Add TTL GC controller

cmd/kube-controller-manager/app/BUILD

@@ -68,6 +68,7 @@ go_library(
         "//pkg/controller/serviceaccount:go_default_library",
         "//pkg/controller/statefulset:go_default_library",
         "//pkg/controller/ttl:go_default_library",
+        "//pkg/controller/ttlafterfinished:go_default_library",
         "//pkg/controller/volume/attachdetach:go_default_library",
         "//pkg/controller/volume/expand:go_default_library",
         "//pkg/controller/volume/persistentvolume:go_default_library",

cmd/kube-controller-manager/app/controllermanager.go

@@ -378,6 +378,7 @@ func NewControllerInitializers(loopMode ControllerLoopMode) map[string]InitFunc
 	controllers["clusterrole-aggregation"] = startClusterRoleAggregrationController
 	controllers["pvc-protection"] = startPVCProtectionController
 	controllers["pv-protection"] = startPVProtectionController
+	controllers["ttl-after-finished-controller"] = startTTLAfterFinishedController
 
 	return controllers
 }

cmd/kube-controller-manager/app/core.go

@@ -52,6 +52,7 @@ import (
 	servicecontroller "k8s.io/kubernetes/pkg/controller/service"
 	serviceaccountcontroller "k8s.io/kubernetes/pkg/controller/serviceaccount"
 	ttlcontroller "k8s.io/kubernetes/pkg/controller/ttl"
+	"k8s.io/kubernetes/pkg/controller/ttlafterfinished"
 	"k8s.io/kubernetes/pkg/controller/volume/attachdetach"
 	"k8s.io/kubernetes/pkg/controller/volume/expand"
 	persistentvolumecontroller "k8s.io/kubernetes/pkg/controller/volume/persistentvolume"
@@ -417,3 +418,14 @@ func startPVProtectionController(ctx ControllerContext) (http.Handler, bool, err
 	).Run(1, ctx.Stop)
 	return nil, true, nil
 }
+
+func startTTLAfterFinishedController(ctx ControllerContext) (http.Handler, bool, error) {
+	if !utilfeature.DefaultFeatureGate.Enabled(features.TTLAfterFinished) {
+		return nil, false, nil
+	}
+	go ttlafterfinished.New(
+		ctx.InformerFactory.Batch().V1().Jobs(),
+		ctx.ClientBuilder.ClientOrDie("ttl-after-finished-controller"),
+	).Run(5, ctx.Stop)
+	return nil, true, nil
+}

pkg/controller/BUILD

@@ -131,6 +131,7 @@ filegroup(
         "//pkg/controller/statefulset:all-srcs",
         "//pkg/controller/testutil:all-srcs",
         "//pkg/controller/ttl:all-srcs",
+        "//pkg/controller/ttlafterfinished:all-srcs",
         "//pkg/controller/util/node:all-srcs",
         "//pkg/controller/volume/attachdetach:all-srcs",
         "//pkg/controller/volume/events:all-srcs",

pkg/controller/ttlafterfinished/BUILD

+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["ttlafterfinished_controller.go"],
+    importpath = "k8s.io/kubernetes/pkg/controller/ttlafterfinished",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/job:go_default_library",
+        "//pkg/kubectl/scheme:go_default_library",
+        "//pkg/util/metrics:go_default_library",
+        "//staging/src/k8s.io/api/batch/v1:go_default_library",
+        "//staging/src/k8s.io/api/core/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/util/clock:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/util/runtime:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//staging/src/k8s.io/client-go/informers/batch/v1:go_default_library",
+        "//staging/src/k8s.io/client-go/kubernetes:go_default_library",
+        "//staging/src/k8s.io/client-go/kubernetes/typed/core/v1:go_default_library",
+        "//staging/src/k8s.io/client-go/listers/batch/v1:go_default_library",
+        "//staging/src/k8s.io/client-go/tools/cache:go_default_library",
+        "//staging/src/k8s.io/client-go/tools/record:go_default_library",
+        "//staging/src/k8s.io/client-go/util/workqueue:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["ttlafterfinished_controller_test.go"],
+    embed = [":go_default_library"],
+    deps = [
+        "//staging/src/k8s.io/api/batch/v1:go_default_library",
+        "//staging/src/k8s.io/api/core/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/controller/ttlafterfinished/ttlafterfinished_controller_test.go

+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ttlafterfinished
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	batch "k8s.io/api/batch/v1"
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func newJob(completionTime, failedTime metav1.Time, ttl *int32) *batch.Job {
+	j := &batch.Job{
+		TypeMeta: metav1.TypeMeta{Kind: "Job"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "foobar",
+			Namespace: metav1.NamespaceDefault,
+		},
+		Spec: batch.JobSpec{
+			Selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{"foo": "bar"},
+			},
+			Template: v1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						"foo": "bar",
+					},
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{Image: "foo/bar"},
+					},
+				},
+			},
+		},
+	}
+
+	if !completionTime.IsZero() {
+		c := batch.JobCondition{Type: batch.JobComplete, Status: v1.ConditionTrue, LastTransitionTime: completionTime}
+		j.Status.Conditions = append(j.Status.Conditions, c)
+	}
+
+	if !failedTime.IsZero() {
+		c := batch.JobCondition{Type: batch.JobFailed, Status: v1.ConditionTrue, LastTransitionTime: failedTime}
+		j.Status.Conditions = append(j.Status.Conditions, c)
+	}
+
+	if ttl != nil {
+		j.Spec.TTLSecondsAfterFinished = ttl
+	}
+
+	return j
+}
+
+func durationPointer(n int) *time.Duration {
+	s := time.Duration(n) * time.Second
+	return &s
+}
+
+func int32Ptr(n int32) *int32 {
+	return &n
+}
+
+func TestTimeLeft(t *testing.T) {
+	now := metav1.Now()
+
+	testCases := []struct {
+		name             string
+		completionTime   metav1.Time
+		failedTime       metav1.Time
+		ttl              *int32
+		since            *time.Time
+		expectErr        bool
+		expectErrStr     string
+		expectedTimeLeft *time.Duration
+	}{
+		{
+			name:         "Error case: Job unfinished",
+			ttl:          int32Ptr(100),
+			since:        &now.Time,
+			expectErr:    true,
+			expectErrStr: "should not be cleaned up",
+		},
+		{
+			name:           "Error case: Job completed now, no TTL",
+			completionTime: now,
+			since:          &now.Time,
+			expectErr:      true,
+			expectErrStr:   "should not be cleaned up",
+		},
+		{
+			name:             "Job completed now, 0s TTL",
+			completionTime:   now,
+			ttl:              int32Ptr(0),
+			since:            &now.Time,
+			expectedTimeLeft: durationPointer(0),
+		},
+		{
+			name:             "Job completed now, 10s TTL",
+			completionTime:   now,
+			ttl:              int32Ptr(10),
+			since:            &now.Time,
+			expectedTimeLeft: durationPointer(10),
+		},
+		{
+			name:             "Job completed 10s ago, 15s TTL",
+			completionTime:   metav1.NewTime(now.Add(-10 * time.Second)),
+			ttl:              int32Ptr(15),
+			since:            &now.Time,
+			expectedTimeLeft: durationPointer(5),
+		},
+		{
+			name:         "Error case: Job failed now, no TTL",
+			failedTime:   now,
+			since:        &now.Time,
+			expectErr:    true,
+			expectErrStr: "should not be cleaned up",
+		},
+		{
+			name:             "Job failed now, 0s TTL",
+			failedTime:       now,
+			ttl:              int32Ptr(0),
+			since:            &now.Time,
+			expectedTimeLeft: durationPointer(0),
+		},
+		{
+			name:             "Job failed now, 10s TTL",
+			failedTime:       now,
+			ttl:              int32Ptr(10),
+			since:            &now.Time,
+			expectedTimeLeft: durationPointer(10),
+		},
+		{
+			name:             "Job failed 10s ago, 15s TTL",
+			failedTime:       metav1.NewTime(now.Add(-10 * time.Second)),
+			ttl:              int32Ptr(15),
+			since:            &now.Time,
+			expectedTimeLeft: durationPointer(5),
+		},
+	}
+
+	for _, tc := range testCases {
+		job := newJob(tc.completionTime, tc.failedTime, tc.ttl)
+		gotTimeLeft, gotErr := timeLeft(job, tc.since)
+		if tc.expectErr != (gotErr != nil) {
+			t.Errorf("%s: expected error is %t, got %t, error: %v", tc.name, tc.expectErr, gotErr != nil, gotErr)
+		}
+		if tc.expectErr && len(tc.expectErrStr) == 0 {
+			t.Errorf("%s: invalid test setup; error message must not be empty for error cases", tc.name)
+		}
+		if tc.expectErr && !strings.Contains(gotErr.Error(), tc.expectErrStr) {
+			t.Errorf("%s: expected error message contains %q, got %v", tc.name, tc.expectErrStr, gotErr)
+		}
+		if !tc.expectErr {
+			if *gotTimeLeft != *tc.expectedTimeLeft {
+				t.Errorf("%s: expected time left %v, got %v", tc.name, tc.expectedTimeLeft, gotTimeLeft)
+			}
+		}
+	}
+}

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go

@@ -340,6 +340,15 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding)
 			eventsRule(),
 		},
 	})
+	if utilfeature.DefaultFeatureGate.Enabled(features.TTLAfterFinished) {
+		addControllerRole(&controllerRoles, &controllerRoleBindings, rbacv1.ClusterRole{
+			ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + "ttl-after-finished-controller"},
+			Rules: []rbacv1.PolicyRule{
+				rbacv1helpers.NewRule("get", "list", "watch", "delete").Groups(batchGroup).Resources("jobs").RuleOrDie(),
+				eventsRule(),
+			},
+		})
+	}
 
 	return controllerRoles, controllerRoleBindings
 }