Merge pull request #66928 from RobertKrawitz/ephemeral-storage-quota-exp

pkg/features/kube_features.go

@@ -452,6 +452,13 @@ const (
 	//
 	// Enables the regional PD feature on GCE.
 	deprecatedGCERegionalPersistentDisk featuregate.Feature = "GCERegionalPersistentDisk"
+
+	// owner: @RobertKrawitz
+	// alpha: v1.15
+	//
+	// Allow use of filesystems for ephemeral storage monitoring.
+	// Only applies if LocalStorageCapacityIsolation is set.
+	LocalStorageCapacityIsolationFSQuotaMonitoring featuregate.Feature = "LocalStorageCapacityIsolationFSQuotaMonitoring"
 )
 
 func init() {
@@ -528,6 +535,7 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS
 	TTLAfterFinished:                            {Default: false, PreRelease: featuregate.Alpha},
 	KubeletPodResources:                         {Default: false, PreRelease: featuregate.Alpha},
 	WindowsGMSA:                                 {Default: false, PreRelease: featuregate.Alpha},
+	LocalStorageCapacityIsolationFSQuotaMonitoring: {Default: false, PreRelease: featuregate.Alpha},
 
 	// inherited features from generic apiserver, relisted here to get a conflict if it is changed
 	// unintentionally on either side:

pkg/kubelet/eviction/BUILD

@@ -62,6 +62,7 @@ go_library(
         "//pkg/kubelet/util/format:go_default_library",
         "//pkg/scheduler/api:go_default_library",
         "//pkg/scheduler/util:go_default_library",
+        "//pkg/volume/util:go_default_library",
         "//staging/src/k8s.io/api/core/v1:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/api/resource:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",

pkg/kubelet/eviction/helpers.go

@@ -32,6 +32,7 @@ import (
 	evictionapi "k8s.io/kubernetes/pkg/kubelet/eviction/api"
 	kubetypes "k8s.io/kubernetes/pkg/kubelet/types"
 	schedulerutils "k8s.io/kubernetes/pkg/scheduler/util"
+	volumeutils "k8s.io/kubernetes/pkg/volume/util"
 )
 
 const (
@@ -399,9 +400,7 @@ func podDiskUsage(podStats statsapi.PodStats, pod *v1.Pod, statsToMeasure []fsSt
 func localEphemeralVolumeNames(pod *v1.Pod) []string {
 	result := []string{}
 	for _, volume := range pod.Spec.Volumes {
-		if volume.GitRepo != nil ||
-			(volume.EmptyDir != nil && volume.EmptyDir.Medium != v1.StorageMediumMemory) ||
-			volume.ConfigMap != nil || volume.DownwardAPI != nil {
+		if volumeutils.IsLocalEphemeralVolume(volume) {
 			result = append(result, volume.Name)
 		}
 	}

pkg/kubelet/kubelet_volumes_test.go

@@ -439,11 +439,11 @@ func (f *stubVolume) CanMount() error {
 	return nil
 }
 
-func (f *stubVolume) SetUp(fsGroup *int64) error {
+func (f *stubVolume) SetUp(mounterArgs volume.MounterArgs) error {
 	return nil
 }
 
-func (f *stubVolume) SetUpAt(dir string, fsGroup *int64) error {
+func (f *stubVolume) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	return nil
 }
 

pkg/kubelet/volumemanager/cache/BUILD

@@ -14,12 +14,14 @@ go_library(
     ],
     importpath = "k8s.io/kubernetes/pkg/kubelet/volumemanager/cache",
     deps = [
+        "//pkg/api/v1/resource:go_default_library",
         "//pkg/features:go_default_library",
         "//pkg/volume:go_default_library",
         "//pkg/volume/util:go_default_library",
         "//pkg/volume/util/operationexecutor:go_default_library",
         "//pkg/volume/util/types:go_default_library",
         "//staging/src/k8s.io/api/core/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/api/resource:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/types:go_default_library",
         "//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library",
         "//vendor/k8s.io/klog:go_default_library",

pkg/kubelet/volumemanager/cache/desired_state_of_world.go

@@ -25,6 +25,8 @@ import (
 	"sync"
 
 	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	apiv1resource "k8s.io/kubernetes/pkg/api/v1/resource"
 	"k8s.io/kubernetes/pkg/volume"
 	"k8s.io/kubernetes/pkg/volume/util"
 	"k8s.io/kubernetes/pkg/volume/util/operationexecutor"
@@ -160,6 +162,10 @@ type volumeToMount struct {
 	// reportedInUse indicates that the volume was successfully added to the
 	// VolumesInUse field in the node's status.
 	reportedInUse bool
+
+	// desiredSizeLimit indicates the desired upper bound on the size of the volume
+	// (if so implemented)
+	desiredSizeLimit *resource.Quantity
 }
 
 // The pod object represents a pod that references the underlying volume and
@@ -226,6 +232,20 @@ func (dsw *desiredStateOfWorld) AddPodToVolume(
 	}
 
 	if _, volumeExists := dsw.volumesToMount[volumeName]; !volumeExists {
+		var sizeLimit *resource.Quantity
+		if volumeSpec.Volume != nil {
+			if util.IsLocalEphemeralVolume(*volumeSpec.Volume) {
+				_, podLimits := apiv1resource.PodRequestsAndLimits(pod)
+				ephemeralStorageLimit := podLimits[v1.ResourceEphemeralStorage]
+				sizeLimit = resource.NewQuantity(ephemeralStorageLimit.Value(), resource.BinarySI)
+				if volumeSpec.Volume.EmptyDir != nil &&
+					volumeSpec.Volume.EmptyDir.SizeLimit != nil &&
+					volumeSpec.Volume.EmptyDir.SizeLimit.Value() > 0 &&
+					volumeSpec.Volume.EmptyDir.SizeLimit.Value() < sizeLimit.Value() {
+					sizeLimit = resource.NewQuantity(volumeSpec.Volume.EmptyDir.SizeLimit.Value(), resource.BinarySI)
+				}
+			}
+		}
 		dsw.volumesToMount[volumeName] = volumeToMount{
 			volumeName:              volumeName,
 			podsToMount:             make(map[types.UniquePodName]podToMount),
@@ -233,6 +253,7 @@ func (dsw *desiredStateOfWorld) AddPodToVolume(
 			pluginIsDeviceMountable: deviceMountable,
 			volumeGidValue:          volumeGidValue,
 			reportedInUse:           false,
+			desiredSizeLimit:        sizeLimit,
 		}
 	}
 
@@ -360,7 +381,8 @@ func (dsw *desiredStateOfWorld) GetVolumesToMount() []VolumeToMount {
 						PluginIsDeviceMountable: volumeObj.pluginIsDeviceMountable,
 						OuterVolumeSpecName:     podObj.outerVolumeSpecName,
 						VolumeGidValue:          volumeObj.volumeGidValue,
-						ReportedInUse:           volumeObj.reportedInUse}})
+						ReportedInUse:           volumeObj.reportedInUse,
+						DesiredSizeLimit:        volumeObj.desiredSizeLimit}})
 		}
 	}
 	return volumesToMount

pkg/volume/awsebs/aws_ebs.go

@@ -382,12 +382,12 @@ func (b *awsElasticBlockStoreMounter) CanMount() error {
 }
 
 // SetUp attaches the disk and bind mounts to the volume path.
-func (b *awsElasticBlockStoreMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *awsElasticBlockStoreMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
 // SetUpAt attaches the disk and bind mounts to the volume path.
-func (b *awsElasticBlockStoreMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *awsElasticBlockStoreMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	// TODO: handle failed mounts here.
 	notMnt, err := b.mounter.IsLikelyNotMountPoint(dir)
 	klog.V(4).Infof("PersistentDisk set up: %s %v %v", dir, !notMnt, err)
@@ -440,7 +440,7 @@ func (b *awsElasticBlockStoreMounter) SetUpAt(dir string, fsGroup *int64) error
 	}
 
 	if !b.readOnly {
-		volume.SetVolumeOwnership(b, fsGroup)
+		volume.SetVolumeOwnership(b, mounterArgs.FsGroup)
 	}
 
 	klog.V(4).Infof("Successfully mounted %s", dir)

pkg/volume/awsebs/aws_ebs_test.go

@@ -136,7 +136,7 @@ func TestPlugin(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", path)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(path); err != nil {
@@ -367,7 +367,7 @@ func TestMountOptions(t *testing.T) {
 		t.Errorf("Got a nil Mounter")
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	mountOptions := fakeMounter.MountPoints[0].Opts

pkg/volume/azure_dd/azure_mounter.go

@@ -62,15 +62,15 @@ func (m *azureDiskMounter) CanMount() error {
 	return nil
 }
 
-func (m *azureDiskMounter) SetUp(fsGroup *int64) error {
-	return m.SetUpAt(m.GetPath(), fsGroup)
+func (m *azureDiskMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return m.SetUpAt(m.GetPath(), mounterArgs)
 }
 
 func (m *azureDiskMounter) GetPath() string {
 	return getPath(m.dataDisk.podUID, m.dataDisk.volumeName, m.plugin.host)
 }
 
-func (m *azureDiskMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (m *azureDiskMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	mounter := m.plugin.host.GetMounter(m.plugin.GetPluginName())
 	volumeSource, _, err := getVolumeSource(m.spec)
 
@@ -161,7 +161,7 @@ func (m *azureDiskMounter) SetUpAt(dir string, fsGroup *int64) error {
 	}
 
 	if volumeSource.ReadOnly == nil || !*volumeSource.ReadOnly {
-		volume.SetVolumeOwnership(m, fsGroup)
+		volume.SetVolumeOwnership(m, mounterArgs.FsGroup)
 	}
 
 	klog.V(2).Infof("azureDisk - successfully mounted disk %s on %s", diskName, dir)

pkg/volume/azure_file/azure_file.go

@@ -239,11 +239,11 @@ func (b *azureFileMounter) CanMount() error {
 }
 
 // SetUp attaches the disk and bind mounts to the volume path.
-func (b *azureFileMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *azureFileMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
-func (b *azureFileMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *azureFileMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	notMnt, err := b.mounter.IsLikelyNotMountPoint(dir)
 	klog.V(4).Infof("AzureFile mount set up: %s %v %v", dir, !notMnt, err)
 	if err != nil && !os.IsNotExist(err) {
@@ -286,7 +286,7 @@ func (b *azureFileMounter) SetUpAt(dir string, fsGroup *int64) error {
 			options = append(options, "ro")
 		}
 		mountOptions = volutil.JoinMountOptions(b.mountOptions, options)
-		mountOptions = appendDefaultMountOptions(mountOptions, fsGroup)
+		mountOptions = appendDefaultMountOptions(mountOptions, mounterArgs.FsGroup)
 	}
 
 	err = b.mounter.Mount(source, dir, "cifs", mountOptions)

pkg/volume/azure_file/azure_file_test.go

@@ -155,7 +155,7 @@ func testPlugin(t *testing.T, tmpDir string, volumeHost volume.VolumeHost) {
 		t.Errorf("Got unexpected path: %s", path)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(path); err != nil {

pkg/volume/cephfs/cephfs.go

@@ -222,12 +222,12 @@ func (cephfsVolume *cephfsMounter) CanMount() error {
 }
 
 // SetUp attaches the disk and bind mounts to the volume path.
-func (cephfsVolume *cephfsMounter) SetUp(fsGroup *int64) error {
-	return cephfsVolume.SetUpAt(cephfsVolume.GetPath(), fsGroup)
+func (cephfsVolume *cephfsMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return cephfsVolume.SetUpAt(cephfsVolume.GetPath(), mounterArgs)
 }
 
 // SetUpAt attaches the disk and bind mounts to the volume path.
-func (cephfsVolume *cephfsMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (cephfsVolume *cephfsMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	notMnt, err := cephfsVolume.mounter.IsLikelyNotMountPoint(dir)
 	klog.V(4).Infof("CephFS mount set up: %s %v %v", dir, !notMnt, err)
 	if err != nil && !os.IsNotExist(err) {

pkg/volume/cephfs/cephfs_test.go

@@ -87,7 +87,7 @@ func TestPlugin(t *testing.T) {
 	if volumePath != volpath {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(volumePath); err != nil {

pkg/volume/cinder/cinder.go

@@ -377,12 +377,12 @@ func (b *cinderVolumeMounter) CanMount() error {
 	return nil
 }
 
-func (b *cinderVolumeMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *cinderVolumeMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
 // SetUp bind mounts to the volume path.
-func (b *cinderVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *cinderVolumeMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	klog.V(5).Infof("Cinder SetUp %s to %s", b.pdName, dir)
 
 	b.plugin.volumeLocks.LockKey(b.pdName)
@@ -442,7 +442,7 @@ func (b *cinderVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 	}
 
 	if !b.readOnly {
-		volume.SetVolumeOwnership(b, fsGroup)
+		volume.SetVolumeOwnership(b, mounterArgs.FsGroup)
 	}
 	klog.V(3).Infof("Cinder volume %s mounted to %s", b.pdName, dir)
 

pkg/volume/cinder/cinder_test.go

@@ -166,7 +166,7 @@ func TestPlugin(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", path)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(path); err != nil {

pkg/volume/configmap/configmap.go

@@ -183,11 +183,11 @@ func (b *configMapVolumeMounter) CanMount() error {
 	return nil
 }
 
-func (b *configMapVolumeMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *configMapVolumeMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
-func (b *configMapVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *configMapVolumeMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	klog.V(3).Infof("Setting up volume %v for pod %v at %v", b.volName, b.pod.UID, dir)
 
 	// Wrap EmptyDir, let it do the setup.
@@ -224,7 +224,7 @@ func (b *configMapVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 	}
 
 	setupSuccess := false
-	if err := wrapped.SetUpAt(dir, fsGroup); err != nil {
+	if err := wrapped.SetUpAt(dir, mounterArgs); err != nil {
 		return err
 	}
 	if err := volumeutil.MakeNestedMountpoints(b.volName, dir, b.pod); err != nil {
@@ -259,9 +259,9 @@ func (b *configMapVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 		return err
 	}
 
-	err = volume.SetVolumeOwnership(b, fsGroup)
+	err = volume.SetVolumeOwnership(b, mounterArgs.FsGroup)
 	if err != nil {
-		klog.Errorf("Error applying volume ownership settings for group: %v", fsGroup)
+		klog.Errorf("Error applying volume ownership settings for group: %v", mounterArgs.FsGroup)
 		return err
 	}
 	setupSuccess = true

pkg/volume/configmap/configmap_test.go

@@ -365,8 +365,10 @@ func TestPlugin(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	fsGroup := int64(1001)
-	err = mounter.SetUp(&fsGroup)
+	var mounterArgs volume.MounterArgs
+	group := int64(1001)
+	mounterArgs.FsGroup = &group
+	err = mounter.SetUp(mounterArgs)
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}
@@ -423,8 +425,10 @@ func TestPluginReboot(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	fsGroup := int64(1001)
-	err = mounter.SetUp(&fsGroup)
+	var mounterArgs volume.MounterArgs
+	group := int64(1001)
+	mounterArgs.FsGroup = &group
+	err = mounter.SetUp(mounterArgs)
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}
@@ -485,8 +489,10 @@ func TestPluginOptional(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	fsGroup := int64(1001)
-	err = mounter.SetUp(&fsGroup)
+	var mounterArgs volume.MounterArgs
+	group := int64(1001)
+	mounterArgs.FsGroup = &group
+	err = mounter.SetUp(mounterArgs)
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}
@@ -582,8 +588,10 @@ func TestPluginKeysOptional(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	fsGroup := int64(1001)
-	err = mounter.SetUp(&fsGroup)
+	var mounterArgs volume.MounterArgs
+	group := int64(1001)
+	mounterArgs.FsGroup = &group
+	err = mounter.SetUp(mounterArgs)
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}
@@ -660,8 +668,10 @@ func TestInvalidConfigMapSetup(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	fsGroup := int64(1001)
-	err = mounter.SetUp(&fsGroup)
+	var mounterArgs volume.MounterArgs
+	group := int64(1001)
+	mounterArgs.FsGroup = &group
+	err = mounter.SetUp(mounterArgs)
 	if err == nil {
 		t.Errorf("Expected setup to fail")
 	}

pkg/volume/csi/csi_mounter.go

@@ -93,11 +93,11 @@ func (c *csiMountMgr) CanMount() error {
 	return nil
 }
 
-func (c *csiMountMgr) SetUp(fsGroup *int64) error {
-	return c.SetUpAt(c.GetPath(), fsGroup)
+func (c *csiMountMgr) SetUp(mounterArgs volume.MounterArgs) error {
+	return c.SetUpAt(c.GetPath(), mounterArgs)
 }
 
-func (c *csiMountMgr) SetUpAt(dir string, fsGroup *int64) error {
+func (c *csiMountMgr) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	klog.V(4).Infof(log("Mounter.SetUpAt(%s)", dir))
 
 	mounted, err := isDirMounted(c.plugin, dir)
@@ -268,7 +268,7 @@ func (c *csiMountMgr) SetUpAt(dir string, fsGroup *int64) error {
 	// if fstype is "", then skip fsgroup (could be indication of non-block filesystem)
 	// if fstype is provided and pv.AccessMode == ReadWriteOnly, then apply fsgroup
 
-	err = c.applyFSGroup(fsType, fsGroup)
+	err = c.applyFSGroup(fsType, mounterArgs.FsGroup)
 	if err != nil {
 		// attempt to rollback mount.
 		fsGrpErr := fmt.Errorf("applyFSGroup failed for vol %s: %v", c.volumeID, err)

pkg/volume/csi/csi_mounter_test.go

@@ -203,8 +203,10 @@ func MounterSetUpTests(t *testing.T, podInfoEnabled bool) {
 			}
 
 			// Mounter.SetUp()
+			var mounterArgs volume.MounterArgs
 			fsGroup := int64(2000)
-			if err := csiMounter.SetUp(&fsGroup); err != nil {
+			mounterArgs.FsGroup = &fsGroup
+			if err := csiMounter.SetUp(mounterArgs); err != nil {
 				t.Fatalf("mounter.Setup failed: %v", err)
 			}
 
@@ -344,7 +346,7 @@ func TestMounterSetUpSimple(t *testing.T) {
 			}
 
 			// Mounter.SetUp()
-			if err := csiMounter.SetUp(nil); err != nil {
+			if err := csiMounter.SetUp(volume.MounterArgs{}); err != nil {
 				t.Fatalf("mounter.Setup failed: %v", err)
 			}
 
@@ -475,7 +477,7 @@ func TestMounterSetUpWithInline(t *testing.T) {
 			}
 
 			// Mounter.SetUp()
-			if err := csiMounter.SetUp(nil); err != nil {
+			if err := csiMounter.SetUp(volume.MounterArgs{}); err != nil {
 				t.Fatalf("mounter.Setup failed: %v", err)
 			}
 
@@ -621,12 +623,14 @@ func TestMounterSetUpWithFSGroup(t *testing.T) {
 		}
 
 		// Mounter.SetUp()
+		var mounterArgs volume.MounterArgs
 		var fsGroupPtr *int64
 		if tc.setFsGroup {
 			fsGroup := tc.fsGroup
 			fsGroupPtr = &fsGroup
 		}
-		if err := csiMounter.SetUp(fsGroupPtr); err != nil {
+		mounterArgs.FsGroup = fsGroupPtr
+		if err := csiMounter.SetUp(mounterArgs); err != nil {
 			t.Fatalf("mounter.Setup failed: %v", err)
 		}
 

pkg/volume/csi/csi_test.go

@@ -268,7 +268,9 @@ func TestCSI_VolumeAll(t *testing.T) {
 
 			csiMounter := mounter.(*csiMountMgr)
 			csiMounter.csiClient = csiClient
-			if err := csiMounter.SetUp(fsGroup); err != nil {
+			var mounterArgs volume.MounterArgs
+			mounterArgs.FsGroup = fsGroup
+			if err := csiMounter.SetUp(mounterArgs); err != nil {
 				t.Fatalf("csiTest.VolumeAll mounter.Setup(fsGroup) failed: %s", err)
 			}
 			t.Log("csiTest.VolumeAll mounter.Setup(fsGroup) done OK")

pkg/volume/downwardapi/downwardapi.go

@@ -174,11 +174,11 @@ func (b *downwardAPIVolumeMounter) CanMount() error {
 // This function is not idempotent by design. We want the data to be refreshed periodically.
 // The internal sync interval of kubelet will drive the refresh of data.
 // TODO: Add volume specific ticker and refresh loop
-func (b *downwardAPIVolumeMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *downwardAPIVolumeMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
-func (b *downwardAPIVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *downwardAPIVolumeMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	klog.V(3).Infof("Setting up a downwardAPI volume %v for pod %v/%v at %v", b.volName, b.pod.Namespace, b.pod.Name, dir)
 	// Wrap EmptyDir. Here we rely on the idempotency of the wrapped plugin to avoid repeatedly mounting
 	wrapped, err := b.plugin.host.NewWrapperMounter(b.volName, wrappedVolumeSpec(), b.pod, *b.opts)
@@ -194,7 +194,7 @@ func (b *downwardAPIVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 	}
 
 	setupSuccess := false
-	if err := wrapped.SetUpAt(dir, fsGroup); err != nil {
+	if err := wrapped.SetUpAt(dir, mounterArgs); err != nil {
 		klog.Errorf("Unable to setup downwardAPI volume %v for pod %v/%v: %s", b.volName, b.pod.Namespace, b.pod.Name, err.Error())
 		return err
 	}
@@ -231,9 +231,9 @@ func (b *downwardAPIVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 		return err
 	}
 
-	err = volume.SetVolumeOwnership(b, fsGroup)
+	err = volume.SetVolumeOwnership(b, mounterArgs.FsGroup)
 	if err != nil {
-		klog.Errorf("Error applying volume ownership settings for group: %v", fsGroup)
+		klog.Errorf("Error applying volume ownership settings for group: %v", mounterArgs.FsGroup)
 		return err
 	}
 

pkg/volume/downwardapi/downwardapi_test.go

@@ -253,7 +253,7 @@ func newDownwardAPITest(t *testing.T, name string, volumeFiles, podLabels, podAn
 
 	volumePath := mounter.GetPath()
 
-	err = mounter.SetUp(nil)
+	err = mounter.SetUp(volume.MounterArgs{})
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}
@@ -380,7 +380,7 @@ func (step reSetUp) run(test *downwardAPITest) {
 	}
 
 	// now re-run Setup
-	if err = test.mounter.SetUp(nil); err != nil {
+	if err = test.mounter.SetUp(volume.MounterArgs{}); err != nil {
 		test.t.Errorf("Failed to re-setup volume: %v", err)
 	}
 

pkg/volume/emptydir/BUILD

@@ -20,6 +20,7 @@ go_library(
         "//pkg/util/mount:go_default_library",
         "//pkg/volume:go_default_library",
         "//pkg/volume/util:go_default_library",
+        "//pkg/volume/util/quota:go_default_library",
         "//staging/src/k8s.io/api/core/v1:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/api/resource:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",

pkg/volume/emptydir/empty_dir.go

@@ -30,6 +30,7 @@ import (
 	"k8s.io/kubernetes/pkg/util/mount"
 	"k8s.io/kubernetes/pkg/volume"
 	volumeutil "k8s.io/kubernetes/pkg/volume/util"
+	"k8s.io/kubernetes/pkg/volume/util/quota"
 	utilstrings "k8s.io/utils/strings"
 )
 
@@ -174,6 +175,7 @@ type emptyDir struct {
 	mounter       mount.Interface
 	mountDetector mountDetector
 	plugin        *emptyDirPlugin
+	desiredSize   int64
 	volume.MetricsProvider
 }
 
@@ -193,12 +195,12 @@ func (ed *emptyDir) CanMount() error {
 }
 
 // SetUp creates new directory.
-func (ed *emptyDir) SetUp(fsGroup *int64) error {
-	return ed.SetUpAt(ed.GetPath(), fsGroup)
+func (ed *emptyDir) SetUp(mounterArgs volume.MounterArgs) error {
+	return ed.SetUpAt(ed.GetPath(), mounterArgs)
 }
 
 // SetUpAt creates new directory.
-func (ed *emptyDir) SetUpAt(dir string, fsGroup *int64) error {
+func (ed *emptyDir) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	notMnt, err := ed.mounter.IsLikelyNotMountPoint(dir)
 	// Getting an os.IsNotExist err from is a contingency; the directory
 	// may not exist yet, in which case, setup should run.
@@ -229,12 +231,28 @@ func (ed *emptyDir) SetUpAt(dir string, fsGroup *int64) error {
 		err = fmt.Errorf("unknown storage medium %q", ed.medium)
 	}
 
-	volume.SetVolumeOwnership(ed, fsGroup)
+	volume.SetVolumeOwnership(ed, mounterArgs.FsGroup)
 
+	// If setting up the quota fails, just log a message but don't actually error out.
+	// We'll use the old du mechanism in this case, at least until we support
+	// enforcement.
 	if err == nil {
 		volumeutil.SetReady(ed.getMetaDir())
+		if mounterArgs.DesiredSize != nil {
+			// Deliberately shadow the outer use of err as noted
+			// above.
+			hasQuotas, err := quota.SupportsQuotas(ed.mounter, dir)
+			if err != nil {
+				klog.V(3).Infof("Unable to check for quota support on %s: %s", dir, err.Error())
+			} else if hasQuotas {
+				klog.V(4).Infof("emptydir trying to assign quota %v on %s", mounterArgs.DesiredSize, dir)
+				err := quota.AssignQuota(ed.mounter, dir, mounterArgs.PodUID, mounterArgs.DesiredSize)
+				if err != nil {
+					klog.V(3).Infof("Set quota on %s failed %s", dir, err.Error())
+				}
+			}
+		}
 	}
-
 	return err
 }
 
@@ -397,9 +415,14 @@ func (ed *emptyDir) TearDownAt(dir string) error {
 }
 
 func (ed *emptyDir) teardownDefault(dir string) error {
+	// Remove any quota
+	err := quota.ClearQuota(ed.mounter, dir)
+	if err != nil {
+		klog.Warningf("Warning: Failed to clear quota on %s: %v", dir, err)
+	}
 	// Renaming the directory is not required anymore because the operation executor
 	// now handles duplicate operations on the same volume
-	err := os.RemoveAll(dir)
+	err = os.RemoveAll(dir)
 	if err != nil {
 		return err
 	}

pkg/volume/emptydir/empty_dir_test.go

@@ -163,7 +163,7 @@ func doTestPlugin(t *testing.T, config pluginTestConfig) {
 		t.Errorf("Got unexpected path: %s", volPath)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 

pkg/volume/fc/fc.go

@@ -371,13 +371,13 @@ func (b *fcDiskMounter) CanMount() error {
 	return nil
 }
 
-func (b *fcDiskMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *fcDiskMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
-func (b *fcDiskMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *fcDiskMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	// diskSetUp checks mountpoints and prevent repeated calls
-	err := diskSetUp(b.manager, *b, dir, b.mounter, fsGroup)
+	err := diskSetUp(b.manager, *b, dir, b.mounter, mounterArgs.FsGroup)
 	if err != nil {
 		klog.Errorf("fc: failed to setup")
 	}

pkg/volume/fc/fc_test.go

@@ -179,7 +179,7 @@ func doTestPlugin(t *testing.T, spec *volume.Spec) {
 		t.Errorf("Unexpected path, expected %q, got: %q", expectedPath, path)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(path); err != nil {

pkg/volume/flexvolume/driver-call.go

@@ -51,7 +51,7 @@ const (
 	optionFSType         = "kubernetes.io/fsType"
 	optionReadWrite      = "kubernetes.io/readwrite"
 	optionKeySecret      = "kubernetes.io/secret"
-	optionFSGroup        = "kubernetes.io/fsGroup"
+	optionFSGroup        = "kubernetes.io/mounterArgs.FsGroup"
 	optionMountsDir      = "kubernetes.io/mountsDir"
 	optionPVorVolumeName = "kubernetes.io/pvOrVolumeName"
 

pkg/volume/flexvolume/mounter-defaults.go

@@ -26,7 +26,7 @@ type mounterDefaults flexVolumeMounter
 
 // SetUpAt is part of the volume.Mounter interface.
 // This implementation relies on the attacher's device mount path and does a bind mount to dir.
-func (f *mounterDefaults) SetUpAt(dir string, fsGroup *int64) error {
+func (f *mounterDefaults) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	klog.Warning(logPrefix(f.plugin), "using default SetUpAt to ", dir)
 
 	src, err := f.plugin.getDeviceMountPath(f.spec)

pkg/volume/flexvolume/mounter.go

@@ -39,12 +39,12 @@ var _ volume.Mounter = &flexVolumeMounter{}
 // Mounter interface
 
 // SetUp creates new directory.
-func (f *flexVolumeMounter) SetUp(fsGroup *int64) error {
-	return f.SetUpAt(f.GetPath(), fsGroup)
+func (f *flexVolumeMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return f.SetUpAt(f.GetPath(), mounterArgs)
 }
 
 // SetUpAt creates new directory.
-func (f *flexVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (f *flexVolumeMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	// Mount only once.
 	alreadyMounted, err := prepareForMount(f.mounter, dir)
 	if err != nil {
@@ -75,15 +75,15 @@ func (f *flexVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 	}
 
 	// Implicit parameters
-	if fsGroup != nil {
-		extraOptions[optionFSGroup] = strconv.FormatInt(int64(*fsGroup), 10)
+	if mounterArgs.FsGroup != nil {
+		extraOptions[optionFSGroup] = strconv.FormatInt(int64(*mounterArgs.FsGroup), 10)
 	}
 
 	call.AppendSpec(f.spec, f.plugin.host, extraOptions)
 
 	_, err = call.Run()
 	if isCmdNotSupportedErr(err) {
-		err = (*mounterDefaults)(f).SetUpAt(dir, fsGroup)
+		err = (*mounterDefaults)(f).SetUpAt(dir, mounterArgs)
 	}
 
 	if err != nil {
@@ -93,7 +93,7 @@ func (f *flexVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 
 	if !f.readOnly {
 		if f.plugin.capabilities.FSGroup {
-			volume.SetVolumeOwnership(f, fsGroup)
+			volume.SetVolumeOwnership(f, mounterArgs.FsGroup)
 		}
 	}
 

pkg/volume/flexvolume/mounter_test.go

@@ -23,6 +23,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/kubernetes/pkg/util/mount"
+	"k8s.io/kubernetes/pkg/volume"
 	"k8s.io/kubernetes/test/utils/harness"
 )
 
@@ -46,7 +47,7 @@ func TestSetUpAt(tt *testing.T) {
 	plugin, rootDir := testPlugin(t)
 	plugin.unsupportedCommands = []string{"unsupportedCmd"}
 	plugin.runner = fakeRunner(
-		// first call without fsGroup
+		// first call without mounterArgs.FsGroup
 		assertDriverCall(t, successOutput(), mountCmd, rootDir+"/mount-dir",
 			specJSON(plugin, spec, map[string]string{
 				optionKeyPodName:            "my-pod",
@@ -55,7 +56,7 @@ func TestSetUpAt(tt *testing.T) {
 				optionKeyServiceAccountName: "my-sa",
 			})),
 
-		// second test has fsGroup
+		// second test has mounterArgs.FsGroup
 		assertDriverCall(t, notSupportedOutput(), mountCmd, rootDir+"/mount-dir",
 			specJSON(plugin, spec, map[string]string{
 				optionFSGroup:               "42",
@@ -69,8 +70,10 @@ func TestSetUpAt(tt *testing.T) {
 	)
 
 	m, _ := plugin.newMounterInternal(spec, pod, mounter, plugin.runner)
-	m.SetUpAt(rootDir+"/mount-dir", nil)
+	var mounterArgs volume.MounterArgs
+	m.SetUpAt(rootDir+"/mount-dir", mounterArgs)
 
-	fsGroup := int64(42)
-	m.SetUpAt(rootDir+"/mount-dir", &fsGroup)
+	group := int64(42)
+	mounterArgs.FsGroup = &group
+	m.SetUpAt(rootDir+"/mount-dir", mounterArgs)
 }

pkg/volume/flocker/flocker.go

@@ -235,8 +235,8 @@ func (b *flockerVolumeMounter) GetPath() string {
 }
 
 // SetUp bind mounts the disk global mount to the volume path.
-func (b *flockerVolumeMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *flockerVolumeMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
 // newFlockerClient uses environment variables and pod attributes to return a
@@ -277,7 +277,7 @@ control service:
    need to update the Primary UUID for this volume.
 5. Wait until the Primary UUID was updated or timeout.
 */
-func (b *flockerVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *flockerVolumeMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	var err error
 	if b.flockerClient == nil {
 		b.flockerClient, err = b.newFlockerClient()
@@ -365,7 +365,7 @@ func (b *flockerVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 	}
 
 	if !b.readOnly {
-		volume.SetVolumeOwnership(b, fsGroup)
+		volume.SetVolumeOwnership(b, mounterArgs.FsGroup)
 	}
 
 	klog.V(4).Infof("successfully mounted %s", dir)

pkg/volume/gcepd/gce_pd.go

@@ -354,12 +354,12 @@ func (b *gcePersistentDiskMounter) CanMount() error {
 }
 
 // SetUp bind mounts the disk global mount to the volume path.
-func (b *gcePersistentDiskMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *gcePersistentDiskMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
 // SetUp bind mounts the disk global mount to the give volume path.
-func (b *gcePersistentDiskMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *gcePersistentDiskMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	// TODO: handle failed mounts here.
 	notMnt, err := b.mounter.IsLikelyNotMountPoint(dir)
 	klog.V(4).Infof("GCE PersistentDisk set up: Dir (%s) PD name (%q) Mounted (%t) Error (%v), ReadOnly (%t)", dir, b.pdName, !notMnt, err, b.readOnly)
@@ -419,7 +419,7 @@ func (b *gcePersistentDiskMounter) SetUpAt(dir string, fsGroup *int64) error {
 	}
 
 	if !b.readOnly {
-		volume.SetVolumeOwnership(b, fsGroup)
+		volume.SetVolumeOwnership(b, mounterArgs.FsGroup)
 	}
 
 	klog.V(4).Infof("Successfully mounted %s", dir)

pkg/volume/gcepd/gce_pd_test.go

@@ -141,7 +141,7 @@ func TestPlugin(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", path)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(path); err != nil {
@@ -279,7 +279,7 @@ func TestMountOptions(t *testing.T) {
 		t.Errorf("Got a nil Mounter")
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	mountOptions := fakeMounter.MountPoints[0].Opts

pkg/volume/git_repo/git_repo.go

@@ -179,12 +179,12 @@ func (b *gitRepoVolumeMounter) CanMount() error {
 }
 
 // SetUp creates new directory and clones a git repo.
-func (b *gitRepoVolumeMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *gitRepoVolumeMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
 // SetUpAt creates new directory and clones a git repo.
-func (b *gitRepoVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *gitRepoVolumeMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	if volumeutil.IsReady(b.getMetaDir()) {
 		return nil
 	}
@@ -194,7 +194,7 @@ func (b *gitRepoVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 	if err != nil {
 		return err
 	}
-	if err := wrapped.SetUpAt(dir, fsGroup); err != nil {
+	if err := wrapped.SetUpAt(dir, mounterArgs); err != nil {
 		return err
 	}
 
@@ -240,7 +240,7 @@ func (b *gitRepoVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 		return fmt.Errorf("failed to exec 'git reset --hard': %s: %v", output, err)
 	}
 
-	volume.SetVolumeOwnership(b, fsGroup)
+	volume.SetVolumeOwnership(b, mounterArgs.FsGroup)
 
 	volumeutil.SetReady(b.getMetaDir())
 	return nil

pkg/volume/git_repo/git_repo_test.go

@@ -422,7 +422,7 @@ func doTestSetUp(scenario struct {
 	g := mounter.(*gitRepoVolumeMounter)
 	g.exec = &fake
 
-	g.SetUp(nil)
+	g.SetUp(volume.MounterArgs{})
 
 	if fake.CommandCalls != len(expecteds) {
 		allErrs = append(allErrs,

pkg/volume/glusterfs/glusterfs.go

@@ -275,11 +275,11 @@ func (b *glusterfsMounter) CanMount() error {
 }
 
 // SetUp attaches the disk and bind mounts to the volume path.
-func (b *glusterfsMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *glusterfsMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
-func (b *glusterfsMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *glusterfsMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	notMnt, err := b.mounter.IsLikelyNotMountPoint(dir)
 	klog.V(4).Infof("mount setup: %s %v %v", dir, !notMnt, err)
 	if err != nil && !os.IsNotExist(err) {

pkg/volume/glusterfs/glusterfs_test.go

@@ -118,7 +118,7 @@ func doTestPlugin(t *testing.T, spec *volume.Spec) {
 	if volumePath != expectedPath {
 		t.Errorf("Unexpected path, expected %q, got: %q", expectedPath, volumePath)
 	}
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(volumePath); err != nil {

pkg/volume/hostpath/host_path.go

@@ -222,7 +222,7 @@ func (b *hostPathMounter) CanMount() error {
 }
 
 // SetUp does nothing.
-func (b *hostPathMounter) SetUp(fsGroup *int64) error {
+func (b *hostPathMounter) SetUp(mounterArgs volume.MounterArgs) error {
 	err := validation.ValidatePathNoBacksteps(b.GetPath())
 	if err != nil {
 		return fmt.Errorf("invalid HostPath `%s`: %v", b.GetPath(), err)
@@ -235,7 +235,7 @@ func (b *hostPathMounter) SetUp(fsGroup *int64) error {
 }
 
 // SetUpAt does not make sense for host paths - probably programmer error.
-func (b *hostPathMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *hostPathMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	return fmt.Errorf("SetUpAt() does not make sense for host paths")
 }
 

pkg/volume/hostpath/host_path_test.go

@@ -217,7 +217,7 @@ func TestInvalidHostPath(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = mounter.SetUp(nil)
+	err = mounter.SetUp(volume.MounterArgs{})
 	expectedMsg := "invalid HostPath `/no/backsteps/allowed/..`: must not contain '..'"
 	if err.Error() != expectedMsg {
 		t.Fatalf("expected error `%s` but got `%s`", expectedMsg, err)
@@ -253,7 +253,7 @@ func TestPlugin(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", path)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 

pkg/volume/iscsi/iscsi.go

@@ -330,13 +330,13 @@ func (b *iscsiDiskMounter) CanMount() error {
 	return nil
 }
 
-func (b *iscsiDiskMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *iscsiDiskMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
-func (b *iscsiDiskMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *iscsiDiskMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	// diskSetUp checks mountpoints and prevent repeated calls
-	err := diskSetUp(b.manager, *b, dir, b.mounter, fsGroup)
+	err := diskSetUp(b.manager, *b, dir, b.mounter, mounterArgs.FsGroup)
 	if err != nil {
 		klog.Errorf("iscsi: failed to setup")
 	}

pkg/volume/iscsi/iscsi_test.go

@@ -175,7 +175,7 @@ func doTestPlugin(t *testing.T, spec *volume.Spec) {
 		t.Errorf("Unexpected path, expected %q, got: %q", expectedPath, path)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(path); err != nil {

pkg/volume/local/local.go

@@ -423,12 +423,12 @@ func (m *localVolumeMounter) CanMount() error {
 }
 
 // SetUp bind mounts the directory to the volume path
-func (m *localVolumeMounter) SetUp(fsGroup *int64) error {
-	return m.SetUpAt(m.GetPath(), fsGroup)
+func (m *localVolumeMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return m.SetUpAt(m.GetPath(), mounterArgs)
 }
 
 // SetUpAt bind mounts the directory to the volume path and sets up volume ownership
-func (m *localVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (m *localVolumeMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	m.plugin.volumeLocks.LockKey(m.globalPath)
 	defer m.plugin.volumeLocks.UnlockKey(m.globalPath)
 
@@ -452,7 +452,7 @@ func (m *localVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 		return nil
 	}
 	refs, err := m.mounter.GetMountRefs(m.globalPath)
-	if fsGroup != nil {
+	if mounterArgs.FsGroup != nil {
 		if err != nil {
 			klog.Errorf("cannot collect mounting information: %s %v", m.globalPath, err)
 			return err
@@ -461,7 +461,7 @@ func (m *localVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 		// Only count mounts from other pods
 		refs = m.filterPodMounts(refs)
 		if len(refs) > 0 {
-			fsGroupNew := int64(*fsGroup)
+			fsGroupNew := int64(*mounterArgs.FsGroup)
 			fsGroupOld, err := m.mounter.GetFSGroup(m.globalPath)
 			if err != nil {
 				return fmt.Errorf("failed to check fsGroup for %s (%v)", m.globalPath, err)
@@ -519,7 +519,7 @@ func (m *localVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 	if !m.readOnly {
 		// Volume owner will be written only once on the first volume mount
 		if len(refs) == 0 {
-			return volume.SetVolumeOwnership(m, fsGroup)
+			return volume.SetVolumeOwnership(m, mounterArgs.FsGroup)
 		}
 	}
 	return nil

pkg/volume/local/local_test.go

@@ -200,7 +200,7 @@ func TestInvalidLocalPath(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = mounter.SetUp(nil)
+	err = mounter.SetUp(volume.MounterArgs{})
 	expectedMsg := "invalid path: /no/backsteps/allowed/.. must not contain '..'"
 	if err.Error() != expectedMsg {
 		t.Fatalf("expected error `%s` but got `%s`", expectedMsg, err)
@@ -307,7 +307,7 @@ func TestMountUnmount(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", path)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 
@@ -412,7 +412,9 @@ func testFSGroupMount(plug volume.VolumePlugin, pod *v1.Pod, tmpDir string, fsGr
 		return fmt.Errorf("Got unexpected path: %s", path)
 	}
 
-	if err := mounter.SetUp(&fsGroup); err != nil {
+	var mounterArgs volume.MounterArgs
+	mounterArgs.FsGroup = &fsGroup
+	if err := mounter.SetUp(mounterArgs); err != nil {
 		return err
 	}
 	return nil
@@ -517,7 +519,7 @@ func TestMountOptions(t *testing.T) {
 	fakeMounter := &mount.FakeMounter{}
 	mounter.(*localVolumeMounter).mounter = fakeMounter
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	mountOptions := fakeMounter.MountPoints[0].Opts

pkg/volume/nfs/nfs.go

@@ -233,11 +233,11 @@ func (nfsMounter *nfsMounter) GetAttributes() volume.Attributes {
 }
 
 // SetUp attaches the disk and bind mounts to the volume path.
-func (nfsMounter *nfsMounter) SetUp(fsGroup *int64) error {
-	return nfsMounter.SetUpAt(nfsMounter.GetPath(), fsGroup)
+func (nfsMounter *nfsMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return nfsMounter.SetUpAt(nfsMounter.GetPath(), mounterArgs)
 }
 
-func (nfsMounter *nfsMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (nfsMounter *nfsMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	notMnt, err := mount.IsNotMountPoint(nfsMounter.mounter, dir)
 	klog.V(4).Infof("NFS mount set up: %s %v %v", dir, !notMnt, err)
 	if err != nil && !os.IsNotExist(err) {

pkg/volume/nfs/nfs_test.go

@@ -122,7 +122,7 @@ func doTestPlugin(t *testing.T, spec *volume.Spec) {
 	if volumePath != expectedPath {
 		t.Errorf("Unexpected path, expected %q, got: %q", expectedPath, volumePath)
 	}
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(volumePath); err != nil {

pkg/volume/photon_pd/photon_pd.go

@@ -200,12 +200,12 @@ func (b *photonPersistentDiskMounter) CanMount() error {
 }
 
 // SetUp attaches the disk and bind mounts to the volume path.
-func (b *photonPersistentDiskMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *photonPersistentDiskMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
 // SetUp attaches the disk and bind mounts to the volume path.
-func (b *photonPersistentDiskMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *photonPersistentDiskMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	klog.V(4).Infof("Photon Persistent Disk setup %s to %s", b.pdID, dir)
 
 	// TODO: handle failed mounts here.

pkg/volume/photon_pd/photon_pd_test.go

@@ -128,7 +128,7 @@ func TestPlugin(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", path)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(path); err != nil {

pkg/volume/portworx/portworx.go

@@ -298,12 +298,12 @@ func (b *portworxVolumeMounter) CanMount() error {
 }
 
 // SetUp attaches the disk and bind mounts to the volume path.
-func (b *portworxVolumeMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *portworxVolumeMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
 // SetUpAt attaches the disk and bind mounts to the volume path.
-func (b *portworxVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *portworxVolumeMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	notMnt, err := b.mounter.IsLikelyNotMountPoint(dir)
 	klog.Infof("Portworx Volume set up. Dir: %s %v %v", dir, !notMnt, err)
 	if err != nil && !os.IsNotExist(err) {
@@ -331,7 +331,7 @@ func (b *portworxVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 		return err
 	}
 	if !b.readOnly {
-		volume.SetVolumeOwnership(b, fsGroup)
+		volume.SetVolumeOwnership(b, mounterArgs.FsGroup)
 	}
 	klog.Infof("Portworx Volume %s setup at %s", b.volumeID, dir)
 	return nil

pkg/volume/portworx/portworx_test.go

@@ -163,7 +163,7 @@ func TestPlugin(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", path)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(path); err != nil {

pkg/volume/projected/projected.go

@@ -188,11 +188,11 @@ func (s *projectedVolumeMounter) CanMount() error {
 	return nil
 }
 
-func (s *projectedVolumeMounter) SetUp(fsGroup *int64) error {
-	return s.SetUpAt(s.GetPath(), fsGroup)
+func (s *projectedVolumeMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return s.SetUpAt(s.GetPath(), mounterArgs)
 }
 
-func (s *projectedVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (s *projectedVolumeMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	klog.V(3).Infof("Setting up volume %v for pod %v at %v", s.volName, s.pod.UID, dir)
 
 	wrapped, err := s.plugin.host.NewWrapperMounter(s.volName, wrappedVolumeSpec(), s.pod, *s.opts)
@@ -207,7 +207,7 @@ func (s *projectedVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 	}
 
 	setupSuccess := false
-	if err := wrapped.SetUpAt(dir, fsGroup); err != nil {
+	if err := wrapped.SetUpAt(dir, mounterArgs); err != nil {
 		return err
 	}
 
@@ -243,9 +243,9 @@ func (s *projectedVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 		return err
 	}
 
-	err = volume.SetVolumeOwnership(s, fsGroup)
+	err = volume.SetVolumeOwnership(s, mounterArgs.FsGroup)
 	if err != nil {
-		klog.Errorf("Error applying volume ownership settings for group: %v", fsGroup)
+		klog.Errorf("Error applying volume ownership settings for group: %v", mounterArgs.FsGroup)
 		return err
 	}
 	setupSuccess = true

pkg/volume/projected/projected_test.go

@@ -878,7 +878,7 @@ func TestPlugin(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	err = mounter.SetUp(nil)
+	err = mounter.SetUp(volume.MounterArgs{})
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}
@@ -943,7 +943,8 @@ func TestInvalidPathProjected(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	err = mounter.SetUp(nil)
+	var mounterArgs volume.MounterArgs
+	err = mounter.SetUp(mounterArgs)
 	if err == nil {
 		t.Errorf("Expected error while setting up secret")
 	}
@@ -994,7 +995,7 @@ func TestPluginReboot(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	err = mounter.SetUp(nil)
+	err = mounter.SetUp(volume.MounterArgs{})
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}
@@ -1046,7 +1047,7 @@ func TestPluginOptional(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	err = mounter.SetUp(nil)
+	err = mounter.SetUp(volume.MounterArgs{})
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}
@@ -1144,7 +1145,7 @@ func TestPluginOptionalKeys(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	err = mounter.SetUp(nil)
+	err = mounter.SetUp(volume.MounterArgs{})
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}

pkg/volume/quobyte/quobyte.go

@@ -237,12 +237,12 @@ func (mounter *quobyteMounter) CanMount() error {
 }
 
 // SetUp attaches the disk and bind mounts to the volume path.
-func (mounter *quobyteMounter) SetUp(fsGroup *int64) error {
+func (mounter *quobyteMounter) SetUp(mounterArgs volume.MounterArgs) error {
 	pluginDir := mounter.plugin.host.GetPluginDir(utilstrings.EscapeQualifiedName(quobytePluginName))
-	return mounter.SetUpAt(pluginDir, fsGroup)
+	return mounter.SetUpAt(pluginDir, mounterArgs)
 }
 
-func (mounter *quobyteMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (mounter *quobyteMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	// Check if Quobyte is already mounted on the host in the Plugin Dir
 	// if so we can use this mountpoint instead of creating a new one
 	// IsLikelyNotMountPoint wouldn't check the mount type

pkg/volume/quobyte/quobyte_test.go

@@ -101,7 +101,7 @@ func doTestPlugin(t *testing.T, spec *volume.Spec) {
 	if volumePath != fmt.Sprintf("%s/plugins/kubernetes.io~quobyte/root#root@vol", tmpDir) {
 		t.Errorf("Got unexpected path: %s expected: %s", volumePath, fmt.Sprintf("%s/plugins/kubernetes.io~quobyte/root#root@vol", tmpDir))
 	}
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	unmounter, err := plug.(*quobytePlugin).newUnmounterInternal("vol", types.UID("poduid"), &mount.FakeMounter{})

pkg/volume/rbd/rbd.go

@@ -825,14 +825,14 @@ func (b *rbdMounter) CanMount() error {
 	return nil
 }
 
-func (b *rbdMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *rbdMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
-func (b *rbdMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *rbdMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	// diskSetUp checks mountpoints and prevent repeated calls
 	klog.V(4).Infof("rbd: attempting to setup at %s", dir)
-	err := diskSetUp(b.manager, *b, dir, b.mounter, fsGroup)
+	err := diskSetUp(b.manager, *b, dir, b.mounter, mounterArgs.FsGroup)
 	if err != nil {
 		klog.Errorf("rbd: failed to setup at %s %v", dir, err)
 	}

pkg/volume/rbd/rbd_test.go

@@ -305,7 +305,7 @@ func doTestPlugin(t *testing.T, c *testcase) {
 		t.Errorf("Unexpected path, expected %q, got: %q", c.expectedPodMountPath, path)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(path); err != nil {

pkg/volume/scaleio/sio_volume.go

@@ -77,12 +77,12 @@ func (v *sioVolume) CanMount() error {
 	return nil
 }
 
-func (v *sioVolume) SetUp(fsGroup *int64) error {
-	return v.SetUpAt(v.GetPath(), fsGroup)
+func (v *sioVolume) SetUp(mounterArgs volume.MounterArgs) error {
+	return v.SetUpAt(v.GetPath(), mounterArgs)
 }
 
 // SetUp bind mounts the disk global mount to the volume path.
-func (v *sioVolume) SetUpAt(dir string, fsGroup *int64) error {
+func (v *sioVolume) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	v.plugin.volumeMtx.LockKey(v.volSpecName)
 	defer v.plugin.volumeMtx.UnlockKey(v.volSpecName)
 
@@ -154,9 +154,9 @@ func (v *sioVolume) SetUpAt(dir string, fsGroup *int64) error {
 		return err
 	}
 
-	if !v.readOnly && fsGroup != nil {
+	if !v.readOnly && mounterArgs.FsGroup != nil {
 		klog.V(4).Info(log("applying  value FSGroup ownership"))
-		volume.SetVolumeOwnership(v, fsGroup)
+		volume.SetVolumeOwnership(v, mounterArgs.FsGroup)
 	}
 
 	klog.V(4).Info(log("successfully setup PV %s: volume %s mapped as %s mounted at %s", v.volSpecName, v.volName, devicePath, dir))

pkg/volume/scaleio/sio_volume_test.go

@@ -191,7 +191,7 @@ func TestVolumeMounterUnmounter(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", path)
 	}
 
-	if err := sioMounter.SetUp(nil); err != nil {
+	if err := sioMounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(path); err != nil {
@@ -345,7 +345,7 @@ func TestVolumeProvisioner(t *testing.T) {
 		t.Fatalf("failed to create sio mgr: %v", err)
 	}
 	sioVol.sioMgr.client = sio
-	if err := sioMounter.SetUp(nil); err != nil {
+	if err := sioMounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Fatalf("Expected success, got: %v", err)
 	}
 

pkg/volume/secret/secret.go

@@ -178,11 +178,11 @@ func (b *secretVolumeMounter) CanMount() error {
 	return nil
 }
 
-func (b *secretVolumeMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *secretVolumeMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
-func (b *secretVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *secretVolumeMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	klog.V(3).Infof("Setting up volume %v for pod %v at %v", b.volName, b.pod.UID, dir)
 
 	// Wrap EmptyDir, let it do the setup.
@@ -219,7 +219,7 @@ func (b *secretVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 	}
 
 	setupSuccess := false
-	if err := wrapped.SetUpAt(dir, fsGroup); err != nil {
+	if err := wrapped.SetUpAt(dir, mounterArgs); err != nil {
 		return err
 	}
 	if err := volumeutil.MakeNestedMountpoints(b.volName, dir, b.pod); err != nil {
@@ -254,9 +254,9 @@ func (b *secretVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 		return err
 	}
 
-	err = volume.SetVolumeOwnership(b, fsGroup)
+	err = volume.SetVolumeOwnership(b, mounterArgs.FsGroup)
 	if err != nil {
-		klog.Errorf("Error applying volume ownership settings for group: %v", fsGroup)
+		klog.Errorf("Error applying volume ownership settings for group: %v", mounterArgs.FsGroup)
 		return err
 	}
 	setupSuccess = true

pkg/volume/secret/secret_test.go

@@ -327,7 +327,7 @@ func TestPlugin(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	err = mounter.SetUp(nil)
+	err = mounter.SetUp(volume.MounterArgs{})
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}
@@ -401,7 +401,8 @@ func TestInvalidPathSecret(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	err = mounter.SetUp(nil)
+	var mounterArgs volume.MounterArgs
+	err = mounter.SetUp(mounterArgs)
 	if err == nil {
 		t.Errorf("Expected error while setting up secret")
 	}
@@ -452,7 +453,7 @@ func TestPluginReboot(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	err = mounter.SetUp(nil)
+	err = mounter.SetUp(volume.MounterArgs{})
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}
@@ -504,7 +505,7 @@ func TestPluginOptional(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	err = mounter.SetUp(nil)
+	err = mounter.SetUp(volume.MounterArgs{})
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}
@@ -602,7 +603,7 @@ func TestPluginOptionalKeys(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", volumePath)
 	}
 
-	err = mounter.SetUp(nil)
+	err = mounter.SetUp(volume.MounterArgs{})
 	if err != nil {
 		t.Errorf("Failed to setup volume: %v", err)
 	}

pkg/volume/storageos/storageos.go

@@ -345,7 +345,7 @@ func (b *storageosMounter) CanMount() error {
 }
 
 // SetUp attaches the disk and bind mounts to the volume path.
-func (b *storageosMounter) SetUp(fsGroup *int64) error {
+func (b *storageosMounter) SetUp(mounterArgs volume.MounterArgs) error {
 	// Need a namespace to find the volume, try pod's namespace if not set.
 	if b.volNamespace == "" {
 		klog.V(2).Infof("Setting StorageOS volume namespace to pod namespace: %s", b.podNamespace)
@@ -375,11 +375,11 @@ func (b *storageosMounter) SetUp(fsGroup *int64) error {
 	klog.V(4).Infof("Successfully mounted StorageOS volume %s into global mount directory", b.volName)
 
 	// Bind mount the volume into the pod
-	return b.SetUpAt(b.GetPath(), fsGroup)
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
 // SetUp bind mounts the disk global mount to the give volume path.
-func (b *storageosMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *storageosMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	notMnt, err := b.mounter.IsLikelyNotMountPoint(dir)
 	klog.V(4).Infof("StorageOS volume set up: %s %v %v", dir, !notMnt, err)
 	if err != nil && !os.IsNotExist(err) {
@@ -433,7 +433,7 @@ func (b *storageosMounter) SetUpAt(dir string, fsGroup *int64) error {
 	}
 
 	if !b.readOnly {
-		volume.SetVolumeOwnership(b, fsGroup)
+		volume.SetVolumeOwnership(b, mounterArgs.FsGroup)
 	}
 	klog.V(4).Infof("StorageOS volume setup complete on %s", dir)
 	return nil

pkg/volume/storageos/storageos_test.go

@@ -208,7 +208,7 @@ func TestPlugin(t *testing.T) {
 		t.Errorf("Expected path: '%s' got: '%s'", expectedPath, volPath)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 	if _, err := os.Stat(volPath); err != nil {

pkg/volume/testing/testing.go

@@ -765,11 +765,11 @@ func (fv *FakeVolume) CanMount() error {
 	return nil
 }
 
-func (fv *FakeVolume) SetUp(fsGroup *int64) error {
+func (fv *FakeVolume) SetUp(mounterArgs MounterArgs) error {
 	fv.Lock()
 	defer fv.Unlock()
 	fv.SetUpCallCount++
-	return fv.SetUpAt(fv.getPath(), fsGroup)
+	return fv.SetUpAt(fv.getPath(), mounterArgs)
 }
 
 func (fv *FakeVolume) GetSetUpCallCount() int {
@@ -778,7 +778,7 @@ func (fv *FakeVolume) GetSetUpCallCount() int {
 	return fv.SetUpCallCount
 }
 
-func (fv *FakeVolume) SetUpAt(dir string, fsGroup *int64) error {
+func (fv *FakeVolume) SetUpAt(dir string, mounterArgs MounterArgs) error {
 	return os.MkdirAll(dir, 0750)
 }
 

pkg/volume/util/BUILD

@@ -91,6 +91,7 @@ filegroup(
         "//pkg/volume/util/nestedpendingoperations:all-srcs",
         "//pkg/volume/util/nsenter:all-srcs",
         "//pkg/volume/util/operationexecutor:all-srcs",
+        "//pkg/volume/util/quota:all-srcs",
         "//pkg/volume/util/recyclerclient:all-srcs",
         "//pkg/volume/util/subpath:all-srcs",
         "//pkg/volume/util/types:all-srcs",

pkg/volume/util/fs/BUILD

@@ -14,6 +14,7 @@ go_library(
             "//staging/src/k8s.io/apimachinery/pkg/api/resource:go_default_library",
         ],
         "@io_bazel_rules_go//go/platform:darwin": [
+            "//pkg/volume/util/quota:go_default_library",
             "//staging/src/k8s.io/apimachinery/pkg/api/resource:go_default_library",
             "//vendor/golang.org/x/sys/unix:go_default_library",
         ],
@@ -24,6 +25,7 @@ go_library(
             "//staging/src/k8s.io/apimachinery/pkg/api/resource:go_default_library",
         ],
         "@io_bazel_rules_go//go/platform:linux": [
+            "//pkg/volume/util/quota:go_default_library",
             "//staging/src/k8s.io/apimachinery/pkg/api/resource:go_default_library",
             "//vendor/golang.org/x/sys/unix:go_default_library",
         ],

pkg/volume/util/fs/fs.go

@@ -27,6 +27,7 @@ import (
 	"golang.org/x/sys/unix"
 
 	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/volume/util/quota"
 )
 
 // FSInfo linux returns (available bytes, byte capacity, byte usage, total inodes, inodes free, inode usage, error)
@@ -56,6 +57,15 @@ func FsInfo(path string) (int64, int64, int64, int64, int64, int64, error) {
 
 // DiskUsage gets disk usage of specified path.
 func DiskUsage(path string) (*resource.Quantity, error) {
+	// First check whether the quota system knows about this directory
+	// A nil quantity with no error means that the path does not support quotas
+	// and we should use other mechanisms.
+	data, err := quota.GetConsumption(path)
+	if data != nil {
+		return data, nil
+	} else if err != nil {
+		return nil, fmt.Errorf("unable to retrieve disk consumption via quota for %s: %v", path, err)
+	}
 	// Uses the same niceness level as cadvisor.fs does when running du
 	// Uses -B 1 to always scale to a blocksize of 1 byte
 	out, err := exec.Command("nice", "-n", "19", "du", "-s", "-B", "1", path).CombinedOutput()
@@ -76,6 +86,15 @@ func Find(path string) (int64, error) {
 	if path == "" {
 		return 0, fmt.Errorf("invalid directory")
 	}
+	// First check whether the quota system knows about this directory
+	// A nil quantity with no error means that the path does not support quotas
+	// and we should use other mechanisms.
+	inodes, err := quota.GetInodes(path)
+	if inodes != nil {
+		return inodes.Value(), nil
+	} else if err != nil {
+		return 0, fmt.Errorf("unable to retrieve inode consumption via quota for %s: %v", path, err)
+	}
 	var counter byteCounter
 	var stderr bytes.Buffer
 	findCmd := exec.Command("find", path, "-xdev", "-printf", ".")

pkg/volume/util/operationexecutor/BUILD

@@ -26,6 +26,7 @@ go_library(
         "//pkg/volume/util/volumepathhandler:go_default_library",
         "//staging/src/k8s.io/api/core/v1:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/api/resource:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/types:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library",

pkg/volume/util/operationexecutor/operation_executor.go

@@ -27,6 +27,7 @@ import (
 	"k8s.io/klog"
 
 	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/kubernetes/pkg/util/mount"
 	"k8s.io/kubernetes/pkg/volume"
@@ -346,6 +347,10 @@ type VolumeToMount struct {
 	// ReportedInUse indicates that the volume was successfully added to the
 	// VolumesInUse field in the node's status.
 	ReportedInUse bool
+
+	// DesiredSizeLimit indicates the desired upper bound on the size of the volume
+	// (if so implemented)
+	DesiredSizeLimit *resource.Quantity
 }
 
 // GenerateMsgDetailed returns detailed msgs for volumes to mount

pkg/volume/util/operationexecutor/operation_generator.go

@@ -701,7 +701,11 @@ func (og *operationGenerator) GenerateMountVolumeFunc(
 		}
 
 		// Execute mount
-		mountErr := volumeMounter.SetUp(fsGroup)
+		mountErr := volumeMounter.SetUp(volume.MounterArgs{
+			FsGroup:     fsGroup,
+			DesiredSize: volumeToMount.DesiredSizeLimit,
+			PodUID:      string(volumeToMount.Pod.UID),
+		})
 		if mountErr != nil {
 			// On failure, return error. Caller will log and retry.
 			return volumeToMount.GenerateError("MountVolume.SetUp failed", mountErr)

pkg/volume/util/quota/BUILD

+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "project.go",
+        "quota.go",
+        "quota_linux.go",
+        "quota_unsupported.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/volume/util/quota",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/features:go_default_library",
+        "//pkg/util/mount:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library",
+    ] + select({
+        "@io_bazel_rules_go//go/platform:linux": [
+            "//pkg/volume/util/quota/common:go_default_library",
+            "//staging/src/k8s.io/apimachinery/pkg/util/uuid:go_default_library",
+            "//vendor/golang.org/x/sys/unix:go_default_library",
+            "//vendor/k8s.io/klog:go_default_library",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["quota_linux_test.go"],
+    embed = [":go_default_library"],
+    deps = select({
+        "@io_bazel_rules_go//go/platform:linux": [
+            "//pkg/features:go_default_library",
+            "//pkg/util/mount:go_default_library",
+            "//pkg/volume/util/quota/common:go_default_library",
+            "//staging/src/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+            "//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library",
+            "//staging/src/k8s.io/component-base/featuregate/testing:go_default_library",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//pkg/volume/util/quota/common:all-srcs",
+    ],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/volume/util/quota/common/BUILD

+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "quota_linux_common.go",
+        "quota_linux_common_impl.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/volume/util/quota/common",
+    visibility = ["//visibility:public"],
+    deps = select({
+        "@io_bazel_rules_go//go/platform:linux": [
+            "//vendor/k8s.io/klog:go_default_library",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

pkg/volume/util/quota/common/quota_linux_common.go

+// +build linux
+
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package common
+
+import (
+	"regexp"
+)
+
+// QuotaID is generic quota identifier.
+// Data type based on quotactl(2).
+type QuotaID int32
+
+const (
+	// UnknownQuotaID -- cannot determine whether a quota is in force
+	UnknownQuotaID QuotaID = -1
+	// BadQuotaID -- Invalid quota
+	BadQuotaID QuotaID = 0
+)
+
+const (
+	acct      = iota
+	enforcing = iota
+)
+
+// QuotaType -- type of quota to be applied
+type QuotaType int
+
+const (
+	// FSQuotaAccounting for quotas for accounting only
+	FSQuotaAccounting QuotaType = 1 << iota
+	// FSQuotaEnforcing for quotas for enforcement
+	FSQuotaEnforcing QuotaType = 1 << iota
+)
+
+// FirstQuota is the quota ID we start with.
+// XXXXXXX Need a better way of doing this...
+var FirstQuota QuotaID = 1048577
+
+// MountsFile is the location of the system mount data
+var MountsFile = "/proc/self/mounts"
+
+// MountParseRegexp parses out /proc/sys/self/mounts
+var MountParseRegexp = regexp.MustCompilePOSIX("^([^ ]*)[ \t]*([^ ]*)[ \t]*([^ ]*)") // Ignore options etc.
+
+// LinuxVolumeQuotaProvider returns an appropriate quota applier
+// object if we can support quotas on this device
+type LinuxVolumeQuotaProvider interface {
+	// GetQuotaApplier retrieves an object that can apply
+	// quotas (or nil if this provider cannot support quotas
+	// on the device)
+	GetQuotaApplier(mountpoint string, backingDev string) LinuxVolumeQuotaApplier
+}
+
+// LinuxVolumeQuotaApplier is a generic interface to any quota
+// mechanism supported by Linux
+type LinuxVolumeQuotaApplier interface {
+	// GetQuotaOnDir gets the quota ID (if any) that applies to
+	// this directory
+	GetQuotaOnDir(path string) (QuotaID, error)
+
+	// SetQuotaOnDir applies the specified quota ID to a directory.
+	// Negative value for bytes means that a non-enforcing quota
+	// should be applied (perhaps by setting a quota too large to
+	// be hit)
+	SetQuotaOnDir(path string, id QuotaID, bytes int64) error
+
+	// QuotaIDIsInUse determines whether the quota ID is in use.
+	// Implementations should not check /etc/project or /etc/projid,
+	// only whether their underlying mechanism already has the ID in
+	// use.
+	// Return value of false with no error means that the ID is not
+	// in use; true means that it is already in use.  An error
+	// return means that any quota ID will fail.
+	QuotaIDIsInUse(id QuotaID) (bool, error)
+
+	// GetConsumption returns the consumption (in bytes) of the
+	// directory, determined by the implementation's quota-based
+	// mechanism.  If it is unable to do so using that mechanism,
+	// it should return an error and allow higher layers to
+	// enumerate the directory.
+	GetConsumption(path string, id QuotaID) (int64, error)
+
+	// GetInodes returns the number of inodes used by the
+	// directory, determined by the implementation's quota-based
+	// mechanism.  If it is unable to do so using that mechanism,
+	// it should return an error and allow higher layers to
+	// enumerate the directory.
+	GetInodes(path string, id QuotaID) (int64, error)
+}

pkg/volume/util/quota/common/quota_linux_common_impl.go

+// +build linux
+
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package common
+
+import (
+	"bufio"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"syscall"
+
+	"k8s.io/klog"
+)
+
+var quotaCmd string
+var quotaCmdInitialized bool
+var quotaCmdLock sync.RWMutex
+
+// If we later get a filesystem that uses project quota semantics other than
+// XFS, we'll need to change this.
+// Higher levels don't need to know what's inside
+type linuxFilesystemType struct {
+	name             string
+	typeMagic        int64 // Filesystem magic number, per statfs(2)
+	maxQuota         int64
+	allowEmptyOutput bool // Accept empty output from "quota" command
+}
+
+const (
+	bitsPerWord = 32 << (^uint(0) >> 63) // either 32 or 64
+)
+
+var (
+	linuxSupportedFilesystems = []linuxFilesystemType{
+		{
+			name:             "XFS",
+			typeMagic:        0x58465342,
+			maxQuota:         1<<(bitsPerWord-1) - 1,
+			allowEmptyOutput: true, // XFS filesystems report nothing if a quota is not present
+		}, {
+			name:             "ext4fs",
+			typeMagic:        0xef53,
+			maxQuota:         (1<<(bitsPerWord-1) - 1) & (1<<58 - 1),
+			allowEmptyOutput: false, // ext4 filesystems always report something even if a quota is not present
+		},
+	}
+)
+
+// VolumeProvider supplies a quota applier to the generic code.
+type VolumeProvider struct {
+}
+
+var quotaCmds = []string{"/sbin/xfs_quota",
+	"/usr/sbin/xfs_quota",
+	"/bin/xfs_quota"}
+
+var quotaParseRegexp = regexp.MustCompilePOSIX("^[^ \t]*[ \t]*([0-9]+)")
+
+var lsattrCmd = "/usr/bin/lsattr"
+var lsattrParseRegexp = regexp.MustCompilePOSIX("^ *([0-9]+) [^ ]+ (.*)$")
+
+// GetQuotaApplier -- does this backing device support quotas that
+// can be applied to directories?
+func (*VolumeProvider) GetQuotaApplier(mountpoint string, backingDev string) LinuxVolumeQuotaApplier {
+	for _, fsType := range linuxSupportedFilesystems {
+		if isFilesystemOfType(mountpoint, backingDev, fsType.typeMagic) {
+			return linuxVolumeQuotaApplier{mountpoint: mountpoint,
+				maxQuota:         fsType.maxQuota,
+				allowEmptyOutput: fsType.allowEmptyOutput,
+			}
+		}
+	}
+	return nil
+}
+
+type linuxVolumeQuotaApplier struct {
+	mountpoint       string
+	maxQuota         int64
+	allowEmptyOutput bool
+}
+
+func getXFSQuotaCmd() (string, error) {
+	quotaCmdLock.Lock()
+	defer quotaCmdLock.Unlock()
+	if quotaCmdInitialized {
+		return quotaCmd, nil
+	}
+	for _, program := range quotaCmds {
+		fileinfo, err := os.Stat(program)
+		if err == nil && ((fileinfo.Mode().Perm() & (1 << 6)) != 0) {
+			klog.V(3).Infof("Found xfs_quota program %s", program)
+			quotaCmd = program
+			quotaCmdInitialized = true
+			return quotaCmd, nil
+		}
+	}
+	quotaCmdInitialized = true
+	return "", fmt.Errorf("No xfs_quota program found")
+}
+
+func doRunXFSQuotaCommand(mountpoint string, mountsFile, command string) (string, error) {
+	quotaCmd, err := getXFSQuotaCmd()
+	if err != nil {
+		return "", err
+	}
+	// We're using numeric project IDs directly; no need to scan
+	// /etc/projects or /etc/projid
+	klog.V(4).Infof("runXFSQuotaCommand %s -t %s -P/dev/null -D/dev/null -x -f %s -c %s", quotaCmd, mountsFile, mountpoint, command)
+	cmd := exec.Command(quotaCmd, "-t", mountsFile, "-P/dev/null", "-D/dev/null", "-x", "-f", mountpoint, "-c", command)
+
+	data, err := cmd.Output()
+	if err != nil {
+		return "", err
+	}
+	klog.V(4).Infof("runXFSQuotaCommand output %q", string(data))
+	return string(data), nil
+}
+
+// Extract the mountpoint we care about into a temporary mounts file so that xfs_quota does
+// not attempt to scan every mount on the filesystem, which could hang if e. g.
+// a stuck NFS mount is present.
+// See https://bugzilla.redhat.com/show_bug.cgi?id=237120 for an example
+// of the problem that could be caused if this were to happen.
+func runXFSQuotaCommand(mountpoint string, command string) (string, error) {
+	tmpMounts, err := ioutil.TempFile("", "mounts")
+	if err != nil {
+		return "", fmt.Errorf("Cannot create temporary mount file: %v", err)
+	}
+	tmpMountsFileName := tmpMounts.Name()
+	defer tmpMounts.Close()
+	defer os.Remove(tmpMountsFileName)
+
+	mounts, err := os.Open(MountsFile)
+	if err != nil {
+		return "", fmt.Errorf("Cannot open mounts file %s: %v", MountsFile, err)
+	}
+	defer mounts.Close()
+
+	scanner := bufio.NewScanner(mounts)
+	for scanner.Scan() {
+		match := MountParseRegexp.FindStringSubmatch(scanner.Text())
+		if match != nil {
+			mount := match[2]
+			if mount == mountpoint {
+				if _, err := tmpMounts.WriteString(fmt.Sprintf("%s\n", scanner.Text())); err != nil {
+					return "", fmt.Errorf("Cannot write temporary mounts file: %v", err)
+				}
+				if err := tmpMounts.Sync(); err != nil {
+					return "", fmt.Errorf("Cannot sync temporary mounts file: %v", err)
+				}
+				return doRunXFSQuotaCommand(mountpoint, tmpMountsFileName, command)
+			}
+		}
+	}
+	return "", fmt.Errorf("Cannot run xfs_quota: cannot find mount point %s in %s", mountpoint, MountsFile)
+}
+
+// SupportsQuotas determines whether the filesystem supports quotas.
+func SupportsQuotas(mountpoint string, qType QuotaType) (bool, error) {
+	data, err := runXFSQuotaCommand(mountpoint, "state -p")
+	if err != nil {
+		return false, err
+	}
+	if qType == FSQuotaEnforcing {
+		return strings.Contains(data, "Enforcement: ON"), nil
+	}
+	return strings.Contains(data, "Accounting: ON"), nil
+}
+
+func isFilesystemOfType(mountpoint string, backingDev string, typeMagic int64) bool {
+	var buf syscall.Statfs_t
+	err := syscall.Statfs(mountpoint, &buf)
+	if err != nil {
+		klog.Warningf("Warning: Unable to statfs %s: %v", mountpoint, err)
+		return false
+	}
+	if int64(buf.Type) != typeMagic {
+		return false
+	}
+	if answer, _ := SupportsQuotas(mountpoint, FSQuotaAccounting); answer {
+		return true
+	}
+	return false
+}
+
+// GetQuotaOnDir retrieves the quota ID (if any) associated with the specified directory
+// If we can't make system calls, all we can say is that we don't know whether
+// it has a quota, and higher levels have to make the call.
+func (v linuxVolumeQuotaApplier) GetQuotaOnDir(path string) (QuotaID, error) {
+	cmd := exec.Command(lsattrCmd, "-pd", path)
+	data, err := cmd.Output()
+	if err != nil {
+		return BadQuotaID, fmt.Errorf("cannot run lsattr: %v", err)
+	}
+	match := lsattrParseRegexp.FindStringSubmatch(string(data))
+	if match == nil {
+		return BadQuotaID, fmt.Errorf("Unable to parse lsattr -pd %s output %s", path, string(data))
+	}
+	if match[2] != path {
+		return BadQuotaID, fmt.Errorf("Mismatch between supplied and returned path (%s != %s)", path, match[2])
+	}
+	projid, err := strconv.ParseInt(match[1], 10, 32)
+	if err != nil {
+		return BadQuotaID, fmt.Errorf("Unable to parse project ID from %s (%v)", match[1], err)
+	}
+	return QuotaID(projid), nil
+}
+
+// SetQuotaOnDir applies a quota to the specified directory under the specified mountpoint.
+func (v linuxVolumeQuotaApplier) SetQuotaOnDir(path string, id QuotaID, bytes int64) error {
+	if bytes < 0 || bytes > v.maxQuota {
+		bytes = v.maxQuota
+	}
+	_, err := runXFSQuotaCommand(v.mountpoint, fmt.Sprintf("limit -p bhard=%v bsoft=%v %v", bytes, bytes, id))
+	if err != nil {
+		return err
+	}
+
+	_, err = runXFSQuotaCommand(v.mountpoint, fmt.Sprintf("project -s -p %s %v", path, id))
+	return err
+}
+
+func getQuantity(mountpoint string, id QuotaID, xfsQuotaArg string, multiplier int64, allowEmptyOutput bool) (int64, error) {
+	data, err := runXFSQuotaCommand(mountpoint, fmt.Sprintf("quota -p -N -n -v %s %v", xfsQuotaArg, id))
+	if err != nil {
+		return 0, fmt.Errorf("Unable to run xfs_quota: %v", err)
+	}
+	if data == "" && allowEmptyOutput {
+		return 0, nil
+	}
+	match := quotaParseRegexp.FindStringSubmatch(data)
+	if match == nil {
+		return 0, fmt.Errorf("Unable to parse quota output '%s'", data)
+	}
+	size, err := strconv.ParseInt(match[1], 10, 64)
+	if err != nil {
+		return 0, fmt.Errorf("Unable to parse data size '%s' from '%s': %v", match[1], data, err)
+	}
+	klog.V(4).Infof("getQuantity %s %d %s %d => %d %v", mountpoint, id, xfsQuotaArg, multiplier, size, err)
+	return size * multiplier, nil
+}
+
+// GetConsumption returns the consumption in bytes if available via quotas
+func (v linuxVolumeQuotaApplier) GetConsumption(_ string, id QuotaID) (int64, error) {
+	return getQuantity(v.mountpoint, id, "-b", 1024, v.allowEmptyOutput)
+}
+
+// GetInodes returns the inodes in use if available via quotas
+func (v linuxVolumeQuotaApplier) GetInodes(_ string, id QuotaID) (int64, error) {
+	return getQuantity(v.mountpoint, id, "-i", 1, v.allowEmptyOutput)
+}
+
+// QuotaIDIsInUse checks whether the specified quota ID is in use on the specified
+// filesystem
+func (v linuxVolumeQuotaApplier) QuotaIDIsInUse(id QuotaID) (bool, error) {
+	bytes, err := v.GetConsumption(v.mountpoint, id)
+	if err != nil {
+		return false, err
+	}
+	if bytes > 0 {
+		return true, nil
+	}
+	inodes, err := v.GetInodes(v.mountpoint, id)
+	return inodes > 0, err
+}

pkg/volume/util/quota/quota.go

+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package quota
+
+import (
+	"k8s.io/apimachinery/pkg/api/resource"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
+	"k8s.io/kubernetes/pkg/features"
+	"k8s.io/kubernetes/pkg/util/mount"
+)
+
+// Interface -- quota interface
+type Interface interface {
+	// Does the path provided support quotas, and if so, what types
+	SupportsQuotas(m mount.Interface, path string) (bool, error)
+	// Assign a quota (picked by the quota mechanism) to a path,
+	// and return it.
+	AssignQuota(m mount.Interface, path string, poduid string, bytes *resource.Quantity) error
+
+	// Get the quota-based storage consumption for the path
+	GetConsumption(path string) (*resource.Quantity, error)
+
+	// Get the quota-based inode consumption for the path
+	GetInodes(path string) (*resource.Quantity, error)
+
+	// Remove the quota from a path
+	// Implementations may assume that any data covered by the
+	// quota has already been removed.
+	ClearQuota(m mount.Interface, path string, poduid string) error
+}
+
+func enabledQuotasForMonitoring() bool {
+	return utilfeature.DefaultFeatureGate.Enabled(features.LocalStorageCapacityIsolationFSQuotaMonitoring)
+}

pkg/volume/util/quota/quota_unsupported.go

+// +build !linux
+
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package quota
+
+import (
+	"errors"
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/util/mount"
+)
+
+// Dummy quota implementation for systems that do not implement support
+// for volume quotas
+
+var errNotImplemented = errors.New("not implemented")
+
+// SupportsQuotas -- dummy implementation
+func SupportsQuotas(_ mount.Interface, _ string) (bool, error) {
+	return false, errNotImplemented
+}
+
+// AssignQuota -- dummy implementation
+func AssignQuota(_ mount.Interface, _ string, _ string, _ *resource.Quantity) error {
+	return errNotImplemented
+}
+
+// GetConsumption -- dummy implementation
+func GetConsumption(_ string) (*resource.Quantity, error) {
+	return nil, errNotImplemented
+}
+
+// GetInodes -- dummy implementation
+func GetInodes(_ string) (*resource.Quantity, error) {
+	return nil, errNotImplemented
+}
+
+// ClearQuota -- dummy implementation
+func ClearQuota(_ mount.Interface, _ string) error {
+	return errNotImplemented
+}

pkg/volume/util/util.go

@@ -540,3 +540,11 @@ func GetPluginMountDir(host volume.VolumeHost, name string) string {
 	mntDir := filepath.Join(host.GetPluginDir(name), MountsInGlobalPDPath)
 	return mntDir
 }
+
+// IsLocalEphemeralVolume determines whether the argument is a local ephemeral
+// volume vs. some other type
+func IsLocalEphemeralVolume(volume v1.Volume) bool {
+	return volume.GitRepo != nil ||
+		(volume.EmptyDir != nil && volume.EmptyDir.Medium != v1.StorageMediumMemory) ||
+		volume.ConfigMap != nil || volume.DownwardAPI != nil
+}

pkg/volume/volume.go

@@ -101,6 +101,13 @@ type Attributes struct {
 	SupportsSELinux bool
 }
 
+// MounterArgs provides more easily extensible arguments to Mounter
+type MounterArgs struct {
+	FsGroup     *int64
+	DesiredSize *resource.Quantity
+	PodUID      string
+}
+
 // Mounter interface provides methods to set up/mount the volume.
 type Mounter interface {
 	// Uses Interface to provide the path for Docker binds.
@@ -122,14 +129,14 @@ type Mounter interface {
 	// content should be owned by 'fsGroup' so that it can be
 	// accessed by the pod. This may be called more than once, so
 	// implementations must be idempotent.
-	SetUp(fsGroup *int64) error
+	SetUp(mounterArgs MounterArgs) error
 	// SetUpAt prepares and mounts/unpacks the volume to the
 	// specified directory path, which may or may not exist yet.
 	// The mount point and its content should be owned by
 	// 'fsGroup' so that it can be accessed by the pod. This may
 	// be called more than once, so implementations must be
 	// idempotent.
-	SetUpAt(dir string, fsGroup *int64) error
+	SetUpAt(dir string, mounterArgs MounterArgs) error
 	// GetAttributes returns the attributes of the mounter.
 	// This function is called after SetUp()/SetUpAt().
 	GetAttributes() Attributes

pkg/volume/vsphere_volume/vsphere_volume.go

@@ -208,8 +208,8 @@ func (b *vsphereVolumeMounter) GetAttributes() volume.Attributes {
 }
 
 // SetUp attaches the disk and bind mounts to the volume path.
-func (b *vsphereVolumeMounter) SetUp(fsGroup *int64) error {
-	return b.SetUpAt(b.GetPath(), fsGroup)
+func (b *vsphereVolumeMounter) SetUp(mounterArgs volume.MounterArgs) error {
+	return b.SetUpAt(b.GetPath(), mounterArgs)
 }
 
 // Checks prior to mount operations to verify that the required components (binaries, etc.)
@@ -220,7 +220,7 @@ func (b *vsphereVolumeMounter) CanMount() error {
 }
 
 // SetUp attaches the disk and bind mounts to the volume path.
-func (b *vsphereVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
+func (b *vsphereVolumeMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
 	klog.V(5).Infof("vSphere volume setup %s to %s", b.volPath, dir)
 
 	// TODO: handle failed mounts here.
@@ -269,7 +269,7 @@ func (b *vsphereVolumeMounter) SetUpAt(dir string, fsGroup *int64) error {
 		os.Remove(dir)
 		return err
 	}
-	volume.SetVolumeOwnership(b, fsGroup)
+	volume.SetVolumeOwnership(b, mounterArgs.FsGroup)
 	klog.V(3).Infof("vSphere volume %s mounted to %s", b.volPath, dir)
 
 	return nil

pkg/volume/vsphere_volume/vsphere_volume_test.go

@@ -123,7 +123,7 @@ func TestPlugin(t *testing.T) {
 		t.Errorf("Got unexpected path: %s", path)
 	}
 
-	if err := mounter.SetUp(nil); err != nil {
+	if err := mounter.SetUp(volume.MounterArgs{}); err != nil {
 		t.Errorf("Expected success, got: %v", err)
 	}
 

test/e2e_node/BUILD

@@ -19,6 +19,8 @@ go_library(
         "node_problem_detector_linux.go",
         "resource_collector.go",
         "util.go",
+        "util_xfs_linux.go",
+        "util_xfs_unsupported.go",
     ],
     importpath = "k8s.io/kubernetes/test/e2e_node",
     visibility = ["//visibility:public"],
@@ -41,7 +43,9 @@ go_library(
         "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/util/uuid:go_default_library",
+        "//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library",
         "//staging/src/k8s.io/client-go/kubernetes/scheme:go_default_library",
+        "//staging/src/k8s.io/component-base/featuregate:go_default_library",
         "//staging/src/k8s.io/cri-api/pkg/apis:go_default_library",
         "//staging/src/k8s.io/cri-api/pkg/apis/runtime/v1alpha2:go_default_library",
         "//staging/src/k8s.io/kubelet/config/v1beta1:go_default_library",
@@ -62,6 +66,7 @@ go_library(
         "//vendor/k8s.io/klog:go_default_library",
     ] + select({
         "@io_bazel_rules_go//go/platform:linux": [
+            "//pkg/util/mount:go_default_library",
             "//pkg/util/procfs:go_default_library",
             "//staging/src/k8s.io/apimachinery/pkg/fields:go_default_library",
             "//staging/src/k8s.io/apimachinery/pkg/labels:go_default_library",
@@ -105,6 +110,7 @@ go_test(
         "node_perf_test.go",
         "pids_test.go",
         "pods_container_manager_test.go",
+        "quota_lsci_test.go",
         "resource_metrics_test.go",
         "resource_usage_test.go",
         "restart_test.go",
@@ -138,6 +144,8 @@ go_test(
         "//pkg/kubelet/metrics:go_default_library",
         "//pkg/kubelet/types:go_default_library",
         "//pkg/security/apparmor:go_default_library",
+        "//pkg/util/mount:go_default_library",
+        "//pkg/volume/util/quota:go_default_library",
         "//staging/src/k8s.io/api/core/v1:go_default_library",
         "//staging/src/k8s.io/api/scheduling/v1:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/api/equality:go_default_library",

test/e2e_node/image_list.go

@@ -49,6 +49,7 @@ var NodeImageWhiteList = sets.NewString(
 	busyboxImage,
 	"k8s.gcr.io/busybox@sha256:4bdd623e848417d96127e16037743f0cd8b528c026e9175e22a84f639eca58ff",
 	imageutils.GetE2EImage(imageutils.Nginx),
+	imageutils.GetE2EImage(imageutils.Perl),
 	imageutils.GetE2EImage(imageutils.ServeHostname),
 	imageutils.GetE2EImage(imageutils.Netexec),
 	imageutils.GetE2EImage(imageutils.Nonewprivs),

test/e2e_node/quota_lsci_test.go

+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+	"path/filepath"
+	"time"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/features"
+	kubeletconfig "k8s.io/kubernetes/pkg/kubelet/apis/config"
+	"k8s.io/kubernetes/pkg/util/mount"
+	"k8s.io/kubernetes/pkg/volume/util/quota"
+	"k8s.io/kubernetes/test/e2e/framework"
+	imageutils "k8s.io/kubernetes/test/utils/image"
+
+	. "github.com/onsi/ginkgo"
+)
+
+const (
+	LSCIQuotaFeature = features.LocalStorageCapacityIsolationFSQuotaMonitoring
+)
+
+func runOneQuotaTest(f *framework.Framework, quotasRequested bool) {
+	evictionTestTimeout := 10 * time.Minute
+	sizeLimit := resource.MustParse("100Mi")
+	useOverLimit := 101 /* Mb */
+	useUnderLimit := 99 /* Mb */
+	// TODO: remove hardcoded kubelet volume directory path
+	// framework.TestContext.KubeVolumeDir is currently not populated for node e2e
+	// As for why we do this: see comment below at isXfs.
+	if isXfs("/var/lib/kubelet") {
+		useUnderLimit = 50 /* Mb */
+	}
+	priority := 0
+	if quotasRequested {
+		priority = 1
+	}
+	Context(fmt.Sprintf(testContextFmt, fmt.Sprintf("use quotas for LSCI monitoring (quotas enabled: %v)", quotasRequested)), func() {
+		tempSetCurrentKubeletConfig(f, func(initialConfig *kubeletconfig.KubeletConfiguration) {
+			defer withFeatureGate(LSCIQuotaFeature, quotasRequested)()
+			// TODO: remove hardcoded kubelet volume directory path
+			// framework.TestContext.KubeVolumeDir is currently not populated for node e2e
+			if quotasRequested && !supportsQuotas("/var/lib/kubelet") {
+				// No point in running this as a positive test if quotas are not
+				// enabled on the underlying filesystem.
+				framework.Skipf("Cannot run LocalStorageCapacityIsolationQuotaMonitoring on filesystem without project quota enabled")
+			}
+			// setting a threshold to 0% disables; non-empty map overrides default value (necessary due to omitempty)
+			initialConfig.EvictionHard = map[string]string{"memory.available": "0%"}
+			initialConfig.FeatureGates[string(LSCIQuotaFeature)] = quotasRequested
+		})
+		runEvictionTest(f, evictionTestTimeout, noPressure, noStarvedResource, logDiskMetrics, []podEvictSpec{
+			{
+				evictionPriority: priority, // This pod should be evicted because of emptyDir violation only if quotas are enabled
+				pod: diskConcealingPod(fmt.Sprintf("emptydir-concealed-disk-over-sizelimit-quotas-%v", quotasRequested), useOverLimit, &v1.VolumeSource{
+					EmptyDir: &v1.EmptyDirVolumeSource{SizeLimit: &sizeLimit},
+				}, v1.ResourceRequirements{}),
+			},
+			{
+				evictionPriority: 0, // This pod should not be evicted because it uses less than its limit (test for quotas)
+				pod: diskConcealingPod(fmt.Sprintf("emptydir-concealed-disk-under-sizelimit-quotas-%v", quotasRequested), useUnderLimit, &v1.VolumeSource{
+					EmptyDir: &v1.EmptyDirVolumeSource{SizeLimit: &sizeLimit},
+				}, v1.ResourceRequirements{}),
+			},
+		})
+	})
+}
+
+// LocalStorageCapacityIsolationQuotaMonitoring tests that quotas are
+// used for monitoring rather than du.  The mechanism is to create a
+// pod that creates a file, deletes it, and writes data to it.  If
+// quotas are used to monitor, it will detect this deleted-but-in-use
+// file; if du is used to monitor, it will not detect this.
+var _ = framework.KubeDescribe("LocalStorageCapacityIsolationQuotaMonitoring [Slow] [Serial] [Disruptive] [Feature:LocalStorageCapacityIsolationQuota][NodeFeature:LSCIQuotaMonitoring]", func() {
+	f := framework.NewDefaultFramework("localstorage-quota-monitoring-test")
+	runOneQuotaTest(f, true)
+	runOneQuotaTest(f, false)
+})
+
+const (
+	writeConcealedPodCommand = `
+my $file = "%s.bin";
+open OUT, ">$file" || die "Cannot open $file: $!\n";
+unlink "$file" || die "Cannot unlink $file: $!\n";
+my $a = "a";
+foreach (1..20) { $a = "$a$a"; }
+foreach (1..%d) { syswrite(OUT, $a); }
+sleep 999999;`
+)
+
+// This is needed for testing eviction of pods using disk space in concealed files; the shell has no convenient
+// way of performing I/O to a concealed file, and the busybox image doesn't contain Perl.
+func diskConcealingPod(name string, diskConsumedMB int, volumeSource *v1.VolumeSource, resources v1.ResourceRequirements) *v1.Pod {
+	path := ""
+	volumeMounts := []v1.VolumeMount{}
+	volumes := []v1.Volume{}
+	if volumeSource != nil {
+		path = volumeMountPath
+		volumeMounts = []v1.VolumeMount{{MountPath: volumeMountPath, Name: volumeName}}
+		volumes = []v1.Volume{{Name: volumeName, VolumeSource: *volumeSource}}
+	}
+	return &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("%s-pod", name)},
+		Spec: v1.PodSpec{
+			RestartPolicy: v1.RestartPolicyNever,
+			Containers: []v1.Container{
+				{
+					Image: imageutils.GetE2EImage(imageutils.Perl),
+					Name:  fmt.Sprintf("%s-container", name),
+					Command: []string{
+						"perl",
+						"-e",
+						fmt.Sprintf(writeConcealedPodCommand, filepath.Join(path, "file"), diskConsumedMB),
+					},
+					Resources:    resources,
+					VolumeMounts: volumeMounts,
+				},
+			},
+			Volumes: volumes,
+		},
+	}
+}
+
+// Don't bother returning an error; if something goes wrong,
+// simply treat it as "no".
+func supportsQuotas(dir string) bool {
+	supportsQuota, err := quota.SupportsQuotas(mount.New(""), dir)
+	return supportsQuota && err == nil
+}

test/e2e_node/util.go

@@ -34,7 +34,9 @@ import (
 	apiequality "k8s.io/apimachinery/pkg/api/equality"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/sets"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/component-base/featuregate"
 	internalapi "k8s.io/cri-api/pkg/apis"
 	kubeletconfigv1beta1 "k8s.io/kubelet/config/v1beta1"
 	"k8s.io/kubernetes/pkg/features"
@@ -62,6 +64,7 @@ var kubeletAddress = flag.String("kubelet-address", "http://127.0.0.1:10255", "H
 var startServices = flag.Bool("start-services", true, "If true, start local node services")
 var stopServices = flag.Bool("stop-services", true, "If true, stop local node services after running tests")
 var busyboxImage = imageutils.GetE2EImage(imageutils.BusyBox)
+var perlImage = imageutils.GetE2EImage(imageutils.Perl)
 
 const (
 	// Kubelet internal cgroup name for node allocatable cgroup.
@@ -440,3 +443,15 @@ func reduceAllocatableMemoryUsage() {
 	_, err := exec.Command("sudo", "sh", "-c", cmd).CombinedOutput()
 	framework.ExpectNoError(err)
 }
+
+// Equivalent of featuregatetesting.SetFeatureGateDuringTest
+// which can't be used here because we're not in a Testing context.
+// This must be in a non-"_test" file to pass
+// make verify WHAT=test-featuregates
+func withFeatureGate(feature featuregate.Feature, desired bool) func() {
+	current := utilfeature.DefaultFeatureGate.Enabled(feature)
+	utilfeature.DefaultMutableFeatureGate.Set(fmt.Sprintf("%s=%v", string(feature), desired))
+	return func() {
+		utilfeature.DefaultMutableFeatureGate.Set(fmt.Sprintf("%s=%v", string(feature), current))
+	}
+}

test/e2e_node/util_xfs_linux.go

+// +build linux
+
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"path/filepath"
+	"syscall"
+
+	"k8s.io/kubernetes/pkg/util/mount"
+)
+
+func detectMountpoint(m mount.Interface, path string) string {
+	path, err := filepath.Abs(path)
+	if err == nil {
+		path, err = filepath.EvalSymlinks(path)
+	}
+	if err != nil {
+		return ""
+	}
+	for path != "" && path != "/" {
+		isNotMount, err := m.IsLikelyNotMountPoint(path)
+		if err != nil {
+			return ""
+		}
+		if !isNotMount {
+			return path
+		}
+		path = filepath.Dir(path)
+	}
+	return "/"
+}
+
+const (
+	xfsMagic = 0x58465342
+)
+
+// XFS over-allocates and then eventually removes that excess allocation.
+// That can lead to a file growing beyond its eventual size, causing
+// an unnecessary eviction:
+//
+// % ls -ls
+// total 32704
+// 32704 -rw-r--r-- 1 rkrawitz rkrawitz 20971520 Jan 15 13:16 foo.bin
+//
+// This issue can be hit regardless of the means used to count storage.
+// It is not present in ext4fs.
+func isXfs(dir string) bool {
+	mountpoint := detectMountpoint(mount.New(""), dir)
+	if mountpoint == "" {
+		return false
+	}
+	var buf syscall.Statfs_t
+	err := syscall.Statfs(mountpoint, &buf)
+	if err != nil {
+		return false
+	}
+	return buf.Type == xfsMagic
+}

test/e2e_node/util_xfs_unsupported.go

+// +build !linux
+
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+func isXfs(dir string) bool {
+	return false
+}

test/utils/image/manifest.go

@@ -171,6 +171,8 @@ const (
 	// Pause - when these values are updated, also update cmd/kubelet/app/options/container_runtime.go
 	// Pause image
 	Pause
+	// Perl image
+	Perl
 	// Porter image
 	Porter
 	// PortForwardTester image
@@ -236,6 +238,7 @@ func initImageConfigs() map[int]Config {
 	configs[NoSnatTestProxy] = Config{e2eRegistry, "no-snat-test-proxy", "1.0"}
 	// Pause - when these values are updated, also update cmd/kubelet/app/options/container_runtime.go
 	configs[Pause] = Config{gcRegistry, "pause", "3.1"}
+	configs[Perl] = Config{dockerLibraryRegistry, "perl", "5.26"}
 	configs[Porter] = Config{e2eRegistry, "porter", "1.0"}
 	configs[PortForwardTester] = Config{e2eRegistry, "port-forward-tester", "1.0"}
 	configs[Redis] = Config{e2eRegistry, "redis", "1.0"}