Merge pull request #14358 from ncdc/kube/45427-45897-gc-improvements

Kube GC improvements backports

Author: smarterclayton

pkg/cmd/server/kubernetes/master/master_config_test.go

@@ -3,6 +3,7 @@ package master
 import (
 	"net"
 	"reflect"
+	"sort"
 	"strings"
 	"testing"
 	"time"
@@ -147,8 +148,32 @@ func TestAPIServerDefaults(t *testing.T) {
 	}
 }
 
+// sortedGCIgnoredResources sorts by Group, then Resource.
+type sortedGCIgnoredResources []componentconfig.GroupResource
+
+func (r sortedGCIgnoredResources) Len() int {
+	return len(r)
+}
+
+func (r sortedGCIgnoredResources) Less(i, j int) bool {
+	if r[i].Group < r[j].Group {
+		return true
+	} else if r[i].Group > r[j].Group {
+		return false
+	}
+
+	return r[i].Resource < r[j].Resource
+}
+
+func (r sortedGCIgnoredResources) Swap(i, j int) {
+	r[i], r[j] = r[j], r[i]
+}
+
 func TestCMServerDefaults(t *testing.T) {
 	defaults := cmapp.NewCMServer()
+	// We need to sort GCIgnoredResources because it's built from a map, which means the insertion
+	// order is random.
+	sort.Sort(sortedGCIgnoredResources(defaults.GCIgnoredResources))
 
 	// This is a snapshot of the default config
 	// If the default changes (new fields are added, or default values change), we want to know
@@ -209,16 +234,30 @@ func TestCMServerDefaults(t *testing.T) {
 				RenewDeadline: metav1.Duration{Duration: 10 * time.Second},
 				RetryPeriod:   metav1.Duration{Duration: 2 * time.Second},
 			},
-			ClusterSigningCertFile:            "/etc/kubernetes/ca/ca.pem",
-			ClusterSigningKeyFile:             "/etc/kubernetes/ca/ca.key",
-			EnableGarbageCollector:            true,
+			ClusterSigningCertFile: "/etc/kubernetes/ca/ca.pem",
+			ClusterSigningKeyFile:  "/etc/kubernetes/ca/ca.key",
+			EnableGarbageCollector: true,
+			GCIgnoredResources: []componentconfig.GroupResource{
+				{Group: "extensions", Resource: "replicationcontrollers"},
+				{Group: "", Resource: "bindings"},
+				{Group: "", Resource: "componentstatuses"},
+				{Group: "", Resource: "events"},
+				{Group: "authentication.k8s.io", Resource: "tokenreviews"},
+				{Group: "authorization.k8s.io", Resource: "subjectaccessreviews"},
+				{Group: "authorization.k8s.io", Resource: "selfsubjectaccessreviews"},
+				{Group: "authorization.k8s.io", Resource: "localsubjectaccessreviews"},
+				{Group: "apiregistration.k8s.io", Resource: "apiservices"},
+			},
 			DisableAttachDetachReconcilerSync: false,
 			ReconcilerSyncLoopPeriod:          metav1.Duration{Duration: 60 * time.Second},
 			Controllers:                       []string{"*"},
 			EnableTaintManager:                true,
 		},
 	}
 
+	// Because we sorted the defaults, we need to sort the expectedDefaults too.
+	sort.Sort(sortedGCIgnoredResources(expectedDefaults.GCIgnoredResources))
+
 	if !reflect.DeepEqual(defaults, expectedDefaults) {
 		t.Logf("expected defaults, actual defaults: \n%s", diff.ObjectReflectDiff(expectedDefaults, defaults))
 		t.Errorf("Got different defaults than expected, adjust in BuildKubernetesMasterConfig and update expectedDefaults")

test/testdata/bootstrappolicy/bootstrap_cluster_roles.yaml

@@ -5033,88 +5033,10 @@ items:
     verbs:
     - create
   - apiGroups:
-    - ""
-    attributeRestrictions: null
-    resources:
-    - configmaps
-    - namespaces
-    - nodes
-    - persistentvolumeclaims
-    - persistentvolumes
-    - pods
-    - replicationcontrollers
-    - resourcequotas
-    - secrets
-    - serviceaccounts
-    - services
-    verbs:
-    - list
-    - watch
-  - apiGroups:
-    - extensions
-    attributeRestrictions: null
-    resources:
-    - daemonsets
-    - deployments
-    - podsecuritypolicies
-    - replicasets
-    verbs:
-    - list
-    - watch
-  - apiGroups:
-    - apps
-    attributeRestrictions: null
-    resources:
-    - deployments
-    verbs:
-    - list
-    - watch
-  - apiGroups:
-    - batch
-    attributeRestrictions: null
-    resources:
-    - cronjobs
-    - jobs
-    verbs:
-    - list
-    - watch
-  - apiGroups:
-    - apps
-    attributeRestrictions: null
-    resources:
-    - statefulsets
-    verbs:
-    - list
-    - watch
-  - apiGroups:
-    - policy
-    attributeRestrictions: null
-    resources:
-    - poddisruptionbudgets
-    verbs:
-    - list
-    - watch
-  - apiGroups:
-    - autoscaling
-    attributeRestrictions: null
-    resources:
-    - horizontalpodautoscalers
-    verbs:
-    - list
-    - watch
-  - apiGroups:
-    - certificates.k8s.io
-    attributeRestrictions: null
-    resources:
-    - certificatesigningrequests
-    verbs:
-    - list
-    - watch
-  - apiGroups:
-    - storage.k8s.io
+    - '*'
     attributeRestrictions: null
     resources:
-    - storageclasses
+    - '*'
     verbs:
     - list
     - watch