@@ -51,7 +51,6 @@ import (

 	deployconfiggenerator "github.com/openshift/origin/pkg/deploy/registry/generator"

 	deployrollback "github.com/openshift/origin/pkg/deploy/registry/rollback"

 	"github.com/openshift/origin/pkg/dockerregistry"

-	imageadmission "github.com/openshift/origin/pkg/image/admission"

 	"github.com/openshift/origin/pkg/image/importer"

 	imageimporter "github.com/openshift/origin/pkg/image/importer"

 	"github.com/openshift/origin/pkg/image/registry/image"

@@ -463,9 +462,8 @@ func (c *MasterConfig) GetRestStorage() map[string]rest.Storage {

 	checkStorageErr(err)

 	imageRegistry := image.NewRegistry(imageStorage)

 	imageSignatureStorage := imagesignature.NewREST(c.PrivilegedLoopbackOpenShiftClient.Images())

-	imageStreamLimitVerifier := imageadmission.NewLimitVerifier(c.KubeClient())

 	imageStreamSecretsStorage := imagesecret.NewREST(c.ImageStreamSecretClient())

-	imageStreamStorage, imageStreamStatusStorage, internalImageStreamStorage, err := imagestreametcd.NewREST(c.RESTOptionsGetter, c.RegistryNameFn, subjectAccessReviewRegistry, imageStreamLimitVerifier)

+	imageStreamStorage, imageStreamStatusStorage, internalImageStreamStorage, err := imagestreametcd.NewREST(c.RESTOptionsGetter, c.RegistryNameFn, subjectAccessReviewRegistry, c.LimitVerifier)

 	checkStorageErr(err)

 	imageStreamRegistry := imagestream.NewRegistry(imageStreamStorage, imageStreamStatusStorage, internalImageStreamStorage)

 	imageStreamMappingStorage := imagestreammapping.NewREST(imageRegistry, imageStreamRegistry, c.RegistryNameFn)

@@ -16,6 +16,7 @@ import (

 	"k8s.io/kubernetes/pkg/admission"

 	kapi "k8s.io/kubernetes/pkg/api"

+	kapierrors "k8s.io/kubernetes/pkg/api/errors"

 	"k8s.io/kubernetes/pkg/api/unversioned"

 	"k8s.io/kubernetes/pkg/apiserver"

 	"k8s.io/kubernetes/pkg/client/cache"

@@ -25,6 +26,7 @@ import (

 	clientadapter "k8s.io/kubernetes/pkg/client/unversioned/adapters/internalclientset"

 	sacontroller "k8s.io/kubernetes/pkg/controller/serviceaccount"

 	kubeletclient "k8s.io/kubernetes/pkg/kubelet/client"

+	"k8s.io/kubernetes/pkg/labels"

 	"k8s.io/kubernetes/pkg/runtime"

 	"k8s.io/kubernetes/pkg/serviceaccount"

 	kutilrand "k8s.io/kubernetes/pkg/util/rand"

@@ -105,6 +107,7 @@ type MasterConfig struct {

 	ProjectAuthorizationCache     *projectauth.AuthorizationCache

 	ProjectCache                  *projectcache.ProjectCache

 	ClusterQuotaMappingController *clusterquotamapping.ClusterQuotaMappingController

+	LimitVerifier                 imageadmission.LimitVerifier

 	// RequestContextMapper maps requests to contexts

 	RequestContextMapper kapi.RequestContextMapper

@@ -296,6 +299,23 @@ func BuildMasterConfig(options configapi.MasterConfig) (*MasterConfig, error) {

 		Informers:                          informerFactory,

 	}

+	// ensure that the limit range informer will be started

+	informer := config.Informers.LimitRanges().Informer()

+	config.LimitVerifier = imageadmission.NewLimitVerifier(imageadmission.LimitRangesForNamespaceFunc(func(ns string) ([]*kapi.LimitRange, error) {

+		list, err := config.Informers.LimitRanges().Lister().LimitRanges(ns).List(labels.Everything())

+		if err != nil {

+			return nil, err

+		}

+		// the verifier must return an error

+		if len(list) == 0 && len(informer.LastSyncResourceVersion()) == 0 {

+			glog.V(4).Infof("LimitVerifier still waiting for ranges to load: %#v", informer)

+			forbiddenErr := kapierrors.NewForbidden(unversioned.GroupResource{Resource: "limitranges"}, "", fmt.Errorf("the server is still loading limit information"))

+			forbiddenErr.ErrStatus.Details.RetryAfterSeconds = 1

+			return nil, forbiddenErr

+		}

+		return list, nil

+	}))

+

 	return config, nil

 }

@@ -322,6 +342,7 @@ var (

 		serviceadmit.ExternalIPPluginName,

 		serviceadmit.RestrictedEndpointsPluginName,

 		imagepolicy.PluginName,

+		"ImagePolicyWebhook",

 		"LimitRanger",

 		"ServiceAccount",

 		"SecurityContextConstraint",

@@ -357,6 +378,7 @@ var (

 		serviceadmit.ExternalIPPluginName,

 		serviceadmit.RestrictedEndpointsPluginName,

 		imagepolicy.PluginName,

+		"ImagePolicyWebhook",

 		"LimitRanger",

 		"ServiceAccount",

 		"SecurityContextConstraint",

@@ -4,8 +4,10 @@ import (

 	"reflect"

 	kapi "k8s.io/kubernetes/pkg/api"

+	"k8s.io/kubernetes/pkg/api/errors"

 	"k8s.io/kubernetes/pkg/client/cache"

 	"k8s.io/kubernetes/pkg/controller/framework"

+	"k8s.io/kubernetes/pkg/labels"

 	"k8s.io/kubernetes/pkg/runtime"

 	"k8s.io/kubernetes/pkg/watch"

 )

@@ -337,3 +339,115 @@ func (f *namespaceInformer) Lister() *cache.IndexerToNamespaceLister {

 	informer := f.Informer()

 	return &cache.IndexerToNamespaceLister{Indexer: informer.GetIndexer()}

 }

+

+type LimitRangeInformer interface {

+	Informer() framework.SharedIndexInformer

+	Indexer() cache.Indexer

+	Lister() StoreToLimitRangeLister

+}

+

+type limitRangeInformer struct {

+	*sharedInformerFactory

+}

+

+func (f *limitRangeInformer) Informer() framework.SharedIndexInformer {

+	f.lock.Lock()

+	defer f.lock.Unlock()

+

+	informerObj := &kapi.LimitRange{}

+	informerType := reflect.TypeOf(informerObj)

+	informer, exists := f.informers[informerType]

+	if exists {

+		return informer

+	}

+

+	lw := f.customListerWatchers.GetListerWatcher(kapi.Resource("limitrange"))

+	if lw == nil {

+		lw = &cache.ListWatch{

+			ListFunc: func(options kapi.ListOptions) (runtime.Object, error) {

+				return f.kubeClient.LimitRanges(kapi.NamespaceAll).List(options)

+			},

+			WatchFunc: func(options kapi.ListOptions) (watch.Interface, error) {

+				return f.kubeClient.LimitRanges(kapi.NamespaceAll).Watch(options)

+			},

+		}

+	}

+

+	informer = framework.NewSharedIndexInformer(

+		lw,

+		informerObj,

+		f.defaultResync,

+		cache.Indexers{},

+	)

+	f.informers[informerType] = informer

+

+	return informer

+}

+

+func (f *limitRangeInformer) Indexer() cache.Indexer {

+	informer := f.Informer()

+	return informer.GetIndexer()

+}

+

+func (f *limitRangeInformer) Lister() StoreToLimitRangeLister {

+	informer := f.Informer()

+	return StoreToLimitRangeLister{Indexer: informer.GetIndexer()}

+}

+

+// StoreToLimitRangeLister gives a store List and Get methods. The store must contain only LimitRanges.

+type StoreToLimitRangeLister struct {

+	cache.Indexer

+}

+

+func (s StoreToLimitRangeLister) LimitRanges(namespace string) storeLimitRangesNamespacer {

+	return storeLimitRangesNamespacer{s.Indexer, namespace}

+}

+

+type storeLimitRangesNamespacer struct {

+	indexer   cache.Indexer

+	namespace string

+}

+

+func (s storeLimitRangesNamespacer) List(selector labels.Selector) ([]*kapi.LimitRange, error) {

+	var controllers []*kapi.LimitRange

+

+	if s.namespace == kapi.NamespaceAll {

+		for _, m := range s.indexer.List() {

+			rc := m.(*kapi.LimitRange)

+			if selector.Matches(labels.Set(rc.Labels)) {

+				controllers = append(controllers, rc)

+			}

+		}

+		return controllers, nil

+	}

+

+	key := &kapi.LimitRange{ObjectMeta: kapi.ObjectMeta{Namespace: s.namespace}}

+	items, err := s.indexer.Index(cache.NamespaceIndex, key)

+	if err != nil {

+		for _, m := range s.indexer.List() {

+			rc := m.(*kapi.LimitRange)

+			if s.namespace == rc.Namespace && selector.Matches(labels.Set(rc.Labels)) {

+				controllers = append(controllers, rc)

+			}

+		}

+		return controllers, nil

+	}

+	for _, m := range items {

+		rc := m.(*kapi.LimitRange)

+		if selector.Matches(labels.Set(rc.Labels)) {

+			controllers = append(controllers, rc)

+		}

+	}

+	return controllers, nil

+}

+

+func (s storeLimitRangesNamespacer) Get(name string) (*kapi.LimitRange, error) {

+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)

+	if err != nil {

+		return nil, err

+	}

+	if !exists {

+		return nil, errors.NewNotFound(kapi.Resource("limitrange"), name)

+	}

+	return obj.(*kapi.LimitRange), nil

+}

@@ -26,6 +26,7 @@ type InformerFactory interface {

 	PersistentVolumes() PersistentVolumeInformer

 	PersistentVolumeClaims() PersistentVolumeClaimInformer

 	ReplicationControllers() ReplicationControllerInformer

+	LimitRanges() LimitRangeInformer

 	ClusterPolicies() ClusterPolicyInformer

 	ClusterPolicyBindings() ClusterPolicyBindingInformer

@@ -129,6 +130,10 @@ func (f *sharedInformerFactory) Namespaces() NamespaceInformer {

 	return &namespaceInformer{sharedInformerFactory: f}

 }

+func (f *sharedInformerFactory) LimitRanges() LimitRangeInformer {

+	return &limitRangeInformer{sharedInformerFactory: f}

+}

+

 func (f *sharedInformerFactory) ClusterPolicies() ClusterPolicyInformer {

 	return &clusterPolicyInformer{sharedInformerFactory: f}

 }

@@ -1,14 +1,9 @@

 package admission

 import (

-	"fmt"

 	kapi "k8s.io/kubernetes/pkg/api"

 	kapierrors "k8s.io/kubernetes/pkg/api/errors"

-	"k8s.io/kubernetes/pkg/client/cache"

-	kclient "k8s.io/kubernetes/pkg/client/unversioned"

-	"k8s.io/kubernetes/pkg/runtime"

 	kerrutil "k8s.io/kubernetes/pkg/util/errors"

-	watch "k8s.io/kubernetes/pkg/watch"

 	imageapi "github.com/openshift/origin/pkg/image/api"

 )

@@ -17,79 +12,80 @@ type LimitVerifier interface {

 	VerifyLimits(namespace string, is *imageapi.ImageStream) error

 }

-func NewLimitVerifier(client kclient.LimitRangesNamespacer) LimitVerifier {

-	lw := &cache.ListWatch{

-		ListFunc: func(options kapi.ListOptions) (runtime.Object, error) {

-			return client.LimitRanges(kapi.NamespaceAll).List(options)

-		},

-		WatchFunc: func(options kapi.ListOptions) (watch.Interface, error) {

-			return client.LimitRanges(kapi.NamespaceAll).Watch(options)

-		},

-	}

-	indexer, reflector := cache.NewNamespaceKeyedIndexerAndReflector(lw, &kapi.LimitRange{}, 0)

-	reflector.Run()

+type NamespaceLimiter interface {

+	LimitsForNamespace(namespace string) (kapi.ResourceList, error)

+}

+

+// NewLimitVerifier accepts a NamespaceLimiter

+func NewLimitVerifier(limiter NamespaceLimiter) LimitVerifier {

 	return &limitVerifier{

-		client:  client,

-		indexer: indexer,

+		limiter: limiter,

 	}

 }

 type limitVerifier struct {

-	client  kclient.LimitRangesNamespacer

-	indexer cache.Indexer

+	limiter NamespaceLimiter

 }

 func (v *limitVerifier) VerifyLimits(namespace string, is *imageapi.ImageStream) error {

-	items, err := v.indexer.Index("namespace", &kapi.LimitRange{ObjectMeta: kapi.ObjectMeta{Namespace: namespace}})

-	if err != nil {

-		return fmt.Errorf("error resolving limit ranges: %v", err)

-	}

-	if len(items) == 0 {

-		return nil

-	}

-	limits := getMaxLimits(items)

-	if len(limits) == 0 {

-		return nil

+	limits, err := v.limiter.LimitsForNamespace(namespace)

+	if err != nil || len(limits) == 0 {

+		return err

 	}

 	usage := GetImageStreamUsage(is)

-

 	if err := verifyImageStreamUsage(usage, limits); err != nil {

 		return kapierrors.NewForbidden(imageapi.Resource("ImageStream"), is.Name, err)

 	}

 	return nil

 }

-func getMaxLimits(limits []interface{}) kapi.ResourceList {

-	res := kapi.ResourceList{}

+func verifyImageStreamUsage(isUsage kapi.ResourceList, limits kapi.ResourceList) error {

+	var errs []error

-	for _, limitObject := range limits {

-		lr := limitObject.(*kapi.LimitRange)

-		for _, item := range lr.Spec.Limits {

-			if item.Type != imageapi.LimitTypeImageStream {

-				continue

-			}

-			for _, resource := range []kapi.ResourceName{imageapi.ResourceImageStreamImages, imageapi.ResourceImageStreamTags} {

-				if max, ok := item.Max[resource]; ok {

-					if oldMax, exists := res[resource]; !exists || oldMax.Cmp(max) > 0 {

-						res[resource] = max

-					}

-				}

-			}

+	for resource, limit := range limits {

+		if usage, ok := isUsage[resource]; ok && usage.Cmp(limit) > 0 {

+			errs = append(errs, newLimitExceededError(imageapi.LimitTypeImageStream, resource, &usage, &limit))

 		}

 	}

-	return res

+	return kerrutil.NewAggregate(errs)

 }

-func verifyImageStreamUsage(isUsage kapi.ResourceList, limits kapi.ResourceList) error {

-	errs := []error{}

+type LimitRangesForNamespaceFunc func(namespace string) ([]*kapi.LimitRange, error)

-	for resource, limit := range limits {

-		if usage, ok := isUsage[resource]; ok && usage.Cmp(limit) > 0 {

-			errs = append(errs, newLimitExceededError(imageapi.LimitTypeImageStream, resource, &usage, &limit))

+func (fn LimitRangesForNamespaceFunc) LimitsForNamespace(namespace string) (kapi.ResourceList, error) {

+	items, err := fn(namespace)

+	if err != nil {

+		return nil, err

+	}

+	var res kapi.ResourceList

+	for _, limitRange := range items {

+		res = getMaxLimits(limitRange, res)

+	}

+	return res, nil

+}

+

+// getMaxLimits updates the resource list to include the max allowed image count

+// TODO: use the existing Max function for resource lists.

+func getMaxLimits(limit *kapi.LimitRange, current kapi.ResourceList) kapi.ResourceList {

+	res := current

+

+	for _, item := range limit.Spec.Limits {

+		if item.Type != imageapi.LimitTypeImageStream {

+			continue

+		}

+		for _, resource := range []kapi.ResourceName{imageapi.ResourceImageStreamImages, imageapi.ResourceImageStreamTags} {

+			if max, ok := item.Max[resource]; ok {

+				if oldMax, exists := res[resource]; !exists || oldMax.Cmp(max) > 0 {

+					if res == nil {

+						res = make(kapi.ResourceList)

+					}

+					res[resource] = max

+				}

+			}

 		}

 	}

-	return kerrutil.NewAggregate(errs)

+	return res

 }

@@ -6,8 +6,6 @@ import (

 	kapi "k8s.io/kubernetes/pkg/api"

 	"k8s.io/kubernetes/pkg/api/resource"

-	"k8s.io/kubernetes/pkg/client/cache"

-	fake "k8s.io/kubernetes/pkg/client/unversioned/testclient"

 	imagetest "github.com/openshift/origin/pkg/image/admission/testutil"

 	imageapi "github.com/openshift/origin/pkg/image/api"

@@ -214,11 +212,10 @@ func TestGetMaxLimits(t *testing.T) {

 			},

 		},

 	} {

-		lrs := make([]interface{}, len(tc.lrs))

+		var limits kapi.ResourceList

 		for i := range tc.lrs {

-			lrs[i] = &tc.lrs[i]

+			limits = getMaxLimits(&tc.lrs[i], limits)

 		}

-		limits := getMaxLimits(lrs)

 		if len(limits) != len(tc.expectedLimits) {

 			t.Errorf("[%s] got unexpected number of limits (%d != %d)", tc.name, len(limits), len(tc.expectedLimits))

 		}

@@ -390,13 +387,10 @@ func TestVerifyLimits(t *testing.T) {

 			},

 		}

-		kubeClient := fake.NewSimpleFake(limitRange)

-		indexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{"namespace": cache.MetaNamespaceIndexFunc})

-		indexer.Add(limitRange)

-

 		verifier := &limitVerifier{

-			client:  kubeClient,

-			indexer: indexer,

+			limiter: LimitRangesForNamespaceFunc(func(ns string) ([]*kapi.LimitRange, error) {

+				return []*kapi.LimitRange{limitRange}, nil

+			}),

 		}

 		err := verifier.VerifyLimits("test", &tc.is)

@@ -43,9 +43,12 @@ func NewREST(optsGetter restoptions.Getter, defaultRegistry api.DefaultRegistry,

 		ReturnDeletedObject: false,

 	}

-	strategy := imagestream.NewStrategy(defaultRegistry, subjectAccessReviewRegistry, limitVerifier)

-	rest := &REST{Store: &store, subjectAccessReviewRegistry: subjectAccessReviewRegistry}

-	strategy.ImageStreamGetter = rest

+	rest := &REST{

+		Store: &store,

+		subjectAccessReviewRegistry: subjectAccessReviewRegistry,

+	}

+	// strategy must be able to load image streams across namespaces during tag verification

+	strategy := imagestream.NewStrategy(defaultRegistry, subjectAccessReviewRegistry, limitVerifier, rest)

 	store.CreateStrategy = strategy

 	store.UpdateStrategy = strategy

@@ -55,10 +58,12 @@ func NewREST(optsGetter restoptions.Getter, defaultRegistry api.DefaultRegistry,

 		return nil, nil, nil, err

 	}

+	statusStrategy := imagestream.NewStatusStrategy(strategy)

 	statusStore := store

 	statusStore.Decorator = nil

 	statusStore.CreateStrategy = nil

-	statusStore.UpdateStrategy = imagestream.NewStatusStrategy(strategy)

+	statusStore.UpdateStrategy = statusStrategy

+	statusREST := &StatusREST{store: &statusStore}

 	internalStore := store

 	internalStrategy := imagestream.NewInternalStrategy(strategy)

@@ -66,7 +71,8 @@ func NewREST(optsGetter restoptions.Getter, defaultRegistry api.DefaultRegistry,

 	internalStore.CreateStrategy = internalStrategy

 	internalStore.UpdateStrategy = internalStrategy

-	return rest, &StatusREST{store: &statusStore}, &InternalREST{store: &internalStore}, nil

+	internalREST := &InternalREST{store: &internalStore}

+	return rest, statusREST, internalREST, nil

 }

 // StatusREST implements the REST endpoint for changing the status of an image stream.

@@ -119,68 +119,6 @@ func TestGetImageStreamOK(t *testing.T) {

 	}

 }

-// func TestListImageStreamsError(t *testing.T) {

-// 	storage, _, _, server := newStorage(t)

-// 	defer server.Terminate(t)

-

-// 	objs, err := storage.List(kapi.NewDefaultContext(), nil)

-// 	if err != nil {

-// 		t.Errorf("Expected err, got nothing")

-// 	}

-// 	got := objs.(*api.ImageStreamList)

-// 	if got == nil || len(got.Items) != 0 {

-// 		t.Errorf("Unexpected empty imageStreams list, got %#v", got)

-// 	}

-// }

-

-// func TestListImageStreamsEmptyList(t *testing.T) {

-// 	fakeEtcdClient, helper := newStorage(t)

-// 	fakeEtcdClient.ChangeIndex = 1

-// 	fakeEtcdClient.Data[etcdtest.AddPrefix("/imagestreams/default")] = tools.EtcdResponseWithError{

-// 		R: &etcd.Response{},

-// 		E: fakeEtcdClient.NewError(tools.EtcdErrorCodeNotFound),

-// 	}

-// 	storage, _, _ := NewREST(helper, noDefaultRegistry, &fakeSubjectAccessReviewRegistry{})

-

-// 	imageStreams, err := storage.List(kapi.NewDefaultContext(), labels.Everything(), fields.Everything())

-// 	if err != nil {

-// 		t.Fatalf("Unexpected non-nil error: %#v", err)

-// 	}

-// 	if len(imageStreams.(*api.ImageStreamList).Items) != 0 {

-// 		t.Errorf("Unexpected non-zero imageStreams list: %#v", imageStreams)

-// 	}

-// 	if imageStreams.(*api.ImageStreamList).ResourceVersion != "1" {

-// 		t.Errorf("Unexpected resource version: %#v", imageStreams)

-// 	}

-// }

-

-// func TestListImageStreamsPopulatedList(t *testing.T) {

-// 	fakeEtcdClient, helper := newStorage(t)

-// 	storage, _, _ := NewREST(helper, noDefaultRegistry, &fakeSubjectAccessReviewRegistry{})

-

-// 	fakeEtcdClient.Data[etcdtest.AddPrefix("/imagestreams/default")] = tools.EtcdResponseWithError{

-// 		R: &etcd.Response{

-// 			Node: &etcd.Node{

-// 				Nodes: []*etcd.Node{

-// 					{Value: runtime.EncodeOrDie(latest.Codec, &api.ImageStream{ObjectMeta: kapi.ObjectMeta{Name: "foo"}})},

-// 					{Value: runtime.EncodeOrDie(latest.Codec, &api.ImageStream{ObjectMeta: kapi.ObjectMeta{Name: "bar"}})},

-// 				},

-// 			},

-// 		},

-// 	}

-

-// 	list, err := storage.List(kapi.NewDefaultContext(), labels.Everything(), fields.Everything())

-// 	if err != nil {

-// 		t.Fatalf("Unexpected non-nil error: %#v", err)

-// 	}

-

-// 	imageStreams := list.(*api.ImageStreamList)

-

-// 	if e, a := 2, len(imageStreams.Items); e != a {

-// 		t.Errorf("Expected %v, got %v", e, a)

-// 	}

-// }

-

 type fakeUser struct {

 }

@@ -201,1021 +139,3 @@ func (u *fakeUser) GetGroups() []string {

 func (u *fakeUser) GetExtra() map[string][]string {

 	return map[string][]string{}

 }

-

-// func TestCreateImageStreamOK(t *testing.T) {

-// 	_, helper := newStorage(t)

-// 	storage, _, _ := NewREST(helper, noDefaultRegistry, &fakeSubjectAccessReviewRegistry{})

-

-// 	stream := &api.ImageStream{ObjectMeta: kapi.ObjectMeta{Name: "foo"}}

-// 	ctx := kapi.WithUser(kapi.NewDefaultContext(), &fakeUser{})

-// 	_, err := storage.Create(ctx, stream)

-// 	if err != nil {

-// 		t.Fatalf("Unexpected non-nil error: %#v", err)

-// 	}

-

-// 	actual := &api.ImageStream{}

-// 	if err := helper.Get(kapi.NewDefaultContext(), "/imagestreams/default/foo", actual, false); err != nil {

-// 		t.Fatalf("unexpected extraction error: %v", err)

-// 	}

-// 	if actual.Name != stream.Name {

-// 		t.Errorf("unexpected stream: %#v", actual)

-// 	}

-// 	if len(actual.UID) == 0 {

-// 		t.Errorf("expected stream UID to be set: %#v", actual)

-// 	}

-// 	if stream.CreationTimestamp.IsZero() {

-// 		t.Error("Unexpected zero CreationTimestamp")

-// 	}

-// 	if stream.Spec.DockerImageRepository != "" {

-// 		t.Errorf("unexpected stream: %#v", stream)

-// 	}

-// }

-

-// func TestCreateImageStreamSpecTagsFromSet(t *testing.T) {

-// 	tests := map[string]struct {

-// 		otherNamespace string

-// 		sarExpected    bool

-// 		sarAllowed     bool

-// 	}{

-// 		"same namespace (blank), no sar": {

-// 			otherNamespace: "",

-// 			sarExpected:    false,

-// 		},

-// 		"same namespace (set), no sar": {

-// 			otherNamespace: "default",

-// 			sarExpected:    false,

-// 		},

-// 		"different namespace, sar allowed": {

-// 			otherNamespace: "otherns",

-// 			sarExpected:    true,

-// 			sarAllowed:     true,

-// 		},

-// 		"different namespace, sar denied": {

-// 			otherNamespace: "otherns",

-// 			sarExpected:    true,

-// 			sarAllowed:     false,

-// 		},

-// 	}

-// 	for name, test := range tests {

-// 		fakeEtcdClient, helper := newStorage(t)

-// 		sarRegistry := &fakeSubjectAccessReviewRegistry{

-// 			allow: test.sarAllowed,

-// 		}

-// 		storage, _, _ := NewREST(helper, noDefaultRegistry, sarRegistry)

-

-// 		otherNamespace := test.otherNamespace

-// 		if len(otherNamespace) == 0 {

-// 			otherNamespace = "default"

-// 		}

-// 		fakeEtcdClient.Data[fmt.Sprintf(etcdtest.AddPrefix("/imagestreams/%s/other"), otherNamespace)] = tools.EtcdResponseWithError{

-// 			R: &etcd.Response{

-// 				Node: &etcd.Node{

-// 					Value: runtime.EncodeOrDie(latest.Codec, &api.ImageStream{

-// 						ObjectMeta: kapi.ObjectMeta{Name: "other", Namespace: otherNamespace},

-// 						Status: api.ImageStreamStatus{

-// 							Tags: map[string]api.TagEventList{

-// 								"latest": {

-// 									Items: []api.TagEvent{

-// 										{

-// 											DockerImageReference: fmt.Sprintf("%s/other:latest", otherNamespace),

-// 										},

-// 									},

-// 								},

-// 							},

-// 						},

-// 					}),

-// 					ModifiedIndex: 1,

-// 				},

-// 			},

-// 		}

-

-// 		stream := &api.ImageStream{

-// 			ObjectMeta: kapi.ObjectMeta{Name: "foo"},

-// 			Spec: api.ImageStreamSpec{

-// 				Tags: map[string]api.TagReference{

-// 					"other": {

-// 						From: &kapi.ObjectReference{

-// 							Kind:      "ImageStreamTag",

-// 							Namespace: test.otherNamespace,

-// 							Name:      "other:latest",

-// 						},

-// 					},

-// 				},

-// 			},

-// 		}

-// 		ctx := kapi.WithUser(kapi.NewDefaultContext(), &fakeUser{})

-// 		_, err := storage.Create(ctx, stream)

-// 		if test.sarExpected {

-// 			if sarRegistry.request == nil {

-// 				t.Errorf("%s: expected sar request", name)

-// 				continue

-// 			}

-// 			if e, a := test.sarAllowed, err == nil; e != a {

-// 				t.Errorf("%s: expected sarAllowed=%t, got error %t: %v", name, e, a, err)

-// 				continue

-// 			}

-

-// 			continue

-// 		}

-

-// 		// sar not expected

-// 		if err != nil {

-// 			t.Fatalf("%s: unexpected error: %v", name, err)

-// 		}

-

-// 		actual := &api.ImageStream{}

-// 		if err := helper.Get(kapi.NewDefaultContext(), "/imagestreams/default/foo", actual, false); err != nil {

-// 			t.Fatalf("%s: unexpected extraction error: %v", name, err)

-// 		}

-// 		if e, a := fmt.Sprintf("%s/other:latest", otherNamespace), actual.Status.Tags["other"].Items[0].DockerImageReference; e != a {

-// 			t.Errorf("%s: dockerImageReference: expected %q, got %q", name, e, a)

-// 		}

-// 	}

-// }

-

-// func TestCreateRegistryErrorSaving(t *testing.T) {

-// 	fakeEtcdClient, helper := newStorage(t)

-// 	fakeEtcdClient.Err = fmt.Errorf("foo")

-// 	storage, _, _ := NewREST(helper, noDefaultRegistry, &fakeSubjectAccessReviewRegistry{})

-

-// 	ctx := kapi.WithUser(kapi.NewDefaultContext(), &fakeUser{})

-// 	_, err := storage.Create(ctx, &api.ImageStream{ObjectMeta: kapi.ObjectMeta{Name: "foo"}})

-// 	if err != fakeEtcdClient.Err {

-// 		t.Fatalf("Unexpected non-nil error: %#v", err)

-// 	}

-// }

-

-// func TestUpdateImageStreamMissingID(t *testing.T) {

-// 	_, helper := newStorage(t)

-// 	storage, _, _ := NewREST(helper, noDefaultRegistry, &fakeSubjectAccessReviewRegistry{})

-

-// 	obj, created, err := storage.Update(kapi.NewDefaultContext(), &api.ImageStream{})

-// 	if obj != nil || created {

-// 		t.Fatalf("Expected nil, got %v", obj)

-// 	}

-// 	if strings.Index(err.Error(), "Name parameter required") == -1 {

-// 		t.Errorf("Expected 'Name parameter required' error, got %v", err)

-// 	}

-// }

-

-// func TestUpdateRegistryErrorSaving(t *testing.T) {

-// 	fakeEtcdClient, helper := newStorage(t)

-// 	fakeEtcdClient.Err = fmt.Errorf("foo")

-// 	storage, _, _ := NewREST(helper, noDefaultRegistry, &fakeSubjectAccessReviewRegistry{})

-

-// 	_, created, err := storage.Update(kapi.NewDefaultContext(), &api.ImageStream{ObjectMeta: kapi.ObjectMeta{Name: "bar"}})

-// 	if err != fakeEtcdClient.Err || created {

-// 		t.Fatalf("Unexpected non-nil error: %#v", err)

-// 	}

-// }

-

-// func TestUpdateImageStreamOK(t *testing.T) {

-// 	fakeEtcdClient, helper := newStorage(t)

-// 	fakeEtcdClient.Data[etcdtest.AddPrefix("/imagestreams/default/bar")] = tools.EtcdResponseWithError{

-// 		R: &etcd.Response{

-// 			Node: &etcd.Node{

-// 				Value: runtime.EncodeOrDie(latest.Codec, &api.ImageStream{

-// 					ObjectMeta: kapi.ObjectMeta{Name: "bar", Namespace: "default"},

-// 				}),

-// 				ModifiedIndex: 2,

-// 			},

-// 		},

-// 	}

-// 	storage, _, _ := NewREST(helper, noDefaultRegistry, &fakeSubjectAccessReviewRegistry{})

-

-// 	ctx := kapi.WithUser(kapi.NewDefaultContext(), &fakeUser{})

-// 	obj, created, err := storage.Update(ctx, &api.ImageStream{ObjectMeta: kapi.ObjectMeta{Name: "bar", ResourceVersion: "1"}})

-// 	if !errors.IsConflict(err) {

-// 		t.Fatalf("unexpected non-error: %v", err)

-// 	}

-// 	obj, created, err = storage.Update(ctx, &api.ImageStream{ObjectMeta: kapi.ObjectMeta{Name: "bar", ResourceVersion: "2"}})

-// 	if err != nil || created {

-// 		t.Fatalf("Unexpected non-nil error: %#v", err)

-// 	}

-// 	stream, ok := obj.(*api.ImageStream)

-// 	if !ok {

-// 		t.Errorf("Expected image stream, got %#v", obj)

-// 	}

-// 	if stream.Name != "bar" {

-// 		t.Errorf("Unexpected stream returned: %#v", stream)

-// 	}

-// }

-

-// func TestUpdateImageStreamSpecTagsFromSet(t *testing.T) {

-// 	tests := map[string]struct {

-// 		otherNamespace string

-// 		sarExpected    bool

-// 		sarAllowed     bool

-// 	}{

-// 		"same namespace (blank), no sar": {

-// 			otherNamespace: "",

-// 			sarExpected:    false,

-// 		},

-// 		"same namespace (set), no sar": {

-// 			otherNamespace: "default",

-// 			sarExpected:    false,

-// 		},

-// 		"different namespace, sar allowed": {

-// 			otherNamespace: "otherns",

-// 			sarExpected:    true,

-// 			sarAllowed:     true,

-// 		},

-// 		"different namespace, sar denied": {

-// 			otherNamespace: "otherns",

-// 			sarExpected:    true,

-// 			sarAllowed:     false,

-// 		},

-// 	}

-// 	for name, test := range tests {

-// 		fakeEtcdClient, helper := newStorage(t)

-// 		sarRegistry := &fakeSubjectAccessReviewRegistry{

-// 			allow: test.sarAllowed,

-// 		}

-// 		storage, _, _ := NewREST(helper, noDefaultRegistry, sarRegistry)

-

-// 		fakeEtcdClient.Data[etcdtest.AddPrefix("/imagestreams/default/foo")] = tools.EtcdResponseWithError{

-// 			R: &etcd.Response{

-// 				Node: &etcd.Node{

-// 					Value: runtime.EncodeOrDie(latest.Codec, &api.ImageStream{

-// 						ObjectMeta: kapi.ObjectMeta{Name: "foo", Namespace: "default"},

-// 					}),

-// 					ModifiedIndex: 1,

-// 				},

-// 			},

-// 		}

-

-// 		otherNamespace := test.otherNamespace

-// 		if len(otherNamespace) == 0 {

-// 			otherNamespace = "default"

-// 		}

-// 		fakeEtcdClient.Data[fmt.Sprintf(etcdtest.AddPrefix("/imagestreams/%s/other"), otherNamespace)] = tools.EtcdResponseWithError{

-// 			R: &etcd.Response{

-// 				Node: &etcd.Node{

-// 					Value: runtime.EncodeOrDie(latest.Codec, &api.ImageStream{

-// 						ObjectMeta: kapi.ObjectMeta{Name: "other", Namespace: otherNamespace},

-// 						Status: api.ImageStreamStatus{

-// 							Tags: map[string]api.TagEventList{

-// 								"latest": {

-// 									Items: []api.TagEvent{

-// 										{

-// 											DockerImageReference: fmt.Sprintf("%s/other:latest", otherNamespace),

-// 										},

-// 									},

-// 								},

-// 							},

-// 						},

-// 					}),

-// 					ModifiedIndex: 1,

-// 				},

-// 			},

-// 		}

-

-// 		stream := &api.ImageStream{

-// 			ObjectMeta: kapi.ObjectMeta{Name: "foo", ResourceVersion: "1"},

-// 			Spec: api.ImageStreamSpec{

-// 				Tags: map[string]api.TagReference{

-// 					"other": {

-// 						From: &kapi.ObjectReference{

-// 							Kind:      "ImageStreamTag",

-// 							Namespace: test.otherNamespace,

-// 							Name:      "other:latest",

-// 						},

-// 					},

-// 				},

-// 			},

-// 		}

-// 		ctx := kapi.WithUser(kapi.NewDefaultContext(), &fakeUser{})

-// 		_, _, err := storage.Update(ctx, stream)

-// 		if test.sarExpected {

-// 			if sarRegistry.request == nil {

-// 				t.Errorf("%s: expected sar request", name)

-// 				continue

-// 			}

-// 			if e, a := test.sarAllowed, err == nil; e != a {

-// 				t.Errorf("%s: expected sarAllowed=%t, got error %t: %v", name, e, a, err)

-// 				continue

-// 			}

-

-// 			continue

-// 		}

-

-// 		// sar not expected

-// 		if err != nil {

-// 			t.Fatalf("%s: unexpected error: %v", name, err)

-// 		}

-

-// 		actual := &api.ImageStream{}

-// 		if err := helper.Get(kapi.NewDefaultContext(), "/imagestreams/default/foo", actual, false); err != nil {

-// 			t.Fatalf("%s: unexpected extraction error: %v", name, err)

-// 		}

-// 		if e, a := fmt.Sprintf("%s/other:latest", otherNamespace), actual.Status.Tags["other"].Items[0].DockerImageReference; e != a {

-// 			t.Errorf("%s: dockerImageReference: expected %q, got %q", name, e, a)

-// 		}

-// 	}

-// }

-

-// func TestUpdateImageStreamTags(t *testing.T) {

-// 	fakeEtcdClient, helper := newStorage(t)

-// 	fakeEtcdClient.Data[etcdtest.AddPrefix("/imagestreams/default/test")] = tools.EtcdResponseWithError{

-// 		R: &etcd.Response{

-// 			Node: &etcd.Node{

-// 				Value: runtime.EncodeOrDie(latest.Codec, &api.ImageStream{

-// 					ObjectMeta: kapi.ObjectMeta{Name: "test", Namespace: "default"},

-// 					Spec: api.ImageStreamSpec{

-// 						Tags: map[string]api.TagReference{

-// 							"another": {

-// 								From: &kapi.ObjectReference{

-// 									Kind: "ImageStreamTag",

-// 									Name: "test:another",

-// 								},

-// 							},

-// 							api.DefaultImageTag: {

-// 								From: &kapi.ObjectReference{

-// 									Kind: "ImageStreamTag",

-// 									Name: "test:latest",

-// 								},

-// 							},

-// 						},

-// 					},

-// 					Status: api.ImageStreamStatus{

-// 						DockerImageRepository: "registry.default.local/default/test",

-// 						Tags: map[string]api.TagEventList{

-// 							api.DefaultImageTag: {

-// 								Items: []api.TagEvent{

-// 									{

-// 										DockerImageReference: "registry.default.local/default/test@sha256:381151ac5b7f775e8371e489f3479b84a4c004c90ceddb2ad80b6877215a892f",

-// 										Image:                "sha256:381151ac5b7f775e8371e489f3479b84a4c004c90ceddb2ad80b6877215a892f",

-// 									},

-// 								},

-// 							},

-// 						},

-// 					},

-// 				}),

-// 				ModifiedIndex: 1,