k8s.io/kubernetes@v1.31.0-alpha.0.0.20240520171757-56147500dadc/pkg/controller/namespace/namespace_controller.go (about) 1 /* 2 Copyright 2015 The Kubernetes Authors. 3 4 Licensed under the Apache License, Version 2.0 (the "License"); 5 you may not use this file except in compliance with the License. 6 You may obtain a copy of the License at 7 8 http://www.apache.org/licenses/LICENSE-2.0 9 10 Unless required by applicable law or agreed to in writing, software 11 distributed under the License is distributed on an "AS IS" BASIS, 12 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 See the License for the specific language governing permissions and 14 limitations under the License. 15 */ 16 17 package namespace 18 19 import ( 20 "context" 21 "fmt" 22 "time" 23 24 "golang.org/x/time/rate" 25 26 v1 "k8s.io/api/core/v1" 27 "k8s.io/apimachinery/pkg/api/errors" 28 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" 29 utilruntime "k8s.io/apimachinery/pkg/util/runtime" 30 "k8s.io/apimachinery/pkg/util/wait" 31 coreinformers "k8s.io/client-go/informers/core/v1" 32 clientset "k8s.io/client-go/kubernetes" 33 corelisters "k8s.io/client-go/listers/core/v1" 34 "k8s.io/client-go/metadata" 35 "k8s.io/client-go/tools/cache" 36 "k8s.io/client-go/util/workqueue" 37 "k8s.io/kubernetes/pkg/controller" 38 "k8s.io/kubernetes/pkg/controller/namespace/deletion" 39 40 "k8s.io/klog/v2" 41 ) 42 43 const ( 44 // namespaceDeletionGracePeriod is the time period to wait before processing a received namespace event. 45 // This allows time for the following to occur: 46 // * lifecycle admission plugins on HA apiservers to also observe a namespace 47 // deletion and prevent new objects from being created in the terminating namespace 48 // * non-leader etcd servers to observe last-minute object creations in a namespace 49 // so this controller's cleanup can actually clean up all objects 50 namespaceDeletionGracePeriod = 5 * time.Second 51 ) 52 53 // NamespaceController is responsible for performing actions dependent upon a namespace phase 54 type NamespaceController struct { 55 // lister that can list namespaces from a shared cache 56 lister corelisters.NamespaceLister 57 // returns true when the namespace cache is ready 58 listerSynced cache.InformerSynced 59 // namespaces that have been queued up for processing by workers 60 queue workqueue.TypedRateLimitingInterface[string] 61 // helper to delete all resources in the namespace when the namespace is deleted. 62 namespacedResourcesDeleter deletion.NamespacedResourcesDeleterInterface 63 } 64 65 // NewNamespaceController creates a new NamespaceController 66 func NewNamespaceController( 67 ctx context.Context, 68 kubeClient clientset.Interface, 69 metadataClient metadata.Interface, 70 discoverResourcesFn func() ([]*metav1.APIResourceList, error), 71 namespaceInformer coreinformers.NamespaceInformer, 72 resyncPeriod time.Duration, 73 finalizerToken v1.FinalizerName) *NamespaceController { 74 75 // create the controller so we can inject the enqueue function 76 namespaceController := &NamespaceController{ 77 queue: workqueue.NewTypedRateLimitingQueueWithConfig( 78 nsControllerRateLimiter(), 79 workqueue.TypedRateLimitingQueueConfig[string]{ 80 Name: "namespace", 81 }, 82 ), 83 namespacedResourcesDeleter: deletion.NewNamespacedResourcesDeleter(ctx, kubeClient.CoreV1().Namespaces(), metadataClient, kubeClient.CoreV1(), discoverResourcesFn, finalizerToken), 84 } 85 86 // configure the namespace informer event handlers 87 namespaceInformer.Informer().AddEventHandlerWithResyncPeriod( 88 cache.ResourceEventHandlerFuncs{ 89 AddFunc: func(obj interface{}) { 90 namespace := obj.(*v1.Namespace) 91 namespaceController.enqueueNamespace(namespace) 92 }, 93 UpdateFunc: func(oldObj, newObj interface{}) { 94 namespace := newObj.(*v1.Namespace) 95 namespaceController.enqueueNamespace(namespace) 96 }, 97 }, 98 resyncPeriod, 99 ) 100 namespaceController.lister = namespaceInformer.Lister() 101 namespaceController.listerSynced = namespaceInformer.Informer().HasSynced 102 103 return namespaceController 104 } 105 106 // nsControllerRateLimiter is tuned for a faster than normal recycle time with default backoff speed and default overall 107 // requeing speed. We do this so that namespace cleanup is reliably faster and we know that the number of namespaces being 108 // deleted is smaller than total number of other namespace scoped resources in a cluster. 109 func nsControllerRateLimiter() workqueue.TypedRateLimiter[string] { 110 return workqueue.NewTypedMaxOfRateLimiter( 111 // this ensures that we retry namespace deletion at least every minute, never longer. 112 workqueue.NewTypedItemExponentialFailureRateLimiter[string](5*time.Millisecond, 60*time.Second), 113 // 10 qps, 100 bucket size. This is only for retry speed and its only the overall factor (not per item) 114 &workqueue.TypedBucketRateLimiter[string]{Limiter: rate.NewLimiter(rate.Limit(10), 100)}, 115 ) 116 } 117 118 // enqueueNamespace adds an object to the controller work queue 119 // obj could be an *v1.Namespace, or a DeletionFinalStateUnknown item. 120 func (nm *NamespaceController) enqueueNamespace(obj interface{}) { 121 key, err := controller.KeyFunc(obj) 122 if err != nil { 123 utilruntime.HandleError(fmt.Errorf("Couldn't get key for object %+v: %v", obj, err)) 124 return 125 } 126 127 namespace := obj.(*v1.Namespace) 128 // don't queue if we aren't deleted 129 if namespace.DeletionTimestamp == nil || namespace.DeletionTimestamp.IsZero() { 130 return 131 } 132 133 // delay processing namespace events to allow HA api servers to observe namespace deletion, 134 // and HA etcd servers to observe last minute object creations inside the namespace 135 nm.queue.AddAfter(key, namespaceDeletionGracePeriod) 136 } 137 138 // worker processes the queue of namespace objects. 139 // Each namespace can be in the queue at most once. 140 // The system ensures that no two workers can process 141 // the same namespace at the same time. 142 func (nm *NamespaceController) worker(ctx context.Context) { 143 workFunc := func(ctx context.Context) bool { 144 key, quit := nm.queue.Get() 145 if quit { 146 return true 147 } 148 defer nm.queue.Done(key) 149 150 err := nm.syncNamespaceFromKey(ctx, key) 151 if err == nil { 152 // no error, forget this entry and return 153 nm.queue.Forget(key) 154 return false 155 } 156 157 if estimate, ok := err.(*deletion.ResourcesRemainingError); ok { 158 t := estimate.Estimate/2 + 1 159 klog.FromContext(ctx).V(4).Info("Content remaining in namespace", "namespace", key, "waitSeconds", t) 160 nm.queue.AddAfter(key, time.Duration(t)*time.Second) 161 } else { 162 // rather than wait for a full resync, re-add the namespace to the queue to be processed 163 nm.queue.AddRateLimited(key) 164 utilruntime.HandleError(fmt.Errorf("deletion of namespace %v failed: %v", key, err)) 165 } 166 return false 167 } 168 for { 169 quit := workFunc(ctx) 170 171 if quit { 172 return 173 } 174 } 175 } 176 177 // syncNamespaceFromKey looks for a namespace with the specified key in its store and synchronizes it 178 func (nm *NamespaceController) syncNamespaceFromKey(ctx context.Context, key string) (err error) { 179 startTime := time.Now() 180 logger := klog.FromContext(ctx) 181 defer func() { 182 logger.V(4).Info("Finished syncing namespace", "namespace", key, "duration", time.Since(startTime)) 183 }() 184 185 namespace, err := nm.lister.Get(key) 186 if errors.IsNotFound(err) { 187 logger.Info("Namespace has been deleted", "namespace", key) 188 return nil 189 } 190 if err != nil { 191 utilruntime.HandleError(fmt.Errorf("Unable to retrieve namespace %v from store: %v", key, err)) 192 return err 193 } 194 return nm.namespacedResourcesDeleter.Delete(ctx, namespace.Name) 195 } 196 197 // Run starts observing the system with the specified number of workers. 198 func (nm *NamespaceController) Run(ctx context.Context, workers int) { 199 defer utilruntime.HandleCrash() 200 defer nm.queue.ShutDown() 201 logger := klog.FromContext(ctx) 202 logger.Info("Starting namespace controller") 203 defer logger.Info("Shutting down namespace controller") 204 205 if !cache.WaitForNamedCacheSync("namespace", ctx.Done(), nm.listerSynced) { 206 return 207 } 208 209 logger.V(5).Info("Starting workers of namespace controller") 210 for i := 0; i < workers; i++ { 211 go wait.UntilWithContext(ctx, nm.worker, time.Second) 212 } 213 <-ctx.Done() 214 }