@opensoha/contracts 0.1.24 → 0.1.25

package/resource/runtime/resource_edit_test.go

@@ -0,0 +1,183 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"testing"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	k8sruntime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	dynamicfake "k8s.io/client-go/dynamic/fake"
+	clienttesting "k8s.io/client-go/testing"
+)
+
+const testEditManager = "opensoha-resource-edit/v1"
+
+func editFixture() *unstructured.Unstructured {
+	item := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "v1", "kind": "ConfigMap", "metadata": map[string]any{"name": "sample", "namespace": "demo", "uid": "original", "resourceVersion": "1"}, "data": map[string]any{"phase": "created"}}}
+	item.SetManagedFields([]metav1.ManagedFieldsEntry{{Manager: testEditManager, Operation: metav1.ManagedFieldsOperationUpdate, APIVersion: "v1", FieldsType: "FieldsV1", FieldsV1: metav1.NewFieldsV1(`{"f:data":{"f:phase":{}}}`)}})
+	return item
+}
+
+func editConflict(manager string) error {
+	return apierrors.NewApplyConflict([]metav1.StatusCause{{Type: metav1.CauseTypeFieldManagerConflict, Field: ".data.phase", Message: fmt.Sprintf("conflict with %q using v1", manager)}}, "field conflict")
+}
+
+func TestApplyResourceEditMigratesOnlyItsOwnCreationFields(t *testing.T) {
+	for _, test := range []struct {
+		name                                                     string
+		dryRun, foreign, race, retryFail, probePass, portInvalid bool
+	}{
+		{name: "write"}, {name: "dry-run", dryRun: true}, {name: "successful-ssa-preview", dryRun: true, probePass: true}, {name: "port-list-preview", dryRun: true, portInvalid: true},
+		{name: "external", foreign: true}, {name: "external-dry-run", foreign: true, dryRun: true},
+		{name: "concurrent-migration", race: true}, {name: "concurrent-retry", retryFail: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			live := editFixture()
+			if test.portInvalid {
+				live.SetKind("Service")
+			}
+			if test.foreign {
+				owners := live.GetManagedFields()
+				owners = append(owners, metav1.ManagedFieldsEntry{Manager: "helm", Operation: metav1.ManagedFieldsOperationApply, APIVersion: "v1", FieldsType: "FieldsV1", FieldsV1: metav1.NewFieldsV1(`{"f:data":{"f:external":{}}}`)})
+				live.SetManagedFields(owners)
+			}
+			desired := live.DeepCopy()
+			desired.SetManagedFields(nil)
+			desired.Object["data"] = map[string]any{"phase": "updated"}
+			client := dynamicfake.NewSimpleDynamicClient(k8sruntime.NewScheme(), live)
+			applyCalls, migrations, updates := 0, 0, 0
+			client.PrependReactor("patch", "configmaps", func(action clienttesting.Action) (bool, k8sruntime.Object, error) {
+				patch, ok := action.(clienttesting.PatchActionImpl)
+				if !ok {
+					t.Fatalf("unexpected action %T", action)
+				}
+				if patch.GetPatchType() == types.JSONPatchType {
+					migrations++
+					assertEditMigration(t, patch.GetPatch(), test.foreign)
+					if test.race {
+						return true, nil, apierrors.NewConflict(schema.GroupResource{Resource: "configmaps"}, "sample", errors.New("concurrent update"))
+					}
+					moved := live.DeepCopy()
+					moved.SetResourceVersion("2")
+					return true, moved, nil
+				}
+				applyCalls++
+				options := patch.GetPatchOptions()
+				if options.Force == nil || *options.Force || options.FieldManager != testEditManager || (len(options.DryRun) > 0) != test.dryRun {
+					t.Fatalf("unsafe apply options: %+v", options)
+				}
+				if test.probePass {
+					return true, desired, nil
+				}
+				if test.portInvalid {
+					return true, nil, apierrors.NewInvalid(schema.GroupKind{Kind: "Service"}, "sample", field.ErrorList{field.Required(field.NewPath("spec", "ports").Index(0).Child("name"), "")})
+				}
+				if test.dryRun || test.foreign {
+					manager := testEditManager
+					if test.foreign {
+						manager = "helm"
+					}
+					return true, nil, editConflict(manager)
+				}
+				if test.retryFail {
+					return true, nil, editConflict("external-controller")
+				}
+				var body unstructured.Unstructured
+				if err := json.Unmarshal(patch.GetPatch(), &body); err != nil || body.GetResourceVersion() != "2" || body.GetUID() != live.GetUID() {
+					t.Fatalf("retry lost observed identity: %s %v", patch.GetPatch(), err)
+				}
+				return true, &body, nil
+			})
+			client.PrependReactor("update", "configmaps", func(action clienttesting.Action) (bool, k8sruntime.Object, error) {
+				update, ok := action.(clienttesting.UpdateActionImpl)
+				if !ok {
+					t.Fatalf("unexpected update %T", action)
+				}
+				options := update.GetUpdateOptions()
+				if !test.dryRun || len(options.DryRun) != 1 || options.DryRun[0] != metav1.DryRunAll || options.FieldManager != testEditManager {
+					t.Fatalf("migration validation wrote live data: %+v", options)
+				}
+				updates++
+				return true, update.GetObject(), nil
+			})
+			resource := client.Resource(schema.GroupVersionResource{Version: "v1", Resource: "configmaps"}).Namespace("demo")
+			_, err := ApplyResourceEdit(context.Background(), resource, live, desired, testEditManager, test.dryRun)
+			if (err != nil) != (test.foreign || test.race || test.retryFail) {
+				t.Fatalf("result: %v", err)
+			}
+			wantMigrations, wantUpdates, wantApply := 1, 0, 1
+			if test.foreign {
+				wantMigrations, wantApply = 1, 1
+			}
+			if test.dryRun {
+				wantMigrations, wantApply = 0, 1
+				if !test.foreign && !test.probePass {
+					wantUpdates = 1
+				}
+			}
+			if test.race {
+				wantApply = 0
+			}
+			if migrations != wantMigrations || updates != wantUpdates || applyCalls != wantApply || desired.GetResourceVersion() != "1" {
+				t.Fatalf("apply=%d migrate=%d validate=%d; caller RV=%s", applyCalls, migrations, updates, desired.GetResourceVersion())
+			}
+		})
+	}
+}
+
+func assertEditMigration(t *testing.T, payload []byte, foreign bool) {
+	t.Helper()
+	var ops []struct {
+		Op, Path string
+		Value    json.RawMessage
+	}
+	if err := json.Unmarshal(payload, &ops); err != nil || len(ops) != 3 {
+		t.Fatalf("invalid migration: %s %v", payload, err)
+	}
+	if ops[0].Op != "test" || ops[0].Path != "/metadata/uid" || string(ops[0].Value) != `"original"` || ops[2].Path != "/metadata/resourceVersion" || string(ops[2].Value) != `"1"` {
+		t.Fatalf("migration lacks UID/RV protection: %s", payload)
+	}
+	var owners []metav1.ManagedFieldsEntry
+	if err := json.Unmarshal(ops[1].Value, &owners); err != nil || len(owners) < 1 || owners[0].Manager != testEditManager || owners[0].Operation != metav1.ManagedFieldsOperationApply {
+		t.Fatalf("unexpected ownership migration: %s %v", payload, err)
+	}
+	if foreign && (len(owners) != 2 || owners[1].Manager != "helm" || owners[1].Operation != metav1.ManagedFieldsOperationApply || owners[1].FieldsV1.GetRawString() != `{"f:data":{"f:external":{}}}`) {
+		t.Fatal("migration changed external ownership")
+	}
+}
+
+func TestResourceEditMigrationFailsClosed(t *testing.T) {
+	for _, missing := range []string{"uid", "resourceVersion"} {
+		live := editFixture()
+		unstructured.RemoveNestedField(live.Object, "metadata", missing)
+		if patch, err := resourceEditMigrationPatch(live, testEditManager); err != nil || patch != nil {
+			t.Fatalf("migrated without %s: %s %v", missing, patch, err)
+		}
+	}
+	for _, manager := range []string{"helm", testEditManager + "-other", testEditManager + `" using v1`} {
+		if onlyResourceEditConflicts(editFixture(), editConflict(manager), testEditManager) {
+			t.Fatalf("misidentified foreign manager %q", manager)
+		}
+	}
+	for _, entry := range []metav1.ManagedFieldsEntry{
+		{Manager: testEditManager, Operation: metav1.ManagedFieldsOperationUpdate, APIVersion: "v1beta1"},
+		{Manager: testEditManager, Operation: metav1.ManagedFieldsOperationApply, APIVersion: "v1beta1"},
+	} {
+		live := editFixture()
+		live.SetManagedFields(append(live.GetManagedFields(), entry))
+		if patch, err := resourceEditMigrationPatch(live, testEditManager); err != nil || patch != nil {
+			t.Fatalf("discarded another version's ownership: %s %v", patch, err)
+		}
+	}
+	if onlyResourceEditConflicts(editFixture(), apierrors.NewApplyConflict(nil, "unknown conflict"), testEditManager) {
+		t.Fatal("accepted incomplete conflict evidence")
+	}
+}

package/resource/runtime/resource_monitoring.go

@@ -0,0 +1,243 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"math"
+	"sort"
+	"time"
+
+	cr "github.com/opensoha/soha-contracts/resource"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/client-go/rest"
+)
+
+// ReadResourceMonitoringInventory returns bounded current aggregate facts, not Pod manifests.
+func ReadResourceMonitoringInventory(ctx context.Context, client rest.Interface, clusterID string) (cr.ResourceMonitoringInventory, error) {
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	now := time.Now().UTC().Format(time.RFC3339)
+	output := cr.ResourceMonitoringInventory{Nodes: []cr.ResourceMonitoringNode{}, Quality: "valid", ObservedAt: now}
+	var nodes corev1.NodeList
+	if err := readMonitoringList(ctx, client, "nodes", cr.ResourceMonitoringMaxNodes, 2<<20, &nodes); err != nil {
+		return output, err
+	}
+	var pods corev1.PodList
+	podErr := readMonitoringList(ctx, client, "pods", 5000, 16<<20, &pods)
+	complete := podErr == nil && pods.Continue == "" && len(pods.Items) <= 5000
+	if !complete {
+		output.Quality = "partial"
+		output.ReasonCode = "pod_snapshot_incomplete"
+		output.Truncated = pods.Continue != "" || len(pods.Items) > 5000
+	}
+	if nodes.Continue != "" || len(nodes.Items) > cr.ResourceMonitoringMaxNodes {
+		output.Quality = "partial"
+		output.ReasonCode = "node_budget"
+		output.Truncated = true
+	}
+	aggregates := monitoringPodAggregates(pods.Items)
+	if complete {
+		output.UnscheduledPendingPods = number(aggregates[""].pending)
+	}
+	for index, node := range nodes.Items {
+		if index >= cr.ResourceMonitoringMaxNodes {
+			break
+		}
+		fact := monitoringNodeFact(clusterID, node, aggregates[node.Name], complete, now)
+		output.Nodes = append(output.Nodes, fact)
+	}
+
+	sort.Slice(output.Nodes, func(i, j int) bool { return output.Nodes[i].NodeRef.Name < output.Nodes[j].NodeRef.Name })
+	return output, nil
+}
+
+func readMonitoringList(ctx context.Context, client rest.Interface, resource string, limit, maxBytes int, target any) error {
+	if client == nil {
+		return fmt.Errorf("kubernetes REST client unavailable")
+	}
+	stream, err := client.Get().AbsPath("/api/v1/"+resource).Param("limit", fmt.Sprint(limit)).SetHeader("Accept", "application/json").Stream(ctx)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = stream.Close() }()
+	raw, err := io.ReadAll(io.LimitReader(stream, int64(maxBytes)+1))
+	if err != nil {
+		return err
+	}
+	if len(raw) > maxBytes {
+		return fmt.Errorf("monitoring inventory byte budget")
+	}
+	return json.Unmarshal(raw, target)
+}
+
+type monitoringPodAggregate struct {
+	cpuRequest, memoryRequest, cpuLimit, memoryLimit, count, pending float64
+	cpuComplete, memoryComplete                                      bool
+	initialized                                                      bool
+}
+
+func monitoringPodAggregates(pods []corev1.Pod) map[string]monitoringPodAggregate {
+	result := map[string]monitoringPodAggregate{}
+	for _, pod := range pods {
+		if monitoringTerminalPod(pod) {
+			continue
+		}
+		aggregate := result[pod.Spec.NodeName]
+		if !aggregate.initialized {
+			aggregate.cpuComplete = true
+			aggregate.memoryComplete = true
+			aggregate.initialized = true
+		}
+		aggregate.count++
+		if pod.Status.Phase == corev1.PodPending {
+			aggregate.pending++
+		}
+		requests, limits, cpuComplete, memoryComplete := effectiveMonitoringPodResources(pod)
+		aggregate.cpuRequest += requests.cpu
+		aggregate.memoryRequest += requests.memory
+		aggregate.cpuLimit += limits.cpu
+		aggregate.memoryLimit += limits.memory
+		aggregate.cpuComplete = aggregate.cpuComplete && cpuComplete
+		aggregate.memoryComplete = aggregate.memoryComplete && memoryComplete
+		result[pod.Spec.NodeName] = aggregate
+	}
+	return result
+}
+func monitoringTerminalPod(pod corev1.Pod) bool {
+	return pod.Status.Phase == corev1.PodSucceeded || pod.Status.Phase == corev1.PodFailed
+}
+
+type monitoringResources struct{ cpu, memory float64 }
+
+func monitoringResourcesFromList(values corev1.ResourceList) monitoringResources {
+	cpu := values[corev1.ResourceCPU]
+	memory := values[corev1.ResourceMemory]
+	return monitoringResources{cpu: float64(cpu.MilliValue()) / 1000, memory: float64(memory.Value())}
+}
+func (r monitoringResources) add(other monitoringResources) monitoringResources {
+	return monitoringResources{cpu: r.cpu + other.cpu, memory: r.memory + other.memory}
+}
+func (r monitoringResources) max(other monitoringResources) monitoringResources {
+	return monitoringResources{cpu: math.Max(r.cpu, other.cpu), memory: math.Max(r.memory, other.memory)}
+}
+
+func effectiveMonitoringPodResources(pod corev1.Pod) (monitoringResources, monitoringResources, bool, bool) {
+	var regularRequest, regularLimit, sidecarRequest, sidecarLimit, initRequest, initLimit monitoringResources
+	cpuComplete, memoryComplete := true, true
+	addCoverage := func(container corev1.Container) {
+		cpuValue, cpu := container.Resources.Limits[corev1.ResourceCPU]
+		memoryValue, memory := container.Resources.Limits[corev1.ResourceMemory]
+		cpu = cpu && !cpuValue.IsZero()
+		memory = memory && !memoryValue.IsZero()
+		cpuComplete = cpuComplete && cpu
+		memoryComplete = memoryComplete && memory
+	}
+	for _, container := range pod.Spec.Containers {
+		regularRequest = regularRequest.add(monitoringResourcesFromList(container.Resources.Requests))
+		regularLimit = regularLimit.add(monitoringResourcesFromList(container.Resources.Limits))
+		addCoverage(container)
+	}
+	for _, container := range pod.Spec.InitContainers {
+		requests := monitoringResourcesFromList(container.Resources.Requests)
+		limits := monitoringResourcesFromList(container.Resources.Limits)
+		addCoverage(container)
+		if container.RestartPolicy != nil && *container.RestartPolicy == corev1.ContainerRestartPolicyAlways {
+			sidecarRequest = sidecarRequest.add(requests)
+			sidecarLimit = sidecarLimit.add(limits)
+			requests = sidecarRequest
+			limits = sidecarLimit
+		} else {
+			requests = requests.add(sidecarRequest)
+			limits = limits.add(sidecarLimit)
+		}
+		initRequest = initRequest.max(requests)
+		initLimit = initLimit.max(limits)
+	}
+	requests := regularRequest.add(sidecarRequest).max(initRequest)
+	limits := regularLimit.add(sidecarLimit).max(initLimit)
+	if pod.Spec.Resources != nil {
+		requests = monitoringPodLevelOverride(requests, pod.Spec.Resources.Requests)
+		limits = monitoringPodLevelOverride(limits, pod.Spec.Resources.Limits)
+		if value, ok := pod.Spec.Resources.Limits[corev1.ResourceCPU]; ok {
+			cpuComplete = !value.IsZero()
+		}
+		if value, ok := pod.Spec.Resources.Limits[corev1.ResourceMemory]; ok {
+			memoryComplete = !value.IsZero()
+		}
+	}
+	overhead := monitoringResourcesFromList(pod.Spec.Overhead)
+	requests = requests.add(overhead)
+	if limits.cpu > 0 {
+		limits.cpu += overhead.cpu
+	}
+	if limits.memory > 0 {
+		limits.memory += overhead.memory
+	}
+	return requests, limits, cpuComplete, memoryComplete
+}
+func monitoringPodLevelOverride(current monitoringResources, values corev1.ResourceList) monitoringResources {
+	if value, ok := values[corev1.ResourceCPU]; ok {
+		current.cpu = float64(value.MilliValue()) / 1000
+	}
+	if value, ok := values[corev1.ResourceMemory]; ok {
+		current.memory = float64(value.Value())
+	}
+	return current
+}
+func monitoringQuantity(values corev1.ResourceList) cr.ResourceMonitoringQuantity {
+	result := cr.ResourceMonitoringQuantity{}
+	if cpu, ok := values[corev1.ResourceCPU]; ok {
+		result.CPUCores = number(float64(cpu.MilliValue()) / 1000)
+	}
+	if memory, ok := values[corev1.ResourceMemory]; ok {
+		result.MemoryBytes = number(float64(memory.Value()))
+	}
+	if pods, ok := values[corev1.ResourcePods]; ok {
+		result.PodSlots = number(float64(pods.Value()))
+	}
+	return result
+}
+func monitoringNodeFact(clusterID string, node corev1.Node, aggregate monitoringPodAggregate, complete bool, now string) cr.ResourceMonitoringNode {
+	fact := cr.ResourceMonitoringNode{NodeRef: cr.ResourceRef{ClusterID: clusterID, APIVersion: "v1", Kind: "Node", Name: node.Name, ScopeMode: cr.ResourceScopeModeCluster, UID: string(node.UID), ResourceVersion: node.ResourceVersion}, OS: node.Status.NodeInfo.OperatingSystem, CreatedAt: node.CreationTimestamp.UTC().Format(time.RFC3339), Ready: "Unknown", MemoryPressure: "Unknown", DiskPressure: "Unknown", PIDPressure: "Unknown", Cordoned: node.Spec.Unschedulable, Capacity: monitoringQuantity(node.Status.Capacity), Allocatable: monitoringQuantity(node.Status.Allocatable), Quality: "valid", ObservedAt: now}
+	for _, address := range node.Status.Addresses {
+		if address.Type == corev1.NodeInternalIP {
+			fact.InternalIP = address.Address
+			break
+		}
+	}
+	for _, condition := range node.Status.Conditions {
+		switch condition.Type {
+		case corev1.NodeReady:
+			fact.Ready = string(condition.Status)
+		case corev1.NodeMemoryPressure:
+			fact.MemoryPressure = string(condition.Status)
+		case corev1.NodeDiskPressure:
+			fact.DiskPressure = string(condition.Status)
+		case corev1.NodePIDPressure:
+			fact.PIDPressure = string(condition.Status)
+		}
+	}
+	if !complete {
+		fact.Quality = "partial"
+		return fact
+	}
+	fact.Requests = cr.ResourceMonitoringQuantity{CPUCores: number(aggregate.cpuRequest), MemoryBytes: number(aggregate.memoryRequest)}
+	fact.CPULimitsComplete = !aggregate.initialized || aggregate.cpuComplete
+	fact.MemoryLimitsComplete = !aggregate.initialized || aggregate.memoryComplete
+	if fact.CPULimitsComplete {
+		fact.Limits.CPUCores = number(aggregate.cpuLimit)
+	}
+	if fact.MemoryLimitsComplete {
+		fact.Limits.MemoryBytes = number(aggregate.memoryLimit)
+	}
+	fact.BoundPods = number(aggregate.count)
+	fact.PendingPods = number(aggregate.pending)
+	if fact.Allocatable.PodSlots != nil {
+		fact.RemainingPodSlots = number(math.Max(0, *fact.Allocatable.PodSlots-aggregate.count))
+		fact.OverflowPodSlots = number(math.Max(0, aggregate.count-*fact.Allocatable.PodSlots))
+	}
+	return fact
+}
+func number(value float64) *float64 { return &value }

package/resource/runtime/resource_monitoring_test.go

@@ -0,0 +1,88 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+func monitoringResourceList(cpu, memory string) corev1.ResourceList {
+	return corev1.ResourceList{corev1.ResourceCPU: resource.MustParse(cpu), corev1.ResourceMemory: resource.MustParse(memory)}
+}
+func TestMonitoringFootprintHandlesSidecarsInitAndOverhead(t *testing.T) {
+	always := corev1.ContainerRestartPolicyAlways
+	container := func(name, cpu string) corev1.Container {
+		return corev1.Container{Name: name, Resources: corev1.ResourceRequirements{Requests: monitoringResourceList(cpu, "1Mi"), Limits: monitoringResourceList(cpu, "1Mi")}}
+	}
+	sidecar := container("sidecar", "1")
+	sidecar.RestartPolicy = &always
+	pod := corev1.Pod{Spec: corev1.PodSpec{Containers: []corev1.Container{container("app", "2")}, InitContainers: []corev1.Container{sidecar, container("init", "4")}, Overhead: monitoringResourceList("100m", "1Mi")}}
+	requests, limits, cpuComplete, memoryComplete := effectiveMonitoringPodResources(pod)
+	if requests.cpu != 5.1 || limits.cpu != 5.1 || !cpuComplete || !memoryComplete {
+		t.Fatalf("effective footprint requests=%+v limits=%+v complete=%v/%v", requests, limits, cpuComplete, memoryComplete)
+	}
+	pod.Spec.Containers[0].Resources.Limits = monitoringResourceList("0", "0")
+	_, _, cpuComplete, memoryComplete = effectiveMonitoringPodResources(pod)
+	if cpuComplete || memoryComplete {
+		t.Fatal("zero limits treated as an explicit finite limit")
+	}
+	pod.Spec.Resources = &corev1.ResourceRequirements{Limits: monitoringResourceList("0", "0")}
+	_, _, cpuComplete, memoryComplete = effectiveMonitoringPodResources(pod)
+	if cpuComplete || memoryComplete {
+		t.Fatal("Pod-level zero limits treated as complete finite limits")
+	}
+}
+func TestMonitoringInventoryCountsOnlyBoundNonterminalPods(t *testing.T) {
+	nodes := corev1.NodeList{Items: []corev1.Node{{ObjectMeta: metav1.ObjectMeta{Name: "node", UID: types.UID("node-uid")}, Status: corev1.NodeStatus{Capacity: monitoringResourceList("4", "8Gi"), Allocatable: corev1.ResourceList{corev1.ResourcePods: resource.MustParse("1")}}}}}
+	deleting := metav1.Now()
+	pods := corev1.PodList{Items: []corev1.Pod{
+		{ObjectMeta: metav1.ObjectMeta{DeletionTimestamp: &deleting}, Spec: corev1.PodSpec{NodeName: "node"}, Status: corev1.PodStatus{Phase: corev1.PodRunning}},
+		{Spec: corev1.PodSpec{NodeName: "node"}, Status: corev1.PodStatus{Phase: corev1.PodPending}},
+		{Spec: corev1.PodSpec{NodeName: "node"}, Status: corev1.PodStatus{Phase: corev1.PodSucceeded}},
+		{Spec: corev1.PodSpec{NodeName: "node"}, Status: corev1.PodStatus{Phase: corev1.PodFailed}},
+		{Status: corev1.PodStatus{Phase: corev1.PodPending}},
+	}}
+	forbidden := false
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/v1/nodes":
+			_ = json.NewEncoder(w).Encode(nodes)
+		case "/api/v1/pods":
+			if forbidden {
+				http.Error(w, "Forbidden", http.StatusForbidden)
+				return
+			}
+			_ = json.NewEncoder(w).Encode(pods)
+		default:
+			t.Errorf("unexpected path %s", r.URL.Path)
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	client, _ := kubernetes.NewForConfig(&rest.Config{Host: server.URL})
+	inventory, err := ReadResourceMonitoringInventory(context.Background(), client.CoreV1().RESTClient(), "c")
+	if err != nil {
+		t.Fatal(err)
+	}
+	fact := inventory.Nodes[0]
+	if fact.BoundPods == nil || *fact.BoundPods != 2 || *fact.PendingPods != 1 || *fact.RemainingPodSlots != 0 || *fact.OverflowPodSlots != 1 || *inventory.UnscheduledPendingPods != 1 {
+		t.Fatalf("wrong capacity: %+v", fact)
+	}
+	forbidden = true
+	inventory, err = ReadResourceMonitoringInventory(context.Background(), client.CoreV1().RESTClient(), "c")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if inventory.Quality != "partial" || inventory.Nodes[0].BoundPods != nil || inventory.Nodes[0].Requests.CPUCores != nil {
+		t.Fatalf("partial Pod read invented zero capacity facts: %+v", inventory)
+	}
+}