7 +247,10 @@ func TestPodEvaluatorUsage(t *testing.T) {
 		},
 	}
 	for testName, testCase := range testCases {
-		actual := evaluator.Usage(testCase.pod)
+		actual, err := evaluator.Usage(testCase.pod)
+		if err != nil {
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
 		if !quota.Equals(testCase.usage, actual) {
 			t.Errorf("%s expected: %v, actual: %v", testName, testCase.usage, actual)
 		}

pkg/quota/evaluator/core/replication_controllers.go

@@ -17,7 +17,6 @@ limitations under the License.
 package core
 
 import (
-	"k8s.io/kubernetes/pkg/admission"
 	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/v1"
 	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
@@ -28,17 +27,10 @@ import (
 
 // NewReplicationControllerEvaluator returns an evaluator that can evaluate replication controllers
 func NewReplicationControllerEvaluator(kubeClient clientset.Interface) quota.Evaluator {
-	allResources := []api.ResourceName{api.ResourceReplicationControllers}
-	return &generic.GenericEvaluator{
-		Name:              "Evaluator.ReplicationController",
-		InternalGroupKind: api.Kind("ReplicationController"),
-		InternalOperationResources: map[admission.Operation][]api.ResourceName{
-			admission.Create: allResources,
-		},
-		MatchedResourceNames: allResources,
-		MatchesScopeFunc:     generic.MatchesNoScopeFunc,
-		ConstraintsFunc:      generic.ObjectCountConstraintsFunc(api.ResourceReplicationControllers),
-		UsageFunc:            generic.ObjectCountUsageFunc(api.ResourceReplicationControllers),
+	return &generic.ObjectCountEvaluator{
+		AllowCreateOnUpdate: false,
+		InternalGroupKind:   api.Kind("ReplicationController"),
+		ResourceName:        api.ResourceReplicationControllers,
 		ListFuncByNamespace: func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
 			itemList, err := kubeClient.Core().ReplicationControllers(namespace).List(options)
 			if err != nil {

pkg/quota/evaluator/core/resource_quotas.go

@@ -17,7 +17,6 @@ limitations under the License.
 package core
 
 import (
-	"k8s.io/kubernetes/pkg/admission"
 	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/v1"
 	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
@@ -28,17 +27,10 @@ import (
 
 // NewResourceQuotaEvaluator returns an evaluator that can evaluate resource quotas
 func NewResourceQuotaEvaluator(kubeClient clientset.Interface) quota.Evaluator {
-	allResources := []api.ResourceName{api.ResourceQuotas}
-	return &generic.GenericEvaluator{
-		Name:              "Evaluator.ResourceQuota",
-		InternalGroupKind: api.Kind("ResourceQuota"),
-		InternalOperationResources: map[admission.Operation][]api.ResourceName{
-			admission.Create: allResources,
-		},
-		MatchedResourceNames: allResources,
-		MatchesScopeFunc:     generic.MatchesNoScopeFunc,
-		ConstraintsFunc:      generic.ObjectCountConstraintsFunc(api.ResourceQuotas),
-		UsageFunc:            generic.ObjectCountUsageFunc(api.ResourceQuotas),
+	return &generic.ObjectCountEvaluator{
+		AllowCreateOnUpdate: false,
+		InternalGroupKind:   api.Kind("ResourceQuota"),
+		ResourceName:        api.ResourceQuotas,
 		ListFuncByNamespace: func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
 			itemList, err := kubeClient.Core().ResourceQuotas(namespace).List(options)
 			if err != nil {

pkg/quota/evaluator/core/secrets.go

@@ -17,7 +17,6 @@ limitations under the License.
 package core
 
 import (
-	"k8s.io/kubernetes/pkg/admission"
 	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/v1"
 	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
@@ -28,17 +27,10 @@ import (
 
 // NewSecretEvaluator returns an evaluator that can evaluate secrets
 func NewSecretEvaluator(kubeClient clientset.Interface) quota.Evaluator {
-	allResources := []api.ResourceName{api.ResourceSecrets}
-	return &generic.GenericEvaluator{
-		Name:              "Evaluator.Secret",
-		InternalGroupKind: api.Kind("Secret"),
-		InternalOperationResources: map[admission.Operation][]api.ResourceName{
-			admission.Create: allResources,
-		},
-		MatchedResourceNames: allResources,
-		MatchesScopeFunc:     generic.MatchesNoScopeFunc,
-		ConstraintsFunc:      generic.ObjectCountConstraintsFunc(api.ResourceSecrets),
-		UsageFunc:            generic.ObjectCountUsageFunc(api.ResourceSecrets),
+	return &generic.ObjectCountEvaluator{
+		AllowCreateOnUpdate: false,
+		InternalGroupKind:   api.Kind("Secret"),
+		ResourceName:        api.ResourceSecrets,
 		ListFuncByNamespace: func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
 			itemList, err := kubeClient.Core().Secrets(namespace).List(options)
 			if err != nil {

pkg/quota/evaluator/core/services.go

@@ -28,28 +28,21 @@ import (
 	"k8s.io/kubernetes/pkg/quota"
 	"k8s.io/kubernetes/pkg/quota/generic"
 	"k8s.io/kubernetes/pkg/runtime"
+	"k8s.io/kubernetes/pkg/runtime/schema"
 	"k8s.io/kubernetes/pkg/util/sets"
 )
 
+// serviceResources are the set of resources managed by quota associated with services.
+var serviceResources = []api.ResourceName{
+	api.ResourceServices,
+	api.ResourceServicesNodePorts,
+	api.ResourceServicesLoadBalancers,
+}
+
 // NewServiceEvaluator returns an evaluator that can evaluate service quotas
 func NewServiceEvaluator(kubeClient clientset.Interface) quota.Evaluator {
-	allResources := []api.ResourceName{
-		api.ResourceServices,
-		api.ResourceServicesNodePorts,
-		api.ResourceServicesLoadBalancers,
-	}
-	return &generic.GenericEvaluator{
-		Name:              "Evaluator.Service",
-		InternalGroupKind: api.Kind("Service"),
-		InternalOperationResources: map[admission.Operation][]api.ResourceName{
-			admission.Create: allResources,
-			admission.Update: allResources,
-		},
-		MatchedResourceNames: allResources,
-		MatchesScopeFunc:     generic.MatchesNoScopeFunc,
-		ConstraintsFunc:      ServiceConstraintsFunc,
-		UsageFunc:            ServiceUsageFunc,
-		ListFuncByNamespace: func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
+	return &serviceEvaluator{
+		listFuncByNamespace: func(namespace string, options v1.ListOptions) ([]runtime.Object, error) {
 			itemList, err := kubeClient.Core().Services(namespace).List(options)
 			if err != nil {
 				return nil, err
@@ -63,39 +56,104 @@ func NewServiceEvaluator(kubeClient clientset.Interface) quota.Evaluator {
 	}
 }
 
-// ServiceUsageFunc knows how to measure usage associated with services
-func ServiceUsageFunc(object runtime.Object) api.ResourceList {
-	result := api.ResourceList{}
-	var serviceType api.ServiceType
-	var ports int
+// serviceEvaluator knows how to measure usage for services.
+type serviceEvaluator struct {
+	// knows how to list items by namespace
+	listFuncByNamespace generic.ListFuncByNamespace
+}
+
+// Constraints verifies that all required resources are present on the item
+func (p *serviceEvaluator) Constraints(required []api.ResourceName, item runtime.Object) error {
+	service, ok := item.(*api.Service)
+	if !ok {
+		return fmt.Errorf("unexpected input object %v", item)
+	}
+
+	requiredSet := quota.ToSet(required)
+	missingSet := sets.NewString()
+	serviceUsage, err := p.Usage(service)
+	if err != nil {
+		return err
+	}
+	serviceSet := quota.ToSet(quota.ResourceNames(serviceUsage))
+	if diff := requiredSet.Difference(serviceSet); len(diff) > 0 {
+		missingSet.Insert(diff.List()...)
+	}
+
+	if len(missingSet) == 0 {
+		return nil
+	}
+	return fmt.Errorf("must specify %s", strings.Join(missingSet.List(), ","))
+}
+
+// GroupKind that this evaluator tracks
+func (p *serviceEvaluator) GroupKind() schema.GroupKind {
+	return api.Kind("Service")
+}
+
+// Handles returns true of the evalutor should handle the specified operation.
+func (p *serviceEvaluator) Handles(operation admission.Operation) bool {
+	// We handle create and update because a service type can change.
+	return admission.Create == operation || admission.Update == operation
+}
 
-	switch t := object.(type) {
+// Matches returns true if the evaluator matches the specified quota with the provided input item
+func (p *serviceEvaluator) Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error) {
+	return generic.Matches(resourceQuota, item, p.MatchingResources, generic.MatchesNoScopeFunc)
+}
+
+// MatchingResources takes the input specified list of resources and returns the set of resources it matches.
+func (p *serviceEvaluator) MatchingResources(input []api.ResourceName) []api.ResourceName {
+	return quota.Intersection(input, serviceResources)
+}
+
+// convert the input object to an internal service object or error.
+func toInternalServiceOrError(obj runtime.Object) (*api.Service, error) {
+	svc := &api.Service{}
+	switch t := obj.(type) {
 	case *v1.Service:
-		serviceType = api.ServiceType(t.Spec.Type)
-		ports = len(t.Spec.Ports)
+		if err := v1.Convert_v1_Service_To_api_Service(t, svc, nil); err != nil {
+			return nil, err
+		}
 	case *api.Service:
-		serviceType = t.Spec.Type
-		ports = len(t.Spec.Ports)
+		svc = t
 	default:
-		panic(fmt.Sprintf("expect *api.Service or *v1.Service, got %v", t))
+		return nil, fmt.Errorf("expect *api.Service or *v1.Service, got %v", t)
 	}
+	return svc, nil
+}
 
+// Usage knows how to measure usage associated with pods
+func (p *serviceEvaluator) Usage(item runtime.Object) (api.ResourceList, error) {
+	result := api.ResourceList{}
+	svc, err := toInternalServiceOrError(item)
+	if err != nil {
+		return result, err
+	}
+	ports := len(svc.Spec.Ports)
 	// default service usage
-	result[api.ResourceServices] = resource.MustParse("1")
-	result[api.ResourceServicesLoadBalancers] = resource.MustParse("0")
-	result[api.ResourceServicesNodePorts] = resource.MustParse("0")
-	switch serviceType {
+	result[api.ResourceServices] = *(resource.NewQuantity(1, resource.DecimalSI))
+	result[api.ResourceServicesLoadBalancers] = resource.Quantity{Format: resource.DecimalSI}
+	result[api.ResourceServicesNodePorts] = resource.Quantity{Format: resource.DecimalSI}
+	switch svc.Spec.Type {
 	case api.ServiceTypeNodePort:
 		// node port services need to count node ports
 		value := resource.NewQuantity(int64(ports), resource.DecimalSI)
 		result[api.ResourceServicesNodePorts] = *value
 	case api.ServiceTypeLoadBalancer:
 		// load balancer services need to count load balancers
-		result[api.ResourceServicesLoadBalancers] = resource.MustParse("1")
+		result[api.ResourceServicesLoadBalancers] = *(resource.NewQuantity(1, resource.DecimalSI))
 	}
-	return result
+	return result, nil
 }
 
+// UsageStats calculates aggregate usage for the object.
+func (p *serviceEvaluator) UsageStats(options quota.UsageStatsOptions) (quota.UsageStats, error) {
+	return generic.CalculateUsageStats(options, p.listFuncByNamespace, generic.MatchesNoScopeFunc, p.Usage)
+}
+
+var _ quota.Evaluator = &serviceEvaluator{}
+
 // QuotaServiceType returns true if the service type is eligible to track against a quota
 func QuotaServiceType(service *v1.Service) bool {
 	switch service.Spec.Type {
@@ -115,24 +173,3 @@ func GetQuotaServiceType(service *v1.Service) v1.ServiceType {
 	}
 	return v1.ServiceType("")
 }
-
-// ServiceConstraintsFunc verifies that all required resources are captured in service usage.
-func ServiceConstraintsFunc(required []api.ResourceName, object runtime.Object) error {
-	service, ok := object.(*api.Service)
-	if !ok {
-		return fmt.Errorf("unexpected input object %v", object)
-	}
-
-	requiredSet := quota.ToSet(required)
-	missingSet := sets.NewString()
-	serviceUsage := ServiceUsageFunc(service)
-	serviceSet := quota.ToSet(quota.ResourceNames(serviceUsage))
-	if diff := requiredSet.Difference(serviceSet); len(diff) > 0 {
-		missingSet.Insert(diff.List()...)
-	}
-
-	if len(missingSet) == 0 {
-		return nil
-	}
-	return fmt.Errorf("must specify %s", strings.Join(missingSet.List(), ","))
-}

pkg/quota/evaluator/core/services_test.go

@@ -28,12 +28,21 @@ import (
 func TestServiceEvaluatorMatchesResources(t *testing.T) {
 	kubeClient := fake.NewSimpleClientset()
 	evaluator := NewServiceEvaluator(kubeClient)
+	// we give a lot of resources
+	input := []api.ResourceName{
+		api.ResourceConfigMaps,
+		api.ResourceCPU,
+		api.ResourceServices,
+		api.ResourceServicesNodePorts,
+		api.ResourceServicesLoadBalancers,
+	}
+	// but we only match these...
 	expected := quota.ToSet([]api.ResourceName{
 		api.ResourceServices,
 		api.ResourceServicesNodePorts,
 		api.ResourceServicesLoadBalancers,
 	})
-	actual := quota.ToSet(evaluator.MatchesResources())
+	actual := quota.ToSet(evaluator.MatchingResources(input))
 	if !expected.Equal(actual) {
 		t.Errorf("expected: %v, actual: %v", expected, actual)
 	}
@@ -109,7 +118,10 @@ func TestServiceEvaluatorUsage(t *testing.T) {
 		},
 	}
 	for testName, testCase := range testCases {
-		actual := evaluator.Usage(testCase.service)
+		actual, err := evaluator.Usage(testCase.service)
+		if err != nil {
+			t.Errorf("%s unexpected error: %v", testName, err)
+		}
 		if !quota.Equals(testCase.usage, actual) {
 			t.Errorf("%s expected: %v, actual: %v", testName, testCase.usage, actual)
 		}
@@ -168,8 +180,11 @@ func TestServiceConstraintsFunc(t *testing.T) {
 			required: []api.ResourceName{api.ResourceServicesNodePorts},
 		},
 	}
+
+	kubeClient := fake.NewSimpleClientset()
+	evaluator := NewServiceEvaluator(kubeClient)
 	for testName, test := range testCases {
-		err := ServiceConstraintsFunc(test.required, test.service)
+		err := evaluator.Constraints(test.required, test.service)
 		switch {
 		case err != nil && len(test.err) == 0,
 			err == nil && len(test.err) != 0,

pkg/quota/interfaces.go

@@ -29,6 +29,8 @@ type UsageStatsOptions struct {
 	Namespace string
 	// Scopes that must match counted objects
 	Scopes []api.ResourceQuotaScope
+	// Resources are the set of resources to include in the measurement
+	Resources []api.ResourceName
 }
 
 // UsageStats is result of measuring observed resource use in the system
@@ -41,20 +43,17 @@ type UsageStats struct {
 type Evaluator interface {
 	// Constraints ensures that each required resource is present on item
 	Constraints(required []api.ResourceName, item runtime.Object) error
-	// Get returns the object with specified namespace and name
-	Get(namespace, name string) (runtime.Object, error)
 	// GroupKind returns the groupKind that this object knows how to evaluate
 	GroupKind() schema.GroupKind
-	// MatchesResources is the list of resources that this evaluator matches
-	MatchesResources() []api.ResourceName
+	// Handles determines if quota could be impacted by the specified operation.
+	// If true, admission control must perform quota processing for the operation, otherwise it is safe to ignore quota.
+	Handles(operation admission.Operation) bool
 	// Matches returns true if the specified quota matches the input item
-	Matches(resourceQuota *api.ResourceQuota, item runtime.Object) bool
-	// OperationResources returns the set of resources that could be updated for the
-	// specified operation for this kind.  If empty, admission control will ignore
-	// quota processing for the operation.
-	OperationResources(operation admission.Operation) []api.ResourceName
+	Matches(resourceQuota *api.ResourceQuota, item runtime.Object) (bool, error)
+	// MatchingResources takes the input specified list of resources and returns the set of resources evaluator matches.
+	MatchingResources(input []api.ResourceName) []api.ResourceName
 	// Usage returns the resource usage for the specified object
-	Usage(object runtime.Object) api.ResourceList
+	Usage(item runtime.Object) (api.ResourceList, error)
 	// UsageStats calculates latest observed usage stats for all objects
 	UsageStats(options UsageStatsOptions) (UsageStats, error)
 }
@@ -69,6 +68,7 @@ type Registry interface {
 // is the "winner"
 type UnionRegistry []Registry
 
+// Evaluators returns a mapping of evaluators by group kind.
 func (r UnionRegistry) Evaluators() map[schema.GroupKind]Evaluator {
 	ret := map[schema.GroupKind]Evaluator{}
 

pkg/quota/resources.go

@@ -223,18 +223,21 @@ func CalculateUsage(namespaceName string, scopes []api.ResourceQuotaScope, hardL
 	potentialResources := []api.ResourceName{}
 	evaluators := registry.Evaluators()
 	for _, evaluator := range evaluators {
-		potentialResources = append(potentialResources, evaluator.MatchesResources()...)
+		potentialResources = append(potentialResources, evaluator.MatchingResources(hardResources)...)
 	}
+	// NOTE: the intersection just removes duplicates since the evaluator match intersects wtih hard
 	matchedResources := Intersection(hardResources, potentialResources)
 
 	// sum the observed usage from each evaluator
 	newUsage := api.ResourceList{}
-	usageStatsOptions := UsageStatsOptions{Namespace: namespaceName, Scopes: scopes}
 	for _, evaluator := range evaluators {
 		// only trigger the evaluator if it matches a resource in the quota, otherwise, skip calculating anything
-		if intersection := Intersection(evaluator.MatchesResources(), matchedResources); len(intersection) == 0 {
+		intersection := evaluator.MatchingResources(matchedResources)
+		if len(intersection) == 0 {
 			continue
 		}
+
+		usageStatsOptions := UsageStatsOptions{Namespace: namespaceName, Scopes: scopes, Resources: intersection}
 		stats, err := evaluator.UsageStats(usageStatsOptions)
 		if err != nil {
 			return nil, err

pkg/util/validation/validation_test.go

@@ -218,6 +218,7 @@ func TestIsQualifiedName(t *testing.T) {
 		"1.2.3.4/5678",
 		"Uppercase_Is_OK_123",
 		"example.com/Uppercase_Is_OK_123",
+		"requests.storage-foo",
 		strings.Repeat("a", 63),
 		strings.Repeat("a", 253) + "/" + strings.Repeat("b", 63),
 	}

plugin/pkg/admission/resourcequota/BUILD

@@ -54,10 +54,8 @@ go_test(
         "//pkg/client/clientset_generated/internalclientset/fake:go_default_library",
         "//pkg/client/testing/core:go_default_library",
         "//pkg/quota:go_default_library",
-        "//pkg/quota/evaluator/core:go_default_library",
         "//pkg/quota/generic:go_default_library",
         "//pkg/quota/install:go_default_library",
-        "//pkg/runtime:go_default_library",
         "//pkg/runtime/schema:go_default_library",
         "//pkg/util/sets:go_default_library",
         "//vendor:github.com/hashicorp/golang-lru",

plugin/pkg/admission/resourcequota/admission_test.go

@@ -31,10 +31,8 @@ import (
 	"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/fake"
 	testcore "k8s.io/kubernetes/pkg/client/testing/core"
 	"k8s.io/kubernetes/pkg/quota"
-	"k8s.io/kubernetes/pkg/quota/evaluator/core"
 	"k8s.io/kubernetes/pkg/quota/generic"
 	"k8s.io/kubernetes/pkg/quota/install"
-	"k8s.io/kubernetes/pkg/runtime"
 	"k8s.io/kubernetes/pkg/runtime/schema"
 	"k8s.io/kubernetes/pkg/util/sets"
 )
@@ -896,44 +894,22 @@ func TestAdmissionSetsMissingNamespace(t *testing.T) {
 		ObjectMeta: api.ObjectMeta{Name: "quota", Namespace: namespace, ResourceVersion: "124"},
 		Status: api.ResourceQuotaStatus{
 			Hard: api.ResourceList{
-				api.ResourceCPU: resource.MustParse("3"),
+				api.ResourcePods: resource.MustParse("3"),
 			},
 			Used: api.ResourceList{
-				api.ResourceCPU: resource.MustParse("1"),
+				api.ResourcePods: resource.MustParse("1"),
 			},
 		},
 	}
 	kubeClient := fake.NewSimpleClientset(resourceQuota)
 	indexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{"namespace": cache.MetaNamespaceIndexFunc})
 
-	computeResources := []api.ResourceName{
-		api.ResourcePods,
-		api.ResourceCPU,
-	}
-
-	usageFunc := func(object runtime.Object) api.ResourceList {
-		pod, ok := object.(*api.Pod)
-		if !ok {
-			t.Fatalf("Expected pod, got %T", object)
-		}
-		if pod.Namespace != namespace {
-			t.Errorf("Expected pod with different namespace: %q != %q", pod.Namespace, namespace)
-		}
-		return core.PodUsageFunc(pod)
+	// create a dummy evaluator so we can trigger quota
+	podEvaluator := &generic.ObjectCountEvaluator{
+		AllowCreateOnUpdate: false,
+		InternalGroupKind:   api.Kind("Pod"),
+		ResourceName:        api.ResourcePods,
 	}
-
-	podEvaluator := &generic.GenericEvaluator{
-		Name:              "Test-Evaluator.Pod",
-		InternalGroupKind: api.Kind("Pod"),
-		InternalOperationResources: map[admission.Operation][]api.ResourceName{
-			admission.Create: computeResources,
-		},
-		ConstraintsFunc:      core.PodConstraintsFunc,
-		MatchedResourceNames: computeResources,
-		MatchesScopeFunc:     core.PodMatchesScopeFunc,
-		UsageFunc:            usageFunc,
-	}
-
 	registry := &generic.GenericRegistry{
 		InternalEvaluators: map[schema.GroupKind]quota.Evaluator{
 			podEvaluator.GroupKind(): podEvaluator,

plugin/pkg/admission/resourcequota/controller.go

@@ -327,8 +327,7 @@ func (e *quotaEvaluator) checkRequest(quotas []api.ResourceQuota, a admission.At
 	}
 
 	op := a.GetOperation()
-	operationResources := evaluator.OperationResources(op)
-	if len(operationResources) == 0 {
+	if !evaluator.Handles(op) {
 		return quotas, nil
 	}
 
@@ -340,14 +339,16 @@ func (e *quotaEvaluator) checkRequest(quotas []api.ResourceQuota, a admission.At
 	interestingQuotaIndexes := []int{}
 	for i := range quotas {
 		resourceQuota := quotas[i]
-		match := evaluator.Matches(&resourceQuota, inputObject)
+		match, err := evaluator.Matches(&resourceQuota, inputObject)
+		if err != nil {
+			return quotas, err
+		}
 		if !match {
 			continue
 		}
 
 		hardResources := quota.ResourceNames(resourceQuota.Status.Hard)
-		evaluatorResources := evaluator.MatchesResources()
-		requiredResources := quota.Intersection(hardResources, evaluatorResources)
+		requiredResources := evaluator.MatchingResources(hardResources)
 		if err := evaluator.Constraints(requiredResources, inputObject); err != nil {
 			return nil, admission.NewForbidden(a, fmt.Errorf("failed quota: %s: %v", resourceQuota.Name, err))
 		}
@@ -375,7 +376,10 @@ func (e *quotaEvaluator) checkRequest(quotas []api.ResourceQuota, a admission.At
 	// as a result, we need to measure the usage of this object for quota
 	// on updates, we need to subtract the previous measured usage
 	// if usage shows no change, just return since it has no impact on quota
-	deltaUsage := evaluator.Usage(inputObject)
+	deltaUsage, err := evaluator.Usage(inputObject)
+	if err != nil {
+		return quotas, err
+	}
 
 	// ensure that usage for input object is never negative (this would mean a resource made a negative resource requirement)
 	if negativeUsage := quota.IsNegative(deltaUsage); len(negativeUsage) > 0 {
@@ -392,7 +396,10 @@ func (e *quotaEvaluator) checkRequest(quotas []api.ResourceQuota, a admission.At
 		// then charge based on the delta.  Otherwise, bill the maximum
 		metadata, err := meta.Accessor(prevItem)
 		if err == nil && len(metadata.GetResourceVersion()) > 0 {
-			prevUsage := evaluator.Usage(prevItem)
+			prevUsage, innerErr := evaluator.Usage(prevItem)
+			if innerErr != nil {
+				return quotas, innerErr
+			}
 			deltaUsage = quota.Subtract(deltaUsage, prevUsage)
 		}
 	}
@@ -446,8 +453,7 @@ func (e *quotaEvaluator) Evaluate(a admission.Attributes) error {
 	// for this kind, check if the operation could mutate any quota resources
 	// if no resources tracked by quota are impacted, then just return
 	op := a.GetOperation()
-	operationResources := evaluator.OperationResources(op)
-	if len(operationResources) == 0 {
+	if !evaluator.Handles(op) {
 		return nil
 	}
 

test/e2e/BUILD

@@ -130,6 +130,7 @@ go_library(
         "//pkg/apis/extensions:go_default_library",
         "//pkg/apis/extensions/v1beta1:go_default_library",
         "//pkg/apis/meta/v1:go_default_library",
+        "//pkg/apis/storage/util:go_default_library",
         "//pkg/apis/storage/v1beta1:go_default_library",
         "//pkg/apis/storage/v1beta1/util:go_default_library",
         "//pkg/client/cache:go_default_library",
@@ -159,6 +160,7 @@ go_library(
         "//pkg/labels:go_default_library",
         "//pkg/master/ports:go_default_library",
         "//pkg/metrics:go_default_library",
+        "//pkg/quota/evaluator/core:go_default_library",
         "//pkg/registry/generic/registry:go_default_library",
         "//pkg/runtime:go_default_library",
         "//pkg/runtime/schema:go_default_library",

test/e2e/resource_quota.go

@@ -23,7 +23,9 @@ import (
 	"k8s.io/kubernetes/pkg/api/resource"
 	"k8s.io/kubernetes/pkg/api/v1"
 	metav1 "k8s.io/kubernetes/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/apis/storage/util"
 	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
+	"k8s.io/kubernetes/pkg/quota/evaluator/core"
 	"k8s.io/kubernetes/pkg/util/intstr"
 	"k8s.io/kubernetes/pkg/util/wait"
 	"k8s.io/kubernetes/test/e2e/framework"
@@ -288,7 +290,7 @@ var _ = framework.KubeDescribe("ResourceQuota", func() {
 		pvc, err = f.ClientSet.Core().PersistentVolumeClaims(f.Namespace.Name).Create(pvc)
 		Expect(err).NotTo(HaveOccurred())
 
-		By("Ensuring resource quota status captures persistent volume claimcreation")
+		By("Ensuring resource quota status captures persistent volume claim creation")
 		usedResources = v1.ResourceList{}
 		usedResources[v1.ResourcePersistentVolumeClaims] = resource.MustParse("1")
 		usedResources[v1.ResourceRequestsStorage] = resource.MustParse("1Gi")
@@ -306,6 +308,56 @@ var _ = framework.KubeDescribe("ResourceQuota", func() {
 		Expect(err).NotTo(HaveOccurred())
 	})
 
+	It("should create a ResourceQuota and capture the life of a persistent volume claim with a storage class.", func() {
+		By("Creating a ResourceQuota")
+		quotaName := "test-quota"
+		resourceQuota := newTestResourceQuota(quotaName)
+		resourceQuota, err := createResourceQuota(f.ClientSet, f.Namespace.Name, resourceQuota)
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Ensuring resource quota status is calculated")
+		usedResources := v1.ResourceList{}
+		usedResources[v1.ResourceQuotas] = resource.MustParse("1")
+		usedResources[v1.ResourcePersistentVolumeClaims] = resource.MustParse("0")
+		usedResources[v1.ResourceRequestsStorage] = resource.MustParse("0")
+		usedResources[core.V1ResourceByStorageClass("gold", v1.ResourcePersistentVolumeClaims)] = resource.MustParse("0")
+		usedResources[core.V1ResourceByStorageClass("gold", v1.ResourceRequestsStorage)] = resource.MustParse("0")
+
+		err = waitForResourceQuota(f.ClientSet, f.Namespace.Name, quotaName, usedResources)
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Creating a PersistentVolumeClaim with storage class")
+		pvc := newTestPersistentVolumeClaimForQuota("test-claim")
+		pvc.Annotations = map[string]string{
+			util.StorageClassAnnotation: "gold",
+		}
+		pvc, err = f.ClientSet.Core().PersistentVolumeClaims(f.Namespace.Name).Create(pvc)
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Ensuring resource quota status captures persistent volume claim creation")
+		usedResources = v1.ResourceList{}
+		usedResources[v1.ResourcePersistentVolumeClaims] = resource.MustParse("1")
+		usedResources[v1.ResourceRequestsStorage] = resource.MustParse("1Gi")
+		usedResources[core.V1ResourceByStorageClass("gold", v1.ResourcePersistentVolumeClaims)] = resource.MustParse("1")
+		usedResources[core.V1ResourceByStorageClass("gold", v1.ResourceRequestsStorage)] = resource.MustParse("1Gi")
+
+		err = waitForResourceQuota(f.ClientSet, f.Namespace.Name, quotaName, usedResources)
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Deleting a PersistentVolumeClaim")
+		err = f.ClientSet.Core().PersistentVolumeClaims(f.Namespace.Name).Delete(pvc.Name, nil)
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Ensuring resource quota status released usage")
+		usedResources[v1.ResourcePersistentVolumeClaims] = resource.MustParse("0")
+		usedResources[v1.ResourceRequestsStorage] = resource.MustParse("0")
+		usedResources[core.V1ResourceByStorageClass("gold", v1.ResourcePersistentVolumeClaims)] = resource.MustParse("0")
+		usedResources[core.V1ResourceByStorageClass("gold", v1.ResourceRequestsStorage)] = resource.MustParse("0")
+
+		err = waitForResourceQuota(f.ClientSet, f.Namespace.Name, quotaName, usedResources)
+		Expect(err).NotTo(HaveOccurred())
+	})
+
 	It("should verify ResourceQuota with terminating scopes.", func() {
 		By("Creating a ResourceQuota with terminating scope")
 		quotaTerminatingName := "quota-terminating"
@@ -517,6 +569,8 @@ func newTestResourceQuota(name string) *v1.ResourceQuota {
 	hard[v1.ResourceSecrets] = resource.MustParse("10")
 	hard[v1.ResourcePersistentVolumeClaims] = resource.MustParse("10")
 	hard[v1.ResourceRequestsStorage] = resource.MustParse("10Gi")
+	hard[core.V1ResourceByStorageClass("gold", v1.ResourcePersistentVolumeClaims)] = resource.MustParse("10")
+	hard[core.V1ResourceByStorageClass("gold", v1.ResourceRequestsStorage)] = resource.MustParse("10Gi")
 	return &v1.ResourceQuota{
 		ObjectMeta: v1.ObjectMeta{Name: name},
 		Spec:       v1.ResourceQuotaSpec{Hard: hard},