k8s.io/kubernetes@v1.31.0-alpha.0.0.20240520171757-56147500dadc/pkg/controller/namespace/namespace_controller.go (about)

     1  /*
     2  Copyright 2015 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package namespace
    18  
    19  import (
    20  	"context"
    21  	"fmt"
    22  	"time"
    23  
    24  	"golang.org/x/time/rate"
    25  
    26  	v1 "k8s.io/api/core/v1"
    27  	"k8s.io/apimachinery/pkg/api/errors"
    28  	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    29  	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
    30  	"k8s.io/apimachinery/pkg/util/wait"
    31  	coreinformers "k8s.io/client-go/informers/core/v1"
    32  	clientset "k8s.io/client-go/kubernetes"
    33  	corelisters "k8s.io/client-go/listers/core/v1"
    34  	"k8s.io/client-go/metadata"
    35  	"k8s.io/client-go/tools/cache"
    36  	"k8s.io/client-go/util/workqueue"
    37  	"k8s.io/kubernetes/pkg/controller"
    38  	"k8s.io/kubernetes/pkg/controller/namespace/deletion"
    39  
    40  	"k8s.io/klog/v2"
    41  )
    42  
    43  const (
    44  	// namespaceDeletionGracePeriod is the time period to wait before processing a received namespace event.
    45  	// This allows time for the following to occur:
    46  	// * lifecycle admission plugins on HA apiservers to also observe a namespace
    47  	//   deletion and prevent new objects from being created in the terminating namespace
    48  	// * non-leader etcd servers to observe last-minute object creations in a namespace
    49  	//   so this controller's cleanup can actually clean up all objects
    50  	namespaceDeletionGracePeriod = 5 * time.Second
    51  )
    52  
    53  // NamespaceController is responsible for performing actions dependent upon a namespace phase
    54  type NamespaceController struct {
    55  	// lister that can list namespaces from a shared cache
    56  	lister corelisters.NamespaceLister
    57  	// returns true when the namespace cache is ready
    58  	listerSynced cache.InformerSynced
    59  	// namespaces that have been queued up for processing by workers
    60  	queue workqueue.TypedRateLimitingInterface[string]
    61  	// helper to delete all resources in the namespace when the namespace is deleted.
    62  	namespacedResourcesDeleter deletion.NamespacedResourcesDeleterInterface
    63  }
    64  
    65  // NewNamespaceController creates a new NamespaceController
    66  func NewNamespaceController(
    67  	ctx context.Context,
    68  	kubeClient clientset.Interface,
    69  	metadataClient metadata.Interface,
    70  	discoverResourcesFn func() ([]*metav1.APIResourceList, error),
    71  	namespaceInformer coreinformers.NamespaceInformer,
    72  	resyncPeriod time.Duration,
    73  	finalizerToken v1.FinalizerName) *NamespaceController {
    74  
    75  	// create the controller so we can inject the enqueue function
    76  	namespaceController := &NamespaceController{
    77  		queue: workqueue.NewTypedRateLimitingQueueWithConfig(
    78  			nsControllerRateLimiter(),
    79  			workqueue.TypedRateLimitingQueueConfig[string]{
    80  				Name: "namespace",
    81  			},
    82  		),
    83  		namespacedResourcesDeleter: deletion.NewNamespacedResourcesDeleter(ctx, kubeClient.CoreV1().Namespaces(), metadataClient, kubeClient.CoreV1(), discoverResourcesFn, finalizerToken),
    84  	}
    85  
    86  	// configure the namespace informer event handlers
    87  	namespaceInformer.Informer().AddEventHandlerWithResyncPeriod(
    88  		cache.ResourceEventHandlerFuncs{
    89  			AddFunc: func(obj interface{}) {
    90  				namespace := obj.(*v1.Namespace)
    91  				namespaceController.enqueueNamespace(namespace)
    92  			},
    93  			UpdateFunc: func(oldObj, newObj interface{}) {
    94  				namespace := newObj.(*v1.Namespace)
    95  				namespaceController.enqueueNamespace(namespace)
    96  			},
    97  		},
    98  		resyncPeriod,
    99  	)
   100  	namespaceController.lister = namespaceInformer.Lister()
   101  	namespaceController.listerSynced = namespaceInformer.Informer().HasSynced
   102  
   103  	return namespaceController
   104  }
   105  
   106  // nsControllerRateLimiter is tuned for a faster than normal recycle time with default backoff speed and default overall
   107  // requeing speed.  We do this so that namespace cleanup is reliably faster and we know that the number of namespaces being
   108  // deleted is smaller than total number of other namespace scoped resources in a cluster.
   109  func nsControllerRateLimiter() workqueue.TypedRateLimiter[string] {
   110  	return workqueue.NewTypedMaxOfRateLimiter(
   111  		// this ensures that we retry namespace deletion at least every minute, never longer.
   112  		workqueue.NewTypedItemExponentialFailureRateLimiter[string](5*time.Millisecond, 60*time.Second),
   113  		// 10 qps, 100 bucket size.  This is only for retry speed and its only the overall factor (not per item)
   114  		&workqueue.TypedBucketRateLimiter[string]{Limiter: rate.NewLimiter(rate.Limit(10), 100)},
   115  	)
   116  }
   117  
   118  // enqueueNamespace adds an object to the controller work queue
   119  // obj could be an *v1.Namespace, or a DeletionFinalStateUnknown item.
   120  func (nm *NamespaceController) enqueueNamespace(obj interface{}) {
   121  	key, err := controller.KeyFunc(obj)
   122  	if err != nil {
   123  		utilruntime.HandleError(fmt.Errorf("Couldn't get key for object %+v: %v", obj, err))
   124  		return
   125  	}
   126  
   127  	namespace := obj.(*v1.Namespace)
   128  	// don't queue if we aren't deleted
   129  	if namespace.DeletionTimestamp == nil || namespace.DeletionTimestamp.IsZero() {
   130  		return
   131  	}
   132  
   133  	// delay processing namespace events to allow HA api servers to observe namespace deletion,
   134  	// and HA etcd servers to observe last minute object creations inside the namespace
   135  	nm.queue.AddAfter(key, namespaceDeletionGracePeriod)
   136  }
   137  
   138  // worker processes the queue of namespace objects.
   139  // Each namespace can be in the queue at most once.
   140  // The system ensures that no two workers can process
   141  // the same namespace at the same time.
   142  func (nm *NamespaceController) worker(ctx context.Context) {
   143  	workFunc := func(ctx context.Context) bool {
   144  		key, quit := nm.queue.Get()
   145  		if quit {
   146  			return true
   147  		}
   148  		defer nm.queue.Done(key)
   149  
   150  		err := nm.syncNamespaceFromKey(ctx, key)
   151  		if err == nil {
   152  			// no error, forget this entry and return
   153  			nm.queue.Forget(key)
   154  			return false
   155  		}
   156  
   157  		if estimate, ok := err.(*deletion.ResourcesRemainingError); ok {
   158  			t := estimate.Estimate/2 + 1
   159  			klog.FromContext(ctx).V(4).Info("Content remaining in namespace", "namespace", key, "waitSeconds", t)
   160  			nm.queue.AddAfter(key, time.Duration(t)*time.Second)
   161  		} else {
   162  			// rather than wait for a full resync, re-add the namespace to the queue to be processed
   163  			nm.queue.AddRateLimited(key)
   164  			utilruntime.HandleError(fmt.Errorf("deletion of namespace %v failed: %v", key, err))
   165  		}
   166  		return false
   167  	}
   168  	for {
   169  		quit := workFunc(ctx)
   170  
   171  		if quit {
   172  			return
   173  		}
   174  	}
   175  }
   176  
   177  // syncNamespaceFromKey looks for a namespace with the specified key in its store and synchronizes it
   178  func (nm *NamespaceController) syncNamespaceFromKey(ctx context.Context, key string) (err error) {
   179  	startTime := time.Now()
   180  	logger := klog.FromContext(ctx)
   181  	defer func() {
   182  		logger.V(4).Info("Finished syncing namespace", "namespace", key, "duration", time.Since(startTime))
   183  	}()
   184  
   185  	namespace, err := nm.lister.Get(key)
   186  	if errors.IsNotFound(err) {
   187  		logger.Info("Namespace has been deleted", "namespace", key)
   188  		return nil
   189  	}
   190  	if err != nil {
   191  		utilruntime.HandleError(fmt.Errorf("Unable to retrieve namespace %v from store: %v", key, err))
   192  		return err
   193  	}
   194  	return nm.namespacedResourcesDeleter.Delete(ctx, namespace.Name)
   195  }
   196  
   197  // Run starts observing the system with the specified number of workers.
   198  func (nm *NamespaceController) Run(ctx context.Context, workers int) {
   199  	defer utilruntime.HandleCrash()
   200  	defer nm.queue.ShutDown()
   201  	logger := klog.FromContext(ctx)
   202  	logger.Info("Starting namespace controller")
   203  	defer logger.Info("Shutting down namespace controller")
   204  
   205  	if !cache.WaitForNamedCacheSync("namespace", ctx.Done(), nm.listerSynced) {
   206  		return
   207  	}
   208  
   209  	logger.V(5).Info("Starting workers of namespace controller")
   210  	for i := 0; i < workers; i++ {
   211  		go wait.UntilWithContext(ctx, nm.worker, time.Second)
   212  	}
   213  	<-ctx.Done()
   214  }