Add generated file

This PR adds generated files under pkg/client and vendor folder.

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/BUILD

@@ -0,0 +1,149 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "gce.go",
+        "gce_address_manager.go",
+        "gce_addresses.go",
+        "gce_alpha.go",
+        "gce_annotations.go",
+        "gce_backendservice.go",
+        "gce_cert.go",
+        "gce_clusterid.go",
+        "gce_clusters.go",
+        "gce_disks.go",
+        "gce_firewall.go",
+        "gce_forwardingrule.go",
+        "gce_healthchecks.go",
+        "gce_instancegroup.go",
+        "gce_instances.go",
+        "gce_interfaces.go",
+        "gce_loadbalancer.go",
+        "gce_loadbalancer_external.go",
+        "gce_loadbalancer_internal.go",
+        "gce_loadbalancer_naming.go",
+        "gce_networkendpointgroup.go",
+        "gce_routes.go",
+        "gce_securitypolicy.go",
+        "gce_targetpool.go",
+        "gce_targetproxy.go",
+        "gce_tpu.go",
+        "gce_urlmap.go",
+        "gce_util.go",
+        "gce_zones.go",
+        "metrics.go",
+        "support.go",
+        "token_source.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/cloudprovider/providers/gce",
+    deps = [
+        "//pkg/api/v1/service:go_default_library",
+        "//pkg/cloudprovider:go_default_library",
+        "//pkg/cloudprovider/providers/gce/cloud:go_default_library",
+        "//pkg/cloudprovider/providers/gce/cloud/filter:go_default_library",
+        "//pkg/cloudprovider/providers/gce/cloud/meta:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/features:go_default_library",
+        "//pkg/kubelet/apis:go_default_library",
+        "//pkg/master/ports:go_default_library",
+        "//pkg/util/net/sets:go_default_library",
+        "//pkg/util/version:go_default_library",
+        "//pkg/version:go_default_library",
+        "//pkg/volume:go_default_library",
+        "//pkg/volume/util:go_default_library",
+        "//vendor/cloud.google.com/go/compute/metadata:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/github.com/prometheus/client_golang/prometheus:go_default_library",
+        "//vendor/golang.org/x/oauth2:go_default_library",
+        "//vendor/golang.org/x/oauth2/google:go_default_library",
+        "//vendor/google.golang.org/api/compute/v0.alpha:go_default_library",
+        "//vendor/google.golang.org/api/compute/v0.beta:go_default_library",
+        "//vendor/google.golang.org/api/compute/v1:go_default_library",
+        "//vendor/google.golang.org/api/container/v1:go_default_library",
+        "//vendor/google.golang.org/api/googleapi:go_default_library",
+        "//vendor/google.golang.org/api/tpu/v1:go_default_library",
+        "//vendor/gopkg.in/gcfg.v1:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/fields:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/watch:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/util/feature:go_default_library",
+        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes/scheme:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes/typed/core/v1:go_default_library",
+        "//vendor/k8s.io/client-go/tools/cache:go_default_library",
+        "//vendor/k8s.io/client-go/tools/record:go_default_library",
+        "//vendor/k8s.io/client-go/util/flowcontrol:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "gce_address_manager_test.go",
+        "gce_annotations_test.go",
+        "gce_disks_test.go",
+        "gce_healthchecks_test.go",
+        "gce_loadbalancer_external_test.go",
+        "gce_loadbalancer_internal_test.go",
+        "gce_loadbalancer_test.go",
+        "gce_loadbalancer_utils_test.go",
+        "gce_test.go",
+        "gce_util_test.go",
+        "metrics_test.go",
+    ],
+    embed = [":go_default_library"],
+    deps = [
+        "//pkg/api/v1/service:go_default_library",
+        "//pkg/cloudprovider:go_default_library",
+        "//pkg/cloudprovider/providers/gce/cloud:go_default_library",
+        "//pkg/cloudprovider/providers/gce/cloud/meta:go_default_library",
+        "//pkg/cloudprovider/providers/gce/cloud/mock:go_default_library",
+        "//pkg/kubelet/apis:go_default_library",
+        "//pkg/util/net/sets:go_default_library",
+        "//vendor/github.com/stretchr/testify/assert:go_default_library",
+        "//vendor/github.com/stretchr/testify/require:go_default_library",
+        "//vendor/golang.org/x/oauth2/google:go_default_library",
+        "//vendor/google.golang.org/api/compute/v0.alpha:go_default_library",
+        "//vendor/google.golang.org/api/compute/v0.beta:go_default_library",
+        "//vendor/google.golang.org/api/compute/v1:go_default_library",
+        "//vendor/google.golang.org/api/googleapi:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
+        "//vendor/k8s.io/client-go/tools/cache:go_default_library",
+        "//vendor/k8s.io/client-go/tools/record:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//pkg/cloudprovider/providers/gce/cloud:all-srcs",
+    ],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/OWNERS

@@ -0,0 +1,8 @@
+approvers:
+- saad-ali
+- jingxu97
+- bowei
+- freehan
+- nicksardo
+- mrhohn
+- dnardo

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/BUILD

@@ -0,0 +1,68 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "constants.go",
+        "context.go",
+        "doc.go",
+        "errors.go",
+        "gce_projects.go",
+        "gen.go",
+        "op.go",
+        "project.go",
+        "ratelimit.go",
+        "service.go",
+        "utils.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/cloudprovider/providers/gce/cloud/filter:go_default_library",
+        "//pkg/cloudprovider/providers/gce/cloud/meta:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/google.golang.org/api/compute/v0.alpha:go_default_library",
+        "//vendor/google.golang.org/api/compute/v0.beta:go_default_library",
+        "//vendor/google.golang.org/api/compute/v1:go_default_library",
+        "//vendor/google.golang.org/api/googleapi:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "gen_test.go",
+        "mock_test.go",
+        "ratelimit_test.go",
+        "service_test.go",
+        "utils_test.go",
+    ],
+    embed = [":go_default_library"],
+    deps = [
+        "//pkg/cloudprovider/providers/gce/cloud/filter:go_default_library",
+        "//pkg/cloudprovider/providers/gce/cloud/meta:go_default_library",
+        "//vendor/google.golang.org/api/compute/v0.alpha:go_default_library",
+        "//vendor/google.golang.org/api/compute/v0.beta:go_default_library",
+        "//vendor/google.golang.org/api/compute/v1:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//pkg/cloudprovider/providers/gce/cloud/filter:all-srcs",
+        "//pkg/cloudprovider/providers/gce/cloud/gen:all-srcs",
+        "//pkg/cloudprovider/providers/gce/cloud/meta:all-srcs",
+        "//pkg/cloudprovider/providers/gce/cloud/mock:all-srcs",
+    ],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/constants.go

@@ -0,0 +1,55 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"strings"
+)
+
+// NetworkTier represents the Network Service Tier used by a resource
+type NetworkTier string
+
+// LbScheme represents the possible types of load balancers
+type LbScheme string
+
+const (
+	NetworkTierStandard NetworkTier = "Standard"
+	NetworkTierPremium  NetworkTier = "Premium"
+	NetworkTierDefault  NetworkTier = NetworkTierPremium
+
+	SchemeExternal LbScheme = "EXTERNAL"
+	SchemeInternal LbScheme = "INTERNAL"
+)
+
+// ToGCEValue converts NetworkTier to a string that we can populate the
+// NetworkTier field of GCE objects, including ForwardingRules and Addresses.
+func (n NetworkTier) ToGCEValue() string {
+	return strings.ToUpper(string(n))
+}
+
+// NetworkTierGCEValueToType converts the value of the NetworkTier field of a
+// GCE object to the NetworkTier type.
+func NetworkTierGCEValueToType(s string) NetworkTier {
+	switch s {
+	case NetworkTierStandard.ToGCEValue():
+		return NetworkTierStandard
+	case NetworkTierPremium.ToGCEValue():
+		return NetworkTierPremium
+	default:
+		return NetworkTier(s)
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/context.go

@@ -0,0 +1,31 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"context"
+	"time"
+)
+
+const (
+	defaultCallTimeout = 1 * time.Hour
+)
+
+// ContextWithCallTimeout returns a context with a default timeout, used for generated client calls.
+func ContextWithCallTimeout() (context.Context, context.CancelFunc) {
+	return context.WithTimeout(context.Background(), defaultCallTimeout)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/doc.go

@@ -0,0 +1,117 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package cloud implements a more golang friendly interface to the GCE compute
+// API. The code in this package is generated automatically via the generator
+// implemented in "gen/main.go".  The code generator creates the basic CRUD
+// actions for the given resource: "Insert", "Get", "List" and "Delete".
+// Additional methods by customizing the ServiceInfo object (see below).
+// Generated code includes a full mock of the GCE compute API.
+//
+// Usage
+//
+// The root of the GCE compute API is the interface "Cloud". Code written using
+// Cloud can be used against the actual implementation "GCE" or "MockGCE".
+//
+//  func foo(cloud Cloud) {
+//    igs, err := cloud.InstanceGroups().List(ctx, "us-central1-b", filter.None)
+//    ...
+//  }
+//  // Run foo against the actual cloud.
+//  foo(NewGCE(&Service{...}))
+//  // Run foo with a mock.
+//  foo(NewMockGCE())
+//
+// Rate limiting and routing
+//
+// The generated code allows for custom policies for operation rate limiting
+// and GCE project routing. See RateLimiter and ProjectRouter for more details.
+//
+// Mocks
+//
+// Mocks are automatically generated for each type implementing basic logic for
+// resource manipulation.  This eliminates the boilerplate required to mock GCE
+// functionality.  Each method will also have a corresponding "xxxHook"
+// function generated in the mock structure where unit test code can hook the
+// execution of the method.
+//
+// Mocks for different versions of the same service will share the same set of
+// objects, i.e. an alpha object will be visible with beta and GA methods.
+// Note that translation is done with JSON serialization between the API versions.
+//
+// Changing service code generation
+//
+// The list of services to generate is contained in "meta/meta.go". To add a
+// service, add an entry to the list "meta.AllServices". An example entry:
+//
+//  &ServiceInfo{
+//    Object:      "InstanceGroup",   // Name of the object type.
+//    Service:     "InstanceGroups",  // Name of the service.
+//    Resource:    "instanceGroups",  // Lowercase resource name (as appears in the URL).
+//    version:     meta.VersionAlpha, // API version (one entry per version is needed).
+//    keyType:     Zonal,             // What kind of resource this is.
+//    serviceType: reflect.TypeOf(&alpha.InstanceGroupsService{}), // Associated golang type.
+//    additionalMethods: []string{    // Additional methods to generate code for.
+//      "SetNamedPorts",
+//    },
+//    options: <options>              // Or'd ("|") together.
+//  }
+//
+// Read-only objects
+//
+// Services such as Regions and Zones do not allow for mutations. Specify
+// "ReadOnly" in ServiceInfo.options to omit the mutation methods.
+//
+// Adding custom methods
+//
+// Some methods that may not be properly handled by the generated code. To enable
+// addition of custom code to the generated mocks, set the "CustomOps" option
+// in "meta.ServiceInfo" entry. This will make the generated service interface
+// embed a "<ServiceName>Ops" interface. This interface MUST be written by hand
+// and contain the custom method logic. Corresponding methods must be added to
+// the corresponding Mockxxx and GCExxx struct types.
+//
+//  // In "meta/meta.go":
+//  &ServiceInfo{
+//    Object: "InstanceGroup",
+//    ...
+//    options: CustomOps,
+//  }
+//
+//  // In the generated code "gen.go":
+//  type InstanceGroups interface {
+//    InstanceGroupsOps // Added by CustomOps option.
+//    ...
+//  }
+//
+//  // In hand written file:
+//  type InstanceGroupsOps interface {
+//    MyMethod()
+//  }
+//
+//  func (mock *MockInstanceGroups) MyMethod() {
+//    // Custom mock implementation.
+//  }
+//
+//  func (gce *GCEInstanceGroups) MyMethod() {
+//    // Custom implementation.
+//  }
+//
+// Update generated codes
+//
+// Run hack/update-cloudprovider-gce.sh to update the generated codes.
+//
+package cloud

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/errors.go

@@ -0,0 +1,48 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import "fmt"
+
+// OperationPollingError occurs when the GCE Operation cannot be retrieved for a prolonged period.
+type OperationPollingError struct {
+	LastPollError error
+}
+
+// Error returns a string representation including the last poll error encountered.
+func (e *OperationPollingError) Error() string {
+	return fmt.Sprintf("GCE operation polling error: %v", e.LastPollError)
+}
+
+// GCEOperationError occurs when the GCE Operation finishes with an error.
+type GCEOperationError struct {
+	// HTTPStatusCode is the HTTP status code of the final error.
+	// For example, a failed operation may have 400 - BadRequest.
+	HTTPStatusCode int
+	// Code is GCE's code of what went wrong.
+	// For example, RESOURCE_IN_USE_BY_ANOTHER_RESOURCE
+	Code string
+	// Message is a human readable message.
+	// For example, "The network resource 'xxx' is already being used by 'xxx'"
+	Message string
+}
+
+// Error returns a string representation including the HTTP Status code, GCE's error code
+// and a human readable message.
+func (e *GCEOperationError) Error() string {
+	return fmt.Sprintf("GCE %v - %v: %v", e.HTTPStatusCode, e.Code, e.Message)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter/BUILD

@@ -0,0 +1,29 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["filter.go"],
+    importpath = "k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter",
+    visibility = ["//visibility:public"],
+    deps = ["//vendor/github.com/golang/glog:go_default_library"],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["filter_test.go"],
+    embed = [":go_default_library"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter/filter.go

@@ -0,0 +1,303 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package filter encapsulates the filter argument to compute API calls.
+//
+//  // List all global addresses (no filter).
+//  c.GlobalAddresses().List(ctx, filter.None)
+//
+//  // List global addresses filtering for name matching "abc.*".
+//  c.GlobalAddresses().List(ctx, filter.Regexp("name", "abc.*"))
+//
+//  // List on multiple conditions.
+//  f := filter.Regexp("name", "homer.*").AndNotRegexp("name", "homers")
+//  c.GlobalAddresses().List(ctx, f)
+package filter
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"regexp"
+	"strings"
+
+	"github.com/golang/glog"
+)
+
+var (
+	// None indicates that the List result set should not be filter (i.e.
+	// return all values).
+	None *F
+)
+
+// Regexp returns a filter for fieldName matches regexp v.
+func Regexp(fieldName, v string) *F {
+	return (&F{}).AndRegexp(fieldName, v)
+}
+
+// NotRegexp returns a filter for fieldName not matches regexp v.
+func NotRegexp(fieldName, v string) *F {
+	return (&F{}).AndNotRegexp(fieldName, v)
+}
+
+// EqualInt returns a filter for fieldName ~ v.
+func EqualInt(fieldName string, v int) *F {
+	return (&F{}).AndEqualInt(fieldName, v)
+}
+
+// NotEqualInt returns a filter for fieldName != v.
+func NotEqualInt(fieldName string, v int) *F {
+	return (&F{}).AndNotEqualInt(fieldName, v)
+}
+
+// EqualBool returns a filter for fieldName == v.
+func EqualBool(fieldName string, v bool) *F {
+	return (&F{}).AndEqualBool(fieldName, v)
+}
+
+// NotEqualBool returns a filter for fieldName != v.
+func NotEqualBool(fieldName string, v bool) *F {
+	return (&F{}).AndNotEqualBool(fieldName, v)
+}
+
+// F is a filter to be used with List() operations.
+//
+// From the compute API description:
+//
+// Sets a filter {expression} for filtering listed resources. Your {expression}
+// must be in the format: field_name comparison_string literal_string.
+//
+// The field_name is the name of the field you want to compare. Only atomic field
+// types are supported (string, number, boolean). The comparison_string must be
+// either eq (equals) or ne (not equals). The literal_string is the string value
+// to filter to. The literal value must be valid for the type of field you are
+// filtering by (string, number, boolean). For string fields, the literal value is
+// interpreted as a regular expression using RE2 syntax. The literal value must
+// match the entire field.
+//
+// For example, to filter for instances that do not have a name of
+// example-instance, you would use name ne example-instance.
+//
+// You can filter on nested fields. For example, you could filter on instances
+// that have set the scheduling.automaticRestart field to true. Use filtering on
+// nested fields to take advantage of labels to organize and search for results
+// based on label values.
+//
+// To filter on multiple expressions, provide each separate expression within
+// parentheses. For example, (scheduling.automaticRestart eq true)
+// (zone eq us-central1-f). Multiple expressions are treated as AND expressions,
+// meaning that resources must match all expressions to pass the filters.
+type F struct {
+	predicates []filterPredicate
+}
+
+// And joins two filters together.
+func (fl *F) And(rest *F) *F {
+	fl.predicates = append(fl.predicates, rest.predicates...)
+	return fl
+}
+
+// AndRegexp adds a field match string predicate.
+func (fl *F) AndRegexp(fieldName, v string) *F {
+	fl.predicates = append(fl.predicates, filterPredicate{fieldName: fieldName, op: equals, s: &v})
+	return fl
+}
+
+// AndNotRegexp adds a field not match string predicate.
+func (fl *F) AndNotRegexp(fieldName, v string) *F {
+	fl.predicates = append(fl.predicates, filterPredicate{fieldName: fieldName, op: notEquals, s: &v})
+	return fl
+}
+
+// AndEqualInt adds a field == int predicate.
+func (fl *F) AndEqualInt(fieldName string, v int) *F {
+	fl.predicates = append(fl.predicates, filterPredicate{fieldName: fieldName, op: equals, i: &v})
+	return fl
+}
+
+// AndNotEqualInt adds a field != int predicate.
+func (fl *F) AndNotEqualInt(fieldName string, v int) *F {
+	fl.predicates = append(fl.predicates, filterPredicate{fieldName: fieldName, op: notEquals, i: &v})
+	return fl
+}
+
+// AndEqualBool adds a field == bool predicate.
+func (fl *F) AndEqualBool(fieldName string, v bool) *F {
+	fl.predicates = append(fl.predicates, filterPredicate{fieldName: fieldName, op: equals, b: &v})
+	return fl
+}
+
+// AndNotEqualBool adds a field != bool predicate.
+func (fl *F) AndNotEqualBool(fieldName string, v bool) *F {
+	fl.predicates = append(fl.predicates, filterPredicate{fieldName: fieldName, op: notEquals, b: &v})
+	return fl
+}
+
+func (fl *F) String() string {
+	if len(fl.predicates) == 1 {
+		return fl.predicates[0].String()
+	}
+
+	var pl []string
+	for _, p := range fl.predicates {
+		pl = append(pl, "("+p.String()+")")
+	}
+	return strings.Join(pl, " ")
+}
+
+// Match returns true if the F as specifies matches the given object. This
+// is used by the Mock implementations to perform filtering and SHOULD NOT be
+// used in production code as it is not well-tested to be equivalent to the
+// actual compute API.
+func (fl *F) Match(obj interface{}) bool {
+	if fl == nil {
+		return true
+	}
+	for _, p := range fl.predicates {
+		if !p.match(obj) {
+			return false
+		}
+	}
+	return true
+}
+
+type filterOp int
+
+const (
+	equals    filterOp = iota
+	notEquals filterOp = iota
+)
+
+// filterPredicate is an individual predicate for a fieldName and value.
+type filterPredicate struct {
+	fieldName string
+
+	op filterOp
+	s  *string
+	i  *int
+	b  *bool
+}
+
+func (fp *filterPredicate) String() string {
+	var op string
+	switch fp.op {
+	case equals:
+		op = "eq"
+	case notEquals:
+		op = "ne"
+	default:
+		op = "invalidOp"
+	}
+
+	var value string
+	switch {
+	case fp.s != nil:
+		// There does not seem to be any sort of escaping as specified in the
+		// document. This means it's possible to create malformed expressions.
+		value = *fp.s
+	case fp.i != nil:
+		value = fmt.Sprintf("%d", *fp.i)
+	case fp.b != nil:
+		value = fmt.Sprintf("%t", *fp.b)
+	default:
+		value = "invalidValue"
+	}
+
+	return fmt.Sprintf("%s %s %s", fp.fieldName, op, value)
+}
+
+func (fp *filterPredicate) match(o interface{}) bool {
+	v, err := extractValue(fp.fieldName, o)
+	glog.V(6).Infof("extractValue(%q, %#v) = %v, %v", fp.fieldName, o, v, err)
+	if err != nil {
+		return false
+	}
+
+	var match bool
+	switch x := v.(type) {
+	case string:
+		if fp.s == nil {
+			return false
+		}
+		re, err := regexp.Compile(*fp.s)
+		if err != nil {
+			glog.Errorf("Match regexp %q is invalid: %v", *fp.s, err)
+			return false
+		}
+		match = re.Match([]byte(x))
+	case int:
+		if fp.i == nil {
+			return false
+		}
+		match = x == *fp.i
+	case bool:
+		if fp.b == nil {
+			return false
+		}
+		match = x == *fp.b
+	}
+
+	switch fp.op {
+	case equals:
+		return match
+	case notEquals:
+		return !match
+	}
+
+	return false
+}
+
+// snakeToCamelCase converts from "names_like_this" to "NamesLikeThis" to
+// interoperate between proto and Golang naming conventions.
+func snakeToCamelCase(s string) string {
+	parts := strings.Split(s, "_")
+	var ret string
+	for _, x := range parts {
+		ret += strings.Title(x)
+	}
+	return ret
+}
+
+// extractValue returns the value of the field named by path in object o if it exists.
+func extractValue(path string, o interface{}) (interface{}, error) {
+	parts := strings.Split(path, ".")
+	for _, f := range parts {
+		v := reflect.ValueOf(o)
+		// Dereference Ptr to handle *struct.
+		if v.Kind() == reflect.Ptr {
+			if v.IsNil() {
+				return nil, errors.New("field is nil")
+			}
+			v = v.Elem()
+		}
+		if v.Kind() != reflect.Struct {
+			return nil, fmt.Errorf("cannot get field from non-struct (%T)", o)
+		}
+		v = v.FieldByName(snakeToCamelCase(f))
+		if !v.IsValid() {
+			return nil, fmt.Errorf("cannot get field %q as it is not a valid field in %T", f, o)
+		}
+		if !v.CanInterface() {
+			return nil, fmt.Errorf("cannot get field %q in obj of type %T", f, o)
+		}
+		o = v.Interface()
+	}
+	switch o.(type) {
+	case string, int, bool:
+		return o, nil
+	}
+	return nil, fmt.Errorf("unhandled object of type %T", o)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter/filter_test.go

@@ -0,0 +1,176 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package filter
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestFilterToString(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		f    *F
+		want string
+	}{
+		{Regexp("field1", "abc"), `field1 eq abc`},
+		{NotRegexp("field1", "abc"), `field1 ne abc`},
+		{EqualInt("field1", 13), "field1 eq 13"},
+		{NotEqualInt("field1", 13), "field1 ne 13"},
+		{EqualBool("field1", true), "field1 eq true"},
+		{NotEqualBool("field1", true), "field1 ne true"},
+		{Regexp("field1", "abc").AndRegexp("field2", "def"), `(field1 eq abc) (field2 eq def)`},
+		{Regexp("field1", "abc").AndNotEqualInt("field2", 17), `(field1 eq abc) (field2 ne 17)`},
+		{Regexp("field1", "abc").And(EqualInt("field2", 17)), `(field1 eq abc) (field2 eq 17)`},
+	} {
+		if tc.f.String() != tc.want {
+			t.Errorf("filter %#v String() = %q, want %q", tc.f, tc.f.String(), tc.want)
+		}
+	}
+}
+
+func TestFilterMatch(t *testing.T) {
+	t.Parallel()
+
+	type inner struct {
+		X string
+	}
+	type S struct {
+		S           string
+		I           int
+		B           bool
+		Unhandled   struct{}
+		NestedField *inner
+	}
+
+	for _, tc := range []struct {
+		f    *F
+		o    interface{}
+		want bool
+	}{
+		{f: None, o: &S{}, want: true},
+		{f: Regexp("s", "abc"), o: &S{}},
+		{f: EqualInt("i", 10), o: &S{}},
+		{f: EqualBool("b", true), o: &S{}},
+		{f: NotRegexp("s", "abc"), o: &S{}, want: true},
+		{f: NotEqualInt("i", 10), o: &S{}, want: true},
+		{f: NotEqualBool("b", true), o: &S{}, want: true},
+		{f: Regexp("s", "abc").AndEqualBool("b", true), o: &S{}},
+		{f: Regexp("s", "abc"), o: &S{S: "abc"}, want: true},
+		{f: Regexp("s", "a.*"), o: &S{S: "abc"}, want: true},
+		{f: Regexp("s", "a((("), o: &S{S: "abc"}},
+		{f: NotRegexp("s", "abc"), o: &S{S: "abc"}},
+		{f: EqualInt("i", 10), o: &S{I: 11}},
+		{f: EqualInt("i", 10), o: &S{I: 10}, want: true},
+		{f: Regexp("s", "abc").AndEqualBool("b", true), o: &S{S: "abc"}},
+		{f: Regexp("s", "abcd").AndEqualBool("b", true), o: &S{S: "abc"}},
+		{f: Regexp("s", "abc").AndEqualBool("b", true), o: &S{S: "abc", B: true}, want: true},
+		{f: Regexp("s", "abc").And(EqualBool("b", true)), o: &S{S: "abc", B: true}, want: true},
+		{f: Regexp("unhandled", "xyz"), o: &S{}},
+		{f: Regexp("nested_field.x", "xyz"), o: &S{}},
+		{f: Regexp("nested_field.x", "xyz"), o: &S{NestedField: &inner{"xyz"}}, want: true},
+		{f: NotRegexp("nested_field.x", "xyz"), o: &S{NestedField: &inner{"xyz"}}},
+		{f: Regexp("nested_field.y", "xyz"), o: &S{NestedField: &inner{"xyz"}}},
+		{f: Regexp("nested_field", "xyz"), o: &S{NestedField: &inner{"xyz"}}},
+	} {
+		got := tc.f.Match(tc.o)
+		if got != tc.want {
+			t.Errorf("%v: Match(%+v) = %v, want %v", tc.f, tc.o, got, tc.want)
+		}
+	}
+}
+
+func TestFilterSnakeToCamelCase(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		s    string
+		want string
+	}{
+		{"", ""},
+		{"abc", "Abc"},
+		{"_foo", "Foo"},
+		{"a_b_c", "ABC"},
+		{"a_BC_def", "ABCDef"},
+		{"a_Bc_def", "ABcDef"},
+	} {
+		got := snakeToCamelCase(tc.s)
+		if got != tc.want {
+			t.Errorf("snakeToCamelCase(%q) = %q, want %q", tc.s, got, tc.want)
+		}
+	}
+}
+
+func TestFilterExtractValue(t *testing.T) {
+	t.Parallel()
+
+	type nest2 struct {
+		Y string
+	}
+	type nest struct {
+		X     string
+		Nest2 nest2
+	}
+	st := &struct {
+		S       string
+		I       int
+		F       bool
+		Nest    nest
+		NestPtr *nest
+
+		Unhandled float64
+	}{
+		"abc",
+		13,
+		true,
+		nest{"xyz", nest2{"zzz"}},
+		&nest{"yyy", nest2{}},
+		0.0,
+	}
+
+	for _, tc := range []struct {
+		path    string
+		o       interface{}
+		want    interface{}
+		wantErr bool
+	}{
+		{path: "s", o: st, want: "abc"},
+		{path: "i", o: st, want: 13},
+		{path: "f", o: st, want: true},
+		{path: "nest.x", o: st, want: "xyz"},
+		{path: "nest_ptr.x", o: st, want: "yyy"},
+		// Error cases.
+		{path: "", o: st, wantErr: true},
+		{path: "no_such_field", o: st, wantErr: true},
+		{path: "s.invalid_type", o: st, wantErr: true},
+		{path: "unhandled", o: st, wantErr: true},
+		{path: "nest.x", o: &struct{ Nest *nest }{}, wantErr: true},
+	} {
+		o, err := extractValue(tc.path, tc.o)
+		gotErr := err != nil
+		if gotErr != tc.wantErr {
+			t.Errorf("extractValue(%v, %+v) = %v, %v; gotErr = %v, tc.wantErr = %v", tc.path, tc.o, o, err, gotErr, tc.wantErr)
+		}
+		if err != nil {
+			continue
+		}
+		if !reflect.DeepEqual(o, tc.want) {
+			t.Errorf("extractValue(%v, %+v) = %v, nil; want %v, nil", tc.path, tc.o, o, tc.want)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/gce_projects.go

@@ -0,0 +1,99 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	compute "google.golang.org/api/compute/v1"
+	"google.golang.org/api/googleapi"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+// ProjectsOps is the manually implemented methods for the Projects service.
+type ProjectsOps interface {
+	Get(ctx context.Context, projectID string) (*compute.Project, error)
+	SetCommonInstanceMetadata(ctx context.Context, projectID string, m *compute.Metadata) error
+}
+
+// MockProjectOpsState is stored in the mock.X field.
+type MockProjectOpsState struct {
+	metadata map[string]*compute.Metadata
+}
+
+// Get a project by projectID.
+func (m *MockProjects) Get(ctx context.Context, projectID string) (*compute.Project, error) {
+	m.Lock.Lock()
+	defer m.Lock.Unlock()
+
+	if p, ok := m.Objects[*meta.GlobalKey(projectID)]; ok {
+		return p.ToGA(), nil
+	}
+	return nil, &googleapi.Error{
+		Code:    http.StatusNotFound,
+		Message: fmt.Sprintf("MockProjects %v not found", projectID),
+	}
+}
+
+// Get a project by projectID.
+func (g *GCEProjects) Get(ctx context.Context, projectID string) (*compute.Project, error) {
+	rk := &RateLimitKey{
+		ProjectID: projectID,
+		Operation: "Get",
+		Version:   meta.Version("ga"),
+		Service:   "Projects",
+	}
+	if err := g.s.RateLimiter.Accept(ctx, rk); err != nil {
+		return nil, err
+	}
+	call := g.s.GA.Projects.Get(projectID)
+	call.Context(ctx)
+	return call.Do()
+}
+
+// SetCommonInstanceMetadata for a given project.
+func (m *MockProjects) SetCommonInstanceMetadata(ctx context.Context, projectID string, meta *compute.Metadata) error {
+	if m.X == nil {
+		m.X = &MockProjectOpsState{metadata: map[string]*compute.Metadata{}}
+	}
+	state := m.X.(*MockProjectOpsState)
+	state.metadata[projectID] = meta
+	return nil
+}
+
+// SetCommonInstanceMetadata for a given project.
+func (g *GCEProjects) SetCommonInstanceMetadata(ctx context.Context, projectID string, m *compute.Metadata) error {
+	rk := &RateLimitKey{
+		ProjectID: projectID,
+		Operation: "SetCommonInstanceMetadata",
+		Version:   meta.Version("ga"),
+		Service:   "Projects",
+	}
+	if err := g.s.RateLimiter.Accept(ctx, rk); err != nil {
+		return err
+	}
+	call := g.s.GA.Projects.SetCommonInstanceMetadata(projectID, m)
+	call.Context(ctx)
+
+	op, err := call.Do()
+	if err != nil {
+		return err
+	}
+	return g.s.WaitForCompletion(ctx, op)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/gen/BUILD

@@ -0,0 +1,29 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["main.go"],
+    importpath = "k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/gen",
+    visibility = ["//visibility:private"],
+    deps = ["//pkg/cloudprovider/providers/gce/cloud/meta:go_default_library"],
+)
+
+go_binary(
+    name = "gen",
+    embed = [":go_default_library"],
+    visibility = ["//visibility:public"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta/BUILD

@@ -0,0 +1,39 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "key.go",
+        "meta.go",
+        "method.go",
+        "service.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/google.golang.org/api/compute/v0.alpha:go_default_library",
+        "//vendor/google.golang.org/api/compute/v0.beta:go_default_library",
+        "//vendor/google.golang.org/api/compute/v1:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["key_test.go"],
+    embed = [":go_default_library"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta/doc.go

@@ -0,0 +1,19 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package meta contains the meta description of the GCE cloud types to
+// generate code for.
+package meta

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta/key.go

@@ -0,0 +1,108 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"fmt"
+	"regexp"
+)
+
+// Key for a GCP resource.
+type Key struct {
+	Name   string
+	Zone   string
+	Region string
+}
+
+// KeyType is the type of the key.
+type KeyType string
+
+const (
+	// Zonal key type.
+	Zonal = "zonal"
+	// Regional key type.
+	Regional = "regional"
+	// Global key type.
+	Global = "global"
+)
+
+var (
+	// locationRegexp is the format of regions/zone names in GCE.
+	locationRegexp = regexp.MustCompile("^[a-z](?:[-a-z0-9]+)?$")
+)
+
+// ZonalKey returns the key for a zonal resource.
+func ZonalKey(name, zone string) *Key {
+	return &Key{name, zone, ""}
+}
+
+// RegionalKey returns the key for a regional resource.
+func RegionalKey(name, region string) *Key {
+	return &Key{name, "", region}
+}
+
+// GlobalKey returns the key for a global resource.
+func GlobalKey(name string) *Key {
+	return &Key{name, "", ""}
+}
+
+// Type returns the type of the key.
+func (k *Key) Type() KeyType {
+	switch {
+	case k.Zone != "":
+		return Zonal
+	case k.Region != "":
+		return Regional
+	default:
+		return Global
+	}
+}
+
+// String returns a string representation of the key.
+func (k Key) String() string {
+	switch k.Type() {
+	case Zonal:
+		return fmt.Sprintf("Key{%q, zone: %q}", k.Name, k.Zone)
+	case Regional:
+		return fmt.Sprintf("Key{%q, region: %q}", k.Name, k.Region)
+	default:
+		return fmt.Sprintf("Key{%q}", k.Name)
+	}
+}
+
+// Valid is true if the key is valid.
+func (k *Key) Valid() bool {
+	if k.Zone != "" && k.Region != "" {
+		return false
+	}
+	switch {
+	case k.Region != "":
+		return locationRegexp.Match([]byte(k.Region))
+	case k.Zone != "":
+		return locationRegexp.Match([]byte(k.Zone))
+	}
+	return true
+}
+
+// KeysToMap creates a map[Key]bool from a list of keys.
+func KeysToMap(keys ...Key) map[Key]bool {
+	ret := map[Key]bool{}
+	for _, k := range keys {
+		ret[k] = true
+	}
+	return ret
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta/key_test.go

@@ -0,0 +1,76 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"testing"
+)
+
+func TestKeyType(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		key  *Key
+		want KeyType
+	}{
+		{GlobalKey("abc"), Global},
+		{ZonalKey("abc", "us-central1-b"), Zonal},
+		{RegionalKey("abc", "us-central1"), Regional},
+	} {
+		if tc.key.Type() != tc.want {
+			t.Errorf("key.Type() == %v, want %v", tc.key.Type(), tc.want)
+		}
+	}
+}
+
+func TestKeyString(t *testing.T) {
+	t.Parallel()
+
+	for _, k := range []*Key{
+		GlobalKey("abc"),
+		RegionalKey("abc", "us-central1"),
+		ZonalKey("abc", "us-central1-b"),
+	} {
+		if k.String() == "" {
+			t.Errorf(`k.String() = "", want non-empty`)
+		}
+	}
+}
+
+func TestKeyValid(t *testing.T) {
+	t.Parallel()
+
+	region := "us-central1"
+	zone := "us-central1-b"
+
+	for _, tc := range []struct {
+		key  *Key
+		want bool
+	}{
+		{GlobalKey("abc"), true},
+		{RegionalKey("abc", region), true},
+		{ZonalKey("abc", zone), true},
+		{RegionalKey("abc", "/invalid/"), false},
+		{ZonalKey("abc", "/invalid/"), false},
+		{&Key{"abc", zone, region}, false},
+	} {
+		got := tc.key.Valid()
+		if got != tc.want {
+			t.Errorf("key %+v; key.Valid() = %v, want %v", tc.key, got, tc.want)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta/meta.go

@@ -0,0 +1,414 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"reflect"
+
+	alpha "google.golang.org/api/compute/v0.alpha"
+	beta "google.golang.org/api/compute/v0.beta"
+	ga "google.golang.org/api/compute/v1"
+)
+
+// Version of the API (ga, alpha, beta).
+type Version string
+
+const (
+	// NoGet prevents the Get() method from being generated.
+	NoGet = 1 << iota
+	// NoList prevents the List() method from being generated.
+	NoList = 1 << iota
+	// NoDelete prevents the Delete() method from being generated.
+	NoDelete = 1 << iota
+	// NoInsert prevents the Insert() method from being generated.
+	NoInsert = 1 << iota
+	// CustomOps specifies that an empty interface xxxOps will be generated to
+	// enable custom method calls to be attached to the generated service
+	// interface.
+	CustomOps = 1 << iota
+	// AggregatedList will generated a method for AggregatedList().
+	AggregatedList = 1 << iota
+
+	// ReadOnly specifies that the given resource is read-only and should not
+	// have insert() or delete() methods generated for the wrapper.
+	ReadOnly = NoDelete | NoInsert
+
+	// VersionGA is the API version in compute.v1.
+	VersionGA Version = "ga"
+	// VersionAlpha is the API version in computer.v0.alpha.
+	VersionAlpha Version = "alpha"
+	// VersionBeta is the API version in computer.v0.beta.
+	VersionBeta Version = "beta"
+)
+
+// AllVersions is a list of all versions of the GCE API.
+var AllVersions = []Version{
+	VersionGA,
+	VersionAlpha,
+	VersionBeta,
+}
+
+// AllServices are a list of all the services to generate code for. Keep
+// this list in lexiographical order by object type.
+var AllServices = []*ServiceInfo{
+	{
+		Object:      "Address",
+		Service:     "Addresses",
+		Resource:    "addresses",
+		keyType:     Regional,
+		serviceType: reflect.TypeOf(&ga.AddressesService{}),
+	},
+	{
+		Object:      "Address",
+		Service:     "Addresses",
+		Resource:    "addresses",
+		version:     VersionAlpha,
+		keyType:     Regional,
+		serviceType: reflect.TypeOf(&alpha.AddressesService{}),
+	},
+	{
+		Object:      "Address",
+		Service:     "Addresses",
+		Resource:    "addresses",
+		version:     VersionBeta,
+		keyType:     Regional,
+		serviceType: reflect.TypeOf(&beta.AddressesService{}),
+	},
+	{
+		Object:      "Address",
+		Service:     "GlobalAddresses",
+		Resource:    "addresses",
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&ga.GlobalAddressesService{}),
+	},
+	{
+		Object:      "BackendService",
+		Service:     "BackendServices",
+		Resource:    "backendServices",
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&ga.BackendServicesService{}),
+		additionalMethods: []string{
+			"GetHealth",
+			"Patch",
+			"Update",
+		},
+	},
+	{
+		Object:      "BackendService",
+		Service:     "BackendServices",
+		Resource:    "backendServices",
+		version:     VersionBeta,
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&beta.BackendServicesService{}),
+		additionalMethods: []string{
+			"SetSecurityPolicy",
+		},
+	},
+	{
+		Object:      "BackendService",
+		Service:     "BackendServices",
+		Resource:    "backendServices",
+		version:     VersionAlpha,
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&alpha.BackendServicesService{}),
+		additionalMethods: []string{
+			"Update",
+			"SetSecurityPolicy",
+		},
+	},
+	{
+		Object:      "BackendService",
+		Service:     "RegionBackendServices",
+		Resource:    "backendServices",
+		version:     VersionGA,
+		keyType:     Regional,
+		serviceType: reflect.TypeOf(&ga.RegionBackendServicesService{}),
+		additionalMethods: []string{
+			"GetHealth",
+			"Update",
+		},
+	},
+	{
+		Object:      "BackendService",
+		Service:     "RegionBackendServices",
+		Resource:    "backendServices",
+		version:     VersionAlpha,
+		keyType:     Regional,
+		serviceType: reflect.TypeOf(&alpha.RegionBackendServicesService{}),
+		additionalMethods: []string{
+			"GetHealth",
+			"Update",
+		},
+	},
+	{
+		Object:      "Disk",
+		Service:     "Disks",
+		Resource:    "disks",
+		keyType:     Zonal,
+		serviceType: reflect.TypeOf(&ga.DisksService{}),
+		additionalMethods: []string{
+			"Resize",
+		},
+	},
+	{
+		Object:      "Disk",
+		Service:     "RegionDisks",
+		Resource:    "disks",
+		version:     VersionBeta,
+		keyType:     Regional,
+		serviceType: reflect.TypeOf(&beta.RegionDisksService{}),
+		additionalMethods: []string{
+			"Resize",
+		},
+	},
+	{
+		Object:      "Firewall",
+		Service:     "Firewalls",
+		Resource:    "firewalls",
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&ga.FirewallsService{}),
+		additionalMethods: []string{
+			"Update",
+		},
+	},
+	{
+		Object:      "ForwardingRule",
+		Service:     "ForwardingRules",
+		Resource:    "forwardingRules",
+		keyType:     Regional,
+		serviceType: reflect.TypeOf(&ga.ForwardingRulesService{}),
+	},
+	{
+		Object:      "ForwardingRule",
+		Service:     "ForwardingRules",
+		Resource:    "forwardingRules",
+		version:     VersionAlpha,
+		keyType:     Regional,
+		serviceType: reflect.TypeOf(&alpha.ForwardingRulesService{}),
+	},
+	{
+		Object:      "ForwardingRule",
+		Service:     "GlobalForwardingRules",
+		Resource:    "forwardingRules",
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&ga.GlobalForwardingRulesService{}),
+		additionalMethods: []string{
+			"SetTarget",
+		},
+	},
+	{
+		Object:      "HealthCheck",
+		Service:     "HealthChecks",
+		Resource:    "healthChecks",
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&ga.HealthChecksService{}),
+		additionalMethods: []string{
+			"Update",
+		},
+	},
+	{
+		Object:      "HealthCheck",
+		Service:     "HealthChecks",
+		Resource:    "healthChecks",
+		version:     VersionAlpha,
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&alpha.HealthChecksService{}),
+		additionalMethods: []string{
+			"Update",
+		},
+	},
+	{
+		Object:      "HttpHealthCheck",
+		Service:     "HttpHealthChecks",
+		Resource:    "httpHealthChecks",
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&ga.HttpHealthChecksService{}),
+		additionalMethods: []string{
+			"Update",
+		},
+	},
+	{
+		Object:      "HttpsHealthCheck",
+		Service:     "HttpsHealthChecks",
+		Resource:    "httpsHealthChecks",
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&ga.HttpsHealthChecksService{}),
+		additionalMethods: []string{
+			"Update",
+		},
+	},
+	{
+		Object:      "InstanceGroup",
+		Service:     "InstanceGroups",
+		Resource:    "instanceGroups",
+		keyType:     Zonal,
+		serviceType: reflect.TypeOf(&ga.InstanceGroupsService{}),
+		additionalMethods: []string{
+			"AddInstances",
+			"ListInstances",
+			"RemoveInstances",
+			"SetNamedPorts",
+		},
+	},
+	{
+		Object:      "Instance",
+		Service:     "Instances",
+		Resource:    "instances",
+		keyType:     Zonal,
+		serviceType: reflect.TypeOf(&ga.InstancesService{}),
+		additionalMethods: []string{
+			"AttachDisk",
+			"DetachDisk",
+		},
+	},
+	{
+		Object:      "Instance",
+		Service:     "Instances",
+		Resource:    "instances",
+		version:     VersionBeta,
+		keyType:     Zonal,
+		serviceType: reflect.TypeOf(&beta.InstancesService{}),
+		additionalMethods: []string{
+			"AttachDisk",
+			"DetachDisk",
+			"UpdateNetworkInterface",
+		},
+	},
+	{
+		Object:      "Instance",
+		Service:     "Instances",
+		Resource:    "instances",
+		version:     VersionAlpha,
+		keyType:     Zonal,
+		serviceType: reflect.TypeOf(&alpha.InstancesService{}),
+		additionalMethods: []string{
+			"AttachDisk",
+			"DetachDisk",
+			"UpdateNetworkInterface",
+		},
+	},
+	{
+		Object:      "NetworkEndpointGroup",
+		Service:     "NetworkEndpointGroups",
+		Resource:    "networkEndpointGroups",
+		version:     VersionAlpha,
+		keyType:     Zonal,
+		serviceType: reflect.TypeOf(&alpha.NetworkEndpointGroupsService{}),
+		additionalMethods: []string{
+			"AttachNetworkEndpoints",
+			"DetachNetworkEndpoints",
+			"ListNetworkEndpoints",
+		},
+		options: AggregatedList,
+	},
+	{
+		Object:   "Project",
+		Service:  "Projects",
+		Resource: "projects",
+		keyType:  Global,
+		// Generate only the stub with no methods.
+		options:     NoGet | NoList | NoInsert | NoDelete | CustomOps,
+		serviceType: reflect.TypeOf(&ga.ProjectsService{}),
+	},
+	{
+		Object:      "Region",
+		Service:     "Regions",
+		Resource:    "regions",
+		keyType:     Global,
+		options:     ReadOnly,
+		serviceType: reflect.TypeOf(&ga.RegionsService{}),
+	},
+	{
+		Object:      "Route",
+		Service:     "Routes",
+		Resource:    "routes",
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&ga.RoutesService{}),
+	},
+	{
+		Object:      "SecurityPolicy",
+		Service:     "SecurityPolicies",
+		Resource:    "securityPolicies",
+		version:     VersionBeta,
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&beta.SecurityPoliciesService{}),
+		additionalMethods: []string{
+			"AddRule",
+			"GetRule",
+			"Patch",
+			"PatchRule",
+			"RemoveRule",
+		},
+	},
+	{
+		Object:      "SslCertificate",
+		Service:     "SslCertificates",
+		Resource:    "sslCertificates",
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&ga.SslCertificatesService{}),
+	},
+	{
+		Object:      "TargetHttpProxy",
+		Service:     "TargetHttpProxies",
+		Resource:    "targetHttpProxies",
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&ga.TargetHttpProxiesService{}),
+		additionalMethods: []string{
+			"SetUrlMap",
+		},
+	},
+	{
+		Object:      "TargetHttpsProxy",
+		Service:     "TargetHttpsProxies",
+		Resource:    "targetHttpsProxies",
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&ga.TargetHttpsProxiesService{}),
+		additionalMethods: []string{
+			"SetSslCertificates",
+			"SetUrlMap",
+		},
+	},
+	{
+		Object:      "TargetPool",
+		Service:     "TargetPools",
+		Resource:    "targetPools",
+		keyType:     Regional,
+		serviceType: reflect.TypeOf(&ga.TargetPoolsService{}),
+		additionalMethods: []string{
+			"AddInstance",
+			"RemoveInstance",
+		},
+	},
+	{
+		Object:      "UrlMap",
+		Service:     "UrlMaps",
+		Resource:    "urlMaps",
+		keyType:     Global,
+		serviceType: reflect.TypeOf(&ga.UrlMapsService{}),
+		additionalMethods: []string{
+			"Update",
+		},
+	},
+	{
+		Object:      "Zone",
+		Service:     "Zones",
+		Resource:    "zones",
+		keyType:     Global,
+		options:     ReadOnly,
+		serviceType: reflect.TypeOf(&ga.ZonesService{}),
+	},
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta/method.go

@@ -0,0 +1,337 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+)
+
+func newArg(t reflect.Type) *arg {
+	ret := &arg{}
+
+	// Dereference the pointer types to get at the underlying concrete type.
+Loop:
+	for {
+		switch t.Kind() {
+		case reflect.Ptr:
+			ret.numPtr++
+			t = t.Elem()
+		default:
+			ret.pkg = t.PkgPath()
+			ret.typeName += t.Name()
+			break Loop
+		}
+	}
+	return ret
+}
+
+type arg struct {
+	pkg, typeName string
+	numPtr        int
+}
+
+func (a *arg) normalizedPkg() string {
+	if a.pkg == "" {
+		return ""
+	}
+
+	// Strip the repo.../vendor/ prefix from the package path if present.
+	parts := strings.Split(a.pkg, "/")
+	// Remove vendor prefix.
+	for i := 0; i < len(parts); i++ {
+		if parts[i] == "vendor" {
+			parts = parts[i+1:]
+			break
+		}
+	}
+	switch strings.Join(parts, "/") {
+	case "google.golang.org/api/compute/v1":
+		return "ga."
+	case "google.golang.org/api/compute/v0.alpha":
+		return "alpha."
+	case "google.golang.org/api/compute/v0.beta":
+		return "beta."
+	default:
+		panic(fmt.Errorf("unhandled package %q", a.pkg))
+	}
+}
+
+func (a *arg) String() string {
+	var ret string
+	for i := 0; i < a.numPtr; i++ {
+		ret += "*"
+	}
+	ret += a.normalizedPkg()
+	ret += a.typeName
+	return ret
+}
+
+// newMethod returns a newly initialized method.
+func newMethod(s *ServiceInfo, m reflect.Method) *Method {
+	ret := &Method{
+		ServiceInfo: s,
+		m:           m,
+		kind:        MethodOperation,
+		ReturnType:  "",
+	}
+	ret.init()
+	return ret
+}
+
+// MethodKind is the type of method that we are generated code for.
+type MethodKind int
+
+const (
+	// MethodOperation is a long running method that returns an operation.
+	MethodOperation MethodKind = iota
+	// MethodGet is a method that immediately returns some data.
+	MethodGet MethodKind = iota
+	// MethodPaged is a method that returns a paged set of data.
+	MethodPaged MethodKind = iota
+)
+
+// Method is used to generate the calling code for non-standard methods.
+type Method struct {
+	*ServiceInfo
+	m reflect.Method
+
+	kind MethodKind
+	// ReturnType is the return type for the method.
+	ReturnType string
+	// ItemType is the type of the individual elements returns from a
+	// Pages() call. This is only applicable for MethodPaged kind.
+	ItemType string
+}
+
+// IsOperation is true if the method is an Operation.
+func (m *Method) IsOperation() bool {
+	return m.kind == MethodOperation
+}
+
+// IsPaged is true if the method paged.
+func (m *Method) IsPaged() bool {
+	return m.kind == MethodPaged
+}
+
+// IsGet is true if the method simple get.
+func (m *Method) IsGet() bool {
+	return m.kind == MethodGet
+}
+
+// argsSkip is the number of arguments to skip when generating the
+// synthesized method.
+func (m *Method) argsSkip() int {
+	switch m.keyType {
+	case Zonal:
+		return 4
+	case Regional:
+		return 4
+	case Global:
+		return 3
+	}
+	panic(fmt.Errorf("invalid KeyType %v", m.keyType))
+}
+
+// args return a list of arguments to the method, skipping the first skip
+// elements. If nameArgs is true, then the arguments will include a generated
+// parameter name (arg<N>). prefix will be added to the parameters.
+func (m *Method) args(skip int, nameArgs bool, prefix []string) []string {
+	var args []*arg
+	fType := m.m.Func.Type()
+	for i := 0; i < fType.NumIn(); i++ {
+		t := fType.In(i)
+		args = append(args, newArg(t))
+	}
+
+	var a []string
+	for i := skip; i < fType.NumIn(); i++ {
+		if nameArgs {
+			a = append(a, fmt.Sprintf("arg%d %s", i-skip, args[i]))
+		} else {
+			a = append(a, args[i].String())
+		}
+	}
+	return append(prefix, a...)
+}
+
+// init the method. This performs some rudimentary static checking as well as
+// determines the kind of method by looking at the shape (method signature) of
+// the object.
+func (m *Method) init() {
+	fType := m.m.Func.Type()
+	if fType.NumIn() < m.argsSkip() {
+		err := fmt.Errorf("method %q.%q, arity = %d which is less than required (< %d)",
+			m.Service, m.Name(), fType.NumIn(), m.argsSkip())
+		panic(err)
+	}
+	// Skipped args should all be string (they will be projectID, zone, region etc).
+	for i := 1; i < m.argsSkip(); i++ {
+		if fType.In(i).Kind() != reflect.String {
+			panic(fmt.Errorf("method %q.%q: skipped args can only be strings", m.Service, m.Name()))
+		}
+	}
+	// Return of the method must return a single value of type *xxxCall.
+	if fType.NumOut() != 1 || fType.Out(0).Kind() != reflect.Ptr || !strings.HasSuffix(fType.Out(0).Elem().Name(), "Call") {
+		panic(fmt.Errorf("method %q.%q: generator only supports methods returning an *xxxCall object",
+			m.Service, m.Name()))
+	}
+	returnType := fType.Out(0)
+	returnTypeName := fType.Out(0).Elem().Name()
+	// xxxCall must have a Do() method.
+	doMethod, ok := returnType.MethodByName("Do")
+	if !ok {
+		panic(fmt.Errorf("method %q.%q: return type %q does not have a Do() method",
+			m.Service, m.Name(), returnTypeName))
+	}
+	_, hasPages := returnType.MethodByName("Pages")
+	// Do() method must return (*T, error).
+	switch doMethod.Func.Type().NumOut() {
+	case 2:
+		out0 := doMethod.Func.Type().Out(0)
+		if out0.Kind() != reflect.Ptr {
+			panic(fmt.Errorf("method %q.%q: return type %q of Do() = S, _; S must be pointer type (%v)",
+				m.Service, m.Name(), returnTypeName, out0))
+		}
+		m.ReturnType = out0.Elem().Name()
+		switch {
+		case out0.Elem().Name() == "Operation":
+			m.kind = MethodOperation
+		case hasPages:
+			m.kind = MethodPaged
+			// Pages() returns a xxxList that has the actual list
+			// of objects in the xxxList.Items field.
+			listType := out0.Elem()
+			itemsField, ok := listType.FieldByName("Items")
+			if !ok {
+				panic(fmt.Errorf("method %q.%q: paged return type %q does not have a .Items field", m.Service, m.Name(), listType.Name()))
+			}
+			// itemsField will be a []*ItemType. Dereference to
+			// extract the ItemType.
+			itemsType := itemsField.Type
+			if itemsType.Kind() != reflect.Slice && itemsType.Elem().Kind() != reflect.Ptr {
+				panic(fmt.Errorf("method %q.%q: paged return type %q.Items is not an array of pointers", m.Service, m.Name(), listType.Name()))
+			}
+			m.ItemType = itemsType.Elem().Elem().Name()
+		default:
+			m.kind = MethodGet
+		}
+		// Second argument must be "error".
+		if doMethod.Func.Type().Out(1).Name() != "error" {
+			panic(fmt.Errorf("method %q.%q: return type %q of Do() = S, T; T must be 'error'",
+				m.Service, m.Name(), returnTypeName))
+		}
+		break
+	default:
+		panic(fmt.Errorf("method %q.%q: %q Do() return type is not handled by the generator",
+			m.Service, m.Name(), returnTypeName))
+	}
+}
+
+// Name is the name of the method.
+func (m *Method) Name() string {
+	return m.m.Name
+}
+
+// CallArgs is a list of comma separated "argN" used for calling the method.
+// For example, if the method has two additional arguments, this will return
+// "arg0, arg1".
+func (m *Method) CallArgs() string {
+	var args []string
+	for i := m.argsSkip(); i < m.m.Func.Type().NumIn(); i++ {
+		args = append(args, fmt.Sprintf("arg%d", i-m.argsSkip()))
+	}
+	if len(args) == 0 {
+		return ""
+	}
+	return fmt.Sprintf(", %s", strings.Join(args, ", "))
+}
+
+// MockHookName is the name of the hook function in the mock.
+func (m *Method) MockHookName() string {
+	return m.m.Name + "Hook"
+}
+
+// MockHook is the definition of the hook function.
+func (m *Method) MockHook() string {
+	args := m.args(m.argsSkip(), false, []string{
+		"context.Context",
+		"*meta.Key",
+	})
+	if m.kind == MethodPaged {
+		args = append(args, "*filter.F")
+	}
+
+	args = append(args, fmt.Sprintf("*%s", m.MockWrapType()))
+
+	switch m.kind {
+	case MethodOperation:
+		return fmt.Sprintf("%v func(%v) error", m.MockHookName(), strings.Join(args, ", "))
+	case MethodGet:
+		return fmt.Sprintf("%v func(%v) (*%v.%v, error)", m.MockHookName(), strings.Join(args, ", "), m.Version(), m.ReturnType)
+	case MethodPaged:
+		return fmt.Sprintf("%v func(%v) ([]*%v.%v, error)", m.MockHookName(), strings.Join(args, ", "), m.Version(), m.ItemType)
+	default:
+		panic(fmt.Errorf("invalid method kind: %v", m.kind))
+	}
+}
+
+// FcnArgs is the function signature for the definition of the method.
+func (m *Method) FcnArgs() string {
+	args := m.args(m.argsSkip(), true, []string{
+		"ctx context.Context",
+		"key *meta.Key",
+	})
+	if m.kind == MethodPaged {
+		args = append(args, "fl *filter.F")
+	}
+
+	switch m.kind {
+	case MethodOperation:
+		return fmt.Sprintf("%v(%v) error", m.m.Name, strings.Join(args, ", "))
+	case MethodGet:
+		return fmt.Sprintf("%v(%v) (*%v.%v, error)", m.m.Name, strings.Join(args, ", "), m.Version(), m.ReturnType)
+	case MethodPaged:
+		return fmt.Sprintf("%v(%v) ([]*%v.%v, error)", m.m.Name, strings.Join(args, ", "), m.Version(), m.ItemType)
+	default:
+		panic(fmt.Errorf("invalid method kind: %v", m.kind))
+	}
+}
+
+// InterfaceFunc is the function declaration of the method in the interface.
+func (m *Method) InterfaceFunc() string {
+	args := []string{
+		"context.Context",
+		"*meta.Key",
+	}
+	args = m.args(m.argsSkip(), false, args)
+	if m.kind == MethodPaged {
+		args = append(args, "*filter.F")
+	}
+
+	switch m.kind {
+	case MethodOperation:
+		return fmt.Sprintf("%v(%v) error", m.m.Name, strings.Join(args, ", "))
+	case MethodGet:
+		return fmt.Sprintf("%v(%v) (*%v.%v, error)", m.m.Name, strings.Join(args, ", "), m.Version(), m.ReturnType)
+	case MethodPaged:
+		return fmt.Sprintf("%v(%v) ([]*%v.%v, error)", m.m.Name, strings.Join(args, ", "), m.Version(), m.ItemType)
+	default:
+		panic(fmt.Errorf("invalid method kind: %v", m.kind))
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta/service.go

@@ -0,0 +1,300 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"sort"
+)
+
+// ServiceInfo defines the entry for a Service that code will be generated for.
+type ServiceInfo struct {
+	// Object is the Go name of the object type that the service deals
+	// with. Example: "ForwardingRule".
+	Object string
+	// Service is the Go name of the service struct i.e. where the methods
+	// are defined. Examples: "GlobalForwardingRules".
+	Service string
+	// Resource is the plural noun of the resource in the compute API URL (e.g.
+	// "forwardingRules").
+	Resource string
+	// version if unspecified will be assumed to be VersionGA.
+	version     Version
+	keyType     KeyType
+	serviceType reflect.Type
+
+	additionalMethods   []string
+	options             int
+	aggregatedListField string
+}
+
+// Version returns the version of the Service, defaulting to GA if APIVersion
+// is empty.
+func (i *ServiceInfo) Version() Version {
+	if i.version == "" {
+		return VersionGA
+	}
+	return i.version
+}
+
+// VersionTitle returns the capitalized golang CamelCase name for the version.
+func (i *ServiceInfo) VersionTitle() string {
+	switch i.Version() {
+	case VersionGA:
+		return "GA"
+	case VersionAlpha:
+		return "Alpha"
+	case VersionBeta:
+		return "Beta"
+	}
+	panic(fmt.Errorf("invalid version %q", i.Version()))
+}
+
+// WrapType is the name of the wrapper service type.
+func (i *ServiceInfo) WrapType() string {
+	switch i.Version() {
+	case VersionGA:
+		return i.Service
+	case VersionAlpha:
+		return "Alpha" + i.Service
+	case VersionBeta:
+		return "Beta" + i.Service
+	}
+	return "Invalid"
+}
+
+// WrapTypeOps is the name of the additional operations type.
+func (i *ServiceInfo) WrapTypeOps() string {
+	return i.WrapType() + "Ops"
+}
+
+// FQObjectType is fully qualified name of the object (e.g. compute.Instance).
+func (i *ServiceInfo) FQObjectType() string {
+	return fmt.Sprintf("%v.%v", i.Version(), i.Object)
+}
+
+// ObjectListType is the compute List type for the object (contains Items field).
+func (i *ServiceInfo) ObjectListType() string {
+	return fmt.Sprintf("%v.%vList", i.Version(), i.Object)
+}
+
+// ObjectAggregatedListType is the compute List type for the object (contains Items field).
+func (i *ServiceInfo) ObjectAggregatedListType() string {
+	return fmt.Sprintf("%v.%vAggregatedList", i.Version(), i.Object)
+}
+
+// MockWrapType is the name of the concrete mock for this type.
+func (i *ServiceInfo) MockWrapType() string {
+	return "Mock" + i.WrapType()
+}
+
+// MockField is the name of the field in the mock struct.
+func (i *ServiceInfo) MockField() string {
+	return "Mock" + i.WrapType()
+}
+
+// GCEWrapType is the name of the GCE wrapper type.
+func (i *ServiceInfo) GCEWrapType() string {
+	return "GCE" + i.WrapType()
+}
+
+// Field is the name of the GCE struct.
+func (i *ServiceInfo) Field() string {
+	return "gce" + i.WrapType()
+}
+
+// Methods returns a list of additional methods to generate code for.
+func (i *ServiceInfo) Methods() []*Method {
+	methods := map[string]bool{}
+	for _, m := range i.additionalMethods {
+		methods[m] = true
+	}
+
+	var ret []*Method
+	for j := 0; j < i.serviceType.NumMethod(); j++ {
+		m := i.serviceType.Method(j)
+		if _, ok := methods[m.Name]; !ok {
+			continue
+		}
+		ret = append(ret, newMethod(i, m))
+		methods[m.Name] = false
+	}
+
+	for k, b := range methods {
+		if b {
+			panic(fmt.Errorf("method %q was not found in service %q", k, i.Service))
+		}
+	}
+
+	return ret
+}
+
+// KeyIsGlobal is true if the key is global.
+func (i *ServiceInfo) KeyIsGlobal() bool {
+	return i.keyType == Global
+}
+
+// KeyIsRegional is true if the key is regional.
+func (i *ServiceInfo) KeyIsRegional() bool {
+	return i.keyType == Regional
+}
+
+// KeyIsZonal is true if the key is zonal.
+func (i *ServiceInfo) KeyIsZonal() bool {
+	return i.keyType == Zonal
+}
+
+// KeyIsProject is true if the key represents the project resource.
+func (i *ServiceInfo) KeyIsProject() bool {
+	// Projects are a special resource for ResourceId because there is no 'key' value. This func
+	// is used by the generator to not accept a key parameter.
+	return i.Service == "Projects"
+}
+
+// MakeKey returns the call used to create the appropriate key type.
+func (i *ServiceInfo) MakeKey(name, location string) string {
+	switch i.keyType {
+	case Global:
+		return fmt.Sprintf("GlobalKey(%q)", name)
+	case Regional:
+		return fmt.Sprintf("RegionalKey(%q, %q)", name, location)
+	case Zonal:
+		return fmt.Sprintf("ZonalKey(%q, %q)", name, location)
+	}
+	return "Invalid"
+}
+
+// GenerateGet is true if the method is to be generated.
+func (i *ServiceInfo) GenerateGet() bool {
+	return i.options&NoGet == 0
+}
+
+// GenerateList is true if the method is to be generated.
+func (i *ServiceInfo) GenerateList() bool {
+	return i.options&NoList == 0
+}
+
+// GenerateDelete is true if the method is to be generated.
+func (i *ServiceInfo) GenerateDelete() bool {
+	return i.options&NoDelete == 0
+}
+
+// GenerateInsert is true if the method is to be generated.
+func (i *ServiceInfo) GenerateInsert() bool {
+	return i.options&NoInsert == 0
+}
+
+// GenerateCustomOps is true if we should generated a xxxOps interface for
+// adding additional methods to the generated interface.
+func (i *ServiceInfo) GenerateCustomOps() bool {
+	return i.options&CustomOps != 0
+}
+
+// AggregatedList is true if the method is to be generated.
+func (i *ServiceInfo) AggregatedList() bool {
+	return i.options&AggregatedList != 0
+}
+
+// AggregatedListField is the name of the field used for the aggregated list
+// call. This is typically the same as the name of the service, but can be
+// customized by setting the aggregatedListField field.
+func (i *ServiceInfo) AggregatedListField() string {
+	if i.aggregatedListField == "" {
+		return i.Service
+	}
+	return i.aggregatedListField
+}
+
+// ServiceGroup is a grouping of the same service but at different API versions.
+type ServiceGroup struct {
+	Alpha *ServiceInfo
+	Beta  *ServiceInfo
+	GA    *ServiceInfo
+}
+
+// Service returns any ServiceInfo string belonging to the ServiceGroup.
+func (sg *ServiceGroup) Service() string {
+	return sg.ServiceInfo().Service
+}
+
+// ServiceInfo returns any ServiceInfo object belonging to the ServiceGroup.
+func (sg *ServiceGroup) ServiceInfo() *ServiceInfo {
+	switch {
+	case sg.GA != nil:
+		return sg.GA
+	case sg.Alpha != nil:
+		return sg.Alpha
+	case sg.Beta != nil:
+		return sg.Beta
+	default:
+		panic(errors.New("service group is empty"))
+	}
+}
+
+// HasGA returns true if this object has a GA representation.
+func (sg *ServiceGroup) HasGA() bool {
+	return sg.GA != nil
+}
+
+// HasAlpha returns true if this object has a Alpha representation.
+func (sg *ServiceGroup) HasAlpha() bool {
+	return sg.Alpha != nil
+}
+
+// HasBeta returns true if this object has a Beta representation.
+func (sg *ServiceGroup) HasBeta() bool {
+	return sg.Beta != nil
+}
+
+// groupServices together by version.
+func groupServices(services []*ServiceInfo) map[string]*ServiceGroup {
+	ret := map[string]*ServiceGroup{}
+	for _, si := range services {
+		if _, ok := ret[si.Service]; !ok {
+			ret[si.Service] = &ServiceGroup{}
+		}
+		group := ret[si.Service]
+		switch si.Version() {
+		case VersionAlpha:
+			group.Alpha = si
+		case VersionBeta:
+			group.Beta = si
+		case VersionGA:
+			group.GA = si
+		}
+	}
+	return ret
+}
+
+// AllServicesByGroup is a map of service name to ServicesGroup.
+var AllServicesByGroup map[string]*ServiceGroup
+
+// SortedServicesGroups is a slice of Servicegroup sorted by Service name.
+var SortedServicesGroups []*ServiceGroup
+
+func init() {
+	AllServicesByGroup = groupServices(AllServices)
+
+	for _, sg := range AllServicesByGroup {
+		SortedServicesGroups = append(SortedServicesGroups, sg)
+	}
+	sort.Slice(SortedServicesGroups, func(i, j int) bool {
+		return SortedServicesGroups[i].Service() < SortedServicesGroups[j].Service()
+	})
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/mock/BUILD

@@ -0,0 +1,31 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["mock.go"],
+    importpath = "k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/mock",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/cloudprovider/providers/gce/cloud:go_default_library",
+        "//pkg/cloudprovider/providers/gce/cloud/filter:go_default_library",
+        "//pkg/cloudprovider/providers/gce/cloud/meta:go_default_library",
+        "//vendor/google.golang.org/api/compute/v0.alpha:go_default_library",
+        "//vendor/google.golang.org/api/compute/v0.beta:go_default_library",
+        "//vendor/google.golang.org/api/compute/v1:go_default_library",
+        "//vendor/google.golang.org/api/googleapi:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/mock/mock.go

@@ -0,0 +1,552 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package mock encapsulates mocks for testing GCE provider functionality.
+// These methods are used to override the mock objects' methods in order to
+// intercept the standard processing and to add custom logic for test purposes.
+//
+//  // Example usage:
+// cloud := cloud.NewMockGCE()
+// cloud.MockTargetPools.AddInstanceHook = mock.AddInstanceHook
+package mock
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"sync"
+
+	alpha "google.golang.org/api/compute/v0.alpha"
+	beta "google.golang.org/api/compute/v0.beta"
+	ga "google.golang.org/api/compute/v1"
+	"google.golang.org/api/googleapi"
+	cloud "k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+var (
+	// InUseError is a shared variable with error code StatusBadRequest for error verification.
+	InUseError = &googleapi.Error{Code: http.StatusBadRequest, Message: "It's being used by god."}
+	// InternalServerError is shared variable with error code StatusInternalServerError for error verification.
+	InternalServerError = &googleapi.Error{Code: http.StatusInternalServerError}
+)
+
+// gceObject is an abstraction of all GCE API object in go client
+type gceObject interface {
+	MarshalJSON() ([]byte, error)
+}
+
+// AddInstanceHook mocks adding a Instance to MockTargetPools
+func AddInstanceHook(ctx context.Context, key *meta.Key, req *ga.TargetPoolsAddInstanceRequest, m *cloud.MockTargetPools) error {
+	pool, err := m.Get(ctx, key)
+	if err != nil {
+		return &googleapi.Error{
+			Code:    http.StatusNotFound,
+			Message: fmt.Sprintf("Key: %s was not found in TargetPools", key.String()),
+		}
+	}
+
+	for _, instance := range req.Instances {
+		pool.Instances = append(pool.Instances, instance.Instance)
+	}
+
+	return nil
+}
+
+// RemoveInstanceHook mocks removing a Instance from MockTargetPools
+func RemoveInstanceHook(ctx context.Context, key *meta.Key, req *ga.TargetPoolsRemoveInstanceRequest, m *cloud.MockTargetPools) error {
+	pool, err := m.Get(ctx, key)
+	if err != nil {
+		return &googleapi.Error{
+			Code:    http.StatusNotFound,
+			Message: fmt.Sprintf("Key: %s was not found in TargetPools", key.String()),
+		}
+	}
+
+	for _, instanceToRemove := range req.Instances {
+		for i, instance := range pool.Instances {
+			if instanceToRemove.Instance == instance {
+				// Delete instance from pool.Instances without preserving order
+				pool.Instances[i] = pool.Instances[len(pool.Instances)-1]
+				pool.Instances = pool.Instances[:len(pool.Instances)-1]
+				break
+			}
+		}
+	}
+
+	return nil
+}
+
+func convertAndInsertAlphaForwardingRule(key *meta.Key, obj gceObject, mRules map[meta.Key]*cloud.MockForwardingRulesObj, version meta.Version, projectID string) (bool, error) {
+	if !key.Valid() {
+		return true, fmt.Errorf("invalid GCE key (%+v)", key)
+	}
+
+	if _, ok := mRules[*key]; ok {
+		err := &googleapi.Error{
+			Code:    http.StatusConflict,
+			Message: fmt.Sprintf("MockForwardingRule %v exists", key),
+		}
+		return true, err
+	}
+
+	enc, err := obj.MarshalJSON()
+	if err != nil {
+		return true, err
+	}
+	var fwdRule alpha.ForwardingRule
+	if err := json.Unmarshal(enc, &fwdRule); err != nil {
+		return true, err
+	}
+	// Set the default values for the Alpha fields.
+	if fwdRule.NetworkTier == "" {
+		fwdRule.NetworkTier = cloud.NetworkTierDefault.ToGCEValue()
+	}
+
+	fwdRule.Name = key.Name
+	if fwdRule.SelfLink == "" {
+		fwdRule.SelfLink = cloud.SelfLink(version, projectID, "forwardingRules", key)
+	}
+
+	mRules[*key] = &cloud.MockForwardingRulesObj{Obj: fwdRule}
+	return true, nil
+}
+
+// InsertFwdRuleHook mocks inserting a ForwardingRule. ForwardingRules are
+// expected to default to Premium tier if no NetworkTier is specified.
+func InsertFwdRuleHook(ctx context.Context, key *meta.Key, obj *ga.ForwardingRule, m *cloud.MockForwardingRules) (bool, error) {
+	m.Lock.Lock()
+	defer m.Lock.Unlock()
+
+	projectID := m.ProjectRouter.ProjectID(ctx, meta.VersionGA, "forwardingRules")
+	return convertAndInsertAlphaForwardingRule(key, obj, m.Objects, meta.VersionGA, projectID)
+}
+
+// InsertBetaFwdRuleHook mocks inserting a BetaForwardingRule.
+func InsertBetaFwdRuleHook(ctx context.Context, key *meta.Key, obj *beta.ForwardingRule, m *cloud.MockForwardingRules) (bool, error) {
+	m.Lock.Lock()
+	defer m.Lock.Unlock()
+
+	projectID := m.ProjectRouter.ProjectID(ctx, meta.VersionBeta, "forwardingRules")
+	return convertAndInsertAlphaForwardingRule(key, obj, m.Objects, meta.VersionBeta, projectID)
+}
+
+// InsertAlphaFwdRuleHook mocks inserting an AlphaForwardingRule.
+func InsertAlphaFwdRuleHook(ctx context.Context, key *meta.Key, obj *alpha.ForwardingRule, m *cloud.MockForwardingRules) (bool, error) {
+	m.Lock.Lock()
+	defer m.Lock.Unlock()
+
+	projectID := m.ProjectRouter.ProjectID(ctx, meta.VersionAlpha, "forwardingRules")
+	return convertAndInsertAlphaForwardingRule(key, obj, m.Objects, meta.VersionAlpha, projectID)
+}
+
+// AddressAttributes maps from Address key to a map of Instances
+type AddressAttributes struct {
+	IPCounter int // Used to assign Addresses with no IP a unique IP address
+}
+
+func convertAndInsertAlphaAddress(key *meta.Key, obj gceObject, mAddrs map[meta.Key]*cloud.MockAddressesObj, version meta.Version, projectID string, addressAttrs AddressAttributes) (bool, error) {
+	if !key.Valid() {
+		return true, fmt.Errorf("invalid GCE key (%+v)", key)
+	}
+
+	if _, ok := mAddrs[*key]; ok {
+		err := &googleapi.Error{
+			Code:    http.StatusConflict,
+			Message: fmt.Sprintf("MockAddresses %v exists", key),
+		}
+		return true, err
+	}
+
+	enc, err := obj.MarshalJSON()
+	if err != nil {
+		return true, err
+	}
+	var addr alpha.Address
+	if err := json.Unmarshal(enc, &addr); err != nil {
+		return true, err
+	}
+
+	// Set default address type if not present.
+	if addr.AddressType == "" {
+		addr.AddressType = string(cloud.SchemeExternal)
+	}
+
+	var existingAddresses []*ga.Address
+	for _, obj := range mAddrs {
+		existingAddresses = append(existingAddresses, obj.ToGA())
+	}
+
+	for _, existingAddr := range existingAddresses {
+		if addr.Address == existingAddr.Address {
+			msg := fmt.Sprintf("MockAddresses IP %v in use", addr.Address)
+
+			// When the IP is already in use, this call returns a StatusBadRequest
+			// if the address is an external address, and StatusConflict if an
+			// internal address. This is to be consistent with actual GCE API.
+			errorCode := http.StatusConflict
+			if addr.AddressType == string(cloud.SchemeExternal) {
+				errorCode = http.StatusBadRequest
+			}
+
+			return true, &googleapi.Error{Code: errorCode, Message: msg}
+		}
+	}
+
+	// Set default values used in tests
+	addr.Name = key.Name
+	if addr.SelfLink == "" {
+		addr.SelfLink = cloud.SelfLink(version, projectID, "addresses", key)
+	}
+
+	if addr.Address == "" {
+		addr.Address = fmt.Sprintf("1.2.3.%d", addressAttrs.IPCounter)
+		addressAttrs.IPCounter++
+	}
+
+	// Set the default values for the Alpha fields.
+	if addr.NetworkTier == "" {
+		addr.NetworkTier = cloud.NetworkTierDefault.ToGCEValue()
+	}
+
+	mAddrs[*key] = &cloud.MockAddressesObj{Obj: addr}
+	return true, nil
+}
+
+// InsertAddressHook mocks inserting an Address.
+func InsertAddressHook(ctx context.Context, key *meta.Key, obj *ga.Address, m *cloud.MockAddresses) (bool, error) {
+	m.Lock.Lock()
+	defer m.Lock.Unlock()
+
+	projectID := m.ProjectRouter.ProjectID(ctx, meta.VersionGA, "addresses")
+	return convertAndInsertAlphaAddress(key, obj, m.Objects, meta.VersionGA, projectID, m.X.(AddressAttributes))
+}
+
+// InsertBetaAddressHook mocks inserting a BetaAddress.
+func InsertBetaAddressHook(ctx context.Context, key *meta.Key, obj *beta.Address, m *cloud.MockAddresses) (bool, error) {
+	m.Lock.Lock()
+	defer m.Lock.Unlock()
+
+	projectID := m.ProjectRouter.ProjectID(ctx, meta.VersionBeta, "addresses")
+	return convertAndInsertAlphaAddress(key, obj, m.Objects, meta.VersionBeta, projectID, m.X.(AddressAttributes))
+}
+
+// InsertAlphaAddressHook mocks inserting an Address. Addresses are expected to
+// default to Premium tier if no NetworkTier is specified.
+func InsertAlphaAddressHook(ctx context.Context, key *meta.Key, obj *alpha.Address, m *cloud.MockAlphaAddresses) (bool, error) {
+	m.Lock.Lock()
+	defer m.Lock.Unlock()
+
+	projectID := m.ProjectRouter.ProjectID(ctx, meta.VersionBeta, "addresses")
+	return convertAndInsertAlphaAddress(key, obj, m.Objects, meta.VersionAlpha, projectID, m.X.(AddressAttributes))
+}
+
+// InstanceGroupAttributes maps from InstanceGroup key to a map of Instances
+type InstanceGroupAttributes struct {
+	InstanceMap map[meta.Key]map[string]*ga.InstanceWithNamedPorts
+	Lock        *sync.Mutex
+}
+
+// AddInstances adds a list of Instances passed by InstanceReference
+func (igAttrs *InstanceGroupAttributes) AddInstances(key *meta.Key, instanceRefs []*ga.InstanceReference) error {
+	igAttrs.Lock.Lock()
+	defer igAttrs.Lock.Unlock()
+
+	instancesWithNamedPorts, ok := igAttrs.InstanceMap[*key]
+	if !ok {
+		instancesWithNamedPorts = make(map[string]*ga.InstanceWithNamedPorts)
+	}
+
+	for _, instance := range instanceRefs {
+		iWithPort := &ga.InstanceWithNamedPorts{
+			Instance: instance.Instance,
+		}
+
+		instancesWithNamedPorts[instance.Instance] = iWithPort
+	}
+
+	igAttrs.InstanceMap[*key] = instancesWithNamedPorts
+	return nil
+}
+
+// RemoveInstances removes a list of Instances passed by InstanceReference
+func (igAttrs *InstanceGroupAttributes) RemoveInstances(key *meta.Key, instanceRefs []*ga.InstanceReference) error {
+	igAttrs.Lock.Lock()
+	defer igAttrs.Lock.Unlock()
+
+	instancesWithNamedPorts, ok := igAttrs.InstanceMap[*key]
+	if !ok {
+		instancesWithNamedPorts = make(map[string]*ga.InstanceWithNamedPorts)
+	}
+
+	for _, instanceToRemove := range instanceRefs {
+		if _, ok := instancesWithNamedPorts[instanceToRemove.Instance]; ok {
+			delete(instancesWithNamedPorts, instanceToRemove.Instance)
+		} else {
+			return &googleapi.Error{
+				Code:    http.StatusBadRequest,
+				Message: fmt.Sprintf("%s is not a member of %s", instanceToRemove.Instance, key.String()),
+			}
+		}
+	}
+
+	igAttrs.InstanceMap[*key] = instancesWithNamedPorts
+	return nil
+}
+
+// List gets a list of InstanceWithNamedPorts
+func (igAttrs *InstanceGroupAttributes) List(key *meta.Key) []*ga.InstanceWithNamedPorts {
+	igAttrs.Lock.Lock()
+	defer igAttrs.Lock.Unlock()
+
+	instancesWithNamedPorts, ok := igAttrs.InstanceMap[*key]
+	if !ok {
+		instancesWithNamedPorts = make(map[string]*ga.InstanceWithNamedPorts)
+	}
+
+	var instanceList []*ga.InstanceWithNamedPorts
+	for _, val := range instancesWithNamedPorts {
+		instanceList = append(instanceList, val)
+	}
+
+	return instanceList
+}
+
+// AddInstancesHook mocks adding instances from an InstanceGroup
+func AddInstancesHook(ctx context.Context, key *meta.Key, req *ga.InstanceGroupsAddInstancesRequest, m *cloud.MockInstanceGroups) error {
+	_, err := m.Get(ctx, key)
+	if err != nil {
+		return &googleapi.Error{
+			Code:    http.StatusNotFound,
+			Message: fmt.Sprintf("Key: %s was not found in InstanceGroups", key.String()),
+		}
+	}
+
+	var attrs InstanceGroupAttributes
+	attrs = m.X.(InstanceGroupAttributes)
+	attrs.AddInstances(key, req.Instances)
+	m.X = attrs
+	return nil
+}
+
+// ListInstancesHook mocks listing instances from an InstanceGroup
+func ListInstancesHook(ctx context.Context, key *meta.Key, req *ga.InstanceGroupsListInstancesRequest, filter *filter.F, m *cloud.MockInstanceGroups) ([]*ga.InstanceWithNamedPorts, error) {
+	_, err := m.Get(ctx, key)
+	if err != nil {
+		return nil, &googleapi.Error{
+			Code:    http.StatusNotFound,
+			Message: fmt.Sprintf("Key: %s was not found in InstanceGroups", key.String()),
+		}
+	}
+
+	var attrs InstanceGroupAttributes
+	attrs = m.X.(InstanceGroupAttributes)
+	instances := attrs.List(key)
+
+	return instances, nil
+}
+
+// RemoveInstancesHook mocks removing instances from an InstanceGroup
+func RemoveInstancesHook(ctx context.Context, key *meta.Key, req *ga.InstanceGroupsRemoveInstancesRequest, m *cloud.MockInstanceGroups) error {
+	_, err := m.Get(ctx, key)
+	if err != nil {
+		return &googleapi.Error{
+			Code:    http.StatusNotFound,
+			Message: fmt.Sprintf("Key: %s was not found in InstanceGroups", key.String()),
+		}
+	}
+
+	var attrs InstanceGroupAttributes
+	attrs = m.X.(InstanceGroupAttributes)
+	attrs.RemoveInstances(key, req.Instances)
+	m.X = attrs
+	return nil
+}
+
+// UpdateFirewallHook defines the hook for updating a Firewall. It replaces the
+// object with the same key in the mock with the updated object.
+func UpdateFirewallHook(ctx context.Context, key *meta.Key, obj *ga.Firewall, m *cloud.MockFirewalls) error {
+	_, err := m.Get(ctx, key)
+	if err != nil {
+		return &googleapi.Error{
+			Code:    http.StatusNotFound,
+			Message: fmt.Sprintf("Key: %s was not found in Firewalls", key.String()),
+		}
+	}
+
+	obj.Name = key.Name
+	projectID := m.ProjectRouter.ProjectID(ctx, "ga", "firewalls")
+	obj.SelfLink = cloud.SelfLink(meta.VersionGA, projectID, "firewalls", key)
+
+	m.Objects[*key] = &cloud.MockFirewallsObj{Obj: obj}
+	return nil
+}
+
+// UpdateHealthCheckHook defines the hook for updating a HealthCheck. It
+// replaces the object with the same key in the mock with the updated object.
+func UpdateHealthCheckHook(ctx context.Context, key *meta.Key, obj *ga.HealthCheck, m *cloud.MockHealthChecks) error {
+	_, err := m.Get(ctx, key)
+	if err != nil {
+		return &googleapi.Error{
+			Code:    http.StatusNotFound,
+			Message: fmt.Sprintf("Key: %s was not found in HealthChecks", key.String()),
+		}
+	}
+
+	obj.Name = key.Name
+	projectID := m.ProjectRouter.ProjectID(ctx, "ga", "healthChecks")
+	obj.SelfLink = cloud.SelfLink(meta.VersionGA, projectID, "healthChecks", key)
+
+	m.Objects[*key] = &cloud.MockHealthChecksObj{Obj: obj}
+	return nil
+}
+
+// UpdateRegionBackendServiceHook defines the hook for updating a Region
+// BackendsService. It replaces the object with the same key in the mock with
+// the updated object.
+func UpdateRegionBackendServiceHook(ctx context.Context, key *meta.Key, obj *ga.BackendService, m *cloud.MockRegionBackendServices) error {
+	_, err := m.Get(ctx, key)
+	if err != nil {
+		return &googleapi.Error{
+			Code:    http.StatusNotFound,
+			Message: fmt.Sprintf("Key: %s was not found in RegionBackendServices", key.String()),
+		}
+	}
+
+	obj.Name = key.Name
+	projectID := m.ProjectRouter.ProjectID(ctx, "ga", "backendServices")
+	obj.SelfLink = cloud.SelfLink(meta.VersionGA, projectID, "backendServices", key)
+
+	m.Objects[*key] = &cloud.MockRegionBackendServicesObj{Obj: obj}
+	return nil
+}
+
+// InsertFirewallsUnauthorizedErrHook mocks firewall insertion. A forbidden error will be thrown as return.
+func InsertFirewallsUnauthorizedErrHook(ctx context.Context, key *meta.Key, obj *ga.Firewall, m *cloud.MockFirewalls) (bool, error) {
+	return true, &googleapi.Error{Code: http.StatusForbidden}
+}
+
+// UpdateFirewallsUnauthorizedErrHook mocks firewall updating. A forbidden error will be thrown as return.
+func UpdateFirewallsUnauthorizedErrHook(ctx context.Context, key *meta.Key, obj *ga.Firewall, m *cloud.MockFirewalls) error {
+	return &googleapi.Error{Code: http.StatusForbidden}
+}
+
+// DeleteFirewallsUnauthorizedErrHook mocks firewall deletion. A forbidden error will be thrown as return.
+func DeleteFirewallsUnauthorizedErrHook(ctx context.Context, key *meta.Key, m *cloud.MockFirewalls) (bool, error) {
+	return true, &googleapi.Error{Code: http.StatusForbidden}
+}
+
+// GetFirewallsUnauthorizedErrHook mocks firewall information retrival. A forbidden error will be thrown as return.
+func GetFirewallsUnauthorizedErrHook(ctx context.Context, key *meta.Key, m *cloud.MockFirewalls) (bool, *ga.Firewall, error) {
+	return true, nil, &googleapi.Error{Code: http.StatusForbidden}
+}
+
+// GetTargetPoolInternalErrHook mocks getting target pool. It returns a internal server error.
+func GetTargetPoolInternalErrHook(ctx context.Context, key *meta.Key, m *cloud.MockTargetPools) (bool, *ga.TargetPool, error) {
+	return true, nil, InternalServerError
+}
+
+// GetForwardingRulesInternalErrHook mocks getting forwarding rules and returns an internal server error.
+func GetForwardingRulesInternalErrHook(ctx context.Context, key *meta.Key, m *cloud.MockForwardingRules) (bool, *ga.ForwardingRule, error) {
+	return true, nil, InternalServerError
+}
+
+// GetAddressesInternalErrHook mocks getting network address and returns an internal server error.
+func GetAddressesInternalErrHook(ctx context.Context, key *meta.Key, m *cloud.MockAddresses) (bool, *ga.Address, error) {
+	return true, nil, InternalServerError
+}
+
+// GetHTTPHealthChecksInternalErrHook mocks getting http health check and returns an internal server error.
+func GetHTTPHealthChecksInternalErrHook(ctx context.Context, key *meta.Key, m *cloud.MockHttpHealthChecks) (bool, *ga.HttpHealthCheck, error) {
+	return true, nil, InternalServerError
+}
+
+// InsertTargetPoolsInternalErrHook mocks getting target pool and returns an internal server error.
+func InsertTargetPoolsInternalErrHook(ctx context.Context, key *meta.Key, obj *ga.TargetPool, m *cloud.MockTargetPools) (bool, error) {
+	return true, InternalServerError
+}
+
+// InsertForwardingRulesInternalErrHook mocks getting forwarding rule and returns an internal server error.
+func InsertForwardingRulesInternalErrHook(ctx context.Context, key *meta.Key, obj *ga.ForwardingRule, m *cloud.MockForwardingRules) (bool, error) {
+	return true, InternalServerError
+}
+
+// DeleteAddressesNotFoundErrHook mocks deleting network address and returns a not found error.
+func DeleteAddressesNotFoundErrHook(ctx context.Context, key *meta.Key, m *cloud.MockAddresses) (bool, error) {
+	return true, &googleapi.Error{Code: http.StatusNotFound}
+}
+
+// DeleteAddressesInternalErrHook mocks deleting address and returns an internal server error.
+func DeleteAddressesInternalErrHook(ctx context.Context, key *meta.Key, m *cloud.MockAddresses) (bool, error) {
+	return true, InternalServerError
+}
+
+// GetRegionBackendServicesErrHook mocks getting region backend service and returns an internal server error.
+func GetRegionBackendServicesErrHook(ctx context.Context, key *meta.Key, m *cloud.MockRegionBackendServices) (bool, *ga.BackendService, error) {
+	return true, nil, InternalServerError
+}
+
+// UpdateRegionBackendServicesErrHook mocks updating a reegion backend service and returns an internal server error.
+func UpdateRegionBackendServicesErrHook(ctx context.Context, key *meta.Key, svc *ga.BackendService, m *cloud.MockRegionBackendServices) error {
+	return InternalServerError
+}
+
+// DeleteRegionBackendServicesErrHook mocks deleting region backend service and returns an internal server error.
+func DeleteRegionBackendServicesErrHook(ctx context.Context, key *meta.Key, m *cloud.MockRegionBackendServices) (bool, error) {
+	return true, InternalServerError
+}
+
+// DeleteRegionBackendServicesInUseErrHook mocks deleting region backend service and returns an InUseError.
+func DeleteRegionBackendServicesInUseErrHook(ctx context.Context, key *meta.Key, m *cloud.MockRegionBackendServices) (bool, error) {
+	return true, InUseError
+}
+
+// GetInstanceGroupInternalErrHook mocks getting instance group and returns an internal server error.
+func GetInstanceGroupInternalErrHook(ctx context.Context, key *meta.Key, m *cloud.MockInstanceGroups) (bool, *ga.InstanceGroup, error) {
+	return true, nil, InternalServerError
+}
+
+// GetHealthChecksInternalErrHook mocks getting health check and returns an internal server erorr.
+func GetHealthChecksInternalErrHook(ctx context.Context, key *meta.Key, m *cloud.MockHealthChecks) (bool, *ga.HealthCheck, error) {
+	return true, nil, InternalServerError
+}
+
+// DeleteHealthChecksInternalErrHook mocks deleting health check and returns an internal server error.
+func DeleteHealthChecksInternalErrHook(ctx context.Context, key *meta.Key, m *cloud.MockHealthChecks) (bool, error) {
+	return true, InternalServerError
+}
+
+// DeleteHealthChecksInuseErrHook mocks deleting health check and returns an in use error.
+func DeleteHealthChecksInuseErrHook(ctx context.Context, key *meta.Key, m *cloud.MockHealthChecks) (bool, error) {
+	return true, InUseError
+}
+
+// DeleteForwardingRuleErrHook mocks deleting forwarding rule and returns an internal server error.
+func DeleteForwardingRuleErrHook(ctx context.Context, key *meta.Key, m *cloud.MockForwardingRules) (bool, error) {
+	return true, InternalServerError
+}
+
+// ListZonesInternalErrHook mocks listing zone and returns an internal server error.
+func ListZonesInternalErrHook(ctx context.Context, fl *filter.F, m *cloud.MockZones) (bool, []*ga.Zone, error) {
+	return true, []*ga.Zone{}, InternalServerError
+}
+
+// DeleteInstanceGroupInternalErrHook mocks deleting instance group and returns an internal server error.
+func DeleteInstanceGroupInternalErrHook(ctx context.Context, key *meta.Key, m *cloud.MockInstanceGroups) (bool, error) {
+	return true, InternalServerError
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/mock_test.go

@@ -0,0 +1,151 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	alpha "google.golang.org/api/compute/v0.alpha"
+	beta "google.golang.org/api/compute/v0.beta"
+	ga "google.golang.org/api/compute/v1"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func TestMocks(t *testing.T) {
+	t.Parallel()
+
+	// This test uses Addresses, but the logic that is generated is the same for
+	// other basic objects.
+	const region = "us-central1"
+
+	ctx := context.Background()
+	pr := &SingleProjectRouter{"mock-project"}
+	mock := NewMockGCE(pr)
+
+	keyAlpha := meta.RegionalKey("key-alpha", region)
+	keyBeta := meta.RegionalKey("key-beta", region)
+	keyGA := meta.RegionalKey("key-ga", region)
+	key := keyAlpha
+
+	// Get not found.
+	if _, err := mock.AlphaAddresses().Get(ctx, key); err == nil {
+		t.Errorf("AlphaAddresses().Get(%v, %v) = _, nil; want error", ctx, key)
+	}
+	if _, err := mock.BetaAddresses().Get(ctx, key); err == nil {
+		t.Errorf("BetaAddresses().Get(%v, %v) = _, nil; want error", ctx, key)
+	}
+	if _, err := mock.Addresses().Get(ctx, key); err == nil {
+		t.Errorf("Addresses().Get(%v, %v) = _, nil; want error", ctx, key)
+	}
+	// Insert.
+	{
+		obj := &alpha.Address{}
+		if err := mock.AlphaAddresses().Insert(ctx, keyAlpha, obj); err != nil {
+			t.Errorf("AlphaAddresses().Insert(%v, %v, %v) = %v; want nil", ctx, key, obj, err)
+		}
+	}
+	{
+		obj := &beta.Address{}
+		if err := mock.BetaAddresses().Insert(ctx, keyBeta, obj); err != nil {
+			t.Errorf("BetaAddresses().Insert(%v, %v, %v) = %v; want nil", ctx, key, obj, err)
+		}
+	}
+	{
+		obj := &ga.Address{}
+		if err := mock.Addresses().Insert(ctx, keyGA, &ga.Address{Name: "ga"}); err != nil {
+			t.Errorf("Addresses().Insert(%v, %v, %v) = %v; want nil", ctx, key, obj, err)
+		}
+	}
+	// Get across versions.
+	if obj, err := mock.AlphaAddresses().Get(ctx, key); err != nil {
+		t.Errorf("AlphaAddresses().Get(%v, %v) = %v, %v; want nil", ctx, key, obj, err)
+	}
+	if obj, err := mock.BetaAddresses().Get(ctx, key); err != nil {
+		t.Errorf("BetaAddresses().Get(%v, %v) = %v, %v; want nil", ctx, key, obj, err)
+	}
+	if obj, err := mock.Addresses().Get(ctx, key); err != nil {
+		t.Errorf("Addresses().Get(%v, %v) = %v, %v; want nil", ctx, key, obj, err)
+	}
+	// List across versions.
+	want := map[string]bool{"key-alpha": true, "key-beta": true, "key-ga": true}
+	{
+		objs, err := mock.AlphaAddresses().List(ctx, region, filter.None)
+		if err != nil {
+			t.Errorf("AlphaAddresses().List(%v, %v, %v) = %v, %v; want _, nil", ctx, region, filter.None, objs, err)
+		} else {
+			got := map[string]bool{}
+			for _, obj := range objs {
+				got[obj.Name] = true
+			}
+			if !reflect.DeepEqual(got, want) {
+				t.Errorf("AlphaAddresses().List(); got %+v, want %+v", got, want)
+			}
+		}
+	}
+	{
+		objs, err := mock.BetaAddresses().List(ctx, region, filter.None)
+		if err != nil {
+			t.Errorf("BetaAddresses().List(%v, %v, %v) = %v, %v; want _, nil", ctx, region, filter.None, objs, err)
+		} else {
+			got := map[string]bool{}
+			for _, obj := range objs {
+				got[obj.Name] = true
+			}
+			if !reflect.DeepEqual(got, want) {
+				t.Errorf("AlphaAddresses().List(); got %+v, want %+v", got, want)
+			}
+		}
+	}
+	{
+		objs, err := mock.Addresses().List(ctx, region, filter.None)
+		if err != nil {
+			t.Errorf("Addresses().List(%v, %v, %v) = %v, %v; want _, nil", ctx, region, filter.None, objs, err)
+		} else {
+			got := map[string]bool{}
+			for _, obj := range objs {
+				got[obj.Name] = true
+			}
+			if !reflect.DeepEqual(got, want) {
+				t.Errorf("AlphaAddresses().List(); got %+v, want %+v", got, want)
+			}
+		}
+	}
+	// Delete across versions.
+	if err := mock.AlphaAddresses().Delete(ctx, keyAlpha); err != nil {
+		t.Errorf("AlphaAddresses().Delete(%v, %v) = %v; want nil", ctx, key, err)
+	}
+	if err := mock.BetaAddresses().Delete(ctx, keyBeta); err != nil {
+		t.Errorf("BetaAddresses().Delete(%v, %v) = %v; want nil", ctx, key, err)
+	}
+	if err := mock.Addresses().Delete(ctx, keyGA); err != nil {
+		t.Errorf("Addresses().Delete(%v, %v) = %v; want nil", ctx, key, err)
+	}
+	// Delete not found.
+	if err := mock.AlphaAddresses().Delete(ctx, keyAlpha); err == nil {
+		t.Errorf("AlphaAddresses().Delete(%v, %v) = nil; want error", ctx, key)
+	}
+	if err := mock.BetaAddresses().Delete(ctx, keyBeta); err == nil {
+		t.Errorf("BetaAddresses().Delete(%v, %v) = nil; want error", ctx, key)
+	}
+	if err := mock.Addresses().Delete(ctx, keyGA); err == nil {
+		t.Errorf("Addresses().Delete(%v, %v) = nil; want error", ctx, key)
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/op.go

@@ -0,0 +1,218 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/golang/glog"
+
+	alpha "google.golang.org/api/compute/v0.alpha"
+	beta "google.golang.org/api/compute/v0.beta"
+	ga "google.golang.org/api/compute/v1"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+const (
+	operationStatusDone = "DONE"
+)
+
+// operation is a GCE operation that can be watied on.
+type operation interface {
+	// isDone queries GCE for the done status. This call can block.
+	isDone(ctx context.Context) (bool, error)
+	// error returns the resulting error of the operation. This may be nil if the operations
+	// was successful.
+	error() error
+	// rateLimitKey returns the rate limit key to use for the given operation.
+	// This rate limit will govern how fast the server will be polled for
+	// operation completion status.
+	rateLimitKey() *RateLimitKey
+}
+
+type gaOperation struct {
+	s         *Service
+	projectID string
+	key       *meta.Key
+	err       error
+}
+
+func (o *gaOperation) String() string {
+	return fmt.Sprintf("gaOperation{%q, %v}", o.projectID, o.key)
+}
+
+func (o *gaOperation) isDone(ctx context.Context) (bool, error) {
+	var (
+		op  *ga.Operation
+		err error
+	)
+
+	switch o.key.Type() {
+	case meta.Regional:
+		op, err = o.s.GA.RegionOperations.Get(o.projectID, o.key.Region, o.key.Name).Context(ctx).Do()
+		glog.V(5).Infof("GA.RegionOperations.Get(%v, %v, %v) = %+v, %v; ctx = %v", o.projectID, o.key.Region, o.key.Name, op, err, ctx)
+	case meta.Zonal:
+		op, err = o.s.GA.ZoneOperations.Get(o.projectID, o.key.Zone, o.key.Name).Context(ctx).Do()
+		glog.V(5).Infof("GA.ZoneOperations.Get(%v, %v, %v) = %+v, %v; ctx = %v", o.projectID, o.key.Zone, o.key.Name, op, err, ctx)
+	case meta.Global:
+		op, err = o.s.GA.GlobalOperations.Get(o.projectID, o.key.Name).Context(ctx).Do()
+		glog.V(5).Infof("GA.GlobalOperations.Get(%v, %v) = %+v, %v; ctx = %v", o.projectID, o.key.Name, op, err, ctx)
+	default:
+		return false, fmt.Errorf("invalid key type: %#v", o.key)
+	}
+	if err != nil {
+		return false, err
+	}
+	if op == nil || op.Status != operationStatusDone {
+		return false, nil
+	}
+
+	if op.Error != nil && len(op.Error.Errors) > 0 && op.Error.Errors[0] != nil {
+		e := op.Error.Errors[0]
+		o.err = &GCEOperationError{HTTPStatusCode: op.HTTPStatusCode, Code: e.Code, Message: e.Message}
+	}
+	return true, nil
+}
+
+func (o *gaOperation) rateLimitKey() *RateLimitKey {
+	return &RateLimitKey{
+		ProjectID: o.projectID,
+		Operation: "Get",
+		Service:   "Operations",
+		Version:   meta.VersionGA,
+	}
+}
+
+func (o *gaOperation) error() error {
+	return o.err
+}
+
+type alphaOperation struct {
+	s         *Service
+	projectID string
+	key       *meta.Key
+	err       error
+}
+
+func (o *alphaOperation) String() string {
+	return fmt.Sprintf("alphaOperation{%q, %v}", o.projectID, o.key)
+}
+
+func (o *alphaOperation) isDone(ctx context.Context) (bool, error) {
+	var (
+		op  *alpha.Operation
+		err error
+	)
+
+	switch o.key.Type() {
+	case meta.Regional:
+		op, err = o.s.Alpha.RegionOperations.Get(o.projectID, o.key.Region, o.key.Name).Context(ctx).Do()
+		glog.V(5).Infof("Alpha.RegionOperations.Get(%v, %v, %v) = %+v, %v; ctx = %v", o.projectID, o.key.Region, o.key.Name, op, err, ctx)
+	case meta.Zonal:
+		op, err = o.s.Alpha.ZoneOperations.Get(o.projectID, o.key.Zone, o.key.Name).Context(ctx).Do()
+		glog.V(5).Infof("Alpha.ZoneOperations.Get(%v, %v, %v) = %+v, %v; ctx = %v", o.projectID, o.key.Zone, o.key.Name, op, err, ctx)
+	case meta.Global:
+		op, err = o.s.Alpha.GlobalOperations.Get(o.projectID, o.key.Name).Context(ctx).Do()
+		glog.V(5).Infof("Alpha.GlobalOperations.Get(%v, %v) = %+v, %v; ctx = %v", o.projectID, o.key.Name, op, err, ctx)
+	default:
+		return false, fmt.Errorf("invalid key type: %#v", o.key)
+	}
+	if err != nil {
+		return false, err
+	}
+	if op == nil || op.Status != operationStatusDone {
+		return false, nil
+	}
+
+	if op.Error != nil && len(op.Error.Errors) > 0 && op.Error.Errors[0] != nil {
+		e := op.Error.Errors[0]
+		o.err = &GCEOperationError{HTTPStatusCode: op.HTTPStatusCode, Code: e.Code, Message: e.Message}
+	}
+	return true, nil
+}
+
+func (o *alphaOperation) rateLimitKey() *RateLimitKey {
+	return &RateLimitKey{
+		ProjectID: o.projectID,
+		Operation: "Get",
+		Service:   "Operations",
+		Version:   meta.VersionAlpha,
+	}
+}
+
+func (o *alphaOperation) error() error {
+	return o.err
+}
+
+type betaOperation struct {
+	s         *Service
+	projectID string
+	key       *meta.Key
+	err       error
+}
+
+func (o *betaOperation) String() string {
+	return fmt.Sprintf("betaOperation{%q, %v}", o.projectID, o.key)
+}
+
+func (o *betaOperation) isDone(ctx context.Context) (bool, error) {
+	var (
+		op  *beta.Operation
+		err error
+	)
+
+	switch o.key.Type() {
+	case meta.Regional:
+		op, err = o.s.Beta.RegionOperations.Get(o.projectID, o.key.Region, o.key.Name).Context(ctx).Do()
+		glog.V(5).Infof("Beta.RegionOperations.Get(%v, %v, %v) = %+v, %v; ctx = %v", o.projectID, o.key.Region, o.key.Name, op, err, ctx)
+	case meta.Zonal:
+		op, err = o.s.Beta.ZoneOperations.Get(o.projectID, o.key.Zone, o.key.Name).Context(ctx).Do()
+		glog.V(5).Infof("Beta.ZoneOperations.Get(%v, %v, %v) = %+v, %v; ctx = %v", o.projectID, o.key.Zone, o.key.Name, op, err, ctx)
+	case meta.Global:
+		op, err = o.s.Beta.GlobalOperations.Get(o.projectID, o.key.Name).Context(ctx).Do()
+		glog.V(5).Infof("Beta.GlobalOperations.Get(%v, %v) = %+v, %v; ctx = %v", o.projectID, o.key.Name, op, err, ctx)
+	default:
+		return false, fmt.Errorf("invalid key type: %#v", o.key)
+	}
+	if err != nil {
+		return false, err
+	}
+	if op == nil || op.Status != operationStatusDone {
+		return false, nil
+	}
+
+	if op.Error != nil && len(op.Error.Errors) > 0 && op.Error.Errors[0] != nil {
+		e := op.Error.Errors[0]
+		o.err = &GCEOperationError{HTTPStatusCode: op.HTTPStatusCode, Code: e.Code, Message: e.Message}
+	}
+	return true, nil
+}
+
+func (o *betaOperation) rateLimitKey() *RateLimitKey {
+	return &RateLimitKey{
+		ProjectID: o.projectID,
+		Operation: "Get",
+		Service:   "Operations",
+		Version:   meta.VersionBeta,
+	}
+}
+
+func (o *betaOperation) error() error {
+	return o.err
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/project.go

@@ -0,0 +1,45 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"context"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+// ProjectRouter routes service calls to the appropriate GCE project.
+type ProjectRouter interface {
+	// ProjectID returns the project ID (non-numeric) to be used for a call
+	// to an API (version,service). Example tuples: ("ga", "ForwardingRules"),
+	// ("alpha", "GlobalAddresses").
+	//
+	// This allows for plumbing different service calls to the appropriate
+	// project, for instance, networking services to a separate project
+	// than instance management.
+	ProjectID(ctx context.Context, version meta.Version, service string) string
+}
+
+// SingleProjectRouter routes all service calls to the same project ID.
+type SingleProjectRouter struct {
+	ID string
+}
+
+// ProjectID returns the project ID to be used for a call to the API.
+func (r *SingleProjectRouter) ProjectID(ctx context.Context, version meta.Version, service string) string {
+	return r.ID
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/ratelimit.go

@@ -0,0 +1,106 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"context"
+	"time"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+// RateLimitKey is a key identifying the operation to be rate limited. The rate limit
+// queue will be determined based on the contents of RateKey.
+type RateLimitKey struct {
+	// ProjectID is the non-numeric ID of the project.
+	ProjectID string
+	// Operation is the specific method being invoked (e.g. "Get", "List").
+	Operation string
+	// Version is the API version of the call.
+	Version meta.Version
+	// Service is the service being invoked (e.g. "Firewalls", "BackendServices")
+	Service string
+}
+
+// RateLimiter is the interface for a rate limiting policy.
+type RateLimiter interface {
+	// Accept uses the RateLimitKey to derive a sleep time for the calling
+	// goroutine. This call will block until the operation is ready for
+	// execution.
+	//
+	// Accept returns an error if the given context ctx was canceled
+	// while waiting for acceptance into the queue.
+	Accept(ctx context.Context, key *RateLimitKey) error
+}
+
+// acceptor is an object which blocks within Accept until a call is allowed to run.
+// Accept is a behavior of the flowcontrol.RateLimiter interface.
+type acceptor interface {
+	// Accept blocks until a call is allowed to run.
+	Accept()
+}
+
+// AcceptRateLimiter wraps an Acceptor with RateLimiter parameters.
+type AcceptRateLimiter struct {
+	// Acceptor is the underlying rate limiter.
+	Acceptor acceptor
+}
+
+// Accept wraps an Acceptor and blocks on Accept or context.Done(). Key is ignored.
+func (rl *AcceptRateLimiter) Accept(ctx context.Context, key *RateLimitKey) error {
+	ch := make(chan struct{})
+	go func() {
+		rl.Acceptor.Accept()
+		close(ch)
+	}()
+	select {
+	case <-ch:
+		break
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+	return nil
+}
+
+// NopRateLimiter is a rate limiter that performs no rate limiting.
+type NopRateLimiter struct {
+}
+
+// Accept everything immediately.
+func (*NopRateLimiter) Accept(ctx context.Context, key *RateLimitKey) error {
+	return nil
+}
+
+// MinimumRateLimiter wraps a RateLimiter and will only call its Accept until the minimum
+// duration has been met or the context is cancelled.
+type MinimumRateLimiter struct {
+	// RateLimiter is the underlying ratelimiter which is called after the mininum time is reacehd.
+	RateLimiter RateLimiter
+	// Minimum is the minimum wait time before the underlying ratelimiter is called.
+	Minimum time.Duration
+}
+
+// Accept blocks on the minimum duration and context. Once the minimum duration is met,
+// the func is blocked on the underlying ratelimiter.
+func (m *MinimumRateLimiter) Accept(ctx context.Context, key *RateLimitKey) error {
+	select {
+	case <-time.After(m.Minimum):
+		return m.RateLimiter.Accept(ctx, key)
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/ratelimit_test.go

@@ -0,0 +1,80 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+type FakeAcceptor struct{ accept func() }
+
+func (f *FakeAcceptor) Accept() {
+	f.accept()
+}
+
+func TestAcceptRateLimiter(t *testing.T) {
+	fa := &FakeAcceptor{accept: func() {}}
+	arl := &AcceptRateLimiter{fa}
+	err := arl.Accept(context.Background(), nil)
+	if err != nil {
+		t.Errorf("AcceptRateLimiter.Accept() = %v, want nil", err)
+	}
+
+	// Use context that has been cancelled and expect a context error returned.
+	ctxCancelled, cancelled := context.WithCancel(context.Background())
+	cancelled()
+	// Verify context is cancelled by now.
+	<-ctxCancelled.Done()
+
+	fa.accept = func() { time.Sleep(1 * time.Second) }
+	err = arl.Accept(ctxCancelled, nil)
+	if err != ctxCancelled.Err() {
+		t.Errorf("AcceptRateLimiter.Accept() = %v, want %v", err, ctxCancelled.Err())
+	}
+}
+
+func TestMinimumRateLimiter(t *testing.T) {
+	fa := &FakeAcceptor{accept: func() {}}
+	arl := &AcceptRateLimiter{fa}
+	var called bool
+	fa.accept = func() { called = true }
+	m := &MinimumRateLimiter{RateLimiter: arl, Minimum: 10 * time.Millisecond}
+
+	err := m.Accept(context.Background(), nil)
+	if err != nil {
+		t.Errorf("MinimumRateLimiter.Accept = %v, want nil", err)
+	}
+	if !called {
+		t.Errorf("`called` = false, want true")
+	}
+
+	// Use context that has been cancelled and expect a context error returned.
+	ctxCancelled, cancelled := context.WithCancel(context.Background())
+	cancelled()
+	// Verify context is cancelled by now.
+	<-ctxCancelled.Done()
+	called = false
+	err = m.Accept(ctxCancelled, nil)
+	if err != ctxCancelled.Err() {
+		t.Errorf("AcceptRateLimiter.Accept() = %v, want %v", err, ctxCancelled.Err())
+	}
+	if called {
+		t.Errorf("`called` = true, want false")
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/service.go

@@ -0,0 +1,110 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/golang/glog"
+
+	alpha "google.golang.org/api/compute/v0.alpha"
+	beta "google.golang.org/api/compute/v0.beta"
+	ga "google.golang.org/api/compute/v1"
+)
+
+// Service is the top-level adapter for all of the different compute API
+// versions.
+type Service struct {
+	GA            *ga.Service
+	Alpha         *alpha.Service
+	Beta          *beta.Service
+	ProjectRouter ProjectRouter
+	RateLimiter   RateLimiter
+}
+
+// wrapOperation wraps a GCE anyOP in a version generic operation type.
+func (s *Service) wrapOperation(anyOp interface{}) (operation, error) {
+	switch o := anyOp.(type) {
+	case *ga.Operation:
+		r, err := ParseResourceURL(o.SelfLink)
+		if err != nil {
+			return nil, err
+		}
+		return &gaOperation{s: s, projectID: r.ProjectID, key: r.Key}, nil
+	case *alpha.Operation:
+		r, err := ParseResourceURL(o.SelfLink)
+		if err != nil {
+			return nil, err
+		}
+		return &alphaOperation{s: s, projectID: r.ProjectID, key: r.Key}, nil
+	case *beta.Operation:
+		r, err := ParseResourceURL(o.SelfLink)
+		if err != nil {
+			return nil, err
+		}
+		return &betaOperation{s: s, projectID: r.ProjectID, key: r.Key}, nil
+	default:
+		return nil, fmt.Errorf("invalid type %T", anyOp)
+	}
+}
+
+// WaitForCompletion of a long running operation. This will poll the state of
+// GCE for the completion status of the given operation. genericOp can be one
+// of alpha, beta, ga Operation types.
+func (s *Service) WaitForCompletion(ctx context.Context, genericOp interface{}) error {
+	op, err := s.wrapOperation(genericOp)
+	if err != nil {
+		glog.Errorf("wrapOperation(%+v) error: %v", genericOp, err)
+		return err
+	}
+
+	return s.pollOperation(ctx, op)
+}
+
+// pollOperation calls operations.isDone until the function comes back true or context is Done.
+// If an error occurs retrieving the operation, the loop will continue until the context is done.
+// This is to prevent a transient error from bubbling up to controller-level logic.
+func (s *Service) pollOperation(ctx context.Context, op operation) error {
+	var pollCount int
+	for {
+		// Check if context has been cancelled. Note that ctx.Done() must be checked before
+		// returning ctx.Err().
+		select {
+		case <-ctx.Done():
+			glog.V(5).Infof("op.pollOperation(%v, %v) not completed, poll count = %d, ctx.Err = %v", ctx, op, pollCount, ctx.Err())
+			return ctx.Err()
+		default:
+			// ctx is not canceled, continue immediately
+		}
+
+		pollCount++
+		glog.V(5).Infof("op.isDone(%v) waiting; op = %v, poll count = %d", ctx, op, pollCount)
+		s.RateLimiter.Accept(ctx, op.rateLimitKey())
+		done, err := op.isDone(ctx)
+		if err != nil {
+			glog.V(5).Infof("op.isDone(%v) error; op = %v, poll count = %d, err = %v, retrying", ctx, op, pollCount, err)
+		}
+
+		if done {
+			break
+		}
+	}
+
+	glog.V(5).Infof("op.isDone(%v) complete; op = %v, poll count = %d, op.err = %v", ctx, op, pollCount, op.error())
+	return op.error()
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/service_test.go

@@ -0,0 +1,84 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"context"
+	"fmt"
+	"testing"
+)
+
+func TestPollOperation(t *testing.T) {
+	const totalAttempts = 10
+	var attempts int
+	fo := &fakeOperation{isDoneFunc: func(ctx context.Context) (bool, error) {
+		attempts++
+		if attempts < totalAttempts {
+			return false, nil
+		}
+		return true, nil
+	}}
+	s := Service{RateLimiter: &NopRateLimiter{}}
+	// Check that pollOperation will retry the operation multiple times.
+	err := s.pollOperation(context.Background(), fo)
+	if err != nil {
+		t.Errorf("pollOperation() = %v, want nil", err)
+	}
+	if attempts != totalAttempts {
+		t.Errorf("`attempts` = %d, want %d", attempts, totalAttempts)
+	}
+
+	// Check that the operation's error is returned.
+	fo.err = fmt.Errorf("test operation failed")
+	err = s.pollOperation(context.Background(), fo)
+	if err != fo.err {
+		t.Errorf("pollOperation() = %v, want %v", err, fo.err)
+	}
+	fo.err = nil
+
+	fo.isDoneFunc = func(ctx context.Context) (bool, error) {
+		return false, nil
+	}
+	// Use context that has been cancelled and expect a context error returned.
+	ctxCancelled, cancelled := context.WithCancel(context.Background())
+	cancelled()
+	// Verify context is cancelled by now.
+	<-ctxCancelled.Done()
+	// Check that pollOperation returns because the context is cancelled.
+	err = s.pollOperation(ctxCancelled, fo)
+	if err == nil {
+		t.Errorf("pollOperation() = nil, want: %v", ctxCancelled.Err())
+	}
+}
+
+type fakeOperation struct {
+	isDoneFunc func(ctx context.Context) (bool, error)
+	err        error
+	rateKey    *RateLimitKey
+}
+
+func (f *fakeOperation) isDone(ctx context.Context) (bool, error) {
+	return f.isDoneFunc(ctx)
+}
+
+func (f *fakeOperation) error() error {
+	return f.err
+}
+
+func (f *fakeOperation) rateLimitKey() *RateLimitKey {
+	return f.rateKey
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/utils.go

@@ -0,0 +1,201 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+const (
+	gaPrefix    = "https://www.googleapis.com/compute/v1"
+	alphaPrefix = "https://www.googleapis.com/compute/alpha"
+	betaPrefix  = "https://www.googleapis.com/compute/beta"
+)
+
+// ResourceID identifies a GCE resource as parsed from compute resource URL.
+type ResourceID struct {
+	ProjectID string
+	Resource  string
+	Key       *meta.Key
+}
+
+// Equal returns true if two resource IDs are equal.
+func (r *ResourceID) Equal(other *ResourceID) bool {
+	if r.ProjectID != other.ProjectID || r.Resource != other.Resource {
+		return false
+	}
+	if r.Key != nil && other.Key != nil {
+		return *r.Key == *other.Key
+	}
+	if r.Key == nil && other.Key == nil {
+		return true
+	}
+	return false
+}
+
+// RelativeResourceName returns the relative resource name string
+// representing this ResourceID.
+func (r *ResourceID) RelativeResourceName() string {
+	return RelativeResourceName(r.ProjectID, r.Resource, r.Key)
+}
+
+// ResourcePath returns the resource path representing this ResourceID.
+func (r *ResourceID) ResourcePath() string {
+	return ResourcePath(r.Resource, r.Key)
+}
+
+func (r *ResourceID) SelfLink(ver meta.Version) string {
+	return SelfLink(ver, r.ProjectID, r.Resource, r.Key)
+}
+
+// ParseResourceURL parses resource URLs of the following formats:
+//
+//   global/<res>/<name>
+//   regions/<region>/<res>/<name>
+//   zones/<zone>/<res>/<name>
+//   projects/<proj>
+//   projects/<proj>/global/<res>/<name>
+//   projects/<proj>/regions/<region>/<res>/<name>
+//   projects/<proj>/zones/<zone>/<res>/<name>
+//   [https://www.googleapis.com/compute/<ver>]/projects/<proj>/global/<res>/<name>
+//   [https://www.googleapis.com/compute/<ver>]/projects/<proj>/regions/<region>/<res>/<name>
+//   [https://www.googleapis.com/compute/<ver>]/projects/<proj>/zones/<zone>/<res>/<name>
+func ParseResourceURL(url string) (*ResourceID, error) {
+	errNotValid := fmt.Errorf("%q is not a valid resource URL", url)
+
+	// Trim prefix off URL leaving "projects/..."
+	projectsIndex := strings.Index(url, "/projects/")
+	if projectsIndex >= 0 {
+		url = url[projectsIndex+1:]
+	}
+
+	parts := strings.Split(url, "/")
+	if len(parts) < 2 || len(parts) > 6 {
+		return nil, errNotValid
+	}
+
+	ret := &ResourceID{}
+	scopedName := parts
+	if parts[0] == "projects" {
+		ret.Resource = "projects"
+		ret.ProjectID = parts[1]
+		scopedName = parts[2:]
+
+		if len(scopedName) == 0 {
+			return ret, nil
+		}
+	}
+
+	switch scopedName[0] {
+	case "global":
+		if len(scopedName) != 3 {
+			return nil, errNotValid
+		}
+		ret.Resource = scopedName[1]
+		ret.Key = meta.GlobalKey(scopedName[2])
+		return ret, nil
+	case "regions":
+		switch len(scopedName) {
+		case 2:
+			ret.Resource = "regions"
+			ret.Key = meta.GlobalKey(scopedName[1])
+			return ret, nil
+		case 4:
+			ret.Resource = scopedName[2]
+			ret.Key = meta.RegionalKey(scopedName[3], scopedName[1])
+			return ret, nil
+		default:
+			return nil, errNotValid
+		}
+	case "zones":
+		switch len(scopedName) {
+		case 2:
+			ret.Resource = "zones"
+			ret.Key = meta.GlobalKey(scopedName[1])
+			return ret, nil
+		case 4:
+			ret.Resource = scopedName[2]
+			ret.Key = meta.ZonalKey(scopedName[3], scopedName[1])
+			return ret, nil
+		default:
+			return nil, errNotValid
+		}
+	}
+	return nil, errNotValid
+}
+
+func copyViaJSON(dest, src interface{}) error {
+	bytes, err := json.Marshal(src)
+	if err != nil {
+		return err
+	}
+	return json.Unmarshal(bytes, dest)
+}
+
+// ResourcePath returns the path starting from the location.
+// Example: regions/us-central1/subnetworks/my-subnet
+func ResourcePath(resource string, key *meta.Key) string {
+	switch resource {
+	case "zones", "regions":
+		return fmt.Sprintf("%s/%s", resource, key.Name)
+	case "projects":
+		return "invalid-resource"
+	}
+
+	switch key.Type() {
+	case meta.Zonal:
+		return fmt.Sprintf("zones/%s/%s/%s", key.Zone, resource, key.Name)
+	case meta.Regional:
+		return fmt.Sprintf("regions/%s/%s/%s", key.Region, resource, key.Name)
+	case meta.Global:
+		return fmt.Sprintf("global/%s/%s", resource, key.Name)
+	}
+	return "invalid-key-type"
+}
+
+// RelativeResourceName returns the path starting from project.
+// Example: projects/my-project/regions/us-central1/subnetworks/my-subnet
+func RelativeResourceName(project, resource string, key *meta.Key) string {
+	switch resource {
+	case "projects":
+		return fmt.Sprintf("projects/%s", project)
+	default:
+		return fmt.Sprintf("projects/%s/%s", project, ResourcePath(resource, key))
+	}
+}
+
+// SelfLink returns the self link URL for the given object.
+func SelfLink(ver meta.Version, project, resource string, key *meta.Key) string {
+	var prefix string
+	switch ver {
+	case meta.VersionAlpha:
+		prefix = alphaPrefix
+	case meta.VersionBeta:
+		prefix = betaPrefix
+	case meta.VersionGA:
+		prefix = gaPrefix
+	default:
+		prefix = "invalid-prefix"
+	}
+
+	return fmt.Sprintf("%s/%s", prefix, RelativeResourceName(project, resource, key))
+
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/utils_test.go

@@ -0,0 +1,291 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cloud
+
+import (
+	"errors"
+	"testing"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func TestEqualResourceID(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		a *ResourceID
+		b *ResourceID
+	}{
+		{
+			a: &ResourceID{"some-gce-project", "projects", nil},
+			b: &ResourceID{"some-gce-project", "projects", nil},
+		},
+		{
+			a: &ResourceID{"", "networks", meta.GlobalKey("my-net")},
+			b: &ResourceID{"", "networks", meta.GlobalKey("my-net")},
+		},
+		{
+			a: &ResourceID{"some-gce-project", "projects", meta.GlobalKey("us-central1")},
+			b: &ResourceID{"some-gce-project", "projects", meta.GlobalKey("us-central1")},
+		},
+	} {
+		if !tc.a.Equal(tc.b) {
+			t.Errorf("%v.Equal(%v) = false, want true", tc.a, tc.b)
+		}
+	}
+
+	for _, tc := range []struct {
+		a *ResourceID
+		b *ResourceID
+	}{
+		{
+			a: &ResourceID{"some-gce-project", "projects", nil},
+			b: &ResourceID{"some-other-project", "projects", nil},
+		},
+		{
+			a: &ResourceID{"some-gce-project", "projects", nil},
+			b: &ResourceID{"some-gce-project", "projects", meta.GlobalKey("us-central1")},
+		},
+		{
+			a: &ResourceID{"some-gce-project", "networks", meta.GlobalKey("us-central1")},
+			b: &ResourceID{"some-gce-project", "projects", meta.GlobalKey("us-central1")},
+		},
+	} {
+		if tc.a.Equal(tc.b) {
+			t.Errorf("%v.Equal(%v) = true, want false", tc.a, tc.b)
+		}
+	}
+}
+
+func TestParseResourceURL(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		in string
+		r  *ResourceID
+	}{
+		{
+			"https://www.googleapis.com/compute/v1/projects/some-gce-project",
+			&ResourceID{"some-gce-project", "projects", nil},
+		},
+		{
+			"https://www.googleapis.com/compute/v1/projects/some-gce-project/regions/us-central1",
+			&ResourceID{"some-gce-project", "regions", meta.GlobalKey("us-central1")},
+		},
+		{
+			"https://www.googleapis.com/compute/v1/projects/some-gce-project/zones/us-central1-b",
+			&ResourceID{"some-gce-project", "zones", meta.GlobalKey("us-central1-b")},
+		},
+		{
+			"https://www.googleapis.com/compute/v1/projects/some-gce-project/global/operations/operation-1513289952196-56054460af5a0-b1dae0c3-9bbf9dbf",
+			&ResourceID{"some-gce-project", "operations", meta.GlobalKey("operation-1513289952196-56054460af5a0-b1dae0c3-9bbf9dbf")},
+		},
+		{
+			"https://www.googleapis.com/compute/alpha/projects/some-gce-project/regions/us-central1/addresses/my-address",
+			&ResourceID{"some-gce-project", "addresses", meta.RegionalKey("my-address", "us-central1")},
+		},
+		{
+			"https://www.googleapis.com/compute/v1/projects/some-gce-project/zones/us-central1-c/instances/instance-1",
+			&ResourceID{"some-gce-project", "instances", meta.ZonalKey("instance-1", "us-central1-c")},
+		},
+		{
+			"http://localhost:3990/compute/beta/projects/some-gce-project/global/operations/operation-1513289952196-56054460af5a0-b1dae0c3-9bbf9dbf",
+			&ResourceID{"some-gce-project", "operations", meta.GlobalKey("operation-1513289952196-56054460af5a0-b1dae0c3-9bbf9dbf")},
+		},
+		{
+			"http://localhost:3990/compute/alpha/projects/some-gce-project/regions/dev-central1/addresses/my-address",
+			&ResourceID{"some-gce-project", "addresses", meta.RegionalKey("my-address", "dev-central1")},
+		},
+		{
+			"http://localhost:3990/compute/v1/projects/some-gce-project/zones/dev-central1-std/instances/instance-1",
+			&ResourceID{"some-gce-project", "instances", meta.ZonalKey("instance-1", "dev-central1-std")},
+		},
+		{
+			"projects/some-gce-project",
+			&ResourceID{"some-gce-project", "projects", nil},
+		},
+		{
+			"projects/some-gce-project/regions/us-central1",
+			&ResourceID{"some-gce-project", "regions", meta.GlobalKey("us-central1")},
+		},
+		{
+			"projects/some-gce-project/zones/us-central1-b",
+			&ResourceID{"some-gce-project", "zones", meta.GlobalKey("us-central1-b")},
+		},
+		{
+			"projects/some-gce-project/global/operations/operation-1513289952196-56054460af5a0-b1dae0c3-9bbf9dbf",
+			&ResourceID{"some-gce-project", "operations", meta.GlobalKey("operation-1513289952196-56054460af5a0-b1dae0c3-9bbf9dbf")},
+		},
+		{
+			"projects/some-gce-project/regions/us-central1/addresses/my-address",
+			&ResourceID{"some-gce-project", "addresses", meta.RegionalKey("my-address", "us-central1")},
+		},
+		{
+			"projects/some-gce-project/zones/us-central1-c/instances/instance-1",
+			&ResourceID{"some-gce-project", "instances", meta.ZonalKey("instance-1", "us-central1-c")},
+		},
+		{
+			"global/networks/my-network",
+			&ResourceID{"", "networks", meta.GlobalKey("my-network")},
+		},
+		{
+			"regions/us-central1/subnetworks/my-subnet",
+			&ResourceID{"", "subnetworks", meta.RegionalKey("my-subnet", "us-central1")},
+		},
+		{
+			"zones/us-central1-c/instances/instance-1",
+			&ResourceID{"", "instances", meta.ZonalKey("instance-1", "us-central1-c")},
+		},
+	} {
+		r, err := ParseResourceURL(tc.in)
+		if err != nil {
+			t.Errorf("ParseResourceURL(%q) = %+v, %v; want _, nil", tc.in, r, err)
+			continue
+		}
+		if !r.Equal(tc.r) {
+			t.Errorf("ParseResourceURL(%q) = %+v, nil; want %+v, nil", tc.in, r, tc.r)
+		}
+	}
+	// Malformed URLs.
+	for _, tc := range []string{
+		"",
+		"/",
+		"/a",
+		"/a/b",
+		"/a/b/c",
+		"/a/b/c/d",
+		"/a/b/c/d/e",
+		"/a/b/c/d/e/f",
+		"https://www.googleapis.com/compute/v1/projects/some-gce-project/global",
+		"projects/some-gce-project/global",
+		"projects/some-gce-project/global/foo",
+		"projects/some-gce-project/global/foo/bar/baz",
+		"projects/some-gce-project/regions/us-central1/res",
+		"projects/some-gce-project/zones/us-central1-c/res",
+		"projects/some-gce-project/zones/us-central1-c/res/name/extra",
+	} {
+		r, err := ParseResourceURL(tc)
+		if err == nil {
+			t.Errorf("ParseResourceURL(%q) = %+v, %v, want _, error", tc, r, err)
+		}
+	}
+}
+
+type A struct {
+	A, B, C string
+}
+
+type B struct {
+	A, B, D string
+}
+
+type E struct{}
+
+func (*E) MarshalJSON() ([]byte, error) {
+	return nil, errors.New("injected error")
+}
+
+func TestCopyVisJSON(t *testing.T) {
+	t.Parallel()
+
+	var b B
+	srcA := &A{"aa", "bb", "cc"}
+	err := copyViaJSON(&b, srcA)
+	if err != nil {
+		t.Errorf(`copyViaJSON(&b, %+v) = %v, want nil`, srcA, err)
+	} else {
+		expectedB := B{"aa", "bb", ""}
+		if b != expectedB {
+			t.Errorf("b == %+v, want %+v", b, expectedB)
+		}
+	}
+
+	var a A
+	srcB := &B{"aaa", "bbb", "ccc"}
+	err = copyViaJSON(&a, srcB)
+	if err != nil {
+		t.Errorf(`copyViaJSON(&a, %+v) = %v, want nil`, srcB, err)
+	} else {
+		expectedA := A{"aaa", "bbb", ""}
+		if a != expectedA {
+			t.Errorf("a == %+v, want %+v", a, expectedA)
+		}
+	}
+
+	if err := copyViaJSON(&a, &E{}); err == nil {
+		t.Errorf("copyViaJSON(&a, &E{}) = nil, want error")
+	}
+}
+
+func TestSelfLink(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		ver      meta.Version
+		project  string
+		resource string
+		key      *meta.Key
+		want     string
+	}{
+		{
+			meta.VersionAlpha,
+			"proj1",
+			"addresses",
+			meta.RegionalKey("key1", "us-central1"),
+			"https://www.googleapis.com/compute/alpha/projects/proj1/regions/us-central1/addresses/key1",
+		},
+		{
+			meta.VersionBeta,
+			"proj3",
+			"disks",
+			meta.ZonalKey("key2", "us-central1-b"),
+			"https://www.googleapis.com/compute/beta/projects/proj3/zones/us-central1-b/disks/key2",
+		},
+		{
+			meta.VersionGA,
+			"proj4",
+			"urlMaps",
+			meta.GlobalKey("key3"),
+			"https://www.googleapis.com/compute/v1/projects/proj4/global/urlMaps/key3",
+		},
+		{
+			meta.VersionGA,
+			"proj4",
+			"projects",
+			nil,
+			"https://www.googleapis.com/compute/v1/projects/proj4",
+		},
+		{
+			meta.VersionGA,
+			"proj4",
+			"regions",
+			meta.GlobalKey("us-central1"),
+			"https://www.googleapis.com/compute/v1/projects/proj4/regions/us-central1",
+		},
+		{
+			meta.VersionGA,
+			"proj4",
+			"zones",
+			meta.GlobalKey("us-central1-a"),
+			"https://www.googleapis.com/compute/v1/projects/proj4/zones/us-central1-a",
+		},
+	} {
+		if link := SelfLink(tc.ver, tc.project, tc.resource, tc.key); link != tc.want {
+			t.Errorf("SelfLink(%v, %q, %q, %v) = %v, want %q", tc.ver, tc.project, tc.resource, tc.key, link, tc.want)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/doc.go

@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package gce is an implementation of Interface, LoadBalancer
+// and Instances for Google Compute Engine.
+package gce // import "k8s.io/kubernetes/pkg/cloudprovider/providers/gce"

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce.go

@@ -0,0 +1,887 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	gcfg "gopkg.in/gcfg.v1"
+
+	"cloud.google.com/go/compute/metadata"
+	"github.com/golang/glog"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/google"
+	computealpha "google.golang.org/api/compute/v0.alpha"
+	computebeta "google.golang.org/api/compute/v0.beta"
+	compute "google.golang.org/api/compute/v1"
+	container "google.golang.org/api/container/v1"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/informers"
+	clientset "k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/kubernetes/scheme"
+	v1core "k8s.io/client-go/kubernetes/typed/core/v1"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/util/flowcontrol"
+
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/controller"
+	kubeletapis "k8s.io/kubernetes/pkg/kubelet/apis"
+	"k8s.io/kubernetes/pkg/version"
+)
+
+const (
+	ProviderName = "gce"
+
+	k8sNodeRouteTag = "k8s-node-route"
+
+	// AffinityTypeNone - no session affinity.
+	gceAffinityTypeNone = "NONE"
+	// AffinityTypeClientIP - affinity based on Client IP.
+	gceAffinityTypeClientIP = "CLIENT_IP"
+	// AffinityTypeClientIPProto - affinity based on Client IP and port.
+	gceAffinityTypeClientIPProto = "CLIENT_IP_PROTO"
+
+	operationPollInterval = time.Second
+	// Creating Route in very large clusters, may take more than half an hour.
+	operationPollTimeoutDuration = time.Hour
+
+	// Each page can have 500 results, but we cap how many pages
+	// are iterated through to prevent infinite loops if the API
+	// were to continuously return a nextPageToken.
+	maxPages = 25
+
+	maxTargetPoolCreateInstances = 200
+
+	// HTTP Load Balancer parameters
+	// Configure 2 second period for external health checks.
+	gceHcCheckIntervalSeconds = int64(2)
+	gceHcTimeoutSeconds       = int64(1)
+	// Start sending requests as soon as a pod is found on the node.
+	gceHcHealthyThreshold = int64(1)
+	// Defaults to 5 * 2 = 10 seconds before the LB will steer traffic away
+	gceHcUnhealthyThreshold = int64(5)
+
+	gceComputeAPIEndpoint     = "https://www.googleapis.com/compute/v1/"
+	gceComputeAPIEndpointBeta = "https://www.googleapis.com/compute/beta/"
+)
+
+// gceObject is an abstraction of all GCE API object in go client
+type gceObject interface {
+	MarshalJSON() ([]byte, error)
+}
+
+// GCECloud is an implementation of Interface, LoadBalancer and Instances for Google Compute Engine.
+type GCECloud struct {
+	// ClusterID contains functionality for getting (and initializing) the ingress-uid. Call GCECloud.Initialize()
+	// for the cloudprovider to start watching the configmap.
+	ClusterID ClusterID
+
+	service          *compute.Service
+	serviceBeta      *computebeta.Service
+	serviceAlpha     *computealpha.Service
+	containerService *container.Service
+	tpuService       *tpuService
+	client           clientset.Interface
+	clientBuilder    controller.ControllerClientBuilder
+	eventBroadcaster record.EventBroadcaster
+	eventRecorder    record.EventRecorder
+	projectID        string
+	region           string
+	localZone        string // The zone in which we are running
+	// managedZones will be set to the 1 zone if running a single zone cluster
+	// it will be set to ALL zones in region for any multi-zone cluster
+	// Use GetAllCurrentZones to get only zones that contain nodes
+	managedZones             []string
+	networkURL               string
+	isLegacyNetwork          bool
+	subnetworkURL            string
+	secondaryRangeName       string
+	networkProjectID         string
+	onXPN                    bool
+	nodeTags                 []string    // List of tags to use on firewall rules for load balancers
+	lastComputedNodeTags     []string    // List of node tags calculated in GetHostTags()
+	lastKnownNodeNames       sets.String // List of hostnames used to calculate lastComputedHostTags in GetHostTags(names)
+	computeNodeTagLock       sync.Mutex  // Lock for computing and setting node tags
+	nodeInstancePrefix       string      // If non-"", an advisory prefix for all nodes in the cluster
+	useMetadataServer        bool
+	operationPollRateLimiter flowcontrol.RateLimiter
+	manager                  diskServiceManager
+	// Lock for access to nodeZones
+	nodeZonesLock sync.Mutex
+	// nodeZones is a mapping from Zone to a sets.String of Node's names in the Zone
+	// it is updated by the nodeInformer
+	nodeZones          map[string]sets.String
+	nodeInformerSynced cache.InformerSynced
+	// sharedResourceLock is used to serialize GCE operations that may mutate shared state to
+	// prevent inconsistencies. For example, load balancers manipulation methods will take the
+	// lock to prevent shared resources from being prematurely deleted while the operation is
+	// in progress.
+	sharedResourceLock sync.Mutex
+	// AlphaFeatureGate gates gce alpha features in GCECloud instance.
+	// Related wrapper functions that interacts with gce alpha api should examine whether
+	// the corresponding api is enabled.
+	// If not enabled, it should return error.
+	AlphaFeatureGate *AlphaFeatureGate
+
+	// New code generated interface to the GCE compute library.
+	c cloud.Cloud
+
+	// Keep a reference of this around so we can inject a new cloud.RateLimiter implementation.
+	s *cloud.Service
+}
+
+// TODO: replace gcfg with json
+type ConfigGlobal struct {
+	TokenURL  string `gcfg:"token-url"`
+	TokenBody string `gcfg:"token-body"`
+	// ProjectID and NetworkProjectID can either be the numeric or string-based
+	// unique identifier that starts with [a-z].
+	ProjectID string `gcfg:"project-id"`
+	// NetworkProjectID refers to the project which owns the network being used.
+	NetworkProjectID string `gcfg:"network-project-id"`
+	NetworkName      string `gcfg:"network-name"`
+	SubnetworkName   string `gcfg:"subnetwork-name"`
+	// SecondaryRangeName is the name of the secondary range to allocate IP
+	// aliases. The secondary range must be present on the subnetwork the
+	// cluster is attached to.
+	SecondaryRangeName string   `gcfg:"secondary-range-name"`
+	NodeTags           []string `gcfg:"node-tags"`
+	NodeInstancePrefix string   `gcfg:"node-instance-prefix"`
+	Multizone          bool     `gcfg:"multizone"`
+	// ApiEndpoint is the GCE compute API endpoint to use. If this is blank,
+	// then the default endpoint is used.
+	ApiEndpoint string `gcfg:"api-endpoint"`
+	// LocalZone specifies the GCE zone that gce cloud client instance is
+	// located in (i.e. where the controller will be running). If this is
+	// blank, then the local zone will be discovered via the metadata server.
+	LocalZone string `gcfg:"local-zone"`
+	// Default to none.
+	// For example: MyFeatureFlag
+	AlphaFeatures []string `gcfg:"alpha-features"`
+}
+
+// ConfigFile is the struct used to parse the /etc/gce.conf configuration file.
+type ConfigFile struct {
+	Global ConfigGlobal `gcfg:"global"`
+}
+
+// CloudConfig includes all the necessary configuration for creating GCECloud
+type CloudConfig struct {
+	ApiEndpoint        string
+	ProjectID          string
+	NetworkProjectID   string
+	Region             string
+	Zone               string
+	ManagedZones       []string
+	NetworkName        string
+	NetworkURL         string
+	SubnetworkName     string
+	SubnetworkURL      string
+	SecondaryRangeName string
+	NodeTags           []string
+	NodeInstancePrefix string
+	TokenSource        oauth2.TokenSource
+	UseMetadataServer  bool
+	AlphaFeatureGate   *AlphaFeatureGate
+}
+
+func init() {
+	cloudprovider.RegisterCloudProvider(
+		ProviderName,
+		func(config io.Reader) (cloudprovider.Interface, error) {
+			return newGCECloud(config)
+		})
+}
+
+// Services is the set of all versions of the compute service.
+type Services struct {
+	// GA, Alpha, Beta versions of the compute API.
+	GA    *compute.Service
+	Alpha *computealpha.Service
+	Beta  *computebeta.Service
+}
+
+// ComputeServices returns access to the internal compute services.
+func (g *GCECloud) ComputeServices() *Services {
+	return &Services{g.service, g.serviceAlpha, g.serviceBeta}
+}
+
+// Compute returns the generated stubs for the compute API.
+func (g *GCECloud) Compute() cloud.Cloud {
+	return g.c
+}
+
+// newGCECloud creates a new instance of GCECloud.
+func newGCECloud(config io.Reader) (gceCloud *GCECloud, err error) {
+	var cloudConfig *CloudConfig
+	var configFile *ConfigFile
+
+	if config != nil {
+		configFile, err = readConfig(config)
+		if err != nil {
+			return nil, err
+		}
+		glog.Infof("Using GCE provider config %+v", configFile)
+	}
+
+	cloudConfig, err = generateCloudConfig(configFile)
+	if err != nil {
+		return nil, err
+	}
+	return CreateGCECloud(cloudConfig)
+}
+
+func readConfig(reader io.Reader) (*ConfigFile, error) {
+	cfg := &ConfigFile{}
+	if err := gcfg.FatalOnly(gcfg.ReadInto(cfg, reader)); err != nil {
+		glog.Errorf("Couldn't read config: %v", err)
+		return nil, err
+	}
+	return cfg, nil
+}
+
+func generateCloudConfig(configFile *ConfigFile) (cloudConfig *CloudConfig, err error) {
+	cloudConfig = &CloudConfig{}
+	// By default, fetch token from GCE metadata server
+	cloudConfig.TokenSource = google.ComputeTokenSource("")
+	cloudConfig.UseMetadataServer = true
+	cloudConfig.AlphaFeatureGate = NewAlphaFeatureGate([]string{})
+	if configFile != nil {
+		if configFile.Global.ApiEndpoint != "" {
+			cloudConfig.ApiEndpoint = configFile.Global.ApiEndpoint
+		}
+
+		if configFile.Global.TokenURL != "" {
+			// if tokenURL is nil, set tokenSource to nil. This will force the OAuth client to fall
+			// back to use DefaultTokenSource. This allows running gceCloud remotely.
+			if configFile.Global.TokenURL == "nil" {
+				cloudConfig.TokenSource = nil
+			} else {
+				cloudConfig.TokenSource = NewAltTokenSource(configFile.Global.TokenURL, configFile.Global.TokenBody)
+			}
+		}
+
+		cloudConfig.NodeTags = configFile.Global.NodeTags
+		cloudConfig.NodeInstancePrefix = configFile.Global.NodeInstancePrefix
+		cloudConfig.AlphaFeatureGate = NewAlphaFeatureGate(configFile.Global.AlphaFeatures)
+	}
+
+	// retrieve projectID and zone
+	if configFile == nil || configFile.Global.ProjectID == "" || configFile.Global.LocalZone == "" {
+		cloudConfig.ProjectID, cloudConfig.Zone, err = getProjectAndZone()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if configFile != nil {
+		if configFile.Global.ProjectID != "" {
+			cloudConfig.ProjectID = configFile.Global.ProjectID
+		}
+		if configFile.Global.LocalZone != "" {
+			cloudConfig.Zone = configFile.Global.LocalZone
+		}
+		if configFile.Global.NetworkProjectID != "" {
+			cloudConfig.NetworkProjectID = configFile.Global.NetworkProjectID
+		}
+	}
+
+	// retrieve region
+	cloudConfig.Region, err = GetGCERegion(cloudConfig.Zone)
+	if err != nil {
+		return nil, err
+	}
+
+	// generate managedZones
+	cloudConfig.ManagedZones = []string{cloudConfig.Zone}
+	if configFile != nil && configFile.Global.Multizone {
+		cloudConfig.ManagedZones = nil // Use all zones in region
+	}
+
+	// Determine if network parameter is URL or Name
+	if configFile != nil && configFile.Global.NetworkName != "" {
+		if strings.Contains(configFile.Global.NetworkName, "/") {
+			cloudConfig.NetworkURL = configFile.Global.NetworkName
+		} else {
+			cloudConfig.NetworkName = configFile.Global.NetworkName
+		}
+	} else {
+		cloudConfig.NetworkName, err = getNetworkNameViaMetadata()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Determine if subnetwork parameter is URL or Name
+	// If cluster is on a GCP network of mode=custom, then `SubnetName` must be specified in config file.
+	if configFile != nil && configFile.Global.SubnetworkName != "" {
+		if strings.Contains(configFile.Global.SubnetworkName, "/") {
+			cloudConfig.SubnetworkURL = configFile.Global.SubnetworkName
+		} else {
+			cloudConfig.SubnetworkName = configFile.Global.SubnetworkName
+		}
+	}
+
+	if configFile != nil {
+		cloudConfig.SecondaryRangeName = configFile.Global.SecondaryRangeName
+	}
+
+	return cloudConfig, err
+}
+
+// CreateGCECloud creates a GCECloud object using the specified parameters.
+// If no networkUrl is specified, loads networkName via rest call.
+// If no tokenSource is specified, uses oauth2.DefaultTokenSource.
+// If managedZones is nil / empty all zones in the region will be managed.
+func CreateGCECloud(config *CloudConfig) (*GCECloud, error) {
+	// Remove any pre-release version and build metadata from the semver,
+	// leaving only the MAJOR.MINOR.PATCH portion. See http://semver.org/.
+	version := strings.TrimLeft(strings.Split(strings.Split(version.Get().GitVersion, "-")[0], "+")[0], "v")
+
+	// Create a user-agent header append string to supply to the Google API
+	// clients, to identify Kubernetes as the origin of the GCP API calls.
+	userAgent := fmt.Sprintf("Kubernetes/%s (%s %s)", version, runtime.GOOS, runtime.GOARCH)
+
+	// Use ProjectID for NetworkProjectID, if it wasn't explicitly set.
+	if config.NetworkProjectID == "" {
+		config.NetworkProjectID = config.ProjectID
+	}
+
+	client, err := newOauthClient(config.TokenSource)
+	if err != nil {
+		return nil, err
+	}
+	service, err := compute.New(client)
+	if err != nil {
+		return nil, err
+	}
+	service.UserAgent = userAgent
+
+	client, err = newOauthClient(config.TokenSource)
+	if err != nil {
+		return nil, err
+	}
+	serviceBeta, err := computebeta.New(client)
+	if err != nil {
+		return nil, err
+	}
+	serviceBeta.UserAgent = userAgent
+
+	client, err = newOauthClient(config.TokenSource)
+	if err != nil {
+		return nil, err
+	}
+	serviceAlpha, err := computealpha.New(client)
+	if err != nil {
+		return nil, err
+	}
+	serviceAlpha.UserAgent = userAgent
+
+	// Expect override api endpoint to always be v1 api and follows the same pattern as prod.
+	// Generate alpha and beta api endpoints based on override v1 api endpoint.
+	// For example,
+	// staging API endpoint: https://www.googleapis.com/compute/staging_v1/
+	if config.ApiEndpoint != "" {
+		service.BasePath = fmt.Sprintf("%sprojects/", config.ApiEndpoint)
+		serviceBeta.BasePath = fmt.Sprintf("%sprojects/", strings.Replace(config.ApiEndpoint, "v1", "beta", -1))
+		serviceAlpha.BasePath = fmt.Sprintf("%sprojects/", strings.Replace(config.ApiEndpoint, "v1", "alpha", -1))
+	}
+
+	containerService, err := container.New(client)
+	if err != nil {
+		return nil, err
+	}
+	containerService.UserAgent = userAgent
+
+	tpuService, err := newTPUService(client)
+	if err != nil {
+		return nil, err
+	}
+
+	// ProjectID and.NetworkProjectID may be project number or name.
+	projID, netProjID := tryConvertToProjectNames(config.ProjectID, config.NetworkProjectID, service)
+	onXPN := projID != netProjID
+
+	var networkURL string
+	var subnetURL string
+	var isLegacyNetwork bool
+
+	if config.NetworkURL != "" {
+		networkURL = config.NetworkURL
+	} else if config.NetworkName != "" {
+		networkURL = gceNetworkURL(config.ApiEndpoint, netProjID, config.NetworkName)
+	} else {
+		// Other consumers may use the cloudprovider without utilizing the wrapped GCE API functions
+		// or functions requiring network/subnetwork URLs (e.g. Kubelet).
+		glog.Warningf("No network name or URL specified.")
+	}
+
+	if config.SubnetworkURL != "" {
+		subnetURL = config.SubnetworkURL
+	} else if config.SubnetworkName != "" {
+		subnetURL = gceSubnetworkURL(config.ApiEndpoint, netProjID, config.Region, config.SubnetworkName)
+	} else {
+		// Determine the type of network and attempt to discover the correct subnet for AUTO mode.
+		// Gracefully fail because kubelet calls CreateGCECloud without any config, and minions
+		// lack the proper credentials for API calls.
+		if networkName := lastComponent(networkURL); networkName != "" {
+			var n *compute.Network
+			if n, err = getNetwork(service, netProjID, networkName); err != nil {
+				glog.Warningf("Could not retrieve network %q; err: %v", networkName, err)
+			} else {
+				switch typeOfNetwork(n) {
+				case netTypeLegacy:
+					glog.Infof("Network %q is type legacy - no subnetwork", networkName)
+					isLegacyNetwork = true
+				case netTypeCustom:
+					glog.Warningf("Network %q is type custom - cannot auto select a subnetwork", networkName)
+				case netTypeAuto:
+					subnetURL, err = determineSubnetURL(service, netProjID, networkName, config.Region)
+					if err != nil {
+						glog.Warningf("Could not determine subnetwork for network %q and region %v; err: %v", networkName, config.Region, err)
+					} else {
+						glog.Infof("Auto selecting subnetwork %q", subnetURL)
+					}
+				}
+			}
+		}
+	}
+
+	if len(config.ManagedZones) == 0 {
+		config.ManagedZones, err = getZonesForRegion(service, config.ProjectID, config.Region)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if len(config.ManagedZones) > 1 {
+		glog.Infof("managing multiple zones: %v", config.ManagedZones)
+	}
+
+	operationPollRateLimiter := flowcontrol.NewTokenBucketRateLimiter(5, 5) // 5 qps, 5 burst.
+
+	gce := &GCECloud{
+		service:                  service,
+		serviceAlpha:             serviceAlpha,
+		serviceBeta:              serviceBeta,
+		containerService:         containerService,
+		tpuService:               tpuService,
+		projectID:                projID,
+		networkProjectID:         netProjID,
+		onXPN:                    onXPN,
+		region:                   config.Region,
+		localZone:                config.Zone,
+		managedZones:             config.ManagedZones,
+		networkURL:               networkURL,
+		isLegacyNetwork:          isLegacyNetwork,
+		subnetworkURL:            subnetURL,
+		secondaryRangeName:       config.SecondaryRangeName,
+		nodeTags:                 config.NodeTags,
+		nodeInstancePrefix:       config.NodeInstancePrefix,
+		useMetadataServer:        config.UseMetadataServer,
+		operationPollRateLimiter: operationPollRateLimiter,
+		AlphaFeatureGate:         config.AlphaFeatureGate,
+		nodeZones:                map[string]sets.String{},
+	}
+
+	gce.manager = &gceServiceManager{gce}
+	gce.s = &cloud.Service{
+		GA:            service,
+		Alpha:         serviceAlpha,
+		Beta:          serviceBeta,
+		ProjectRouter: &gceProjectRouter{gce},
+		RateLimiter:   &gceRateLimiter{gce},
+	}
+	gce.c = cloud.NewGCE(gce.s)
+
+	return gce, nil
+}
+
+// SetRateLimiter adds a custom cloud.RateLimiter implementation.
+// WARNING: Calling this could have unexpected behavior if you have in-flight
+// requests. It is best to use this immediately after creating a GCECloud.
+func (g *GCECloud) SetRateLimiter(rl cloud.RateLimiter) {
+	if rl != nil {
+		g.s.RateLimiter = rl
+	}
+}
+
+// determineSubnetURL queries for all subnetworks in a region for a given network and returns
+// the URL of the subnetwork which exists in the auto-subnet range.
+func determineSubnetURL(service *compute.Service, networkProjectID, networkName, region string) (string, error) {
+	subnets, err := listSubnetworksOfNetwork(service, networkProjectID, networkName, region)
+	if err != nil {
+		return "", err
+	}
+
+	autoSubnets, err := subnetsInCIDR(subnets, autoSubnetIPRange)
+	if err != nil {
+		return "", err
+	}
+
+	if len(autoSubnets) == 0 {
+		return "", fmt.Errorf("no subnet exists in auto CIDR")
+	}
+
+	if len(autoSubnets) > 1 {
+		return "", fmt.Errorf("multiple subnetworks in the same region exist in auto CIDR")
+	}
+
+	return autoSubnets[0].SelfLink, nil
+}
+
+func tryConvertToProjectNames(configProject, configNetworkProject string, service *compute.Service) (projID, netProjID string) {
+	projID = configProject
+	if isProjectNumber(projID) {
+		projName, err := getProjectID(service, projID)
+		if err != nil {
+			glog.Warningf("Failed to retrieve project %v while trying to retrieve its name. err %v", projID, err)
+		} else {
+			projID = projName
+		}
+	}
+
+	netProjID = projID
+	if configNetworkProject != configProject {
+		netProjID = configNetworkProject
+	}
+	if isProjectNumber(netProjID) {
+		netProjName, err := getProjectID(service, netProjID)
+		if err != nil {
+			glog.Warningf("Failed to retrieve network project %v while trying to retrieve its name. err %v", netProjID, err)
+		} else {
+			netProjID = netProjName
+		}
+	}
+
+	return projID, netProjID
+}
+
+// Initialize takes in a clientBuilder and spawns a goroutine for watching the clusterid configmap.
+// This must be called before utilizing the funcs of gce.ClusterID
+func (gce *GCECloud) Initialize(clientBuilder controller.ControllerClientBuilder) {
+	gce.clientBuilder = clientBuilder
+	gce.client = clientBuilder.ClientOrDie("cloud-provider")
+
+	if gce.OnXPN() {
+		gce.eventBroadcaster = record.NewBroadcaster()
+		gce.eventBroadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: gce.client.CoreV1().Events("")})
+		gce.eventRecorder = gce.eventBroadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: "gce-cloudprovider"})
+	}
+
+	go gce.watchClusterID()
+}
+
+// LoadBalancer returns an implementation of LoadBalancer for Google Compute Engine.
+func (gce *GCECloud) LoadBalancer() (cloudprovider.LoadBalancer, bool) {
+	return gce, true
+}
+
+// Instances returns an implementation of Instances for Google Compute Engine.
+func (gce *GCECloud) Instances() (cloudprovider.Instances, bool) {
+	return gce, true
+}
+
+// Zones returns an implementation of Zones for Google Compute Engine.
+func (gce *GCECloud) Zones() (cloudprovider.Zones, bool) {
+	return gce, true
+}
+
+func (gce *GCECloud) Clusters() (cloudprovider.Clusters, bool) {
+	return gce, true
+}
+
+// Routes returns an implementation of Routes for Google Compute Engine.
+func (gce *GCECloud) Routes() (cloudprovider.Routes, bool) {
+	return gce, true
+}
+
+// ProviderName returns the cloud provider ID.
+func (gce *GCECloud) ProviderName() string {
+	return ProviderName
+}
+
+// ProjectID returns the ProjectID corresponding to the project this cloud is in.
+func (g *GCECloud) ProjectID() string {
+	return g.projectID
+}
+
+// NetworkProjectID returns the ProjectID corresponding to the project this cluster's network is in.
+func (g *GCECloud) NetworkProjectID() string {
+	return g.networkProjectID
+}
+
+// Region returns the region
+func (gce *GCECloud) Region() string {
+	return gce.region
+}
+
+// OnXPN returns true if the cluster is running on a cross project network (XPN)
+func (gce *GCECloud) OnXPN() bool {
+	return gce.onXPN
+}
+
+// NetworkURL returns the network url
+func (gce *GCECloud) NetworkURL() string {
+	return gce.networkURL
+}
+
+// SubnetworkURL returns the subnetwork url
+func (gce *GCECloud) SubnetworkURL() string {
+	return gce.subnetworkURL
+}
+
+func (gce *GCECloud) IsLegacyNetwork() bool {
+	return gce.isLegacyNetwork
+}
+
+func (gce *GCECloud) SetInformers(informerFactory informers.SharedInformerFactory) {
+	glog.Infof("Setting up informers for GCECloud")
+	nodeInformer := informerFactory.Core().V1().Nodes().Informer()
+	nodeInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc: func(obj interface{}) {
+			node := obj.(*v1.Node)
+			gce.updateNodeZones(nil, node)
+		},
+		UpdateFunc: func(prev, obj interface{}) {
+			prevNode := prev.(*v1.Node)
+			newNode := obj.(*v1.Node)
+			if newNode.Labels[kubeletapis.LabelZoneFailureDomain] ==
+				prevNode.Labels[kubeletapis.LabelZoneFailureDomain] {
+				return
+			}
+			gce.updateNodeZones(prevNode, newNode)
+		},
+		DeleteFunc: func(obj interface{}) {
+			node, isNode := obj.(*v1.Node)
+			// We can get DeletedFinalStateUnknown instead of *v1.Node here
+			// and we need to handle that correctly.
+			if !isNode {
+				deletedState, ok := obj.(cache.DeletedFinalStateUnknown)
+				if !ok {
+					glog.Errorf("Received unexpected object: %v", obj)
+					return
+				}
+				node, ok = deletedState.Obj.(*v1.Node)
+				if !ok {
+					glog.Errorf("DeletedFinalStateUnknown contained non-Node object: %v", deletedState.Obj)
+					return
+				}
+			}
+			gce.updateNodeZones(node, nil)
+		},
+	})
+	gce.nodeInformerSynced = nodeInformer.HasSynced
+}
+
+func (gce *GCECloud) updateNodeZones(prevNode, newNode *v1.Node) {
+	gce.nodeZonesLock.Lock()
+	defer gce.nodeZonesLock.Unlock()
+	if prevNode != nil {
+		prevZone, ok := prevNode.ObjectMeta.Labels[kubeletapis.LabelZoneFailureDomain]
+		if ok {
+			gce.nodeZones[prevZone].Delete(prevNode.ObjectMeta.Name)
+			if gce.nodeZones[prevZone].Len() == 0 {
+				gce.nodeZones[prevZone] = nil
+			}
+		}
+	}
+	if newNode != nil {
+		newZone, ok := newNode.ObjectMeta.Labels[kubeletapis.LabelZoneFailureDomain]
+		if ok {
+			if gce.nodeZones[newZone] == nil {
+				gce.nodeZones[newZone] = sets.NewString()
+			}
+			gce.nodeZones[newZone].Insert(newNode.ObjectMeta.Name)
+		}
+	}
+}
+
+// HasClusterID returns true if the cluster has a clusterID
+func (gce *GCECloud) HasClusterID() bool {
+	return true
+}
+
+// Project IDs cannot have a digit for the first characeter. If the id contains a digit,
+// then it must be a project number.
+func isProjectNumber(idOrNumber string) bool {
+	_, err := strconv.ParseUint(idOrNumber, 10, 64)
+	return err == nil
+}
+
+// GCECloud implements cloudprovider.Interface.
+var _ cloudprovider.Interface = (*GCECloud)(nil)
+
+func gceNetworkURL(apiEndpoint, project, network string) string {
+	if apiEndpoint == "" {
+		apiEndpoint = gceComputeAPIEndpoint
+	}
+	return apiEndpoint + strings.Join([]string{"projects", project, "global", "networks", network}, "/")
+}
+
+func gceSubnetworkURL(apiEndpoint, project, region, subnetwork string) string {
+	if apiEndpoint == "" {
+		apiEndpoint = gceComputeAPIEndpoint
+	}
+	return apiEndpoint + strings.Join([]string{"projects", project, "regions", region, "subnetworks", subnetwork}, "/")
+}
+
+// getRegionInURL parses full resource URLS and shorter URLS
+// https://www.googleapis.com/compute/v1/projects/myproject/regions/us-central1/subnetworks/a
+// projects/myproject/regions/us-central1/subnetworks/a
+// All return "us-central1"
+func getRegionInURL(urlStr string) string {
+	fields := strings.Split(urlStr, "/")
+	for i, v := range fields {
+		if v == "regions" && i < len(fields)-1 {
+			return fields[i+1]
+		}
+	}
+	return ""
+}
+
+func getNetworkNameViaMetadata() (string, error) {
+	result, err := metadata.Get("instance/network-interfaces/0/network")
+	if err != nil {
+		return "", err
+	}
+	parts := strings.Split(result, "/")
+	if len(parts) != 4 {
+		return "", fmt.Errorf("unexpected response: %s", result)
+	}
+	return parts[3], nil
+}
+
+// getNetwork returns a GCP network
+func getNetwork(svc *compute.Service, networkProjectID, networkID string) (*compute.Network, error) {
+	return svc.Networks.Get(networkProjectID, networkID).Do()
+}
+
+// listSubnetworksOfNetwork returns a list of subnetworks for a particular region of a network.
+func listSubnetworksOfNetwork(svc *compute.Service, networkProjectID, networkID, region string) ([]*compute.Subnetwork, error) {
+	var subnets []*compute.Subnetwork
+	err := svc.Subnetworks.List(networkProjectID, region).Filter(fmt.Sprintf("network eq .*/%v$", networkID)).Pages(context.Background(), func(res *compute.SubnetworkList) error {
+		subnets = append(subnets, res.Items...)
+		return nil
+	})
+	return subnets, err
+}
+
+// getProjectID returns the project's string ID given a project number or string
+func getProjectID(svc *compute.Service, projectNumberOrID string) (string, error) {
+	proj, err := svc.Projects.Get(projectNumberOrID).Do()
+	if err != nil {
+		return "", err
+	}
+
+	return proj.Name, nil
+}
+
+func getZonesForRegion(svc *compute.Service, projectID, region string) ([]string, error) {
+	// TODO: use PageToken to list all not just the first 500
+	listCall := svc.Zones.List(projectID)
+
+	// Filtering by region doesn't seem to work
+	// (tested in https://cloud.google.com/compute/docs/reference/latest/zones/list)
+	// listCall = listCall.Filter("region eq " + region)
+
+	res, err := listCall.Do()
+	if err != nil {
+		return nil, fmt.Errorf("unexpected response listing zones: %v", err)
+	}
+	zones := []string{}
+	for _, zone := range res.Items {
+		regionName := lastComponent(zone.Region)
+		if regionName == region {
+			zones = append(zones, zone.Name)
+		}
+	}
+	return zones, nil
+}
+
+func findSubnetForRegion(subnetURLs []string, region string) string {
+	for _, url := range subnetURLs {
+		if thisRegion := getRegionInURL(url); thisRegion == region {
+			return url
+		}
+	}
+	return ""
+}
+
+func newOauthClient(tokenSource oauth2.TokenSource) (*http.Client, error) {
+	if tokenSource == nil {
+		var err error
+		tokenSource, err = google.DefaultTokenSource(
+			oauth2.NoContext,
+			compute.CloudPlatformScope,
+			compute.ComputeScope)
+		glog.Infof("Using DefaultTokenSource %#v", tokenSource)
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		glog.Infof("Using existing Token Source %#v", tokenSource)
+	}
+
+	backoff := wait.Backoff{
+		// These values will add up to about a minute. See #56293 for background.
+		Duration: time.Second,
+		Factor:   1.4,
+		Steps:    10,
+	}
+	if err := wait.ExponentialBackoff(backoff, func() (bool, error) {
+		if _, err := tokenSource.Token(); err != nil {
+			glog.Errorf("error fetching initial token: %v", err)
+			return false, nil
+		}
+		return true, nil
+	}); err != nil {
+		return nil, err
+	}
+
+	return oauth2.NewClient(oauth2.NoContext, tokenSource), nil
+}
+
+func (manager *gceServiceManager) getProjectsAPIEndpoint() string {
+	projectsApiEndpoint := gceComputeAPIEndpoint + "projects/"
+	if manager.gce.service != nil {
+		projectsApiEndpoint = manager.gce.service.BasePath
+	}
+
+	return projectsApiEndpoint
+}
+
+func (manager *gceServiceManager) getProjectsAPIEndpointBeta() string {
+	projectsApiEndpoint := gceComputeAPIEndpointBeta + "projects/"
+	if manager.gce.service != nil {
+		projectsApiEndpoint = manager.gce.serviceBeta.BasePath
+	}
+
+	return projectsApiEndpoint
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_address_manager.go

@@ -0,0 +1,199 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"fmt"
+	"net/http"
+
+	compute "google.golang.org/api/compute/v1"
+
+	"github.com/golang/glog"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+)
+
+type addressManager struct {
+	logPrefix   string
+	svc         CloudAddressService
+	name        string
+	serviceName string
+	targetIP    string
+	addressType cloud.LbScheme
+	region      string
+	subnetURL   string
+	tryRelease  bool
+}
+
+func newAddressManager(svc CloudAddressService, serviceName, region, subnetURL, name, targetIP string, addressType cloud.LbScheme) *addressManager {
+	return &addressManager{
+		svc:         svc,
+		logPrefix:   fmt.Sprintf("AddressManager(%q)", name),
+		region:      region,
+		serviceName: serviceName,
+		name:        name,
+		targetIP:    targetIP,
+		addressType: addressType,
+		tryRelease:  true,
+		subnetURL:   subnetURL,
+	}
+}
+
+// HoldAddress will ensure that the IP is reserved with an address - either owned by the controller
+// or by a user. If the address is not the addressManager.name, then it's assumed to be a user's address.
+// The string returned is the reserved IP address.
+func (am *addressManager) HoldAddress() (string, error) {
+	// HoldAddress starts with retrieving the address that we use for this load balancer (by name).
+	// Retrieving an address by IP will indicate if the IP is reserved and if reserved by the user
+	// or the controller, but won't tell us the current state of the controller's IP. The address
+	// could be reserving another address; therefore, it would need to be deleted. In the normal
+	// case of using a controller address, retrieving the address by name results in the fewest API
+	// calls since it indicates whether a Delete is necessary before Reserve.
+	glog.V(4).Infof("%v: attempting hold of IP %q Type %q", am.logPrefix, am.targetIP, am.addressType)
+	// Get the address in case it was orphaned earlier
+	addr, err := am.svc.GetRegionAddress(am.name, am.region)
+	if err != nil && !isNotFound(err) {
+		return "", err
+	}
+
+	if addr != nil {
+		// If address exists, check if the address had the expected attributes.
+		validationError := am.validateAddress(addr)
+		if validationError == nil {
+			glog.V(4).Infof("%v: address %q already reserves IP %q Type %q. No further action required.", am.logPrefix, addr.Name, addr.Address, addr.AddressType)
+			return addr.Address, nil
+		}
+
+		glog.V(2).Infof("%v: deleting existing address because %v", am.logPrefix, validationError)
+		err := am.svc.DeleteRegionAddress(addr.Name, am.region)
+		if err != nil {
+			if isNotFound(err) {
+				glog.V(4).Infof("%v: address %q was not found. Ignoring.", am.logPrefix, addr.Name)
+			} else {
+				return "", err
+			}
+		} else {
+			glog.V(4).Infof("%v: successfully deleted previous address %q", am.logPrefix, addr.Name)
+		}
+	}
+
+	return am.ensureAddressReservation()
+}
+
+// ReleaseAddress will release the address if it's owned by the controller.
+func (am *addressManager) ReleaseAddress() error {
+	if !am.tryRelease {
+		glog.V(4).Infof("%v: not attempting release of address %q.", am.logPrefix, am.targetIP)
+		return nil
+	}
+
+	glog.V(4).Infof("%v: releasing address %q named %q", am.logPrefix, am.targetIP, am.name)
+	// Controller only ever tries to unreserve the address named with the load balancer's name.
+	err := am.svc.DeleteRegionAddress(am.name, am.region)
+	if err != nil {
+		if isNotFound(err) {
+			glog.Warningf("%v: address %q was not found. Ignoring.", am.logPrefix, am.name)
+			return nil
+		}
+
+		return err
+	}
+
+	glog.V(4).Infof("%v: successfully released IP %q named %q", am.logPrefix, am.targetIP, am.name)
+	return nil
+}
+
+func (am *addressManager) ensureAddressReservation() (string, error) {
+	// Try reserving the IP with controller-owned address name
+	// If am.targetIP is an empty string, a new IP will be created.
+	newAddr := &compute.Address{
+		Name:        am.name,
+		Description: fmt.Sprintf(`{"kubernetes.io/service-name":"%s"}`, am.serviceName),
+		Address:     am.targetIP,
+		AddressType: string(am.addressType),
+		Subnetwork:  am.subnetURL,
+	}
+
+	reserveErr := am.svc.ReserveRegionAddress(newAddr, am.region)
+	if reserveErr == nil {
+		if newAddr.Address != "" {
+			glog.V(4).Infof("%v: successfully reserved IP %q with name %q", am.logPrefix, newAddr.Address, newAddr.Name)
+			return newAddr.Address, nil
+		}
+
+		addr, err := am.svc.GetRegionAddress(newAddr.Name, am.region)
+		if err != nil {
+			return "", err
+		}
+
+		glog.V(4).Infof("%v: successfully created address %q which reserved IP %q", am.logPrefix, addr.Name, addr.Address)
+		return addr.Address, nil
+	} else if !isHTTPErrorCode(reserveErr, http.StatusConflict) && !isHTTPErrorCode(reserveErr, http.StatusBadRequest) {
+		// If the IP is already reserved:
+		//    by an internal address: a StatusConflict is returned
+		//    by an external address: a BadRequest is returned
+		return "", reserveErr
+	}
+
+	// If the target IP was empty, we cannot try to find which IP caused a conflict.
+	// If the name was already used, then the next sync will attempt deletion of that address.
+	if am.targetIP == "" {
+		return "", fmt.Errorf("failed to reserve address %q with no specific IP, err: %v", am.name, reserveErr)
+	}
+
+	// Reserving the address failed due to a conflict or bad request. The address manager just checked that no address
+	// exists with the name, so it may belong to the user.
+	addr, err := am.svc.GetRegionAddressByIP(am.region, am.targetIP)
+	if err != nil {
+		return "", fmt.Errorf("failed to get address by IP %q after reservation attempt, err: %q, reservation err: %q", am.targetIP, err, reserveErr)
+	}
+
+	// Check that the address attributes are as required.
+	if err := am.validateAddress(addr); err != nil {
+		return "", err
+	}
+
+	if am.isManagedAddress(addr) {
+		// The address with this name is checked at the beginning of 'HoldAddress()', but for some reason
+		// it was re-created by this point. May be possible that two controllers are running.
+		glog.Warning("%v: address %q unexpectedly existed with IP %q.", am.logPrefix, addr.Name, am.targetIP)
+	} else {
+		// If the retrieved address is not named with the loadbalancer name, then the controller does not own it, but will allow use of it.
+		glog.V(4).Infof("%v: address %q was already reserved with name: %q, description: %q", am.logPrefix, am.targetIP, addr.Name, addr.Description)
+		am.tryRelease = false
+	}
+
+	return addr.Address, nil
+}
+
+func (am *addressManager) validateAddress(addr *compute.Address) error {
+	if am.targetIP != "" && am.targetIP != addr.Address {
+		return fmt.Errorf("address %q does not have the expected IP %q, actual: %q", addr.Name, am.targetIP, addr.Address)
+	}
+	if addr.AddressType != string(am.addressType) {
+		return fmt.Errorf("address %q does not have the expected address type %q, actual: %q", addr.Name, am.addressType, addr.AddressType)
+	}
+
+	return nil
+}
+
+func (am *addressManager) isManagedAddress(addr *compute.Address) bool {
+	return addr.Name == am.name
+}
+
+func ensureAddressDeleted(svc CloudAddressService, name, region string) error {
+	return ignoreNotFound(svc.DeleteRegionAddress(name, region))
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_address_manager_test.go

@@ -0,0 +1,147 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	compute "google.golang.org/api/compute/v1"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+)
+
+const testSvcName = "my-service"
+const testSubnet = "/projects/x/testRegions/us-central1/testSubnetworks/customsub"
+const testLBName = "a111111111111111"
+
+var vals = DefaultTestClusterValues()
+
+// TestAddressManagerNoRequestedIP tests the typical case of passing in no requested IP
+func TestAddressManagerNoRequestedIP(t *testing.T) {
+	svc, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+	targetIP := ""
+
+	mgr := newAddressManager(svc, testSvcName, vals.Region, testSubnet, testLBName, targetIP, cloud.SchemeInternal)
+	testHoldAddress(t, mgr, svc, testLBName, vals.Region, targetIP, string(cloud.SchemeInternal))
+	testReleaseAddress(t, mgr, svc, testLBName, vals.Region)
+}
+
+// TestAddressManagerBasic tests the typical case of reserving and unreserving an address.
+func TestAddressManagerBasic(t *testing.T) {
+	svc, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+	targetIP := "1.1.1.1"
+
+	mgr := newAddressManager(svc, testSvcName, vals.Region, testSubnet, testLBName, targetIP, cloud.SchemeInternal)
+	testHoldAddress(t, mgr, svc, testLBName, vals.Region, targetIP, string(cloud.SchemeInternal))
+	testReleaseAddress(t, mgr, svc, testLBName, vals.Region)
+}
+
+// TestAddressManagerOrphaned tests the case where the address exists with the IP being equal
+// to the requested address (forwarding rule or loadbalancer IP).
+func TestAddressManagerOrphaned(t *testing.T) {
+	svc, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+	targetIP := "1.1.1.1"
+
+	addr := &compute.Address{Name: testLBName, Address: targetIP, AddressType: string(cloud.SchemeInternal)}
+	err = svc.ReserveRegionAddress(addr, vals.Region)
+	require.NoError(t, err)
+
+	mgr := newAddressManager(svc, testSvcName, vals.Region, testSubnet, testLBName, targetIP, cloud.SchemeInternal)
+	testHoldAddress(t, mgr, svc, testLBName, vals.Region, targetIP, string(cloud.SchemeInternal))
+	testReleaseAddress(t, mgr, svc, testLBName, vals.Region)
+}
+
+// TestAddressManagerOutdatedOrphan tests the case where an address exists but points to
+// an IP other than the forwarding rule or loadbalancer IP.
+func TestAddressManagerOutdatedOrphan(t *testing.T) {
+	svc, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+	previousAddress := "1.1.0.0"
+	targetIP := "1.1.1.1"
+
+	addr := &compute.Address{Name: testLBName, Address: previousAddress, AddressType: string(cloud.SchemeExternal)}
+	err = svc.ReserveRegionAddress(addr, vals.Region)
+	require.NoError(t, err)
+
+	mgr := newAddressManager(svc, testSvcName, vals.Region, testSubnet, testLBName, targetIP, cloud.SchemeInternal)
+	testHoldAddress(t, mgr, svc, testLBName, vals.Region, targetIP, string(cloud.SchemeInternal))
+	testReleaseAddress(t, mgr, svc, testLBName, vals.Region)
+}
+
+// TestAddressManagerExternallyOwned tests the case where the address exists but isn't
+// owned by the controller.
+func TestAddressManagerExternallyOwned(t *testing.T) {
+	svc, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+	targetIP := "1.1.1.1"
+
+	addr := &compute.Address{Name: "my-important-address", Address: targetIP, AddressType: string(cloud.SchemeInternal)}
+	err = svc.ReserveRegionAddress(addr, vals.Region)
+	require.NoError(t, err)
+
+	mgr := newAddressManager(svc, testSvcName, vals.Region, testSubnet, testLBName, targetIP, cloud.SchemeInternal)
+	ipToUse, err := mgr.HoldAddress()
+	require.NoError(t, err)
+	assert.NotEmpty(t, ipToUse)
+
+	ad, err := svc.GetRegionAddress(testLBName, vals.Region)
+	assert.True(t, isNotFound(err))
+	require.Nil(t, ad)
+
+	testReleaseAddress(t, mgr, svc, testLBName, vals.Region)
+}
+
+// TestAddressManagerExternallyOwned tests the case where the address exists but isn't
+// owned by the controller. However, this address has the wrong type.
+func TestAddressManagerBadExternallyOwned(t *testing.T) {
+	svc, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+	targetIP := "1.1.1.1"
+
+	addr := &compute.Address{Name: "my-important-address", Address: targetIP, AddressType: string(cloud.SchemeExternal)}
+	err = svc.ReserveRegionAddress(addr, vals.Region)
+	require.NoError(t, err)
+
+	mgr := newAddressManager(svc, testSvcName, vals.Region, testSubnet, testLBName, targetIP, cloud.SchemeInternal)
+	ad, err := mgr.HoldAddress()
+	assert.NotNil(t, err) // FIXME
+	require.Equal(t, ad, "")
+}
+
+func testHoldAddress(t *testing.T, mgr *addressManager, svc CloudAddressService, name, region, targetIP, scheme string) {
+	ipToUse, err := mgr.HoldAddress()
+	require.NoError(t, err)
+	assert.NotEmpty(t, ipToUse)
+
+	addr, err := svc.GetRegionAddress(name, region)
+	require.NoError(t, err)
+	if targetIP != "" {
+		assert.EqualValues(t, targetIP, addr.Address)
+	}
+	assert.EqualValues(t, scheme, addr.AddressType)
+}
+
+func testReleaseAddress(t *testing.T, mgr *addressManager, svc CloudAddressService, name, region string) {
+	err := mgr.ReleaseAddress()
+	require.NoError(t, err)
+	_, err = svc.GetRegionAddress(name, region)
+	assert.True(t, isNotFound(err))
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_addresses.go

@@ -0,0 +1,211 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"fmt"
+
+	"github.com/golang/glog"
+
+	computealpha "google.golang.org/api/compute/v0.alpha"
+	computebeta "google.golang.org/api/compute/v0.beta"
+	compute "google.golang.org/api/compute/v1"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func newAddressMetricContext(request, region string) *metricContext {
+	return newAddressMetricContextWithVersion(request, region, computeV1Version)
+}
+
+func newAddressMetricContextWithVersion(request, region, version string) *metricContext {
+	return newGenericMetricContext("address", request, region, unusedMetricLabel, version)
+}
+
+// ReserveGlobalAddress creates a global address.
+// Caller is allocated a random IP if they do not specify an ipAddress. If an
+// ipAddress is specified, it must belong to the current project, eg: an
+// ephemeral IP associated with a global forwarding rule.
+func (gce *GCECloud) ReserveGlobalAddress(addr *compute.Address) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newAddressMetricContext("reserve", "")
+	return mc.Observe(gce.c.GlobalAddresses().Insert(ctx, meta.GlobalKey(addr.Name), addr))
+}
+
+// DeleteGlobalAddress deletes a global address by name.
+func (gce *GCECloud) DeleteGlobalAddress(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newAddressMetricContext("delete", "")
+	return mc.Observe(gce.c.GlobalAddresses().Delete(ctx, meta.GlobalKey(name)))
+}
+
+// GetGlobalAddress returns the global address by name.
+func (gce *GCECloud) GetGlobalAddress(name string) (*compute.Address, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newAddressMetricContext("get", "")
+	v, err := gce.c.GlobalAddresses().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// ReserveRegionAddress creates a region address
+func (gce *GCECloud) ReserveRegionAddress(addr *compute.Address, region string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newAddressMetricContext("reserve", region)
+	return mc.Observe(gce.c.Addresses().Insert(ctx, meta.RegionalKey(addr.Name, region), addr))
+}
+
+// ReserveAlphaRegionAddress creates an Alpha, regional address.
+func (gce *GCECloud) ReserveAlphaRegionAddress(addr *computealpha.Address, region string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newAddressMetricContext("reserve", region)
+	return mc.Observe(gce.c.AlphaAddresses().Insert(ctx, meta.RegionalKey(addr.Name, region), addr))
+}
+
+// ReserveBetaRegionAddress creates a beta region address
+func (gce *GCECloud) ReserveBetaRegionAddress(addr *computebeta.Address, region string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newAddressMetricContext("reserve", region)
+	return mc.Observe(gce.c.BetaAddresses().Insert(ctx, meta.RegionalKey(addr.Name, region), addr))
+}
+
+// DeleteRegionAddress deletes a region address by name.
+func (gce *GCECloud) DeleteRegionAddress(name, region string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newAddressMetricContext("delete", region)
+	return mc.Observe(gce.c.Addresses().Delete(ctx, meta.RegionalKey(name, region)))
+}
+
+// GetRegionAddress returns the region address by name
+func (gce *GCECloud) GetRegionAddress(name, region string) (*compute.Address, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newAddressMetricContext("get", region)
+	v, err := gce.c.Addresses().Get(ctx, meta.RegionalKey(name, region))
+	return v, mc.Observe(err)
+}
+
+// GetAlphaRegionAddress returns the Alpha, regional address by name.
+func (gce *GCECloud) GetAlphaRegionAddress(name, region string) (*computealpha.Address, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newAddressMetricContext("get", region)
+	v, err := gce.c.AlphaAddresses().Get(ctx, meta.RegionalKey(name, region))
+	return v, mc.Observe(err)
+}
+
+// GetBetaRegionAddress returns the beta region address by name
+func (gce *GCECloud) GetBetaRegionAddress(name, region string) (*computebeta.Address, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newAddressMetricContext("get", region)
+	v, err := gce.c.BetaAddresses().Get(ctx, meta.RegionalKey(name, region))
+	return v, mc.Observe(err)
+}
+
+// GetRegionAddressByIP returns the regional address matching the given IP address.
+func (gce *GCECloud) GetRegionAddressByIP(region, ipAddress string) (*compute.Address, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newAddressMetricContext("list", region)
+	addrs, err := gce.c.Addresses().List(ctx, region, filter.Regexp("address", ipAddress))
+
+	mc.Observe(err)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(addrs) > 1 {
+		glog.Warningf("More than one addresses matching the IP %q: %v", ipAddress, addrNames(addrs))
+	}
+	for _, addr := range addrs {
+		if addr.Address == ipAddress {
+			return addr, nil
+		}
+	}
+	return nil, makeGoogleAPINotFoundError(fmt.Sprintf("Address with IP %q was not found in region %q", ipAddress, region))
+}
+
+// GetBetaRegionAddressByIP returns the beta regional address matching the given IP address.
+func (gce *GCECloud) GetBetaRegionAddressByIP(region, ipAddress string) (*computebeta.Address, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newAddressMetricContext("list", region)
+	addrs, err := gce.c.BetaAddresses().List(ctx, region, filter.Regexp("address", ipAddress))
+
+	mc.Observe(err)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(addrs) > 1 {
+		glog.Warningf("More than one addresses matching the IP %q: %v", ipAddress, addrNames(addrs))
+	}
+	for _, addr := range addrs {
+		if addr.Address == ipAddress {
+			return addr, nil
+		}
+	}
+	return nil, makeGoogleAPINotFoundError(fmt.Sprintf("Address with IP %q was not found in region %q", ipAddress, region))
+}
+
+// TODO(#51665): retire this function once Network Tiers becomes Beta in GCP.
+func (gce *GCECloud) getNetworkTierFromAddress(name, region string) (string, error) {
+	if !gce.AlphaFeatureGate.Enabled(AlphaFeatureNetworkTiers) {
+		return cloud.NetworkTierDefault.ToGCEValue(), nil
+	}
+	addr, err := gce.GetAlphaRegionAddress(name, region)
+	if err != nil {
+		return handleAlphaNetworkTierGetError(err)
+	}
+	return addr.NetworkTier, nil
+}
+
+func addrNames(items interface{}) []string {
+	var ret []string
+	switch items := items.(type) {
+	case []compute.Address:
+		for _, a := range items {
+			ret = append(ret, a.Name)
+		}
+	case []computebeta.Address:
+		for _, a := range items {
+			ret = append(ret, a.Name)
+		}
+	}
+	return ret
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_alpha.go

@@ -0,0 +1,54 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"fmt"
+)
+
+const (
+	// alpha: v1.8 (for Services)
+	//
+	// Allows Services backed by a GCP load balancer to choose what network
+	// tier to use. Currently supports "Standard" and "Premium" (default).
+	AlphaFeatureNetworkTiers = "NetworkTiers"
+
+	AlphaFeatureNetworkEndpointGroup = "NetworkEndpointGroup"
+)
+
+type AlphaFeatureGate struct {
+	features map[string]bool
+}
+
+func (af *AlphaFeatureGate) Enabled(key string) bool {
+	return af.features[key]
+}
+
+func NewAlphaFeatureGate(features []string) *AlphaFeatureGate {
+	featureMap := make(map[string]bool)
+	for _, name := range features {
+		featureMap[name] = true
+	}
+	return &AlphaFeatureGate{featureMap}
+}
+
+func (gce *GCECloud) alphaFeatureEnabled(feature string) error {
+	if !gce.AlphaFeatureGate.Enabled(feature) {
+		return fmt.Errorf("alpha feature %q is not enabled.", feature)
+	}
+	return nil
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_annotations.go

@@ -0,0 +1,110 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"fmt"
+
+	"github.com/golang/glog"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+)
+
+type LoadBalancerType string
+
+const (
+	// ServiceAnnotationLoadBalancerType is annotated on a service with type LoadBalancer
+	// dictates what specific kind of GCP LB should be assembled.
+	// Currently, only "internal" is supported.
+	ServiceAnnotationLoadBalancerType = "cloud.google.com/load-balancer-type"
+
+	LBTypeInternal LoadBalancerType = "Internal"
+	// Deprecating the lowercase spelling of Internal.
+	deprecatedTypeInternalLowerCase LoadBalancerType = "internal"
+
+	// ServiceAnnotationInternalBackendShare is annotated on a service with "true" when users
+	// want to share GCP Backend Services for a set of internal load balancers.
+	// ALPHA feature - this may be removed in a future release.
+	ServiceAnnotationILBBackendShare = "alpha.cloud.google.com/load-balancer-backend-share"
+	// This annotation did not correctly specify "alpha", so both annotations will be checked.
+	deprecatedServiceAnnotationILBBackendShare = "cloud.google.com/load-balancer-backend-share"
+
+	// NetworkTierAnnotationKey is annotated on a Service object to indicate which
+	// network tier a GCP LB should use. The valid values are "Standard" and
+	// "Premium" (default).
+	NetworkTierAnnotationKey      = "cloud.google.com/network-tier"
+	NetworkTierAnnotationStandard = cloud.NetworkTierStandard
+	NetworkTierAnnotationPremium  = cloud.NetworkTierPremium
+)
+
+// GetLoadBalancerAnnotationType returns the type of GCP load balancer which should be assembled.
+func GetLoadBalancerAnnotationType(service *v1.Service) (LoadBalancerType, bool) {
+	v := LoadBalancerType("")
+	if service.Spec.Type != v1.ServiceTypeLoadBalancer {
+		return v, false
+	}
+
+	l, ok := service.Annotations[ServiceAnnotationLoadBalancerType]
+	v = LoadBalancerType(l)
+	if !ok {
+		return v, false
+	}
+
+	switch v {
+	case LBTypeInternal, deprecatedTypeInternalLowerCase:
+		return LBTypeInternal, true
+	default:
+		return v, false
+	}
+}
+
+// GetLoadBalancerAnnotationBackendShare returns whether this service's backend service should be
+// shared with other load balancers. Health checks and the healthcheck firewall will be shared regardless.
+func GetLoadBalancerAnnotationBackendShare(service *v1.Service) bool {
+	if l, exists := service.Annotations[ServiceAnnotationILBBackendShare]; exists && l == "true" {
+		return true
+	}
+
+	// Check for deprecated annotation key
+	if l, exists := service.Annotations[deprecatedServiceAnnotationILBBackendShare]; exists && l == "true" {
+		glog.Warningf("Annotation %q is deprecated and replaced with an alpha-specific key: %q", deprecatedServiceAnnotationILBBackendShare, ServiceAnnotationILBBackendShare)
+		return true
+	}
+
+	return false
+}
+
+// GetServiceNetworkTier returns the network tier of GCP load balancer
+// which should be assembled, and an error if the specified tier is not
+// supported.
+func GetServiceNetworkTier(service *v1.Service) (cloud.NetworkTier, error) {
+	l, ok := service.Annotations[NetworkTierAnnotationKey]
+	if !ok {
+		return cloud.NetworkTierDefault, nil
+	}
+
+	v := cloud.NetworkTier(l)
+	switch v {
+	case cloud.NetworkTierStandard:
+		fallthrough
+	case cloud.NetworkTierPremium:
+		return v, nil
+	default:
+		return cloud.NetworkTierDefault, fmt.Errorf("unsupported network tier: %q", v)
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_annotations_test.go

@@ -0,0 +1,71 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"testing"
+
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestServiceNetworkTierAnnotationKey(t *testing.T) {
+	createTestService := func() *v1.Service {
+		return &v1.Service{
+			ObjectMeta: metav1.ObjectMeta{
+				UID:       "randome-uid",
+				Name:      "test-svc",
+				Namespace: "test-ns",
+			},
+		}
+	}
+
+	for testName, testCase := range map[string]struct {
+		annotations  map[string]string
+		expectedTier cloud.NetworkTier
+		expectErr    bool
+	}{
+		"Use the default when the annotation does not exist": {
+			annotations:  nil,
+			expectedTier: cloud.NetworkTierDefault,
+		},
+		"Standard tier": {
+			annotations:  map[string]string{NetworkTierAnnotationKey: "Standard"},
+			expectedTier: cloud.NetworkTierStandard,
+		},
+		"Premium tier": {
+			annotations:  map[string]string{NetworkTierAnnotationKey: "Premium"},
+			expectedTier: cloud.NetworkTierPremium,
+		},
+		"Report an error on invalid network tier value": {
+			annotations:  map[string]string{NetworkTierAnnotationKey: "Unknown-tier"},
+			expectedTier: cloud.NetworkTierPremium,
+			expectErr:    true,
+		},
+	} {
+		t.Run(testName, func(t *testing.T) {
+			svc := createTestService()
+			svc.Annotations = testCase.annotations
+			actualTier, err := GetServiceNetworkTier(svc)
+			assert.Equal(t, testCase.expectedTier, actualTier)
+			assert.Equal(t, testCase.expectErr, err != nil)
+		})
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_backendservice.go

@@ -0,0 +1,216 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	computealpha "google.golang.org/api/compute/v0.alpha"
+	computebeta "google.golang.org/api/compute/v0.beta"
+	compute "google.golang.org/api/compute/v1"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func newBackendServiceMetricContext(request, region string) *metricContext {
+	return newBackendServiceMetricContextWithVersion(request, region, computeV1Version)
+}
+
+func newBackendServiceMetricContextWithVersion(request, region, version string) *metricContext {
+	return newGenericMetricContext("backendservice", request, region, unusedMetricLabel, version)
+}
+
+// GetGlobalBackendService retrieves a backend by name.
+func (gce *GCECloud) GetGlobalBackendService(name string) (*compute.BackendService, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("get", "")
+	v, err := gce.c.BackendServices().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// GetBetaGlobalBackendService retrieves beta backend by name.
+func (gce *GCECloud) GetBetaGlobalBackendService(name string) (*computebeta.BackendService, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContextWithVersion("get", "", computeBetaVersion)
+	v, err := gce.c.BetaBackendServices().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// GetAlphaGlobalBackendService retrieves alpha backend by name.
+func (gce *GCECloud) GetAlphaGlobalBackendService(name string) (*computealpha.BackendService, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContextWithVersion("get", "", computeAlphaVersion)
+	v, err := gce.c.AlphaBackendServices().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// UpdateGlobalBackendService applies the given BackendService as an update to
+// an existing service.
+func (gce *GCECloud) UpdateGlobalBackendService(bg *compute.BackendService) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("update", "")
+	return mc.Observe(gce.c.BackendServices().Update(ctx, meta.GlobalKey(bg.Name), bg))
+}
+
+// UpdateAlphaGlobalBackendService applies the given alpha BackendService as an
+// update to an existing service.
+func (gce *GCECloud) UpdateAlphaGlobalBackendService(bg *computealpha.BackendService) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("update", "")
+	return mc.Observe(gce.c.AlphaBackendServices().Update(ctx, meta.GlobalKey(bg.Name), bg))
+}
+
+// DeleteGlobalBackendService deletes the given BackendService by name.
+func (gce *GCECloud) DeleteGlobalBackendService(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("delete", "")
+	return mc.Observe(gce.c.BackendServices().Delete(ctx, meta.GlobalKey(name)))
+}
+
+// CreateGlobalBackendService creates the given BackendService.
+func (gce *GCECloud) CreateGlobalBackendService(bg *compute.BackendService) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("create", "")
+	return mc.Observe(gce.c.BackendServices().Insert(ctx, meta.GlobalKey(bg.Name), bg))
+}
+
+// CreateAlphaGlobalBackendService creates the given alpha BackendService.
+func (gce *GCECloud) CreateAlphaGlobalBackendService(bg *computealpha.BackendService) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("create", "")
+	return mc.Observe(gce.c.AlphaBackendServices().Insert(ctx, meta.GlobalKey(bg.Name), bg))
+}
+
+// ListGlobalBackendServices lists all backend services in the project.
+func (gce *GCECloud) ListGlobalBackendServices() ([]*compute.BackendService, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("list", "")
+	v, err := gce.c.BackendServices().List(ctx, filter.None)
+	return v, mc.Observe(err)
+}
+
+// GetGlobalBackendServiceHealth returns the health of the BackendService
+// identified by the given name, in the given instanceGroup. The
+// instanceGroupLink is the fully qualified self link of an instance group.
+func (gce *GCECloud) GetGlobalBackendServiceHealth(name string, instanceGroupLink string) (*compute.BackendServiceGroupHealth, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("get_health", "")
+	groupRef := &compute.ResourceGroupReference{Group: instanceGroupLink}
+	v, err := gce.c.BackendServices().GetHealth(ctx, meta.GlobalKey(name), groupRef)
+	return v, mc.Observe(err)
+}
+
+// GetRegionBackendService retrieves a backend by name.
+func (gce *GCECloud) GetRegionBackendService(name, region string) (*compute.BackendService, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("get", region)
+	v, err := gce.c.RegionBackendServices().Get(ctx, meta.RegionalKey(name, region))
+	return v, mc.Observe(err)
+}
+
+// UpdateRegionBackendService applies the given BackendService as an update to
+// an existing service.
+func (gce *GCECloud) UpdateRegionBackendService(bg *compute.BackendService, region string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("update", region)
+	return mc.Observe(gce.c.RegionBackendServices().Update(ctx, meta.RegionalKey(bg.Name, region), bg))
+}
+
+// DeleteRegionBackendService deletes the given BackendService by name.
+func (gce *GCECloud) DeleteRegionBackendService(name, region string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("delete", region)
+	return mc.Observe(gce.c.RegionBackendServices().Delete(ctx, meta.RegionalKey(name, region)))
+}
+
+// CreateRegionBackendService creates the given BackendService.
+func (gce *GCECloud) CreateRegionBackendService(bg *compute.BackendService, region string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("create", region)
+	return mc.Observe(gce.c.RegionBackendServices().Insert(ctx, meta.RegionalKey(bg.Name, region), bg))
+}
+
+// ListRegionBackendServices lists all backend services in the project.
+func (gce *GCECloud) ListRegionBackendServices(region string) ([]*compute.BackendService, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("list", region)
+	v, err := gce.c.RegionBackendServices().List(ctx, region, filter.None)
+	return v, mc.Observe(err)
+}
+
+// GetRegionalBackendServiceHealth returns the health of the BackendService
+// identified by the given name, in the given instanceGroup. The
+// instanceGroupLink is the fully qualified self link of an instance group.
+func (gce *GCECloud) GetRegionalBackendServiceHealth(name, region string, instanceGroupLink string) (*compute.BackendServiceGroupHealth, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContext("get_health", region)
+	ref := &compute.ResourceGroupReference{Group: instanceGroupLink}
+	v, err := gce.c.RegionBackendServices().GetHealth(ctx, meta.RegionalKey(name, region), ref)
+	return v, mc.Observe(err)
+}
+
+// SetSecurityPolicyForBetaGlobalBackendService sets the given
+// SecurityPolicyReference for the BackendService identified by the given name.
+func (gce *GCECloud) SetSecurityPolicyForBetaGlobalBackendService(backendServiceName string, securityPolicyReference *computebeta.SecurityPolicyReference) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContextWithVersion("set_security_policy", "", computeBetaVersion)
+	return mc.Observe(gce.c.BetaBackendServices().SetSecurityPolicy(ctx, meta.GlobalKey(backendServiceName), securityPolicyReference))
+}
+
+// SetSecurityPolicyForAlphaGlobalBackendService sets the given
+// SecurityPolicyReference for the BackendService identified by the given name.
+func (gce *GCECloud) SetSecurityPolicyForAlphaGlobalBackendService(backendServiceName string, securityPolicyReference *computealpha.SecurityPolicyReference) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newBackendServiceMetricContextWithVersion("set_security_policy", "", computeAlphaVersion)
+	return mc.Observe(gce.c.AlphaBackendServices().SetSecurityPolicy(ctx, meta.GlobalKey(backendServiceName), securityPolicyReference))
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_cert.go

@@ -0,0 +1,71 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	compute "google.golang.org/api/compute/v1"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func newCertMetricContext(request string) *metricContext {
+	return newGenericMetricContext("cert", request, unusedMetricLabel, unusedMetricLabel, computeV1Version)
+}
+
+// GetSslCertificate returns the SslCertificate by name.
+func (gce *GCECloud) GetSslCertificate(name string) (*compute.SslCertificate, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newCertMetricContext("get")
+	v, err := gce.c.SslCertificates().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// CreateSslCertificate creates and returns a SslCertificate.
+func (gce *GCECloud) CreateSslCertificate(sslCerts *compute.SslCertificate) (*compute.SslCertificate, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newCertMetricContext("create")
+	err := gce.c.SslCertificates().Insert(ctx, meta.GlobalKey(sslCerts.Name), sslCerts)
+	if err != nil {
+		return nil, mc.Observe(err)
+	}
+	return gce.GetSslCertificate(sslCerts.Name)
+}
+
+// DeleteSslCertificate deletes the SslCertificate by name.
+func (gce *GCECloud) DeleteSslCertificate(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newCertMetricContext("delete")
+	return mc.Observe(gce.c.SslCertificates().Delete(ctx, meta.GlobalKey(name)))
+}
+
+// ListSslCertificates lists all SslCertificates in the project.
+func (gce *GCECloud) ListSslCertificates() ([]*compute.SslCertificate, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newCertMetricContext("list")
+	v, err := gce.c.SslCertificates().List(ctx, filter.None)
+	return v, mc.Observe(err)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_clusterid.go

@@ -0,0 +1,258 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"reflect"
+	"sync"
+	"time"
+
+	"github.com/golang/glog"
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	clientset "k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/cache"
+)
+
+const (
+	// Key used to persist UIDs to configmaps.
+	UIDConfigMapName = "ingress-uid"
+	// Namespace which contains the above config map
+	UIDNamespace = metav1.NamespaceSystem
+	// Data keys for the specific ids
+	UIDCluster     = "uid"
+	UIDProvider    = "provider-uid"
+	UIDLengthBytes = 8
+	// Frequency of the updateFunc event handler being called
+	// This does not actually query the apiserver for current state - the local cache value is used.
+	updateFuncFrequency = 10 * time.Minute
+)
+
+type ClusterID struct {
+	idLock     sync.RWMutex
+	client     clientset.Interface
+	cfgMapKey  string
+	store      cache.Store
+	providerID *string
+	clusterID  *string
+}
+
+// Continually watches for changes to the cluster id config map
+func (gce *GCECloud) watchClusterID() {
+	gce.ClusterID = ClusterID{
+		cfgMapKey: fmt.Sprintf("%v/%v", UIDNamespace, UIDConfigMapName),
+		client:    gce.client,
+	}
+
+	mapEventHandler := cache.ResourceEventHandlerFuncs{
+		AddFunc: func(obj interface{}) {
+			m, ok := obj.(*v1.ConfigMap)
+			if !ok || m == nil {
+				glog.Errorf("Expected v1.ConfigMap, item=%+v, typeIsOk=%v", obj, ok)
+				return
+			}
+			if m.Namespace != UIDNamespace ||
+				m.Name != UIDConfigMapName {
+				return
+			}
+
+			glog.V(4).Infof("Observed new configmap for clusteriD: %v, %v; setting local values", m.Name, m.Data)
+			gce.ClusterID.update(m)
+		},
+		UpdateFunc: func(old, cur interface{}) {
+			m, ok := cur.(*v1.ConfigMap)
+			if !ok || m == nil {
+				glog.Errorf("Expected v1.ConfigMap, item=%+v, typeIsOk=%v", cur, ok)
+				return
+			}
+
+			if m.Namespace != UIDNamespace ||
+				m.Name != UIDConfigMapName {
+				return
+			}
+
+			if reflect.DeepEqual(old, cur) {
+				return
+			}
+
+			glog.V(4).Infof("Observed updated configmap for clusteriD %v, %v; setting local values", m.Name, m.Data)
+			gce.ClusterID.update(m)
+		},
+	}
+
+	listerWatcher := cache.NewListWatchFromClient(gce.ClusterID.client.CoreV1().RESTClient(), "configmaps", UIDNamespace, fields.Everything())
+	var controller cache.Controller
+	gce.ClusterID.store, controller = cache.NewInformer(newSingleObjectListerWatcher(listerWatcher, UIDConfigMapName), &v1.ConfigMap{}, updateFuncFrequency, mapEventHandler)
+
+	controller.Run(nil)
+}
+
+// GetID returns the id which is unique to this cluster
+// if federated, return the provider id (unique to the cluster)
+// if not federated, return the cluster id
+func (ci *ClusterID) GetID() (string, error) {
+	if err := ci.getOrInitialize(); err != nil {
+		return "", err
+	}
+
+	ci.idLock.RLock()
+	defer ci.idLock.RUnlock()
+	if ci.clusterID == nil {
+		return "", errors.New("Could not retrieve cluster id")
+	}
+
+	// If provider ID is set, (Federation is enabled) use this field
+	if ci.providerID != nil {
+		return *ci.providerID, nil
+	}
+
+	// providerID is not set, use the cluster id
+	return *ci.clusterID, nil
+}
+
+// GetFederationId returns the id which could represent the entire Federation
+// or just the cluster if not federated.
+func (ci *ClusterID) GetFederationId() (string, bool, error) {
+	if err := ci.getOrInitialize(); err != nil {
+		return "", false, err
+	}
+
+	ci.idLock.RLock()
+	defer ci.idLock.RUnlock()
+	if ci.clusterID == nil {
+		return "", false, errors.New("Could not retrieve cluster id")
+	}
+
+	// If provider ID is not set, return false
+	if ci.providerID == nil || *ci.clusterID == *ci.providerID {
+		return "", false, nil
+	}
+
+	return *ci.clusterID, true, nil
+}
+
+// getOrInitialize either grabs the configmaps current value or defines the value
+// and sets the configmap. This is for the case of the user calling GetClusterID()
+// before the watch has begun.
+func (ci *ClusterID) getOrInitialize() error {
+	if ci.store == nil {
+		return errors.New("GCECloud.ClusterID is not ready. Call Initialize() before using.")
+	}
+
+	if ci.clusterID != nil {
+		return nil
+	}
+
+	exists, err := ci.getConfigMap()
+	if err != nil {
+		return err
+	} else if exists {
+		return nil
+	}
+
+	// The configmap does not exist - let's try creating one.
+	newId, err := makeUID()
+	if err != nil {
+		return err
+	}
+
+	glog.V(4).Infof("Creating clusteriD: %v", newId)
+	cfg := &v1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      UIDConfigMapName,
+			Namespace: UIDNamespace,
+		},
+	}
+	cfg.Data = map[string]string{
+		UIDCluster:  newId,
+		UIDProvider: newId,
+	}
+
+	if _, err := ci.client.CoreV1().ConfigMaps(UIDNamespace).Create(cfg); err != nil {
+		glog.Errorf("GCE cloud provider failed to create %v config map to store cluster id: %v", ci.cfgMapKey, err)
+		return err
+	}
+
+	glog.V(2).Infof("Created a config map containing clusteriD: %v", newId)
+	ci.update(cfg)
+	return nil
+}
+
+func (ci *ClusterID) getConfigMap() (bool, error) {
+	item, exists, err := ci.store.GetByKey(ci.cfgMapKey)
+	if err != nil {
+		return false, err
+	}
+	if !exists {
+		return false, nil
+	}
+
+	m, ok := item.(*v1.ConfigMap)
+	if !ok || m == nil {
+		err = fmt.Errorf("Expected v1.ConfigMap, item=%+v, typeIsOk=%v", item, ok)
+		glog.Error(err)
+		return false, err
+	}
+	ci.update(m)
+	return true, nil
+}
+
+func (ci *ClusterID) update(m *v1.ConfigMap) {
+	ci.idLock.Lock()
+	defer ci.idLock.Unlock()
+	if clusterID, exists := m.Data[UIDCluster]; exists {
+		ci.clusterID = &clusterID
+	}
+	if provId, exists := m.Data[UIDProvider]; exists {
+		ci.providerID = &provId
+	}
+}
+
+func makeUID() (string, error) {
+	b := make([]byte, UIDLengthBytes)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+func newSingleObjectListerWatcher(lw cache.ListerWatcher, objectName string) *singleObjListerWatcher {
+	return &singleObjListerWatcher{lw: lw, objectName: objectName}
+}
+
+type singleObjListerWatcher struct {
+	lw         cache.ListerWatcher
+	objectName string
+}
+
+func (sow *singleObjListerWatcher) List(options metav1.ListOptions) (runtime.Object, error) {
+	options.FieldSelector = "metadata.name=" + sow.objectName
+	return sow.lw.List(options)
+}
+
+func (sow *singleObjListerWatcher) Watch(options metav1.ListOptions) (watch.Interface, error) {
+	options.FieldSelector = "metadata.name=" + sow.objectName
+	return sow.lw.Watch(options)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_clusters.go

@@ -0,0 +1,57 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import "context"
+
+func newClustersMetricContext(request, zone string) *metricContext {
+	return newGenericMetricContext("clusters", request, unusedMetricLabel, zone, computeV1Version)
+}
+
+func (gce *GCECloud) ListClusters(ctx context.Context) ([]string, error) {
+	allClusters := []string{}
+
+	for _, zone := range gce.managedZones {
+		clusters, err := gce.listClustersInZone(zone)
+		if err != nil {
+			return nil, err
+		}
+		// TODO: Scoping?  Do we need to qualify the cluster name?
+		allClusters = append(allClusters, clusters...)
+	}
+
+	return allClusters, nil
+}
+
+func (gce *GCECloud) Master(ctx context.Context, clusterName string) (string, error) {
+	return "k8s-" + clusterName + "-master.internal", nil
+}
+
+func (gce *GCECloud) listClustersInZone(zone string) ([]string, error) {
+	mc := newClustersMetricContext("list_zone", zone)
+	// TODO: use PageToken to list all not just the first 500
+	list, err := gce.containerService.Projects.Zones.Clusters.List(gce.projectID, zone).Do()
+	if err != nil {
+		return nil, mc.Observe(err)
+	}
+
+	result := []string{}
+	for _, cluster := range list.Clusters {
+		result = append(result, cluster.Name)
+	}
+	return result, mc.Observe(nil)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_disks_test.go

@@ -0,0 +1,892 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"testing"
+
+	"fmt"
+
+	computealpha "google.golang.org/api/compute/v0.alpha"
+	computebeta "google.golang.org/api/compute/v0.beta"
+	compute "google.golang.org/api/compute/v1"
+	"google.golang.org/api/googleapi"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	kubeletapis "k8s.io/kubernetes/pkg/kubelet/apis"
+)
+
+// TODO TODO write a test for GetDiskByNameUnknownZone and make sure casting logic works
+// TODO TODO verify that RegionDisks.Get does not return non-replica disks
+
+func TestCreateDisk_Basic(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{"zone1"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       []string{"zone1"},
+		projectID:          gceProjectId,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+
+	diskName := "disk"
+	diskType := DiskTypeSSD
+	zone := "zone1"
+	const sizeGb int64 = 128
+	tags := make(map[string]string)
+	tags["test-tag"] = "test-value"
+
+	expectedDiskTypeURI := gceComputeAPIEndpoint + "projects/" + fmt.Sprintf(
+		diskTypeURITemplateSingleZone, gceProjectId, zone, diskType)
+	expectedDescription := "{\"test-tag\":\"test-value\"}"
+
+	/* Act */
+	err := gce.CreateDisk(diskName, diskType, zone, sizeGb, tags)
+
+	/* Assert */
+	if err != nil {
+		t.Error(err)
+	}
+	if !fakeManager.createDiskCalled {
+		t.Error("Never called GCE disk create.")
+	}
+
+	// Partial check of equality between disk description sent to GCE and parameters of method.
+	diskToCreate := fakeManager.diskToCreateStable
+	if diskToCreate.Name != diskName {
+		t.Errorf("Expected disk name: %s; Actual: %s", diskName, diskToCreate.Name)
+	}
+
+	if diskToCreate.Type != expectedDiskTypeURI {
+		t.Errorf("Expected disk type: %s; Actual: %s", expectedDiskTypeURI, diskToCreate.Type)
+	}
+	if diskToCreate.SizeGb != sizeGb {
+		t.Errorf("Expected disk size: %d; Actual: %d", sizeGb, diskToCreate.SizeGb)
+	}
+	if diskToCreate.Description != expectedDescription {
+		t.Errorf("Expected tag string: %s; Actual: %s", expectedDescription, diskToCreate.Description)
+	}
+}
+
+func TestCreateRegionalDisk_Basic(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{"zone1", "zone3", "zone2"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		projectID:          gceProjectId,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+
+	diskName := "disk"
+	diskType := DiskTypeSSD
+	replicaZones := sets.NewString("zone1", "zone2")
+	const sizeGb int64 = 128
+	tags := make(map[string]string)
+	tags["test-tag"] = "test-value"
+
+	expectedDiskTypeURI := gceComputeAPIEndpointBeta + "projects/" + fmt.Sprintf(
+		diskTypeURITemplateRegional, gceProjectId, gceRegion, diskType)
+	expectedDescription := "{\"test-tag\":\"test-value\"}"
+
+	/* Act */
+	err := gce.CreateRegionalDisk(diskName, diskType, replicaZones, sizeGb, tags)
+
+	/* Assert */
+	if err != nil {
+		t.Error(err)
+	}
+	if !fakeManager.createDiskCalled {
+		t.Error("Never called GCE disk create.")
+	}
+
+	// Partial check of equality between disk description sent to GCE and parameters of method.
+	diskToCreate := fakeManager.diskToCreateStable
+	if diskToCreate.Name != diskName {
+		t.Errorf("Expected disk name: %s; Actual: %s", diskName, diskToCreate.Name)
+	}
+
+	if diskToCreate.Type != expectedDiskTypeURI {
+		t.Errorf("Expected disk type: %s; Actual: %s", expectedDiskTypeURI, diskToCreate.Type)
+	}
+	if diskToCreate.SizeGb != sizeGb {
+		t.Errorf("Expected disk size: %d; Actual: %d", sizeGb, diskToCreate.SizeGb)
+	}
+	if diskToCreate.Description != expectedDescription {
+		t.Errorf("Expected tag string: %s; Actual: %s", expectedDescription, diskToCreate.Description)
+	}
+}
+
+func TestCreateDisk_DiskAlreadyExists(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{"zone1"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+
+	// Inject disk AlreadyExists error.
+	alreadyExistsError := googleapi.ErrorItem{Reason: "alreadyExists"}
+	fakeManager.opError = &googleapi.Error{
+		Errors: []googleapi.ErrorItem{alreadyExistsError},
+	}
+
+	/* Act */
+	err := gce.CreateDisk("disk", DiskTypeSSD, "zone1", 128, nil)
+
+	/* Assert */
+	if err != nil {
+		t.Error(
+			"Expected success when a disk with the given name already exists, but an error is returned.")
+	}
+}
+
+func TestCreateDisk_WrongZone(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{"zone1"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true }}
+
+	diskName := "disk"
+	diskType := DiskTypeSSD
+	const sizeGb int64 = 128
+
+	/* Act */
+	err := gce.CreateDisk(diskName, diskType, "zone2", sizeGb, nil)
+
+	/* Assert */
+	if err == nil {
+		t.Error("Expected error when zone is not managed, but none returned.")
+	}
+}
+
+func TestCreateDisk_NoManagedZone(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true }}
+
+	diskName := "disk"
+	diskType := DiskTypeSSD
+	const sizeGb int64 = 128
+
+	/* Act */
+	err := gce.CreateDisk(diskName, diskType, "zone1", sizeGb, nil)
+
+	/* Assert */
+	if err == nil {
+		t.Error("Expected error when managedZones is empty, but none returned.")
+	}
+}
+
+func TestCreateDisk_BadDiskType(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{"zone1"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	gce := GCECloud{manager: fakeManager,
+		managedZones:       zonesWithNodes,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true }}
+
+	diskName := "disk"
+	diskType := "arbitrary-disk"
+	zone := "zone1"
+	const sizeGb int64 = 128
+
+	/* Act */
+	err := gce.CreateDisk(diskName, diskType, zone, sizeGb, nil)
+
+	/* Assert */
+	if err == nil {
+		t.Error("Expected error when disk type is not supported, but none returned.")
+	}
+}
+
+func TestCreateDisk_MultiZone(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{"zone1", "zone2", "zone3"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+
+	diskName := "disk"
+	diskType := DiskTypeStandard
+	const sizeGb int64 = 128
+
+	/* Act & Assert */
+	for _, zone := range gce.managedZones {
+		diskName = zone + "disk"
+		err := gce.CreateDisk(diskName, diskType, zone, sizeGb, nil)
+		if err != nil {
+			t.Errorf("Error creating disk in zone '%v'; error: \"%v\"", zone, err)
+		}
+	}
+}
+
+func TestDeleteDisk_Basic(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{"zone1"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+	diskName := "disk"
+	diskType := DiskTypeSSD
+	zone := "zone1"
+	const sizeGb int64 = 128
+
+	gce.CreateDisk(diskName, diskType, zone, sizeGb, nil)
+
+	/* Act */
+	err := gce.DeleteDisk(diskName)
+
+	/* Assert */
+	if err != nil {
+		t.Error(err)
+	}
+	if !fakeManager.deleteDiskCalled {
+		t.Error("Never called GCE disk delete.")
+	}
+
+}
+
+func TestDeleteDisk_NotFound(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{"zone1"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+	diskName := "disk"
+
+	/* Act */
+	err := gce.DeleteDisk(diskName)
+
+	/* Assert */
+	if err != nil {
+		t.Error("Expected successful operation when disk is not found, but an error is returned.")
+	}
+}
+
+func TestDeleteDisk_ResourceBeingUsed(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{"zone1"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+	diskName := "disk"
+	diskType := DiskTypeSSD
+	zone := "zone1"
+	const sizeGb int64 = 128
+
+	gce.CreateDisk(diskName, diskType, zone, sizeGb, nil)
+	fakeManager.resourceInUse = true
+
+	/* Act */
+	err := gce.DeleteDisk(diskName)
+
+	/* Assert */
+	if err == nil {
+		t.Error("Expected error when disk is in use, but none returned.")
+	}
+}
+
+func TestDeleteDisk_SameDiskMultiZone(t *testing.T) {
+	/* Assert */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{"zone1", "zone2", "zone3"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+	diskName := "disk"
+	diskType := DiskTypeSSD
+	const sizeGb int64 = 128
+
+	for _, zone := range gce.managedZones {
+		gce.CreateDisk(diskName, diskType, zone, sizeGb, nil)
+	}
+
+	/* Act */
+	// DeleteDisk will call FakeServiceManager.GetDiskFromCloudProvider() with all zones,
+	// and FakeServiceManager.GetDiskFromCloudProvider() always returns a disk,
+	// so DeleteDisk thinks a disk with diskName exists in all zones.
+	err := gce.DeleteDisk(diskName)
+
+	/* Assert */
+	if err == nil {
+		t.Error("Expected error when disk is found in multiple zones, but none returned.")
+	}
+}
+
+func TestDeleteDisk_DiffDiskMultiZone(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{"zone1"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+	diskName := "disk"
+	diskType := DiskTypeSSD
+	const sizeGb int64 = 128
+
+	for _, zone := range gce.managedZones {
+		diskName = zone + "disk"
+		gce.CreateDisk(diskName, diskType, zone, sizeGb, nil)
+	}
+
+	/* Act & Assert */
+	var err error
+	for _, zone := range gce.managedZones {
+		diskName = zone + "disk"
+		err = gce.DeleteDisk(diskName)
+		if err != nil {
+			t.Errorf("Error deleting disk in zone '%v'; error: \"%v\"", zone, err)
+		}
+	}
+}
+
+func TestGetAutoLabelsForPD_Basic(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "us-central1"
+	zone := "us-central1-c"
+	zonesWithNodes := []string{zone}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	diskName := "disk"
+	diskType := DiskTypeSSD
+	const sizeGb int64 = 128
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+
+	gce.CreateDisk(diskName, diskType, zone, sizeGb, nil)
+
+	/* Act */
+	labels, err := gce.GetAutoLabelsForPD(diskName, zone)
+
+	/* Assert */
+	if err != nil {
+		t.Error(err)
+	}
+	if labels[kubeletapis.LabelZoneFailureDomain] != zone {
+		t.Errorf("Failure domain is '%v', but zone is '%v'",
+			labels[kubeletapis.LabelZoneFailureDomain], zone)
+	}
+	if labels[kubeletapis.LabelZoneRegion] != gceRegion {
+		t.Errorf("Region is '%v', but region is 'us-central1'", labels[kubeletapis.LabelZoneRegion])
+	}
+}
+
+func TestGetAutoLabelsForPD_NoZone(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "europe-west1"
+	zone := "europe-west1-d"
+	zonesWithNodes := []string{zone}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	diskName := "disk"
+	diskType := DiskTypeStandard
+	const sizeGb int64 = 128
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+	gce.CreateDisk(diskName, diskType, zone, sizeGb, nil)
+
+	/* Act */
+	labels, err := gce.GetAutoLabelsForPD(diskName, "")
+
+	/* Assert */
+	if err != nil {
+		t.Error(err)
+	}
+	if labels[kubeletapis.LabelZoneFailureDomain] != zone {
+		t.Errorf("Failure domain is '%v', but zone is '%v'",
+			labels[kubeletapis.LabelZoneFailureDomain], zone)
+	}
+	if labels[kubeletapis.LabelZoneRegion] != gceRegion {
+		t.Errorf("Region is '%v', but region is 'europe-west1'", labels[kubeletapis.LabelZoneRegion])
+	}
+}
+
+func TestGetAutoLabelsForPD_DiskNotFound(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zone := "asia-northeast1-a"
+	zonesWithNodes := []string{zone}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	diskName := "disk"
+	gce := GCECloud{manager: fakeManager,
+		managedZones:       zonesWithNodes,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true }}
+
+	/* Act */
+	_, err := gce.GetAutoLabelsForPD(diskName, zone)
+
+	/* Assert */
+	if err == nil {
+		t.Error("Expected error when the specified disk does not exist, but none returned.")
+	}
+}
+
+func TestGetAutoLabelsForPD_DiskNotFoundAndNoZone(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	diskName := "disk"
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+
+	/* Act */
+	_, err := gce.GetAutoLabelsForPD(diskName, "")
+
+	/* Assert */
+	if err == nil {
+		t.Error("Expected error when the specified disk does not exist, but none returned.")
+	}
+}
+
+func TestGetAutoLabelsForPD_DupDisk(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "us-west1"
+	zonesWithNodes := []string{"us-west1-b", "asia-southeast1-a"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	diskName := "disk"
+	diskType := DiskTypeStandard
+	zone := "us-west1-b"
+	const sizeGb int64 = 128
+
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+	for _, zone := range gce.managedZones {
+		gce.CreateDisk(diskName, diskType, zone, sizeGb, nil)
+	}
+
+	/* Act */
+	labels, err := gce.GetAutoLabelsForPD(diskName, zone)
+
+	/* Assert */
+	if err != nil {
+		t.Error("Disk name and zone uniquely identifies a disk, yet an error is returned.")
+	}
+	if labels[kubeletapis.LabelZoneFailureDomain] != zone {
+		t.Errorf("Failure domain is '%v', but zone is '%v'",
+			labels[kubeletapis.LabelZoneFailureDomain], zone)
+	}
+	if labels[kubeletapis.LabelZoneRegion] != gceRegion {
+		t.Errorf("Region is '%v', but region is 'us-west1'", labels[kubeletapis.LabelZoneRegion])
+	}
+}
+
+func TestGetAutoLabelsForPD_DupDiskNoZone(t *testing.T) {
+	/* Arrange */
+	gceProjectId := "test-project"
+	gceRegion := "fake-region"
+	zonesWithNodes := []string{"us-west1-b", "asia-southeast1-a"}
+	fakeManager := newFakeManager(gceProjectId, gceRegion)
+	diskName := "disk"
+	diskType := DiskTypeStandard
+	const sizeGb int64 = 128
+
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	gce := GCECloud{
+		manager:            fakeManager,
+		managedZones:       zonesWithNodes,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          createNodeZones(zonesWithNodes),
+		nodeInformerSynced: func() bool { return true },
+	}
+	for _, zone := range gce.managedZones {
+		gce.CreateDisk(diskName, diskType, zone, sizeGb, nil)
+	}
+
+	/* Act */
+	_, err := gce.GetAutoLabelsForPD(diskName, "")
+
+	/* Assert */
+	if err == nil {
+		t.Error("Expected error when the disk is duplicated and zone is not specified, but none returned.")
+	}
+}
+
+type targetClientAPI int
+
+const (
+	targetStable targetClientAPI = iota
+	targetBeta
+	targetAlpha
+)
+
+type FakeServiceManager struct {
+	// Common fields shared among tests
+	targetAPI     targetClientAPI
+	gceProjectID  string
+	gceRegion     string
+	zonalDisks    map[string]string      // zone: diskName
+	regionalDisks map[string]sets.String // diskName: zones
+	opError       error
+
+	// Fields for TestCreateDisk
+	createDiskCalled   bool
+	diskToCreateAlpha  *computealpha.Disk
+	diskToCreateBeta   *computebeta.Disk
+	diskToCreateStable *compute.Disk
+
+	// Fields for TestDeleteDisk
+	deleteDiskCalled bool
+	resourceInUse    bool // Marks the disk as in-use
+}
+
+func newFakeManager(gceProjectID string, gceRegion string) *FakeServiceManager {
+	return &FakeServiceManager{
+		zonalDisks:    make(map[string]string),
+		regionalDisks: make(map[string]sets.String),
+		gceProjectID:  gceProjectID,
+		gceRegion:     gceRegion,
+	}
+}
+
+/**
+ * Upon disk creation, disk info is stored in FakeServiceManager
+ * to be used by other tested methods.
+ */
+func (manager *FakeServiceManager) CreateDiskOnCloudProvider(
+	name string,
+	sizeGb int64,
+	tagsStr string,
+	diskType string,
+	zone string) error {
+	manager.createDiskCalled = true
+
+	switch t := manager.targetAPI; t {
+	case targetStable:
+		diskTypeURI := gceComputeAPIEndpoint + "projects/" + fmt.Sprintf(diskTypeURITemplateSingleZone, manager.gceProjectID, zone, diskType)
+		diskToCreateV1 := &compute.Disk{
+			Name:        name,
+			SizeGb:      sizeGb,
+			Description: tagsStr,
+			Type:        diskTypeURI,
+		}
+		manager.diskToCreateStable = diskToCreateV1
+		manager.zonalDisks[zone] = diskToCreateV1.Name
+		return nil
+	case targetBeta:
+		diskTypeURI := gceComputeAPIEndpoint + "projects/" + fmt.Sprintf(diskTypeURITemplateSingleZone, manager.gceProjectID, zone, diskType)
+		diskToCreateBeta := &computebeta.Disk{
+			Name:        name,
+			SizeGb:      sizeGb,
+			Description: tagsStr,
+			Type:        diskTypeURI,
+		}
+		manager.diskToCreateBeta = diskToCreateBeta
+		manager.zonalDisks[zone] = diskToCreateBeta.Name
+		return nil
+	case targetAlpha:
+		diskTypeURI := gceComputeAPIEndpointBeta + "projects/" + fmt.Sprintf(diskTypeURITemplateSingleZone, manager.gceProjectID, zone, diskType)
+		diskToCreateAlpha := &computealpha.Disk{
+			Name:        name,
+			SizeGb:      sizeGb,
+			Description: tagsStr,
+			Type:        diskTypeURI,
+		}
+		manager.diskToCreateAlpha = diskToCreateAlpha
+		manager.zonalDisks[zone] = diskToCreateAlpha.Name
+		return nil
+	default:
+		return fmt.Errorf("unexpected type: %T", t)
+	}
+}
+
+/**
+ * Upon disk creation, disk info is stored in FakeServiceManager
+ * to be used by other tested methods.
+ */
+func (manager *FakeServiceManager) CreateRegionalDiskOnCloudProvider(
+	name string,
+	sizeGb int64,
+	tagsStr string,
+	diskType string,
+	zones sets.String) error {
+	manager.createDiskCalled = true
+	diskTypeURI := gceComputeAPIEndpointBeta + "projects/" + fmt.Sprintf(diskTypeURITemplateRegional, manager.gceProjectID, manager.gceRegion, diskType)
+
+	switch t := manager.targetAPI; t {
+	case targetStable:
+		diskToCreateV1 := &compute.Disk{
+			Name:        name,
+			SizeGb:      sizeGb,
+			Description: tagsStr,
+			Type:        diskTypeURI,
+		}
+		manager.diskToCreateStable = diskToCreateV1
+		manager.regionalDisks[diskToCreateV1.Name] = zones
+		return nil
+	case targetBeta:
+		return fmt.Errorf("RegionalDisk CreateDisk op not supported in beta.")
+	case targetAlpha:
+		return fmt.Errorf("RegionalDisk CreateDisk op not supported in alpha.")
+	default:
+		return fmt.Errorf("unexpected type: %T", t)
+	}
+}
+
+func (manager *FakeServiceManager) AttachDiskOnCloudProvider(
+	disk *GCEDisk,
+	readWrite string,
+	instanceZone string,
+	instanceName string) error {
+
+	switch t := manager.targetAPI; t {
+	case targetStable:
+		return nil
+	case targetBeta:
+		return nil
+	case targetAlpha:
+		return nil
+	default:
+		return fmt.Errorf("unexpected type: %T", t)
+	}
+}
+
+func (manager *FakeServiceManager) DetachDiskOnCloudProvider(
+	instanceZone string,
+	instanceName string,
+	devicePath string) error {
+	switch t := manager.targetAPI; t {
+	case targetStable:
+		return nil
+	case targetBeta:
+		return nil
+	case targetAlpha:
+		return nil
+	default:
+		return fmt.Errorf("unexpected type: %T", t)
+	}
+}
+
+/**
+ * Gets disk info stored in the FakeServiceManager.
+ */
+func (manager *FakeServiceManager) GetDiskFromCloudProvider(
+	zone string, diskName string) (*GCEDisk, error) {
+
+	if manager.zonalDisks[zone] == "" {
+		return nil, cloudprovider.DiskNotFound
+	}
+
+	if manager.resourceInUse {
+		errorItem := googleapi.ErrorItem{Reason: "resourceInUseByAnotherResource"}
+		err := &googleapi.Error{Errors: []googleapi.ErrorItem{errorItem}}
+		return nil, err
+	}
+
+	return &GCEDisk{
+		Region:   manager.gceRegion,
+		ZoneInfo: singleZone{lastComponent(zone)},
+		Name:     diskName,
+		Kind:     "compute#disk",
+		Type:     "type",
+	}, nil
+}
+
+/**
+ * Gets disk info stored in the FakeServiceManager.
+ */
+func (manager *FakeServiceManager) GetRegionalDiskFromCloudProvider(
+	diskName string) (*GCEDisk, error) {
+
+	if _, ok := manager.regionalDisks[diskName]; !ok {
+		return nil, cloudprovider.DiskNotFound
+	}
+
+	if manager.resourceInUse {
+		errorItem := googleapi.ErrorItem{Reason: "resourceInUseByAnotherResource"}
+		err := &googleapi.Error{Errors: []googleapi.ErrorItem{errorItem}}
+		return nil, err
+	}
+
+	return &GCEDisk{
+		Region:   manager.gceRegion,
+		ZoneInfo: multiZone{manager.regionalDisks[diskName]},
+		Name:     diskName,
+		Kind:     "compute#disk",
+		Type:     "type",
+	}, nil
+}
+
+func (manager *FakeServiceManager) ResizeDiskOnCloudProvider(
+	disk *GCEDisk,
+	size int64,
+	zone string) error {
+	panic("Not implmented")
+}
+
+func (manager *FakeServiceManager) RegionalResizeDiskOnCloudProvider(
+	disk *GCEDisk,
+	size int64) error {
+	panic("Not implemented")
+}
+
+/**
+ * Disk info is removed from the FakeServiceManager.
+ */
+func (manager *FakeServiceManager) DeleteDiskOnCloudProvider(
+	zone string,
+	disk string) error {
+
+	manager.deleteDiskCalled = true
+	delete(manager.zonalDisks, zone)
+
+	switch t := manager.targetAPI; t {
+	case targetStable:
+		return nil
+	case targetBeta:
+		return nil
+	case targetAlpha:
+		return nil
+	default:
+		return fmt.Errorf("unexpected type: %T", t)
+	}
+}
+
+func (manager *FakeServiceManager) DeleteRegionalDiskOnCloudProvider(
+	disk string) error {
+
+	manager.deleteDiskCalled = true
+	delete(manager.regionalDisks, disk)
+
+	switch t := manager.targetAPI; t {
+	case targetStable:
+		return nil
+	case targetBeta:
+		return nil
+	case targetAlpha:
+		return nil
+	default:
+		return fmt.Errorf("unexpected type: %T", t)
+	}
+}
+
+func createNodeZones(zones []string) map[string]sets.String {
+	nodeZones := map[string]sets.String{}
+	for _, zone := range zones {
+		nodeZones[zone] = sets.NewString("dummynode")
+	}
+	return nodeZones
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_firewall.go

@@ -0,0 +1,65 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	compute "google.golang.org/api/compute/v1"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func newFirewallMetricContext(request string) *metricContext {
+	return newGenericMetricContext("firewall", request, unusedMetricLabel, unusedMetricLabel, computeV1Version)
+}
+
+// GetFirewall returns the Firewall by name.
+func (gce *GCECloud) GetFirewall(name string) (*compute.Firewall, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newFirewallMetricContext("get")
+	v, err := gce.c.Firewalls().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// CreateFirewall creates the passed firewall
+func (gce *GCECloud) CreateFirewall(f *compute.Firewall) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newFirewallMetricContext("create")
+	return mc.Observe(gce.c.Firewalls().Insert(ctx, meta.GlobalKey(f.Name), f))
+}
+
+// DeleteFirewall deletes the given firewall rule.
+func (gce *GCECloud) DeleteFirewall(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newFirewallMetricContext("delete")
+	return mc.Observe(gce.c.Firewalls().Delete(ctx, meta.GlobalKey(name)))
+}
+
+// UpdateFirewall applies the given firewall as an update to an existing service.
+func (gce *GCECloud) UpdateFirewall(f *compute.Firewall) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newFirewallMetricContext("update")
+	return mc.Observe(gce.c.Firewalls().Update(ctx, meta.GlobalKey(f.Name), f))
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_forwardingrule.go

@@ -0,0 +1,162 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	computealpha "google.golang.org/api/compute/v0.alpha"
+	compute "google.golang.org/api/compute/v1"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func newForwardingRuleMetricContext(request, region string) *metricContext {
+	return newForwardingRuleMetricContextWithVersion(request, region, computeV1Version)
+}
+func newForwardingRuleMetricContextWithVersion(request, region, version string) *metricContext {
+	return newGenericMetricContext("forwardingrule", request, region, unusedMetricLabel, version)
+}
+
+// CreateGlobalForwardingRule creates the passed GlobalForwardingRule
+func (gce *GCECloud) CreateGlobalForwardingRule(rule *compute.ForwardingRule) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newForwardingRuleMetricContext("create", "")
+	return mc.Observe(gce.c.GlobalForwardingRules().Insert(ctx, meta.GlobalKey(rule.Name), rule))
+}
+
+// SetProxyForGlobalForwardingRule links the given TargetHttp(s)Proxy with the given GlobalForwardingRule.
+// targetProxyLink is the SelfLink of a TargetHttp(s)Proxy.
+func (gce *GCECloud) SetProxyForGlobalForwardingRule(forwardingRuleName, targetProxyLink string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newForwardingRuleMetricContext("set_proxy", "")
+	target := &compute.TargetReference{Target: targetProxyLink}
+	return mc.Observe(gce.c.GlobalForwardingRules().SetTarget(ctx, meta.GlobalKey(forwardingRuleName), target))
+}
+
+// DeleteGlobalForwardingRule deletes the GlobalForwardingRule by name.
+func (gce *GCECloud) DeleteGlobalForwardingRule(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newForwardingRuleMetricContext("delete", "")
+	return mc.Observe(gce.c.GlobalForwardingRules().Delete(ctx, meta.GlobalKey(name)))
+}
+
+// GetGlobalForwardingRule returns the GlobalForwardingRule by name.
+func (gce *GCECloud) GetGlobalForwardingRule(name string) (*compute.ForwardingRule, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newForwardingRuleMetricContext("get", "")
+	v, err := gce.c.GlobalForwardingRules().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// ListGlobalForwardingRules lists all GlobalForwardingRules in the project.
+func (gce *GCECloud) ListGlobalForwardingRules() ([]*compute.ForwardingRule, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newForwardingRuleMetricContext("list", "")
+	v, err := gce.c.GlobalForwardingRules().List(ctx, filter.None)
+	return v, mc.Observe(err)
+}
+
+// GetRegionForwardingRule returns the RegionalForwardingRule by name & region.
+func (gce *GCECloud) GetRegionForwardingRule(name, region string) (*compute.ForwardingRule, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newForwardingRuleMetricContext("get", region)
+	v, err := gce.c.ForwardingRules().Get(ctx, meta.RegionalKey(name, region))
+	return v, mc.Observe(err)
+}
+
+// GetAlphaRegionForwardingRule returns the Alpha forwarding rule by name & region.
+func (gce *GCECloud) GetAlphaRegionForwardingRule(name, region string) (*computealpha.ForwardingRule, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newForwardingRuleMetricContextWithVersion("get", region, computeAlphaVersion)
+	v, err := gce.c.AlphaForwardingRules().Get(ctx, meta.RegionalKey(name, region))
+	return v, mc.Observe(err)
+}
+
+// ListRegionForwardingRules lists all RegionalForwardingRules in the project & region.
+func (gce *GCECloud) ListRegionForwardingRules(region string) ([]*compute.ForwardingRule, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newForwardingRuleMetricContext("list", region)
+	v, err := gce.c.ForwardingRules().List(ctx, region, filter.None)
+	return v, mc.Observe(err)
+}
+
+// ListAlphaRegionForwardingRules lists all RegionalForwardingRules in the project & region.
+func (gce *GCECloud) ListAlphaRegionForwardingRules(region string) ([]*computealpha.ForwardingRule, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newForwardingRuleMetricContextWithVersion("list", region, computeAlphaVersion)
+	v, err := gce.c.AlphaForwardingRules().List(ctx, region, filter.None)
+	return v, mc.Observe(err)
+}
+
+// CreateRegionForwardingRule creates and returns a
+// RegionalForwardingRule that points to the given BackendService
+func (gce *GCECloud) CreateRegionForwardingRule(rule *compute.ForwardingRule, region string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newForwardingRuleMetricContext("create", region)
+	return mc.Observe(gce.c.ForwardingRules().Insert(ctx, meta.RegionalKey(rule.Name, region), rule))
+}
+
+// CreateAlphaRegionForwardingRule creates and returns an Alpha
+// forwarding fule in the given region.
+func (gce *GCECloud) CreateAlphaRegionForwardingRule(rule *computealpha.ForwardingRule, region string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newForwardingRuleMetricContextWithVersion("create", region, computeAlphaVersion)
+	return mc.Observe(gce.c.AlphaForwardingRules().Insert(ctx, meta.RegionalKey(rule.Name, region), rule))
+}
+
+// DeleteRegionForwardingRule deletes the RegionalForwardingRule by name & region.
+func (gce *GCECloud) DeleteRegionForwardingRule(name, region string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newForwardingRuleMetricContext("delete", region)
+	return mc.Observe(gce.c.ForwardingRules().Delete(ctx, meta.RegionalKey(name, region)))
+}
+
+// TODO(#51665): retire this function once Network Tiers becomes Beta in GCP.
+func (gce *GCECloud) getNetworkTierFromForwardingRule(name, region string) (string, error) {
+	if !gce.AlphaFeatureGate.Enabled(AlphaFeatureNetworkTiers) {
+		return cloud.NetworkTierDefault.ToGCEValue(), nil
+	}
+	fwdRule, err := gce.GetAlphaRegionForwardingRule(name, region)
+	if err != nil {
+		return handleAlphaNetworkTierGetError(err)
+	}
+	return fwdRule.NetworkTier, nil
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_healthchecks.go

@@ -0,0 +1,263 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"github.com/golang/glog"
+
+	computealpha "google.golang.org/api/compute/v0.alpha"
+	compute "google.golang.org/api/compute/v1"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+	"k8s.io/kubernetes/pkg/master/ports"
+	utilversion "k8s.io/kubernetes/pkg/util/version"
+)
+
+const (
+	nodesHealthCheckPath   = "/healthz"
+	lbNodesHealthCheckPort = ports.ProxyHealthzPort
+)
+
+var (
+	minNodesHealthCheckVersion *utilversion.Version
+)
+
+func init() {
+	if v, err := utilversion.ParseGeneric("1.7.2"); err != nil {
+		glog.Fatalf("Failed to parse version for minNodesHealthCheckVersion: %v", err)
+	} else {
+		minNodesHealthCheckVersion = v
+	}
+}
+
+func newHealthcheckMetricContext(request string) *metricContext {
+	return newHealthcheckMetricContextWithVersion(request, computeV1Version)
+}
+
+func newHealthcheckMetricContextWithVersion(request, version string) *metricContext {
+	return newGenericMetricContext("healthcheck", request, unusedMetricLabel, unusedMetricLabel, version)
+}
+
+// GetHttpHealthCheck returns the given HttpHealthCheck by name.
+func (gce *GCECloud) GetHttpHealthCheck(name string) (*compute.HttpHealthCheck, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("get_legacy")
+	v, err := gce.c.HttpHealthChecks().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// UpdateHttpHealthCheck applies the given HttpHealthCheck as an update.
+func (gce *GCECloud) UpdateHttpHealthCheck(hc *compute.HttpHealthCheck) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("update_legacy")
+	return mc.Observe(gce.c.HttpHealthChecks().Update(ctx, meta.GlobalKey(hc.Name), hc))
+}
+
+// DeleteHttpHealthCheck deletes the given HttpHealthCheck by name.
+func (gce *GCECloud) DeleteHttpHealthCheck(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("delete_legacy")
+	return mc.Observe(gce.c.HttpHealthChecks().Delete(ctx, meta.GlobalKey(name)))
+}
+
+// CreateHttpHealthCheck creates the given HttpHealthCheck.
+func (gce *GCECloud) CreateHttpHealthCheck(hc *compute.HttpHealthCheck) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("create_legacy")
+	return mc.Observe(gce.c.HttpHealthChecks().Insert(ctx, meta.GlobalKey(hc.Name), hc))
+}
+
+// ListHttpHealthChecks lists all HttpHealthChecks in the project.
+func (gce *GCECloud) ListHttpHealthChecks() ([]*compute.HttpHealthCheck, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("list_legacy")
+	v, err := gce.c.HttpHealthChecks().List(ctx, filter.None)
+	return v, mc.Observe(err)
+}
+
+// Legacy HTTPS Health Checks
+
+// GetHttpsHealthCheck returns the given HttpsHealthCheck by name.
+func (gce *GCECloud) GetHttpsHealthCheck(name string) (*compute.HttpsHealthCheck, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("get_legacy")
+	v, err := gce.c.HttpsHealthChecks().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// UpdateHttpsHealthCheck applies the given HttpsHealthCheck as an update.
+func (gce *GCECloud) UpdateHttpsHealthCheck(hc *compute.HttpsHealthCheck) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("update_legacy")
+	return mc.Observe(gce.c.HttpsHealthChecks().Update(ctx, meta.GlobalKey(hc.Name), hc))
+}
+
+// DeleteHttpsHealthCheck deletes the given HttpsHealthCheck by name.
+func (gce *GCECloud) DeleteHttpsHealthCheck(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("delete_legacy")
+	return mc.Observe(gce.c.HttpsHealthChecks().Delete(ctx, meta.GlobalKey(name)))
+}
+
+// CreateHttpsHealthCheck creates the given HttpsHealthCheck.
+func (gce *GCECloud) CreateHttpsHealthCheck(hc *compute.HttpsHealthCheck) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("create_legacy")
+	return mc.Observe(gce.c.HttpsHealthChecks().Insert(ctx, meta.GlobalKey(hc.Name), hc))
+}
+
+// ListHttpsHealthChecks lists all HttpsHealthChecks in the project.
+func (gce *GCECloud) ListHttpsHealthChecks() ([]*compute.HttpsHealthCheck, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("list_legacy")
+	v, err := gce.c.HttpsHealthChecks().List(ctx, filter.None)
+	return v, mc.Observe(err)
+}
+
+// Generic HealthCheck
+
+// GetHealthCheck returns the given HealthCheck by name.
+func (gce *GCECloud) GetHealthCheck(name string) (*compute.HealthCheck, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("get")
+	v, err := gce.c.HealthChecks().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// GetAlphaHealthCheck returns the given alpha HealthCheck by name.
+func (gce *GCECloud) GetAlphaHealthCheck(name string) (*computealpha.HealthCheck, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContextWithVersion("get", computeAlphaVersion)
+	v, err := gce.c.AlphaHealthChecks().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// UpdateHealthCheck applies the given HealthCheck as an update.
+func (gce *GCECloud) UpdateHealthCheck(hc *compute.HealthCheck) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("update")
+	return mc.Observe(gce.c.HealthChecks().Update(ctx, meta.GlobalKey(hc.Name), hc))
+}
+
+// UpdateAlphaHealthCheck applies the given alpha HealthCheck as an update.
+func (gce *GCECloud) UpdateAlphaHealthCheck(hc *computealpha.HealthCheck) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContextWithVersion("update", computeAlphaVersion)
+	return mc.Observe(gce.c.AlphaHealthChecks().Update(ctx, meta.GlobalKey(hc.Name), hc))
+}
+
+// DeleteHealthCheck deletes the given HealthCheck by name.
+func (gce *GCECloud) DeleteHealthCheck(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("delete")
+	return mc.Observe(gce.c.HealthChecks().Delete(ctx, meta.GlobalKey(name)))
+}
+
+// CreateHealthCheck creates the given HealthCheck.
+func (gce *GCECloud) CreateHealthCheck(hc *compute.HealthCheck) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("create")
+	return mc.Observe(gce.c.HealthChecks().Insert(ctx, meta.GlobalKey(hc.Name), hc))
+}
+
+// CreateAlphaHealthCheck creates the given alpha HealthCheck.
+func (gce *GCECloud) CreateAlphaHealthCheck(hc *computealpha.HealthCheck) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContextWithVersion("create", computeAlphaVersion)
+	return mc.Observe(gce.c.AlphaHealthChecks().Insert(ctx, meta.GlobalKey(hc.Name), hc))
+}
+
+// ListHealthChecks lists all HealthCheck in the project.
+func (gce *GCECloud) ListHealthChecks() ([]*compute.HealthCheck, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newHealthcheckMetricContext("list")
+	v, err := gce.c.HealthChecks().List(ctx, filter.None)
+	return v, mc.Observe(err)
+}
+
+// GetNodesHealthCheckPort returns the health check port used by the GCE load
+// balancers (l4) for performing health checks on nodes.
+func GetNodesHealthCheckPort() int32 {
+	return lbNodesHealthCheckPort
+}
+
+// GetNodesHealthCheckPath returns the health check path used by the GCE load
+// balancers (l4) for performing health checks on nodes.
+func GetNodesHealthCheckPath() string {
+	return nodesHealthCheckPath
+}
+
+// isAtLeastMinNodesHealthCheckVersion checks if a version is higher than
+// `minNodesHealthCheckVersion`.
+func isAtLeastMinNodesHealthCheckVersion(vstring string) bool {
+	version, err := utilversion.ParseGeneric(vstring)
+	if err != nil {
+		glog.Errorf("vstring (%s) is not a valid version string: %v", vstring, err)
+		return false
+	}
+	return version.AtLeast(minNodesHealthCheckVersion)
+}
+
+// supportsNodesHealthCheck returns false if anyone of the nodes has version
+// lower than `minNodesHealthCheckVersion`.
+func supportsNodesHealthCheck(nodes []*v1.Node) bool {
+	for _, node := range nodes {
+		if !isAtLeastMinNodesHealthCheckVersion(node.Status.NodeInfo.KubeProxyVersion) {
+			return false
+		}
+	}
+	return true
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_healthchecks_test.go

@@ -0,0 +1,124 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"testing"
+
+	"k8s.io/api/core/v1"
+)
+
+func TestIsAtLeastMinNodesHealthCheckVersion(t *testing.T) {
+	testCases := []struct {
+		version string
+		expect  bool
+	}{
+		{"v1.7.3", true},
+		{"v1.7.2", true},
+		{"v1.7.2-alpha.2.597+276d289b90d322", true},
+		{"v1.6.0-beta.3.472+831q821c907t31a", false},
+		{"v1.5.2", false},
+	}
+
+	for _, tc := range testCases {
+		if res := isAtLeastMinNodesHealthCheckVersion(tc.version); res != tc.expect {
+			t.Errorf("%v: want %v, got %v", tc.version, tc.expect, res)
+		}
+	}
+}
+
+func TestSupportsNodesHealthCheck(t *testing.T) {
+	testCases := []struct {
+		desc   string
+		nodes  []*v1.Node
+		expect bool
+	}{
+		{
+			"All nodes support nodes health check",
+			[]*v1.Node{
+				{
+					Status: v1.NodeStatus{
+						NodeInfo: v1.NodeSystemInfo{
+							KubeProxyVersion: "v1.7.2",
+						},
+					},
+				},
+				{
+					Status: v1.NodeStatus{
+						NodeInfo: v1.NodeSystemInfo{
+							KubeProxyVersion: "v1.7.2-alpha.2.597+276d289b90d322",
+						},
+					},
+				},
+			},
+			true,
+		},
+		{
+			"All nodes don't support nodes health check",
+			[]*v1.Node{
+				{
+					Status: v1.NodeStatus{
+						NodeInfo: v1.NodeSystemInfo{
+							KubeProxyVersion: "v1.6.0-beta.3.472+831q821c907t31a",
+						},
+					},
+				},
+				{
+					Status: v1.NodeStatus{
+						NodeInfo: v1.NodeSystemInfo{
+							KubeProxyVersion: "v1.5.2",
+						},
+					},
+				},
+			},
+			false,
+		},
+		{
+			"One node doesn't support nodes health check",
+			[]*v1.Node{
+				{
+					Status: v1.NodeStatus{
+						NodeInfo: v1.NodeSystemInfo{
+							KubeProxyVersion: "v1.7.3",
+						},
+					},
+				},
+				{
+					Status: v1.NodeStatus{
+						NodeInfo: v1.NodeSystemInfo{
+							KubeProxyVersion: "v1.7.2-alpha.2.597+276d289b90d322",
+						},
+					},
+				},
+				{
+					Status: v1.NodeStatus{
+						NodeInfo: v1.NodeSystemInfo{
+							KubeProxyVersion: "v1.5.2",
+						},
+					},
+				},
+			},
+			false,
+		},
+	}
+
+	for _, tc := range testCases {
+		if res := supportsNodesHealthCheck(tc.nodes); res != tc.expect {
+			t.Errorf("%v: want %v, got %v", tc.desc, tc.expect, res)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_instancegroup.go

@@ -0,0 +1,125 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	compute "google.golang.org/api/compute/v1"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func newInstanceGroupMetricContext(request string, zone string) *metricContext {
+	return newGenericMetricContext("instancegroup", request, unusedMetricLabel, zone, computeV1Version)
+}
+
+// CreateInstanceGroup creates an instance group with the given
+// instances. It is the callers responsibility to add named ports.
+func (gce *GCECloud) CreateInstanceGroup(ig *compute.InstanceGroup, zone string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newInstanceGroupMetricContext("create", zone)
+	return mc.Observe(gce.c.InstanceGroups().Insert(ctx, meta.ZonalKey(ig.Name, zone), ig))
+}
+
+// DeleteInstanceGroup deletes an instance group.
+func (gce *GCECloud) DeleteInstanceGroup(name string, zone string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newInstanceGroupMetricContext("delete", zone)
+	return mc.Observe(gce.c.InstanceGroups().Delete(ctx, meta.ZonalKey(name, zone)))
+}
+
+// ListInstanceGroups lists all InstanceGroups in the project and
+// zone.
+func (gce *GCECloud) ListInstanceGroups(zone string) ([]*compute.InstanceGroup, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newInstanceGroupMetricContext("list", zone)
+	v, err := gce.c.InstanceGroups().List(ctx, zone, filter.None)
+	return v, mc.Observe(err)
+}
+
+// ListInstancesInInstanceGroup lists all the instances in a given
+// instance group and state.
+func (gce *GCECloud) ListInstancesInInstanceGroup(name string, zone string, state string) ([]*compute.InstanceWithNamedPorts, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newInstanceGroupMetricContext("list_instances", zone)
+	req := &compute.InstanceGroupsListInstancesRequest{InstanceState: state}
+	v, err := gce.c.InstanceGroups().ListInstances(ctx, meta.ZonalKey(name, zone), req, filter.None)
+	return v, mc.Observe(err)
+}
+
+// AddInstancesToInstanceGroup adds the given instances to the given
+// instance group.
+func (gce *GCECloud) AddInstancesToInstanceGroup(name string, zone string, instanceRefs []*compute.InstanceReference) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newInstanceGroupMetricContext("add_instances", zone)
+	// TODO: should cull operation above this layer.
+	if len(instanceRefs) == 0 {
+		return nil
+	}
+	req := &compute.InstanceGroupsAddInstancesRequest{
+		Instances: instanceRefs,
+	}
+	return mc.Observe(gce.c.InstanceGroups().AddInstances(ctx, meta.ZonalKey(name, zone), req))
+}
+
+// RemoveInstancesFromInstanceGroup removes the given instances from
+// the instance group.
+func (gce *GCECloud) RemoveInstancesFromInstanceGroup(name string, zone string, instanceRefs []*compute.InstanceReference) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newInstanceGroupMetricContext("remove_instances", zone)
+	// TODO: should cull operation above this layer.
+	if len(instanceRefs) == 0 {
+		return nil
+	}
+	req := &compute.InstanceGroupsRemoveInstancesRequest{
+		Instances: instanceRefs,
+	}
+	return mc.Observe(gce.c.InstanceGroups().RemoveInstances(ctx, meta.ZonalKey(name, zone), req))
+}
+
+// SetNamedPortsOfInstanceGroup sets the list of named ports on a given instance group
+func (gce *GCECloud) SetNamedPortsOfInstanceGroup(igName, zone string, namedPorts []*compute.NamedPort) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newInstanceGroupMetricContext("set_namedports", zone)
+	req := &compute.InstanceGroupsSetNamedPortsRequest{NamedPorts: namedPorts}
+	return mc.Observe(gce.c.InstanceGroups().SetNamedPorts(ctx, meta.ZonalKey(igName, zone), req))
+}
+
+// GetInstanceGroup returns an instance group by name.
+func (gce *GCECloud) GetInstanceGroup(name string, zone string) (*compute.InstanceGroup, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newInstanceGroupMetricContext("get", zone)
+	v, err := gce.c.InstanceGroups().Get(ctx, meta.ZonalKey(name, zone))
+	return v, mc.Observe(err)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_instances.go

@@ -0,0 +1,653 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+
+	"cloud.google.com/go/compute/metadata"
+	"github.com/golang/glog"
+	computebeta "google.golang.org/api/compute/v0.beta"
+	compute "google.golang.org/api/compute/v1"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+	kubeletapis "k8s.io/kubernetes/pkg/kubelet/apis"
+)
+
+const (
+	defaultZone = ""
+)
+
+func newInstancesMetricContext(request, zone string) *metricContext {
+	return newGenericMetricContext("instances", request, unusedMetricLabel, zone, computeV1Version)
+}
+
+func splitNodesByZone(nodes []*v1.Node) map[string][]*v1.Node {
+	zones := make(map[string][]*v1.Node)
+	for _, n := range nodes {
+		z := getZone(n)
+		if z != defaultZone {
+			zones[z] = append(zones[z], n)
+		}
+	}
+	return zones
+}
+
+func getZone(n *v1.Node) string {
+	zone, ok := n.Labels[kubeletapis.LabelZoneFailureDomain]
+	if !ok {
+		return defaultZone
+	}
+	return zone
+}
+
+func makeHostURL(projectsApiEndpoint, projectID, zone, host string) string {
+	host = canonicalizeInstanceName(host)
+	return projectsApiEndpoint + strings.Join([]string{projectID, "zones", zone, "instances", host}, "/")
+}
+
+// ToInstanceReferences returns instance references by links
+func (gce *GCECloud) ToInstanceReferences(zone string, instanceNames []string) (refs []*compute.InstanceReference) {
+	for _, ins := range instanceNames {
+		instanceLink := makeHostURL(gce.service.BasePath, gce.projectID, zone, ins)
+		refs = append(refs, &compute.InstanceReference{Instance: instanceLink})
+	}
+	return refs
+}
+
+// NodeAddresses is an implementation of Instances.NodeAddresses.
+func (gce *GCECloud) NodeAddresses(_ context.Context, _ types.NodeName) ([]v1.NodeAddress, error) {
+	internalIP, err := metadata.Get("instance/network-interfaces/0/ip")
+	if err != nil {
+		return nil, fmt.Errorf("couldn't get internal IP: %v", err)
+	}
+	externalIP, err := metadata.Get("instance/network-interfaces/0/access-configs/0/external-ip")
+	if err != nil {
+		return nil, fmt.Errorf("couldn't get external IP: %v", err)
+	}
+	return []v1.NodeAddress{
+		{Type: v1.NodeInternalIP, Address: internalIP},
+		{Type: v1.NodeExternalIP, Address: externalIP},
+	}, nil
+}
+
+// NodeAddressesByProviderID will not be called from the node that is requesting this ID.
+// i.e. metadata service and other local methods cannot be used here
+func (gce *GCECloud) NodeAddressesByProviderID(ctx context.Context, providerID string) ([]v1.NodeAddress, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	_, zone, name, err := splitProviderID(providerID)
+	if err != nil {
+		return []v1.NodeAddress{}, err
+	}
+
+	instance, err := gce.c.Instances().Get(ctx, meta.ZonalKey(canonicalizeInstanceName(name), zone))
+	if err != nil {
+		return []v1.NodeAddress{}, fmt.Errorf("error while querying for providerID %q: %v", providerID, err)
+	}
+
+	if len(instance.NetworkInterfaces) < 1 {
+		return []v1.NodeAddress{}, fmt.Errorf("could not find network interfaces for providerID %q", providerID)
+	}
+	networkInterface := instance.NetworkInterfaces[0]
+
+	nodeAddresses := []v1.NodeAddress{{Type: v1.NodeInternalIP, Address: networkInterface.NetworkIP}}
+	for _, config := range networkInterface.AccessConfigs {
+		nodeAddresses = append(nodeAddresses, v1.NodeAddress{Type: v1.NodeExternalIP, Address: config.NatIP})
+	}
+
+	return nodeAddresses, nil
+}
+
+// instanceByProviderID returns the cloudprovider instance of the node
+// with the specified unique providerID
+func (gce *GCECloud) instanceByProviderID(providerID string) (*gceInstance, error) {
+	project, zone, name, err := splitProviderID(providerID)
+	if err != nil {
+		return nil, err
+	}
+
+	instance, err := gce.getInstanceFromProjectInZoneByName(project, zone, name)
+	if err != nil {
+		if isHTTPErrorCode(err, http.StatusNotFound) {
+			return nil, cloudprovider.InstanceNotFound
+		}
+		return nil, err
+	}
+
+	return instance, nil
+}
+
+// InstanceShutdownByProviderID returns true if the instance is in safe state to detach volumes
+func (gce *GCECloud) InstanceShutdownByProviderID(ctx context.Context, providerID string) (bool, error) {
+	return false, cloudprovider.NotImplemented
+}
+
+// InstanceTypeByProviderID returns the cloudprovider instance type of the node
+// with the specified unique providerID This method will not be called from the
+// node that is requesting this ID. i.e. metadata service and other local
+// methods cannot be used here
+func (gce *GCECloud) InstanceTypeByProviderID(ctx context.Context, providerID string) (string, error) {
+	instance, err := gce.instanceByProviderID(providerID)
+	if err != nil {
+		return "", err
+	}
+
+	return instance.Type, nil
+}
+
+// InstanceExistsByProviderID returns true if the instance with the given provider id still exists and is running.
+// If false is returned with no error, the instance will be immediately deleted by the cloud controller manager.
+func (gce *GCECloud) InstanceExistsByProviderID(ctx context.Context, providerID string) (bool, error) {
+	_, err := gce.instanceByProviderID(providerID)
+	if err != nil {
+		if err == cloudprovider.InstanceNotFound {
+			return false, nil
+		}
+		return false, err
+	}
+
+	return true, nil
+}
+
+// InstanceID returns the cloud provider ID of the node with the specified NodeName.
+func (gce *GCECloud) InstanceID(ctx context.Context, nodeName types.NodeName) (string, error) {
+	instanceName := mapNodeNameToInstanceName(nodeName)
+	if gce.useMetadataServer {
+		// Use metadata, if possible, to fetch ID. See issue #12000
+		if gce.isCurrentInstance(instanceName) {
+			projectID, zone, err := getProjectAndZone()
+			if err == nil {
+				return projectID + "/" + zone + "/" + canonicalizeInstanceName(instanceName), nil
+			}
+		}
+	}
+	instance, err := gce.getInstanceByName(instanceName)
+	if err != nil {
+		return "", err
+	}
+	return gce.projectID + "/" + instance.Zone + "/" + instance.Name, nil
+}
+
+// InstanceType returns the type of the specified node with the specified NodeName.
+func (gce *GCECloud) InstanceType(ctx context.Context, nodeName types.NodeName) (string, error) {
+	instanceName := mapNodeNameToInstanceName(nodeName)
+	if gce.useMetadataServer {
+		// Use metadata, if possible, to fetch ID. See issue #12000
+		if gce.isCurrentInstance(instanceName) {
+			mType, err := getCurrentMachineTypeViaMetadata()
+			if err == nil {
+				return mType, nil
+			}
+		}
+	}
+	instance, err := gce.getInstanceByName(instanceName)
+	if err != nil {
+		return "", err
+	}
+	return instance.Type, nil
+}
+
+func (gce *GCECloud) AddSSHKeyToAllInstances(ctx context.Context, user string, keyData []byte) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	return wait.Poll(2*time.Second, 30*time.Second, func() (bool, error) {
+		project, err := gce.c.Projects().Get(ctx, gce.projectID)
+		if err != nil {
+			glog.Errorf("Could not get project: %v", err)
+			return false, nil
+		}
+		keyString := fmt.Sprintf("%s:%s %s@%s", user, strings.TrimSpace(string(keyData)), user, user)
+		found := false
+		for _, item := range project.CommonInstanceMetadata.Items {
+			if item.Key == "sshKeys" {
+				if strings.Contains(*item.Value, keyString) {
+					// We've already added the key
+					glog.Info("SSHKey already in project metadata")
+					return true, nil
+				}
+				value := *item.Value + "\n" + keyString
+				item.Value = &value
+				found = true
+				break
+			}
+		}
+		if !found {
+			// This is super unlikely, so log.
+			glog.Infof("Failed to find sshKeys metadata, creating a new item")
+			project.CommonInstanceMetadata.Items = append(project.CommonInstanceMetadata.Items,
+				&compute.MetadataItems{
+					Key:   "sshKeys",
+					Value: &keyString,
+				})
+		}
+
+		mc := newInstancesMetricContext("add_ssh_key", "")
+		err = gce.c.Projects().SetCommonInstanceMetadata(ctx, gce.projectID, project.CommonInstanceMetadata)
+		mc.Observe(err)
+
+		if err != nil {
+			glog.Errorf("Could not Set Metadata: %v", err)
+			return false, nil
+		}
+		glog.Infof("Successfully added sshKey to project metadata")
+		return true, nil
+	})
+}
+
+// GetAllCurrentZones returns all the zones in which k8s nodes are currently running
+func (gce *GCECloud) GetAllCurrentZones() (sets.String, error) {
+	if gce.nodeInformerSynced == nil {
+		glog.Warningf("GCECloud object does not have informers set, should only happen in E2E binary.")
+		return gce.GetAllZonesFromCloudProvider()
+	}
+	gce.nodeZonesLock.Lock()
+	defer gce.nodeZonesLock.Unlock()
+	if !gce.nodeInformerSynced() {
+		return nil, fmt.Errorf("node informer is not synced when trying to GetAllCurrentZones")
+	}
+	zones := sets.NewString()
+	for zone, nodes := range gce.nodeZones {
+		if len(nodes) > 0 {
+			zones.Insert(zone)
+		}
+	}
+	return zones, nil
+}
+
+// GetAllZonesFromCloudProvider returns all the zones in which nodes are running
+// Only use this in E2E tests to get zones, on real clusters this will
+// get all zones with compute instances in them even if not k8s instances!!!
+// ex. I have k8s nodes in us-central1-c and us-central1-b. I also have
+// a non-k8s compute in us-central1-a. This func will return a,b, and c.
+//
+// TODO: this should be removed from the cloud provider.
+func (gce *GCECloud) GetAllZonesFromCloudProvider() (sets.String, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	zones := sets.NewString()
+	for _, zone := range gce.managedZones {
+		instances, err := gce.c.Instances().List(ctx, zone, filter.None)
+		if err != nil {
+			return sets.NewString(), err
+		}
+		if len(instances) > 0 {
+			zones.Insert(zone)
+		}
+	}
+	return zones, nil
+}
+
+// InsertInstance creates a new instance on GCP
+func (gce *GCECloud) InsertInstance(project string, zone string, i *compute.Instance) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newInstancesMetricContext("create", zone)
+	return mc.Observe(gce.c.Instances().Insert(ctx, meta.ZonalKey(i.Name, zone), i))
+}
+
+// ListInstanceNames returns a string of instance names separated by spaces.
+// This method should only be used for e2e testing.
+// TODO: remove this method.
+func (gce *GCECloud) ListInstanceNames(project, zone string) (string, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	l, err := gce.c.Instances().List(ctx, zone, filter.None)
+	if err != nil {
+		return "", err
+	}
+	var names []string
+	for _, i := range l {
+		names = append(names, i.Name)
+	}
+	return strings.Join(names, " "), nil
+}
+
+// DeleteInstance deletes an instance specified by project, zone, and name
+func (gce *GCECloud) DeleteInstance(project, zone, name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	return gce.c.Instances().Delete(ctx, meta.ZonalKey(name, zone))
+}
+
+// Implementation of Instances.CurrentNodeName
+func (gce *GCECloud) CurrentNodeName(ctx context.Context, hostname string) (types.NodeName, error) {
+	return types.NodeName(hostname), nil
+}
+
+// AliasRanges returns a list of CIDR ranges that are assigned to the
+// `node` for allocation to pods. Returns a list of the form
+// "<ip>/<netmask>".
+func (gce *GCECloud) AliasRanges(nodeName types.NodeName) (cidrs []string, err error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	var instance *gceInstance
+	instance, err = gce.getInstanceByName(mapNodeNameToInstanceName(nodeName))
+	if err != nil {
+		return
+	}
+
+	var res *computebeta.Instance
+	res, err = gce.c.BetaInstances().Get(ctx, meta.ZonalKey(instance.Name, lastComponent(instance.Zone)))
+	if err != nil {
+		return
+	}
+
+	for _, networkInterface := range res.NetworkInterfaces {
+		for _, r := range networkInterface.AliasIpRanges {
+			cidrs = append(cidrs, r.IpCidrRange)
+		}
+	}
+	return
+}
+
+// AddAliasToInstance adds an alias to the given instance from the named
+// secondary range.
+func (gce *GCECloud) AddAliasToInstance(nodeName types.NodeName, alias *net.IPNet) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	v1instance, err := gce.getInstanceByName(mapNodeNameToInstanceName(nodeName))
+	if err != nil {
+		return err
+	}
+	instance, err := gce.c.BetaInstances().Get(ctx, meta.ZonalKey(v1instance.Name, lastComponent(v1instance.Zone)))
+	if err != nil {
+		return err
+	}
+
+	switch len(instance.NetworkInterfaces) {
+	case 0:
+		return fmt.Errorf("instance %q has no network interfaces", nodeName)
+	case 1:
+	default:
+		glog.Warningf("Instance %q has more than one network interface, using only the first (%v)",
+			nodeName, instance.NetworkInterfaces)
+	}
+
+	iface := &computebeta.NetworkInterface{}
+	iface.Name = instance.NetworkInterfaces[0].Name
+	iface.Fingerprint = instance.NetworkInterfaces[0].Fingerprint
+	iface.AliasIpRanges = append(iface.AliasIpRanges, &computebeta.AliasIpRange{
+		IpCidrRange:         alias.String(),
+		SubnetworkRangeName: gce.secondaryRangeName,
+	})
+
+	mc := newInstancesMetricContext("add_alias", v1instance.Zone)
+	err = gce.c.BetaInstances().UpdateNetworkInterface(ctx, meta.ZonalKey(instance.Name, lastComponent(instance.Zone)), iface.Name, iface)
+	return mc.Observe(err)
+}
+
+// Gets the named instances, returning cloudprovider.InstanceNotFound if any
+// instance is not found
+func (gce *GCECloud) getInstancesByNames(names []string) ([]*gceInstance, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	found := map[string]*gceInstance{}
+	remaining := len(names)
+
+	nodeInstancePrefix := gce.nodeInstancePrefix
+	for _, name := range names {
+		name = canonicalizeInstanceName(name)
+		if !strings.HasPrefix(name, gce.nodeInstancePrefix) {
+			glog.Warningf("Instance %q does not conform to prefix %q, removing filter", name, gce.nodeInstancePrefix)
+			nodeInstancePrefix = ""
+		}
+		found[name] = nil
+	}
+
+	for _, zone := range gce.managedZones {
+		if remaining == 0 {
+			break
+		}
+		instances, err := gce.c.Instances().List(ctx, zone, filter.Regexp("name", nodeInstancePrefix+".*"))
+		if err != nil {
+			return nil, err
+		}
+		for _, inst := range instances {
+			if remaining == 0 {
+				break
+			}
+			if _, ok := found[inst.Name]; !ok {
+				continue
+			}
+			if found[inst.Name] != nil {
+				glog.Errorf("Instance name %q was duplicated (in zone %q and %q)", inst.Name, zone, found[inst.Name].Zone)
+				continue
+			}
+			found[inst.Name] = &gceInstance{
+				Zone:  zone,
+				Name:  inst.Name,
+				ID:    inst.Id,
+				Disks: inst.Disks,
+				Type:  lastComponent(inst.MachineType),
+			}
+			remaining--
+		}
+	}
+
+	if remaining > 0 {
+		var failed []string
+		for k := range found {
+			if found[k] == nil {
+				failed = append(failed, k)
+			}
+		}
+		glog.Errorf("Failed to retrieve instances: %v", failed)
+		return nil, cloudprovider.InstanceNotFound
+	}
+
+	var ret []*gceInstance
+	for _, instance := range found {
+		ret = append(ret, instance)
+	}
+
+	return ret, nil
+}
+
+// Gets the named instance, returning cloudprovider.InstanceNotFound if the instance is not found
+func (gce *GCECloud) getInstanceByName(name string) (*gceInstance, error) {
+	// Avoid changing behaviour when not managing multiple zones
+	for _, zone := range gce.managedZones {
+		instance, err := gce.getInstanceFromProjectInZoneByName(gce.projectID, zone, name)
+		if err != nil {
+			if isHTTPErrorCode(err, http.StatusNotFound) {
+				continue
+			}
+			glog.Errorf("getInstanceByName: failed to get instance %s in zone %s; err: %v", name, zone, err)
+			return nil, err
+		}
+		return instance, nil
+	}
+
+	return nil, cloudprovider.InstanceNotFound
+}
+
+func (gce *GCECloud) getInstanceFromProjectInZoneByName(project, zone, name string) (*gceInstance, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	name = canonicalizeInstanceName(name)
+	mc := newInstancesMetricContext("get", zone)
+	res, err := gce.c.Instances().Get(ctx, meta.ZonalKey(name, zone))
+	mc.Observe(err)
+	if err != nil {
+		return nil, err
+	}
+	return &gceInstance{
+		Zone:  lastComponent(res.Zone),
+		Name:  res.Name,
+		ID:    res.Id,
+		Disks: res.Disks,
+		Type:  lastComponent(res.MachineType),
+	}, nil
+}
+
+func getInstanceIDViaMetadata() (string, error) {
+	result, err := metadata.Get("instance/hostname")
+	if err != nil {
+		return "", err
+	}
+	parts := strings.Split(result, ".")
+	if len(parts) == 0 {
+		return "", fmt.Errorf("unexpected response: %s", result)
+	}
+	return parts[0], nil
+}
+
+func getCurrentMachineTypeViaMetadata() (string, error) {
+	mType, err := metadata.Get("instance/machine-type")
+	if err != nil {
+		return "", fmt.Errorf("couldn't get machine type: %v", err)
+	}
+	parts := strings.Split(mType, "/")
+	if len(parts) != 4 {
+		return "", fmt.Errorf("unexpected response for machine type: %s", mType)
+	}
+
+	return parts[3], nil
+}
+
+// isCurrentInstance uses metadata server to check if specified
+// instanceID matches current machine's instanceID
+func (gce *GCECloud) isCurrentInstance(instanceID string) bool {
+	currentInstanceID, err := getInstanceIDViaMetadata()
+	if err != nil {
+		// Log and swallow error
+		glog.Errorf("Failed to fetch instanceID via Metadata: %v", err)
+		return false
+	}
+
+	return currentInstanceID == canonicalizeInstanceName(instanceID)
+}
+
+// ComputeHostTags grabs all tags from all instances being added to the pool.
+// * The longest tag that is a prefix of the instance name is used
+// * If any instance has no matching prefix tag, return error
+// Invoking this method to get host tags is risky since it depends on the
+// format of the host names in the cluster. Only use it as a fallback if
+// gce.nodeTags is unspecified
+func (gce *GCECloud) computeHostTags(hosts []*gceInstance) ([]string, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	// TODO: We could store the tags in gceInstance, so we could have already fetched it
+	hostNamesByZone := make(map[string]map[string]bool) // map of zones -> map of names -> bool (for easy lookup)
+	nodeInstancePrefix := gce.nodeInstancePrefix
+	for _, host := range hosts {
+		if !strings.HasPrefix(host.Name, gce.nodeInstancePrefix) {
+			glog.Warningf("instance %v does not conform to prefix '%s', ignoring filter", host, gce.nodeInstancePrefix)
+			nodeInstancePrefix = ""
+		}
+
+		z, ok := hostNamesByZone[host.Zone]
+		if !ok {
+			z = make(map[string]bool)
+			hostNamesByZone[host.Zone] = z
+		}
+		z[host.Name] = true
+	}
+
+	tags := sets.NewString()
+
+	filt := filter.None
+	if nodeInstancePrefix != "" {
+		filt = filter.Regexp("name", nodeInstancePrefix+".*")
+	}
+	for zone, hostNames := range hostNamesByZone {
+		instances, err := gce.c.Instances().List(ctx, zone, filt)
+		if err != nil {
+			return nil, err
+		}
+		for _, instance := range instances {
+			if !hostNames[instance.Name] {
+				continue
+			}
+			longest_tag := ""
+			for _, tag := range instance.Tags.Items {
+				if strings.HasPrefix(instance.Name, tag) && len(tag) > len(longest_tag) {
+					longest_tag = tag
+				}
+			}
+			if len(longest_tag) > 0 {
+				tags.Insert(longest_tag)
+			} else {
+				return nil, fmt.Errorf("could not find any tag that is a prefix of instance name for instance %s", instance.Name)
+			}
+		}
+	}
+	if len(tags) == 0 {
+		return nil, fmt.Errorf("no instances found")
+	}
+	return tags.List(), nil
+}
+
+// GetNodeTags will first try returning the list of tags specified in GCE cloud Configuration.
+// If they weren't provided, it'll compute the host tags with the given hostnames. If the list
+// of hostnames has not changed, a cached set of nodetags are returned.
+func (gce *GCECloud) GetNodeTags(nodeNames []string) ([]string, error) {
+	// If nodeTags were specified through configuration, use them
+	if len(gce.nodeTags) > 0 {
+		return gce.nodeTags, nil
+	}
+
+	gce.computeNodeTagLock.Lock()
+	defer gce.computeNodeTagLock.Unlock()
+
+	// Early return if hosts have not changed
+	hosts := sets.NewString(nodeNames...)
+	if hosts.Equal(gce.lastKnownNodeNames) {
+		return gce.lastComputedNodeTags, nil
+	}
+
+	// Get GCE instance data by hostname
+	instances, err := gce.getInstancesByNames(nodeNames)
+	if err != nil {
+		return nil, err
+	}
+
+	// Determine list of host tags
+	tags, err := gce.computeHostTags(instances)
+	if err != nil {
+		return nil, err
+	}
+
+	// Save the list of tags
+	gce.lastKnownNodeNames = hosts
+	gce.lastComputedNodeTags = tags
+	return tags, nil
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_interfaces.go

@@ -0,0 +1,61 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	computealpha "google.golang.org/api/compute/v0.alpha"
+	computebeta "google.golang.org/api/compute/v0.beta"
+	compute "google.golang.org/api/compute/v1"
+)
+
+// These interfaces are added for testability.
+
+// CloudAddressService is an interface for managing addresses
+type CloudAddressService interface {
+	ReserveRegionAddress(address *compute.Address, region string) error
+	GetRegionAddress(name string, region string) (*compute.Address, error)
+	GetRegionAddressByIP(region, ipAddress string) (*compute.Address, error)
+	DeleteRegionAddress(name, region string) error
+	// TODO: Mock Global endpoints
+
+	// Alpha API.
+	GetAlphaRegionAddress(name, region string) (*computealpha.Address, error)
+	ReserveAlphaRegionAddress(addr *computealpha.Address, region string) error
+
+	// Beta API
+	ReserveBetaRegionAddress(address *computebeta.Address, region string) error
+	GetBetaRegionAddress(name string, region string) (*computebeta.Address, error)
+	GetBetaRegionAddressByIP(region, ipAddress string) (*computebeta.Address, error)
+
+	// TODO(#51665): Remove this once the Network Tiers becomes Alpha in GCP.
+	getNetworkTierFromAddress(name, region string) (string, error)
+}
+
+// CloudForwardingRuleService is an interface for managing forwarding rules.
+// TODO: Expand the interface to include more methods.
+type CloudForwardingRuleService interface {
+	GetRegionForwardingRule(name, region string) (*compute.ForwardingRule, error)
+	CreateRegionForwardingRule(rule *compute.ForwardingRule, region string) error
+	DeleteRegionForwardingRule(name, region string) error
+
+	// Alpha API.
+	GetAlphaRegionForwardingRule(name, region string) (*computealpha.ForwardingRule, error)
+	CreateAlphaRegionForwardingRule(rule *computealpha.ForwardingRule, region string) error
+
+	// Needed for the Alpha "Network Tiers" feature.
+	getNetworkTierFromForwardingRule(name, region string) (string, error)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_loadbalancer.go

@@ -0,0 +1,202 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"net"
+	"sort"
+	"strings"
+
+	"github.com/golang/glog"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	netsets "k8s.io/kubernetes/pkg/util/net/sets"
+)
+
+type cidrs struct {
+	ipn   netsets.IPNet
+	isSet bool
+}
+
+var (
+	lbSrcRngsFlag cidrs
+)
+
+func newLoadBalancerMetricContext(request, region string) *metricContext {
+	return newGenericMetricContext("loadbalancer", request, region, unusedMetricLabel, computeV1Version)
+}
+
+func init() {
+	var err error
+	// LB L7 proxies and all L3/4/7 health checkers have client addresses within these known CIDRs.
+	lbSrcRngsFlag.ipn, err = netsets.ParseIPNets([]string{"130.211.0.0/22", "35.191.0.0/16", "209.85.152.0/22", "209.85.204.0/22"}...)
+	if err != nil {
+		panic("Incorrect default GCE L7 source ranges")
+	}
+
+	flag.Var(&lbSrcRngsFlag, "cloud-provider-gce-lb-src-cidrs", "CIDRs opened in GCE firewall for LB traffic proxy & health checks")
+}
+
+// String is the method to format the flag's value, part of the flag.Value interface.
+func (c *cidrs) String() string {
+	s := c.ipn.StringSlice()
+	sort.Strings(s)
+	return strings.Join(s, ",")
+}
+
+// Set supports a value of CSV or the flag repeated multiple times
+func (c *cidrs) Set(value string) error {
+	// On first Set(), clear the original defaults
+	if !c.isSet {
+		c.isSet = true
+		c.ipn = make(netsets.IPNet)
+	} else {
+		return fmt.Errorf("GCE LB CIDRs have already been set")
+	}
+
+	for _, cidr := range strings.Split(value, ",") {
+		_, ipnet, err := net.ParseCIDR(cidr)
+		if err != nil {
+			return err
+		}
+
+		c.ipn.Insert(ipnet)
+	}
+	return nil
+}
+
+// LoadBalancerSrcRanges contains the ranges of ips used by the GCE load balancers (l4 & L7)
+// for proxying client requests and performing health checks.
+func LoadBalancerSrcRanges() []string {
+	return lbSrcRngsFlag.ipn.StringSlice()
+}
+
+// GetLoadBalancer is an implementation of LoadBalancer.GetLoadBalancer
+func (gce *GCECloud) GetLoadBalancer(ctx context.Context, clusterName string, svc *v1.Service) (*v1.LoadBalancerStatus, bool, error) {
+	loadBalancerName := cloudprovider.GetLoadBalancerName(svc)
+	fwd, err := gce.GetRegionForwardingRule(loadBalancerName, gce.region)
+	if err == nil {
+		status := &v1.LoadBalancerStatus{}
+		status.Ingress = []v1.LoadBalancerIngress{{IP: fwd.IPAddress}}
+
+		return status, true, nil
+	}
+	return nil, false, ignoreNotFound(err)
+}
+
+// EnsureLoadBalancer is an implementation of LoadBalancer.EnsureLoadBalancer.
+func (gce *GCECloud) EnsureLoadBalancer(ctx context.Context, clusterName string, svc *v1.Service, nodes []*v1.Node) (*v1.LoadBalancerStatus, error) {
+	loadBalancerName := cloudprovider.GetLoadBalancerName(svc)
+	desiredScheme := getSvcScheme(svc)
+	clusterID, err := gce.ClusterID.GetID()
+	if err != nil {
+		return nil, err
+	}
+
+	glog.V(4).Infof("EnsureLoadBalancer(%v, %v, %v, %v, %v): ensure %v loadbalancer", clusterName, svc.Namespace, svc.Name, loadBalancerName, gce.region, desiredScheme)
+
+	existingFwdRule, err := gce.GetRegionForwardingRule(loadBalancerName, gce.region)
+	if err != nil && !isNotFound(err) {
+		return nil, err
+	}
+
+	if existingFwdRule != nil {
+		existingScheme := cloud.LbScheme(strings.ToUpper(existingFwdRule.LoadBalancingScheme))
+
+		// If the loadbalancer type changes between INTERNAL and EXTERNAL, the old load balancer should be deleted.
+		if existingScheme != desiredScheme {
+			glog.V(4).Infof("EnsureLoadBalancer(%v, %v, %v, %v, %v): deleting existing %v loadbalancer", clusterName, svc.Namespace, svc.Name, loadBalancerName, gce.region, existingScheme)
+			switch existingScheme {
+			case cloud.SchemeInternal:
+				err = gce.ensureInternalLoadBalancerDeleted(clusterName, clusterID, svc)
+			default:
+				err = gce.ensureExternalLoadBalancerDeleted(clusterName, clusterID, svc)
+			}
+			glog.V(4).Infof("EnsureLoadBalancer(%v, %v, %v, %v, %v): done deleting existing %v loadbalancer. err: %v", clusterName, svc.Namespace, svc.Name, loadBalancerName, gce.region, existingScheme, err)
+			if err != nil {
+				return nil, err
+			}
+
+			// Assume the ensureDeleted function successfully deleted the forwarding rule.
+			existingFwdRule = nil
+		}
+	}
+
+	var status *v1.LoadBalancerStatus
+	switch desiredScheme {
+	case cloud.SchemeInternal:
+		status, err = gce.ensureInternalLoadBalancer(clusterName, clusterID, svc, existingFwdRule, nodes)
+	default:
+		status, err = gce.ensureExternalLoadBalancer(clusterName, clusterID, svc, existingFwdRule, nodes)
+	}
+	glog.V(4).Infof("EnsureLoadBalancer(%v, %v, %v, %v, %v): done ensuring loadbalancer. err: %v", clusterName, svc.Namespace, svc.Name, loadBalancerName, gce.region, err)
+	return status, err
+}
+
+// UpdateLoadBalancer is an implementation of LoadBalancer.UpdateLoadBalancer.
+func (gce *GCECloud) UpdateLoadBalancer(ctx context.Context, clusterName string, svc *v1.Service, nodes []*v1.Node) error {
+	loadBalancerName := cloudprovider.GetLoadBalancerName(svc)
+	scheme := getSvcScheme(svc)
+	clusterID, err := gce.ClusterID.GetID()
+	if err != nil {
+		return err
+	}
+
+	glog.V(4).Infof("UpdateLoadBalancer(%v, %v, %v, %v, %v): updating with %d nodes", clusterName, svc.Namespace, svc.Name, loadBalancerName, gce.region, len(nodes))
+
+	switch scheme {
+	case cloud.SchemeInternal:
+		err = gce.updateInternalLoadBalancer(clusterName, clusterID, svc, nodes)
+	default:
+		err = gce.updateExternalLoadBalancer(clusterName, svc, nodes)
+	}
+	glog.V(4).Infof("UpdateLoadBalancer(%v, %v, %v, %v, %v): done updating. err: %v", clusterName, svc.Namespace, svc.Name, loadBalancerName, gce.region, err)
+	return err
+}
+
+// EnsureLoadBalancerDeleted is an implementation of LoadBalancer.EnsureLoadBalancerDeleted.
+func (gce *GCECloud) EnsureLoadBalancerDeleted(ctx context.Context, clusterName string, svc *v1.Service) error {
+	loadBalancerName := cloudprovider.GetLoadBalancerName(svc)
+	scheme := getSvcScheme(svc)
+	clusterID, err := gce.ClusterID.GetID()
+	if err != nil {
+		return err
+	}
+
+	glog.V(4).Infof("EnsureLoadBalancerDeleted(%v, %v, %v, %v, %v): deleting loadbalancer", clusterName, svc.Namespace, svc.Name, loadBalancerName, gce.region)
+
+	switch scheme {
+	case cloud.SchemeInternal:
+		err = gce.ensureInternalLoadBalancerDeleted(clusterName, clusterID, svc)
+	default:
+		err = gce.ensureExternalLoadBalancerDeleted(clusterName, clusterID, svc)
+	}
+	glog.V(4).Infof("EnsureLoadBalancerDeleted(%v, %v, %v, %v, %v): done deleting loadbalancer. err: %v", clusterName, svc.Namespace, svc.Name, loadBalancerName, gce.region, err)
+	return err
+}
+
+func getSvcScheme(svc *v1.Service) cloud.LbScheme {
+	if typ, ok := GetLoadBalancerAnnotationType(svc); ok && typ == LBTypeInternal {
+		return cloud.SchemeInternal
+	}
+	return cloud.SchemeExternal
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_loadbalancer_internal.go

@@ -0,0 +1,705 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/golang/glog"
+	compute "google.golang.org/api/compute/v1"
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
+	v1_service "k8s.io/kubernetes/pkg/api/v1/service"
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+)
+
+const (
+	allInstances = "ALL"
+)
+
+func (gce *GCECloud) ensureInternalLoadBalancer(clusterName, clusterID string, svc *v1.Service, existingFwdRule *compute.ForwardingRule, nodes []*v1.Node) (*v1.LoadBalancerStatus, error) {
+	nm := types.NamespacedName{Name: svc.Name, Namespace: svc.Namespace}
+	ports, protocol := getPortsAndProtocol(svc.Spec.Ports)
+	scheme := cloud.SchemeInternal
+	loadBalancerName := cloudprovider.GetLoadBalancerName(svc)
+	sharedBackend := shareBackendService(svc)
+	backendServiceName := makeBackendServiceName(loadBalancerName, clusterID, sharedBackend, scheme, protocol, svc.Spec.SessionAffinity)
+	backendServiceLink := gce.getBackendServiceLink(backendServiceName)
+
+	// Ensure instance groups exist and nodes are assigned to groups
+	igName := makeInstanceGroupName(clusterID)
+	igLinks, err := gce.ensureInternalInstanceGroups(igName, nodes)
+	if err != nil {
+		return nil, err
+	}
+
+	// Get existing backend service (if exists)
+	var existingBackendService *compute.BackendService
+	if existingFwdRule != nil && existingFwdRule.BackendService != "" {
+		existingBSName := getNameFromLink(existingFwdRule.BackendService)
+		if existingBackendService, err = gce.GetRegionBackendService(existingBSName, gce.region); err != nil && !isNotFound(err) {
+			return nil, err
+		}
+	}
+
+	// Lock the sharedResourceLock to prevent any deletions of shared resources while assembling shared resources here
+	gce.sharedResourceLock.Lock()
+	defer gce.sharedResourceLock.Unlock()
+
+	// Ensure health check exists before creating the backend service. The health check is shared
+	// if externalTrafficPolicy=Cluster.
+	sharedHealthCheck := !v1_service.RequestsOnlyLocalTraffic(svc)
+	hcName := makeHealthCheckName(loadBalancerName, clusterID, sharedHealthCheck)
+	hcPath, hcPort := GetNodesHealthCheckPath(), GetNodesHealthCheckPort()
+	if !sharedHealthCheck {
+		// Service requires a special health check, retrieve the OnlyLocal port & path
+		hcPath, hcPort = v1_service.GetServiceHealthCheckPathPort(svc)
+	}
+	hc, err := gce.ensureInternalHealthCheck(hcName, nm, sharedHealthCheck, hcPath, hcPort)
+	if err != nil {
+		return nil, err
+	}
+
+	// Determine IP which will be used for this LB. If no forwarding rule has been established
+	// or specified in the Service spec, then requestedIP = "".
+	requestedIP := determineRequestedIP(svc, existingFwdRule)
+	ipToUse := requestedIP
+
+	// If the ILB already exists, continue using the subnet that it's already using.
+	// This is to support existing ILBs that were setup using the wrong subnet.
+	subnetworkURL := gce.SubnetworkURL()
+	if existingFwdRule != nil && existingFwdRule.Subnetwork != "" {
+		// external LBs have an empty Subnetwork field.
+		subnetworkURL = existingFwdRule.Subnetwork
+	}
+
+	var addrMgr *addressManager
+	// If the network is not a legacy network, use the address manager
+	if !gce.IsLegacyNetwork() {
+		addrMgr = newAddressManager(gce, nm.String(), gce.Region(), subnetworkURL, loadBalancerName, requestedIP, cloud.SchemeInternal)
+		ipToUse, err = addrMgr.HoldAddress()
+		if err != nil {
+			return nil, err
+		}
+		glog.V(2).Infof("ensureInternalLoadBalancer(%v): reserved IP %q for the forwarding rule", loadBalancerName, ipToUse)
+	}
+
+	// Ensure firewall rules if necessary
+	if err = gce.ensureInternalFirewalls(loadBalancerName, ipToUse, clusterID, nm, svc, strconv.Itoa(int(hcPort)), sharedHealthCheck, nodes); err != nil {
+		return nil, err
+	}
+
+	expectedFwdRule := &compute.ForwardingRule{
+		Name:                loadBalancerName,
+		Description:         fmt.Sprintf(`{"kubernetes.io/service-name":"%s"}`, nm.String()),
+		IPAddress:           ipToUse,
+		BackendService:      backendServiceLink,
+		Ports:               ports,
+		IPProtocol:          string(protocol),
+		LoadBalancingScheme: string(scheme),
+	}
+
+	// Given that CreateGCECloud will attempt to determine the subnet based off the network,
+	// the subnetwork should rarely be unknown.
+	if subnetworkURL != "" {
+		expectedFwdRule.Subnetwork = subnetworkURL
+	} else {
+		expectedFwdRule.Network = gce.networkURL
+	}
+
+	fwdRuleDeleted := false
+	if existingFwdRule != nil && !fwdRuleEqual(existingFwdRule, expectedFwdRule) {
+		glog.V(2).Infof("ensureInternalLoadBalancer(%v): deleting existing forwarding rule with IP address %v", loadBalancerName, existingFwdRule.IPAddress)
+		if err = ignoreNotFound(gce.DeleteRegionForwardingRule(loadBalancerName, gce.region)); err != nil {
+			return nil, err
+		}
+		fwdRuleDeleted = true
+	}
+
+	bsDescription := makeBackendServiceDescription(nm, sharedBackend)
+	err = gce.ensureInternalBackendService(backendServiceName, bsDescription, svc.Spec.SessionAffinity, scheme, protocol, igLinks, hc.SelfLink)
+	if err != nil {
+		return nil, err
+	}
+
+	// If we previously deleted the forwarding rule or it never existed, finally create it.
+	if fwdRuleDeleted || existingFwdRule == nil {
+		glog.V(2).Infof("ensureInternalLoadBalancer(%v): creating forwarding rule", loadBalancerName)
+		if err = gce.CreateRegionForwardingRule(expectedFwdRule, gce.region); err != nil {
+			return nil, err
+		}
+		glog.V(2).Infof("ensureInternalLoadBalancer(%v): created forwarding rule", loadBalancerName)
+	}
+
+	// Delete the previous internal load balancer resources if necessary
+	if existingBackendService != nil {
+		gce.clearPreviousInternalResources(svc, loadBalancerName, existingBackendService, backendServiceName, hcName)
+	}
+
+	if addrMgr != nil {
+		// Now that the controller knows the forwarding rule exists, we can release the address.
+		if err := addrMgr.ReleaseAddress(); err != nil {
+			glog.Errorf("ensureInternalLoadBalancer: failed to release address reservation, possibly causing an orphan: %v", err)
+		}
+	}
+
+	// Get the most recent forwarding rule for the address.
+	updatedFwdRule, err := gce.GetRegionForwardingRule(loadBalancerName, gce.region)
+	if err != nil {
+		return nil, err
+	}
+
+	status := &v1.LoadBalancerStatus{}
+	status.Ingress = []v1.LoadBalancerIngress{{IP: updatedFwdRule.IPAddress}}
+	return status, nil
+}
+
+func (gce *GCECloud) clearPreviousInternalResources(svc *v1.Service, loadBalancerName string, existingBackendService *compute.BackendService, expectedBSName, expectedHCName string) {
+	// If a new backend service was created, delete the old one.
+	if existingBackendService.Name != expectedBSName {
+		glog.V(2).Infof("clearPreviousInternalResources(%v): expected backend service %q does not match previous %q - deleting backend service", loadBalancerName, expectedBSName, existingBackendService.Name)
+		if err := gce.teardownInternalBackendService(existingBackendService.Name); err != nil && !isNotFound(err) {
+			glog.Warningf("clearPreviousInternalResources: could not delete old backend service: %v, err: %v", existingBackendService.Name, err)
+		}
+	}
+
+	// If a new health check was created, delete the old one.
+	if len(existingBackendService.HealthChecks) == 1 {
+		existingHCName := getNameFromLink(existingBackendService.HealthChecks[0])
+		if existingHCName != expectedHCName {
+			glog.V(2).Infof("clearPreviousInternalResources(%v): expected health check %q does not match previous %q - deleting health check", loadBalancerName, expectedHCName, existingHCName)
+			if err := gce.teardownInternalHealthCheckAndFirewall(svc, existingHCName); err != nil {
+				glog.Warningf("clearPreviousInternalResources: could not delete existing healthcheck: %v, err: %v", existingHCName, err)
+			}
+		}
+	} else if len(existingBackendService.HealthChecks) > 1 {
+		glog.Warningf("clearPreviousInternalResources(%v): more than one health check on the backend service %v, %v", loadBalancerName, existingBackendService.Name, existingBackendService.HealthChecks)
+	}
+}
+
+// updateInternalLoadBalancer is called when the list of nodes has changed. Therefore, only the instance groups
+// and possibly the backend service need to be updated.
+func (gce *GCECloud) updateInternalLoadBalancer(clusterName, clusterID string, svc *v1.Service, nodes []*v1.Node) error {
+	gce.sharedResourceLock.Lock()
+	defer gce.sharedResourceLock.Unlock()
+
+	igName := makeInstanceGroupName(clusterID)
+	igLinks, err := gce.ensureInternalInstanceGroups(igName, nodes)
+	if err != nil {
+		return err
+	}
+
+	// Generate the backend service name
+	_, protocol := getPortsAndProtocol(svc.Spec.Ports)
+	scheme := cloud.SchemeInternal
+	loadBalancerName := cloudprovider.GetLoadBalancerName(svc)
+	backendServiceName := makeBackendServiceName(loadBalancerName, clusterID, shareBackendService(svc), scheme, protocol, svc.Spec.SessionAffinity)
+	// Ensure the backend service has the proper backend/instance-group links
+	return gce.ensureInternalBackendServiceGroups(backendServiceName, igLinks)
+}
+
+func (gce *GCECloud) ensureInternalLoadBalancerDeleted(clusterName, clusterID string, svc *v1.Service) error {
+	loadBalancerName := cloudprovider.GetLoadBalancerName(svc)
+	_, protocol := getPortsAndProtocol(svc.Spec.Ports)
+	scheme := cloud.SchemeInternal
+	sharedBackend := shareBackendService(svc)
+	sharedHealthCheck := !v1_service.RequestsOnlyLocalTraffic(svc)
+
+	gce.sharedResourceLock.Lock()
+	defer gce.sharedResourceLock.Unlock()
+
+	glog.V(2).Infof("ensureInternalLoadBalancerDeleted(%v): attempting delete of region internal address", loadBalancerName)
+	ensureAddressDeleted(gce, loadBalancerName, gce.region)
+
+	glog.V(2).Infof("ensureInternalLoadBalancerDeleted(%v): deleting region internal forwarding rule", loadBalancerName)
+	if err := ignoreNotFound(gce.DeleteRegionForwardingRule(loadBalancerName, gce.region)); err != nil {
+		return err
+	}
+
+	backendServiceName := makeBackendServiceName(loadBalancerName, clusterID, sharedBackend, scheme, protocol, svc.Spec.SessionAffinity)
+	glog.V(2).Infof("ensureInternalLoadBalancerDeleted(%v): deleting region backend service %v", loadBalancerName, backendServiceName)
+	if err := gce.teardownInternalBackendService(backendServiceName); err != nil {
+		return err
+	}
+
+	glog.V(2).Infof("ensureInternalLoadBalancerDeleted(%v): deleting firewall for traffic", loadBalancerName)
+	if err := ignoreNotFound(gce.DeleteFirewall(loadBalancerName)); err != nil {
+		if isForbidden(err) && gce.OnXPN() {
+			glog.V(2).Infof("ensureInternalLoadBalancerDeleted(%v): could not delete traffic firewall on XPN cluster. Raising event.", loadBalancerName)
+			gce.raiseFirewallChangeNeededEvent(svc, FirewallToGCloudDeleteCmd(loadBalancerName, gce.NetworkProjectID()))
+		} else {
+			return err
+		}
+	}
+
+	hcName := makeHealthCheckName(loadBalancerName, clusterID, sharedHealthCheck)
+	glog.V(2).Infof("ensureInternalLoadBalancerDeleted(%v): deleting health check %v and its firewall", loadBalancerName, hcName)
+	if err := gce.teardownInternalHealthCheckAndFirewall(svc, hcName); err != nil {
+		return err
+	}
+
+	// Try deleting instance groups - expect ResourceInuse error if needed by other LBs
+	igName := makeInstanceGroupName(clusterID)
+	if err := gce.ensureInternalInstanceGroupsDeleted(igName); err != nil && !isInUsedByError(err) {
+		return err
+	}
+
+	return nil
+}
+
+func (gce *GCECloud) teardownInternalBackendService(bsName string) error {
+	if err := gce.DeleteRegionBackendService(bsName, gce.region); err != nil {
+		if isNotFound(err) {
+			glog.V(2).Infof("teardownInternalBackendService(%v): backend service already deleted. err: %v", bsName, err)
+			return nil
+		} else if isInUsedByError(err) {
+			glog.V(2).Infof("teardownInternalBackendService(%v): backend service in use.", bsName)
+			return nil
+		} else {
+			return fmt.Errorf("failed to delete backend service: %v, err: %v", bsName, err)
+		}
+	}
+	glog.V(2).Infof("teardownInternalBackendService(%v): backend service deleted", bsName)
+	return nil
+}
+
+func (gce *GCECloud) teardownInternalHealthCheckAndFirewall(svc *v1.Service, hcName string) error {
+	if err := gce.DeleteHealthCheck(hcName); err != nil {
+		if isNotFound(err) {
+			glog.V(2).Infof("teardownInternalHealthCheckAndFirewall(%v): health check does not exist.", hcName)
+			// Purposely do not early return - double check the firewall does not exist
+		} else if isInUsedByError(err) {
+			glog.V(2).Infof("teardownInternalHealthCheckAndFirewall(%v): health check in use.", hcName)
+			return nil
+		} else {
+			return fmt.Errorf("failed to delete health check: %v, err: %v", hcName, err)
+		}
+	}
+	glog.V(2).Infof("teardownInternalHealthCheckAndFirewall(%v): health check deleted", hcName)
+
+	hcFirewallName := makeHealthCheckFirewallNameFromHC(hcName)
+	if err := ignoreNotFound(gce.DeleteFirewall(hcFirewallName)); err != nil {
+		if isForbidden(err) && gce.OnXPN() {
+			glog.V(2).Infof("teardownInternalHealthCheckAndFirewall(%v): could not delete health check traffic firewall on XPN cluster. Raising Event.", hcName)
+			gce.raiseFirewallChangeNeededEvent(svc, FirewallToGCloudDeleteCmd(hcFirewallName, gce.NetworkProjectID()))
+			return nil
+		}
+
+		return fmt.Errorf("failed to delete health check firewall: %v, err: %v", hcFirewallName, err)
+	}
+	glog.V(2).Infof("teardownInternalHealthCheckAndFirewall(%v): health check firewall deleted", hcFirewallName)
+	return nil
+}
+
+func (gce *GCECloud) ensureInternalFirewall(svc *v1.Service, fwName, fwDesc string, sourceRanges []string, ports []string, protocol v1.Protocol, nodes []*v1.Node) error {
+	glog.V(2).Infof("ensureInternalFirewall(%v): checking existing firewall", fwName)
+	targetTags, err := gce.GetNodeTags(nodeNames(nodes))
+	if err != nil {
+		return err
+	}
+
+	existingFirewall, err := gce.GetFirewall(fwName)
+	if err != nil && !isNotFound(err) {
+		return err
+	}
+
+	expectedFirewall := &compute.Firewall{
+		Name:         fwName,
+		Description:  fwDesc,
+		Network:      gce.networkURL,
+		SourceRanges: sourceRanges,
+		TargetTags:   targetTags,
+		Allowed: []*compute.FirewallAllowed{
+			{
+				IPProtocol: strings.ToLower(string(protocol)),
+				Ports:      ports,
+			},
+		},
+	}
+
+	if existingFirewall == nil {
+		glog.V(2).Infof("ensureInternalFirewall(%v): creating firewall", fwName)
+		err = gce.CreateFirewall(expectedFirewall)
+		if err != nil && isForbidden(err) && gce.OnXPN() {
+			glog.V(2).Infof("ensureInternalFirewall(%v): do not have permission to create firewall rule (on XPN). Raising event.", fwName)
+			gce.raiseFirewallChangeNeededEvent(svc, FirewallToGCloudCreateCmd(expectedFirewall, gce.NetworkProjectID()))
+			return nil
+		}
+		return err
+	}
+
+	if firewallRuleEqual(expectedFirewall, existingFirewall) {
+		return nil
+	}
+
+	glog.V(2).Infof("ensureInternalFirewall(%v): updating firewall", fwName)
+	err = gce.UpdateFirewall(expectedFirewall)
+	if err != nil && isForbidden(err) && gce.OnXPN() {
+		glog.V(2).Infof("ensureInternalFirewall(%v): do not have permission to update firewall rule (on XPN). Raising event.", fwName)
+		gce.raiseFirewallChangeNeededEvent(svc, FirewallToGCloudUpdateCmd(expectedFirewall, gce.NetworkProjectID()))
+		return nil
+	}
+	return err
+}
+
+func (gce *GCECloud) ensureInternalFirewalls(loadBalancerName, ipAddress, clusterID string, nm types.NamespacedName, svc *v1.Service, healthCheckPort string, sharedHealthCheck bool, nodes []*v1.Node) error {
+	// First firewall is for ingress traffic
+	fwDesc := makeFirewallDescription(nm.String(), ipAddress)
+	ports, protocol := getPortsAndProtocol(svc.Spec.Ports)
+	sourceRanges, err := v1_service.GetLoadBalancerSourceRanges(svc)
+	if err != nil {
+		return err
+	}
+	err = gce.ensureInternalFirewall(svc, loadBalancerName, fwDesc, sourceRanges.StringSlice(), ports, protocol, nodes)
+	if err != nil {
+		return err
+	}
+
+	// Second firewall is for health checking nodes / services
+	fwHCName := makeHealthCheckFirewallName(loadBalancerName, clusterID, sharedHealthCheck)
+	hcSrcRanges := LoadBalancerSrcRanges()
+	return gce.ensureInternalFirewall(svc, fwHCName, "", hcSrcRanges, []string{healthCheckPort}, v1.ProtocolTCP, nodes)
+}
+
+func (gce *GCECloud) ensureInternalHealthCheck(name string, svcName types.NamespacedName, shared bool, path string, port int32) (*compute.HealthCheck, error) {
+	glog.V(2).Infof("ensureInternalHealthCheck(%v, %v, %v): checking existing health check", name, path, port)
+	expectedHC := newInternalLBHealthCheck(name, svcName, shared, path, port)
+
+	hc, err := gce.GetHealthCheck(name)
+	if err != nil && !isNotFound(err) {
+		return nil, err
+	}
+
+	if hc == nil {
+		glog.V(2).Infof("ensureInternalHealthCheck: did not find health check %v, creating one with port %v path %v", name, port, path)
+		if err = gce.CreateHealthCheck(expectedHC); err != nil {
+			return nil, err
+		}
+		hc, err = gce.GetHealthCheck(name)
+		if err != nil {
+			glog.Errorf("Failed to get http health check %v", err)
+			return nil, err
+		}
+		glog.V(2).Infof("ensureInternalHealthCheck: created health check %v", name)
+		return hc, nil
+	}
+
+	if healthChecksEqual(expectedHC, hc) {
+		return hc, nil
+	}
+
+	glog.V(2).Infof("ensureInternalHealthCheck: health check %v exists but parameters have drifted - updating...", name)
+	if err := gce.UpdateHealthCheck(expectedHC); err != nil {
+		glog.Warningf("Failed to reconcile http health check %v parameters", name)
+		return nil, err
+	}
+	glog.V(2).Infof("ensureInternalHealthCheck: corrected health check %v parameters successful", name)
+	return hc, nil
+}
+
+func (gce *GCECloud) ensureInternalInstanceGroup(name, zone string, nodes []*v1.Node) (string, error) {
+	glog.V(2).Infof("ensureInternalInstanceGroup(%v, %v): checking group that it contains %v nodes", name, zone, len(nodes))
+	ig, err := gce.GetInstanceGroup(name, zone)
+	if err != nil && !isNotFound(err) {
+		return "", err
+	}
+
+	kubeNodes := sets.NewString()
+	for _, n := range nodes {
+		kubeNodes.Insert(n.Name)
+	}
+
+	gceNodes := sets.NewString()
+	if ig == nil {
+		glog.V(2).Infof("ensureInternalInstanceGroup(%v, %v): creating instance group", name, zone)
+		newIG := &compute.InstanceGroup{Name: name}
+		if err = gce.CreateInstanceGroup(newIG, zone); err != nil {
+			return "", err
+		}
+
+		ig, err = gce.GetInstanceGroup(name, zone)
+		if err != nil {
+			return "", err
+		}
+	} else {
+		instances, err := gce.ListInstancesInInstanceGroup(name, zone, allInstances)
+		if err != nil {
+			return "", err
+		}
+
+		for _, ins := range instances {
+			parts := strings.Split(ins.Instance, "/")
+			gceNodes.Insert(parts[len(parts)-1])
+		}
+	}
+
+	removeNodes := gceNodes.Difference(kubeNodes).List()
+	addNodes := kubeNodes.Difference(gceNodes).List()
+
+	if len(removeNodes) != 0 {
+		glog.V(2).Infof("ensureInternalInstanceGroup(%v, %v): removing nodes: %v", name, zone, removeNodes)
+		instanceRefs := gce.ToInstanceReferences(zone, removeNodes)
+		// Possible we'll receive 404's here if the instance was deleted before getting to this point.
+		if err = gce.RemoveInstancesFromInstanceGroup(name, zone, instanceRefs); err != nil && !isNotFound(err) {
+			return "", err
+		}
+	}
+
+	if len(addNodes) != 0 {
+		glog.V(2).Infof("ensureInternalInstanceGroup(%v, %v): adding nodes: %v", name, zone, addNodes)
+		instanceRefs := gce.ToInstanceReferences(zone, addNodes)
+		if err = gce.AddInstancesToInstanceGroup(name, zone, instanceRefs); err != nil {
+			return "", err
+		}
+	}
+
+	return ig.SelfLink, nil
+}
+
+// ensureInternalInstanceGroups generates an unmanaged instance group for every zone
+// where a K8s node exists. It also ensures that each node belongs to an instance group
+func (gce *GCECloud) ensureInternalInstanceGroups(name string, nodes []*v1.Node) ([]string, error) {
+	zonedNodes := splitNodesByZone(nodes)
+	glog.V(2).Infof("ensureInternalInstanceGroups(%v): %d nodes over %d zones in region %v", name, len(nodes), len(zonedNodes), gce.region)
+	var igLinks []string
+	for zone, nodes := range zonedNodes {
+		igLink, err := gce.ensureInternalInstanceGroup(name, zone, nodes)
+		if err != nil {
+			return []string{}, err
+		}
+		igLinks = append(igLinks, igLink)
+	}
+
+	return igLinks, nil
+}
+
+func (gce *GCECloud) ensureInternalInstanceGroupsDeleted(name string) error {
+	// List of nodes isn't available here - fetch all zones in region and try deleting this cluster's ig
+	zones, err := gce.ListZonesInRegion(gce.region)
+	if err != nil {
+		return err
+	}
+
+	glog.V(2).Infof("ensureInternalInstanceGroupsDeleted(%v): attempting delete instance group in all %d zones", name, len(zones))
+	for _, z := range zones {
+		if err := gce.DeleteInstanceGroup(name, z.Name); err != nil && !isNotFoundOrInUse(err) {
+			return err
+		}
+	}
+	return nil
+}
+
+func (gce *GCECloud) ensureInternalBackendService(name, description string, affinityType v1.ServiceAffinity, scheme cloud.LbScheme, protocol v1.Protocol, igLinks []string, hcLink string) error {
+	glog.V(2).Infof("ensureInternalBackendService(%v, %v, %v): checking existing backend service with %d groups", name, scheme, protocol, len(igLinks))
+	bs, err := gce.GetRegionBackendService(name, gce.region)
+	if err != nil && !isNotFound(err) {
+		return err
+	}
+
+	backends := backendsFromGroupLinks(igLinks)
+	expectedBS := &compute.BackendService{
+		Name:                name,
+		Protocol:            string(protocol),
+		Description:         description,
+		HealthChecks:        []string{hcLink},
+		Backends:            backends,
+		SessionAffinity:     translateAffinityType(affinityType),
+		LoadBalancingScheme: string(scheme),
+	}
+
+	// Create backend service if none was found
+	if bs == nil {
+		glog.V(2).Infof("ensureInternalBackendService: creating backend service %v", name)
+		err := gce.CreateRegionBackendService(expectedBS, gce.region)
+		if err != nil {
+			return err
+		}
+		glog.V(2).Infof("ensureInternalBackendService: created backend service %v successfully", name)
+		return nil
+	}
+
+	if backendSvcEqual(expectedBS, bs) {
+		return nil
+	}
+
+	glog.V(2).Infof("ensureInternalBackendService: updating backend service %v", name)
+	// Set fingerprint for optimistic locking
+	expectedBS.Fingerprint = bs.Fingerprint
+	if err := gce.UpdateRegionBackendService(expectedBS, gce.region); err != nil {
+		return err
+	}
+	glog.V(2).Infof("ensureInternalBackendService: updated backend service %v successfully", name)
+	return nil
+}
+
+// ensureInternalBackendServiceGroups updates backend services if their list of backend instance groups is incorrect.
+func (gce *GCECloud) ensureInternalBackendServiceGroups(name string, igLinks []string) error {
+	glog.V(2).Infof("ensureInternalBackendServiceGroups(%v): checking existing backend service's groups", name)
+	bs, err := gce.GetRegionBackendService(name, gce.region)
+	if err != nil {
+		return err
+	}
+
+	backends := backendsFromGroupLinks(igLinks)
+	if backendsListEqual(bs.Backends, backends) {
+		return nil
+	}
+
+	// Set the backend service's backends to the updated list.
+	bs.Backends = backends
+
+	glog.V(2).Infof("ensureInternalBackendServiceGroups: updating backend service %v", name)
+	if err := gce.UpdateRegionBackendService(bs, gce.region); err != nil {
+		return err
+	}
+	glog.V(2).Infof("ensureInternalBackendServiceGroups: updated backend service %v successfully", name)
+	return nil
+}
+
+func shareBackendService(svc *v1.Service) bool {
+	return GetLoadBalancerAnnotationBackendShare(svc) && !v1_service.RequestsOnlyLocalTraffic(svc)
+}
+
+func backendsFromGroupLinks(igLinks []string) (backends []*compute.Backend) {
+	for _, igLink := range igLinks {
+		backends = append(backends, &compute.Backend{
+			Group: igLink,
+		})
+	}
+	return backends
+}
+
+func newInternalLBHealthCheck(name string, svcName types.NamespacedName, shared bool, path string, port int32) *compute.HealthCheck {
+	httpSettings := compute.HTTPHealthCheck{
+		Port:        int64(port),
+		RequestPath: path,
+	}
+	desc := ""
+	if !shared {
+		desc = makeHealthCheckDescription(svcName.String())
+	}
+	return &compute.HealthCheck{
+		Name:               name,
+		CheckIntervalSec:   gceHcCheckIntervalSeconds,
+		TimeoutSec:         gceHcTimeoutSeconds,
+		HealthyThreshold:   gceHcHealthyThreshold,
+		UnhealthyThreshold: gceHcUnhealthyThreshold,
+		HttpHealthCheck:    &httpSettings,
+		Type:               "HTTP",
+		Description:        desc,
+	}
+}
+
+func firewallRuleEqual(a, b *compute.Firewall) bool {
+	return a.Description == b.Description &&
+		len(a.Allowed) == 1 && len(a.Allowed) == len(b.Allowed) &&
+		a.Allowed[0].IPProtocol == b.Allowed[0].IPProtocol &&
+		equalStringSets(a.Allowed[0].Ports, b.Allowed[0].Ports) &&
+		equalStringSets(a.SourceRanges, b.SourceRanges) &&
+		equalStringSets(a.TargetTags, b.TargetTags)
+}
+
+func healthChecksEqual(a, b *compute.HealthCheck) bool {
+	return a.HttpHealthCheck != nil && b.HttpHealthCheck != nil &&
+		a.HttpHealthCheck.Port == b.HttpHealthCheck.Port &&
+		a.HttpHealthCheck.RequestPath == b.HttpHealthCheck.RequestPath &&
+		a.Description == b.Description &&
+		a.CheckIntervalSec == b.CheckIntervalSec &&
+		a.TimeoutSec == b.TimeoutSec &&
+		a.UnhealthyThreshold == b.UnhealthyThreshold &&
+		a.HealthyThreshold == b.HealthyThreshold
+}
+
+// backendsListEqual asserts that backend lists are equal by instance group link only
+func backendsListEqual(a, b []*compute.Backend) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	if len(a) == 0 {
+		return true
+	}
+
+	aSet := sets.NewString()
+	for _, v := range a {
+		aSet.Insert(v.Group)
+	}
+	bSet := sets.NewString()
+	for _, v := range b {
+		bSet.Insert(v.Group)
+	}
+
+	return aSet.Equal(bSet)
+}
+
+func backendSvcEqual(a, b *compute.BackendService) bool {
+	return a.Protocol == b.Protocol &&
+		a.Description == b.Description &&
+		a.SessionAffinity == b.SessionAffinity &&
+		a.LoadBalancingScheme == b.LoadBalancingScheme &&
+		equalStringSets(a.HealthChecks, b.HealthChecks) &&
+		backendsListEqual(a.Backends, b.Backends)
+}
+
+func fwdRuleEqual(a, b *compute.ForwardingRule) bool {
+	return (a.IPAddress == "" || b.IPAddress == "" || a.IPAddress == b.IPAddress) &&
+		a.IPProtocol == b.IPProtocol &&
+		a.LoadBalancingScheme == b.LoadBalancingScheme &&
+		equalStringSets(a.Ports, b.Ports) &&
+		a.BackendService == b.BackendService
+}
+
+func getPortsAndProtocol(svcPorts []v1.ServicePort) (ports []string, protocol v1.Protocol) {
+	if len(svcPorts) == 0 {
+		return []string{}, v1.ProtocolUDP
+	}
+
+	// GCP doesn't support multiple protocols for a single load balancer
+	protocol = svcPorts[0].Protocol
+	for _, p := range svcPorts {
+		ports = append(ports, strconv.Itoa(int(p.Port)))
+	}
+	return ports, protocol
+}
+
+func (gce *GCECloud) getBackendServiceLink(name string) string {
+	return gce.service.BasePath + strings.Join([]string{gce.projectID, "regions", gce.region, "backendServices", name}, "/")
+}
+
+func getNameFromLink(link string) string {
+	if link == "" {
+		return ""
+	}
+
+	fields := strings.Split(link, "/")
+	return fields[len(fields)-1]
+}
+
+func determineRequestedIP(svc *v1.Service, fwdRule *compute.ForwardingRule) string {
+	if svc.Spec.LoadBalancerIP != "" {
+		return svc.Spec.LoadBalancerIP
+	}
+
+	if fwdRule != nil {
+		return fwdRule.IPAddress
+	}
+
+	return ""
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_loadbalancer_internal_test.go

@@ -0,0 +1,741 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	compute "google.golang.org/api/compute/v1"
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/tools/record"
+	v1_service "k8s.io/kubernetes/pkg/api/v1/service"
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/mock"
+)
+
+func createInternalLoadBalancer(gce *GCECloud, svc *v1.Service, existingFwdRule *compute.ForwardingRule, nodeNames []string, clusterName, clusterID, zoneName string) (*v1.LoadBalancerStatus, error) {
+	nodes, err := createAndInsertNodes(gce, nodeNames, zoneName)
+	if err != nil {
+		return nil, err
+	}
+
+	return gce.ensureInternalLoadBalancer(
+		clusterName,
+		clusterID,
+		svc,
+		existingFwdRule,
+		nodes,
+	)
+}
+
+func TestEnsureInternalBackendServiceUpdates(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	nodeNames := []string{"test-node-1"}
+
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	svc := fakeLoadbalancerService(string(LBTypeInternal))
+	lbName := cloudprovider.GetLoadBalancerName(svc)
+	nodes, err := createAndInsertNodes(gce, nodeNames, vals.ZoneName)
+	igName := makeInstanceGroupName(vals.ClusterID)
+	igLinks, err := gce.ensureInternalInstanceGroups(igName, nodes)
+	require.NoError(t, err)
+
+	sharedBackend := shareBackendService(svc)
+	bsName := makeBackendServiceName(lbName, vals.ClusterID, sharedBackend, cloud.SchemeInternal, "TCP", svc.Spec.SessionAffinity)
+	err = gce.ensureInternalBackendService(bsName, "description", svc.Spec.SessionAffinity, cloud.SchemeInternal, "TCP", igLinks, "")
+	require.NoError(t, err)
+
+	// Update the Internal Backend Service with a new ServiceAffinity
+	err = gce.ensureInternalBackendService(bsName, "description", v1.ServiceAffinityNone, cloud.SchemeInternal, "TCP", igLinks, "")
+	require.NoError(t, err)
+
+	bs, err := gce.GetRegionBackendService(bsName, gce.region)
+	assert.NoError(t, err)
+	assert.Equal(t, bs.SessionAffinity, strings.ToUpper(string(v1.ServiceAffinityNone)))
+}
+
+func TestEnsureInternalBackendServiceGroups(t *testing.T) {
+	for desc, tc := range map[string]struct {
+		mockModifier func(*cloud.MockGCE)
+	}{
+		"Basic workflow": {},
+		"GetRegionBackendService failed": {
+			mockModifier: func(c *cloud.MockGCE) {
+				c.MockRegionBackendServices.GetHook = mock.GetRegionBackendServicesErrHook
+			},
+		},
+		"UpdateRegionBackendServices failed": {
+			mockModifier: func(c *cloud.MockGCE) {
+				c.MockRegionBackendServices.UpdateHook = mock.UpdateRegionBackendServicesErrHook
+			},
+		},
+	} {
+		t.Run(desc, func(t *testing.T) {
+			t.Parallel()
+
+			vals := DefaultTestClusterValues()
+			nodeNames := []string{"test-node-1"}
+
+			gce, err := fakeGCECloud(vals)
+			require.NoError(t, err)
+
+			svc := fakeLoadbalancerService(string(LBTypeInternal))
+			lbName := cloudprovider.GetLoadBalancerName(svc)
+			nodes, err := createAndInsertNodes(gce, nodeNames, vals.ZoneName)
+			igName := makeInstanceGroupName(vals.ClusterID)
+			igLinks, err := gce.ensureInternalInstanceGroups(igName, nodes)
+			require.NoError(t, err)
+
+			sharedBackend := shareBackendService(svc)
+			bsName := makeBackendServiceName(lbName, vals.ClusterID, sharedBackend, cloud.SchemeInternal, "TCP", svc.Spec.SessionAffinity)
+
+			err = gce.ensureInternalBackendService(bsName, "description", svc.Spec.SessionAffinity, cloud.SchemeInternal, "TCP", igLinks, "")
+			require.NoError(t, err)
+
+			// Update the BackendService with new Instances
+			if tc.mockModifier != nil {
+				tc.mockModifier(gce.c.(*cloud.MockGCE))
+			}
+			newNodeNames := []string{"new-test-node-1", "new-test-node-2"}
+			err = gce.ensureInternalBackendServiceGroups(bsName, newNodeNames)
+			if tc.mockModifier != nil {
+				assert.Error(t, err)
+				return
+			}
+			assert.NoError(t, err)
+
+			bs, err := gce.GetRegionBackendService(bsName, gce.region)
+			assert.NoError(t, err)
+
+			// Check that the instances are updated
+			newNodes, err := createAndInsertNodes(gce, newNodeNames, vals.ZoneName)
+			newIgLinks, err := gce.ensureInternalInstanceGroups(igName, newNodes)
+			backends := backendsFromGroupLinks(newIgLinks)
+			assert.Equal(t, bs.Backends, backends)
+		})
+	}
+}
+
+func TestEnsureInternalLoadBalancer(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	nodeNames := []string{"test-node-1"}
+
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	svc := fakeLoadbalancerService(string(LBTypeInternal))
+	status, err := createInternalLoadBalancer(gce, svc, nil, nodeNames, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+	assert.NoError(t, err)
+	assert.NotEmpty(t, status.Ingress)
+	assertInternalLbResources(t, gce, svc, vals, nodeNames)
+}
+
+func TestEnsureInternalLoadBalancerWithExistingResources(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	nodeNames := []string{"test-node-1"}
+
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+	svc := fakeLoadbalancerService(string(LBTypeInternal))
+
+	// Create the expected resources necessary for an Internal Load Balancer
+	nm := types.NamespacedName{Name: svc.Name, Namespace: svc.Namespace}
+	lbName := cloudprovider.GetLoadBalancerName(svc)
+
+	sharedHealthCheck := !v1_service.RequestsOnlyLocalTraffic(svc)
+	hcName := makeHealthCheckName(lbName, vals.ClusterID, sharedHealthCheck)
+	hcPath, hcPort := GetNodesHealthCheckPath(), GetNodesHealthCheckPort()
+	existingHC := newInternalLBHealthCheck(hcName, nm, sharedHealthCheck, hcPath, hcPort)
+	err = gce.CreateHealthCheck(existingHC)
+	require.NoError(t, err)
+
+	nodes, err := createAndInsertNodes(gce, nodeNames, vals.ZoneName)
+	igName := makeInstanceGroupName(vals.ClusterID)
+	igLinks, err := gce.ensureInternalInstanceGroups(igName, nodes)
+	require.NoError(t, err)
+
+	sharedBackend := shareBackendService(svc)
+	bsDescription := makeBackendServiceDescription(nm, sharedBackend)
+	bsName := makeBackendServiceName(lbName, vals.ClusterID, sharedBackend, cloud.SchemeInternal, "TCP", svc.Spec.SessionAffinity)
+	err = gce.ensureInternalBackendService(bsName, bsDescription, svc.Spec.SessionAffinity, cloud.SchemeInternal, "TCP", igLinks, existingHC.SelfLink)
+	require.NoError(t, err)
+
+	_, err = createInternalLoadBalancer(gce, svc, nil, nodeNames, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+	assert.NoError(t, err)
+}
+
+func TestEnsureInternalLoadBalancerClearPreviousResources(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	svc := fakeLoadbalancerService(string(LBTypeInternal))
+	lbName := cloudprovider.GetLoadBalancerName(svc)
+
+	// Create a ForwardingRule that's missing an IP address
+	existingFwdRule := &compute.ForwardingRule{
+		Name:                lbName,
+		IPAddress:           "",
+		Ports:               []string{"123"},
+		IPProtocol:          "TCP",
+		LoadBalancingScheme: string(cloud.SchemeInternal),
+	}
+	gce.CreateRegionForwardingRule(existingFwdRule, gce.region)
+
+	// Create a Firewall that's missing a Description
+	existingFirewall := &compute.Firewall{
+		Name:    lbName,
+		Network: gce.networkURL,
+		Allowed: []*compute.FirewallAllowed{
+			{
+				IPProtocol: "tcp",
+				Ports:      []string{"123"},
+			},
+		},
+	}
+	gce.CreateFirewall(existingFirewall)
+
+	sharedHealthCheck := !v1_service.RequestsOnlyLocalTraffic(svc)
+	hcName := makeHealthCheckName(lbName, vals.ClusterID, sharedHealthCheck)
+	hcPath, hcPort := GetNodesHealthCheckPath(), GetNodesHealthCheckPort()
+	nm := types.NamespacedName{Name: svc.Name, Namespace: svc.Namespace}
+
+	// Create a healthcheck with an incorrect threshold
+	existingHC := newInternalLBHealthCheck(hcName, nm, sharedHealthCheck, hcPath, hcPort)
+	existingHC.HealthyThreshold = gceHcHealthyThreshold * 10
+	gce.CreateHealthCheck(existingHC)
+
+	// Create a backend Service that's missing Description and Backends
+	sharedBackend := shareBackendService(svc)
+	backendServiceName := makeBackendServiceName(lbName, vals.ClusterID, sharedBackend, cloud.SchemeInternal, "TCP", svc.Spec.SessionAffinity)
+	existingBS := &compute.BackendService{
+		Name:                lbName,
+		Protocol:            "TCP",
+		HealthChecks:        []string{existingHC.SelfLink},
+		SessionAffinity:     translateAffinityType(svc.Spec.SessionAffinity),
+		LoadBalancingScheme: string(cloud.SchemeInternal),
+	}
+
+	gce.CreateRegionBackendService(existingBS, gce.region)
+	existingFwdRule.BackendService = existingBS.Name
+
+	_, err = createInternalLoadBalancer(gce, svc, existingFwdRule, []string{"test-node-1"}, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+	assert.NoError(t, err)
+
+	// Expect new resources with the correct attributes to be created
+	rule, _ := gce.GetRegionForwardingRule(lbName, gce.region)
+	assert.NotEqual(t, existingFwdRule, rule)
+
+	firewall, err := gce.GetFirewall(lbName)
+	require.NoError(t, err)
+	assert.NotEqual(t, firewall, existingFirewall)
+
+	healthcheck, err := gce.GetHealthCheck(hcName)
+	require.NoError(t, err)
+	assert.NotEqual(t, healthcheck, existingHC)
+
+	bs, err := gce.GetRegionBackendService(backendServiceName, gce.region)
+	require.NoError(t, err)
+	assert.NotEqual(t, bs, existingBS)
+}
+
+func TestUpdateInternalLoadBalancerBackendServices(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	nodeName := "test-node-1"
+
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	svc := fakeLoadbalancerService(string(LBTypeInternal))
+	_, err = createInternalLoadBalancer(gce, svc, nil, []string{"test-node-1"}, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+	assert.NoError(t, err)
+
+	// BackendService exists prior to updateInternalLoadBalancer call, but has
+	// incorrect (missing) attributes.
+	// ensureInternalBackendServiceGroups is called and creates the correct
+	// BackendService
+	lbName := cloudprovider.GetLoadBalancerName(svc)
+	sharedBackend := shareBackendService(svc)
+	backendServiceName := makeBackendServiceName(lbName, vals.ClusterID, sharedBackend, cloud.SchemeInternal, "TCP", svc.Spec.SessionAffinity)
+	existingBS := &compute.BackendService{
+		Name:                backendServiceName,
+		Protocol:            "TCP",
+		SessionAffinity:     translateAffinityType(svc.Spec.SessionAffinity),
+		LoadBalancingScheme: string(cloud.SchemeInternal),
+	}
+
+	gce.CreateRegionBackendService(existingBS, gce.region)
+
+	nodes, err := createAndInsertNodes(gce, []string{nodeName}, vals.ZoneName)
+	require.NoError(t, err)
+
+	err = gce.updateInternalLoadBalancer(vals.ClusterName, vals.ClusterID, svc, nodes)
+	assert.NoError(t, err)
+
+	bs, err := gce.GetRegionBackendService(backendServiceName, gce.region)
+	require.NoError(t, err)
+
+	// Check that the new BackendService has the correct attributes
+	url_base := fmt.Sprintf("https://www.googleapis.com/compute/v1/projects/%s", vals.ProjectID)
+
+	assert.NotEqual(t, existingBS, bs)
+	assert.Equal(
+		t,
+		bs.SelfLink,
+		fmt.Sprintf("%s/regions/%s/backendServices/%s", url_base, vals.Region, bs.Name),
+	)
+	assert.Equal(t, bs.Description, `{"kubernetes.io/service-name":"/"}`)
+	assert.Equal(
+		t,
+		bs.HealthChecks,
+		[]string{fmt.Sprintf("%s/global/healthChecks/k8s-%s-node", url_base, vals.ClusterID)},
+	)
+}
+
+func TestUpdateInternalLoadBalancerNodes(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+	node1Name := []string{"test-node-1"}
+
+	svc := fakeLoadbalancerService(string(LBTypeInternal))
+	nodes, err := createAndInsertNodes(gce, node1Name, vals.ZoneName)
+	require.NoError(t, err)
+
+	_, err = gce.ensureInternalLoadBalancer(vals.ClusterName, vals.ClusterID, svc, nil, nodes)
+	assert.NoError(t, err)
+
+	// Replace the node in initial zone; add new node in a new zone.
+	node2Name, node3Name := "test-node-2", "test-node-3"
+	newNodesZoneA, err := createAndInsertNodes(gce, []string{node2Name}, vals.ZoneName)
+	require.NoError(t, err)
+	newNodesZoneB, err := createAndInsertNodes(gce, []string{node3Name}, vals.SecondaryZoneName)
+	require.NoError(t, err)
+
+	nodes = append(newNodesZoneA, newNodesZoneB...)
+	err = gce.updateInternalLoadBalancer(vals.ClusterName, vals.ClusterID, svc, nodes)
+	assert.NoError(t, err)
+
+	lbName := cloudprovider.GetLoadBalancerName(svc)
+	sharedBackend := shareBackendService(svc)
+	backendServiceName := makeBackendServiceName(lbName, vals.ClusterID, sharedBackend, cloud.SchemeInternal, "TCP", svc.Spec.SessionAffinity)
+	bs, err := gce.GetRegionBackendService(backendServiceName, gce.region)
+	require.NoError(t, err)
+	assert.Equal(t, 2, len(bs.Backends), "Want two backends referencing two instances groups")
+
+	for _, zone := range []string{vals.ZoneName, vals.SecondaryZoneName} {
+		var found bool
+		for _, be := range bs.Backends {
+			if strings.Contains(be.Group, zone) {
+				found = true
+				break
+			}
+		}
+		assert.True(t, found, "Expected list of backends to have zone %q", zone)
+	}
+
+	// Expect initial zone to have test-node-2
+	igName := makeInstanceGroupName(vals.ClusterID)
+	instances, err := gce.ListInstancesInInstanceGroup(igName, vals.ZoneName, "ALL")
+	require.NoError(t, err)
+	assert.Equal(t, 1, len(instances))
+	assert.Contains(
+		t,
+		instances[0].Instance,
+		fmt.Sprintf("projects/%s/zones/%s/instances/%s", vals.ProjectID, vals.ZoneName, node2Name),
+	)
+
+	// Expect initial zone to have test-node-3
+	instances, err = gce.ListInstancesInInstanceGroup(igName, vals.SecondaryZoneName, "ALL")
+	require.NoError(t, err)
+	assert.Equal(t, 1, len(instances))
+	assert.Contains(
+		t,
+		instances[0].Instance,
+		fmt.Sprintf("projects/%s/zones/%s/instances/%s", vals.ProjectID, vals.SecondaryZoneName, node3Name),
+	)
+}
+
+func TestEnsureInternalLoadBalancerDeleted(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	svc := fakeLoadbalancerService(string(LBTypeInternal))
+	_, err = createInternalLoadBalancer(gce, svc, nil, []string{"test-node-1"}, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+	assert.NoError(t, err)
+
+	err = gce.ensureInternalLoadBalancerDeleted(vals.ClusterName, vals.ClusterID, svc)
+	assert.NoError(t, err)
+
+	assertInternalLbResourcesDeleted(t, gce, svc, vals, true)
+}
+
+func TestEnsureInternalLoadBalancerDeletedTwiceDoesNotError(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+	svc := fakeLoadbalancerService(string(LBTypeInternal))
+
+	_, err = createInternalLoadBalancer(gce, svc, nil, []string{"test-node-1"}, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+	assert.NoError(t, err)
+
+	err = gce.ensureInternalLoadBalancerDeleted(vals.ClusterName, vals.ClusterID, svc)
+	assert.NoError(t, err)
+
+	// Deleting the loadbalancer and resources again should not cause an error.
+	err = gce.ensureInternalLoadBalancerDeleted(vals.ClusterName, vals.ClusterID, svc)
+	assert.NoError(t, err)
+	assertInternalLbResourcesDeleted(t, gce, svc, vals, true)
+}
+
+func TestEnsureInternalLoadBalancerWithSpecialHealthCheck(t *testing.T) {
+	vals := DefaultTestClusterValues()
+	nodeName := "test-node-1"
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	healthCheckNodePort := int32(10101)
+	svc := fakeLoadbalancerService(string(LBTypeInternal))
+	svc.Spec.HealthCheckNodePort = healthCheckNodePort
+	svc.Spec.Type = v1.ServiceTypeLoadBalancer
+	svc.Spec.ExternalTrafficPolicy = v1.ServiceExternalTrafficPolicyTypeLocal
+
+	status, err := createInternalLoadBalancer(gce, svc, nil, []string{nodeName}, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+	assert.NoError(t, err)
+	assert.NotEmpty(t, status.Ingress)
+
+	loadBalancerName := cloudprovider.GetLoadBalancerName(svc)
+	hc, err := gce.GetHealthCheck(loadBalancerName)
+	assert.NoError(t, err)
+	assert.NotNil(t, hc)
+	assert.Equal(t, int64(healthCheckNodePort), hc.HttpHealthCheck.Port)
+}
+
+func TestClearPreviousInternalResources(t *testing.T) {
+	// Configure testing environment.
+	vals := DefaultTestClusterValues()
+	svc := fakeLoadbalancerService(string(LBTypeInternal))
+	loadBalancerName := cloudprovider.GetLoadBalancerName(svc)
+	nm := types.NamespacedName{Name: svc.Name, Namespace: svc.Namespace}
+	gce, err := fakeGCECloud(vals)
+	c := gce.c.(*cloud.MockGCE)
+	require.NoError(t, err)
+
+	hc_1, err := gce.ensureInternalHealthCheck("hc_1", nm, false, "healthz", 12345)
+	require.NoError(t, err)
+
+	hc_2, err := gce.ensureInternalHealthCheck("hc_2", nm, false, "healthz", 12346)
+	require.NoError(t, err)
+
+	err = gce.ensureInternalBackendService(svc.ObjectMeta.Name, "", svc.Spec.SessionAffinity, cloud.SchemeInternal, v1.ProtocolTCP, []string{}, "")
+	require.NoError(t, err)
+	backendSvc, err := gce.GetRegionBackendService(svc.ObjectMeta.Name, gce.region)
+	backendSvc.HealthChecks = []string{hc_1.SelfLink, hc_2.SelfLink}
+
+	c.MockRegionBackendServices.DeleteHook = mock.DeleteRegionBackendServicesErrHook
+	c.MockHealthChecks.DeleteHook = mock.DeleteHealthChecksInternalErrHook
+	gce.clearPreviousInternalResources(svc, loadBalancerName, backendSvc, "expectedBSName", "expectedHCName")
+
+	backendSvc, err = gce.GetRegionBackendService(svc.ObjectMeta.Name, gce.region)
+	assert.NoError(t, err)
+	assert.NotNil(t, backendSvc, "BackendService should not be deleted when api is mocked out.")
+	hc_1, err = gce.GetHealthCheck("hc_1")
+	assert.NoError(t, err)
+	assert.NotNil(t, hc_1, "HealthCheck should not be deleted when there are more than one healthcheck attached.")
+	hc_2, err = gce.GetHealthCheck("hc_2")
+	assert.NoError(t, err)
+	assert.NotNil(t, hc_2, "HealthCheck should not be deleted when there are more than one healthcheck attached.")
+
+	c.MockRegionBackendServices.DeleteHook = mock.DeleteRegionBackendServicesInUseErrHook
+	backendSvc.HealthChecks = []string{hc_1.SelfLink}
+	gce.clearPreviousInternalResources(svc, loadBalancerName, backendSvc, "expectedBSName", "expectedHCName")
+
+	hc_1, err = gce.GetHealthCheck("hc_1")
+	assert.NoError(t, err)
+	assert.NotNil(t, hc_1, "HealthCheck should not be deleted when api is mocked out.")
+
+	c.MockHealthChecks.DeleteHook = mock.DeleteHealthChecksInuseErrHook
+	gce.clearPreviousInternalResources(svc, loadBalancerName, backendSvc, "expectedBSName", "expectedHCName")
+
+	hc_1, err = gce.GetHealthCheck("hc_1")
+	assert.NoError(t, err)
+	assert.NotNil(t, hc_1, "HealthCheck should not be deleted when api is mocked out.")
+
+	c.MockRegionBackendServices.DeleteHook = nil
+	c.MockHealthChecks.DeleteHook = nil
+	gce.clearPreviousInternalResources(svc, loadBalancerName, backendSvc, "expectedBSName", "expectedHCName")
+
+	backendSvc, err = gce.GetRegionBackendService(svc.ObjectMeta.Name, gce.region)
+	assert.Error(t, err)
+	assert.Nil(t, backendSvc, "BackendService should be deleted.")
+	hc_1, err = gce.GetHealthCheck("hc_1")
+	assert.Error(t, err)
+	assert.Nil(t, hc_1, "HealthCheck should be deleted.")
+}
+
+func TestEnsureInternalFirewallSucceedsOnXPN(t *testing.T) {
+	gce, err := fakeGCECloud(DefaultTestClusterValues())
+	require.NoError(t, err)
+	vals := DefaultTestClusterValues()
+	svc := fakeLoadbalancerService(string(LBTypeInternal))
+	fwName := cloudprovider.GetLoadBalancerName(svc)
+
+	c := gce.c.(*cloud.MockGCE)
+	c.MockFirewalls.InsertHook = mock.InsertFirewallsUnauthorizedErrHook
+	c.MockFirewalls.UpdateHook = mock.UpdateFirewallsUnauthorizedErrHook
+	gce.onXPN = true
+	require.True(t, gce.OnXPN())
+
+	recorder := record.NewFakeRecorder(1024)
+	gce.eventRecorder = recorder
+
+	nodes, err := createAndInsertNodes(gce, []string{"test-node-1"}, vals.ZoneName)
+	require.NoError(t, err)
+	sourceRange := []string{"10.0.0.0/20"}
+	gce.ensureInternalFirewall(
+		svc,
+		fwName,
+		"A sad little firewall",
+		sourceRange,
+		[]string{"123"},
+		v1.ProtocolTCP,
+		nodes)
+	require.Nil(t, err, "Should success when XPN is on.")
+
+	checkEvent(t, recorder, FilewallChangeMsg, true)
+
+	// Create a firewall.
+	c.MockFirewalls.InsertHook = nil
+	c.MockFirewalls.UpdateHook = nil
+	gce.onXPN = false
+
+	gce.ensureInternalFirewall(
+		svc,
+		fwName,
+		"A sad little firewall",
+		sourceRange,
+		[]string{"123"},
+		v1.ProtocolTCP,
+		nodes)
+	require.Nil(t, err)
+	existingFirewall, err := gce.GetFirewall(fwName)
+	require.Nil(t, err)
+	require.NotNil(t, existingFirewall)
+
+	gce.onXPN = true
+	c.MockFirewalls.InsertHook = mock.InsertFirewallsUnauthorizedErrHook
+	c.MockFirewalls.UpdateHook = mock.UpdateFirewallsUnauthorizedErrHook
+
+	// Try to update the firewall just created.
+	gce.ensureInternalFirewall(
+		svc,
+		fwName,
+		"A happy little firewall",
+		sourceRange,
+		[]string{"123"},
+		v1.ProtocolTCP,
+		nodes)
+	require.Nil(t, err, "Should success when XPN is on.")
+
+	checkEvent(t, recorder, FilewallChangeMsg, true)
+}
+
+func TestEnsureLoadBalancerDeletedSucceedsOnXPN(t *testing.T) {
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	c := gce.c.(*cloud.MockGCE)
+	recorder := record.NewFakeRecorder(1024)
+	gce.eventRecorder = recorder
+	require.NoError(t, err)
+
+	_, err = createInternalLoadBalancer(gce, fakeLoadbalancerService(string(LBTypeInternal)), nil, []string{"test-node-1"}, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+	assert.NoError(t, err)
+
+	c.MockFirewalls.DeleteHook = mock.DeleteFirewallsUnauthorizedErrHook
+	gce.onXPN = true
+
+	err = gce.ensureInternalLoadBalancerDeleted(vals.ClusterName, vals.ClusterID, fakeLoadbalancerService(string(LBTypeInternal)))
+	assert.NoError(t, err)
+	checkEvent(t, recorder, FilewallChangeMsg, true)
+}
+
+func TestEnsureInternalInstanceGroupsDeleted(t *testing.T) {
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	c := gce.c.(*cloud.MockGCE)
+	recorder := record.NewFakeRecorder(1024)
+	gce.eventRecorder = recorder
+	require.NoError(t, err)
+
+	igName := makeInstanceGroupName(vals.ClusterID)
+
+	svc := fakeLoadbalancerService(string(LBTypeInternal))
+	_, err = createInternalLoadBalancer(gce, svc, nil, []string{"test-node-1"}, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+	assert.NoError(t, err)
+
+	c.MockZones.ListHook = mock.ListZonesInternalErrHook
+
+	err = gce.ensureInternalLoadBalancerDeleted(igName, vals.ClusterID, svc)
+	assert.Error(t, err, mock.InternalServerError)
+	ig, err := gce.GetInstanceGroup(igName, vals.ZoneName)
+	assert.NoError(t, err)
+	assert.NotNil(t, ig)
+
+	c.MockZones.ListHook = nil
+	c.MockInstanceGroups.DeleteHook = mock.DeleteInstanceGroupInternalErrHook
+
+	err = gce.ensureInternalInstanceGroupsDeleted(igName)
+	assert.Error(t, err, mock.InternalServerError)
+	ig, err = gce.GetInstanceGroup(igName, vals.ZoneName)
+	assert.NoError(t, err)
+	assert.NotNil(t, ig)
+
+	c.MockInstanceGroups.DeleteHook = nil
+	err = gce.ensureInternalInstanceGroupsDeleted(igName)
+	assert.NoError(t, err)
+	ig, err = gce.GetInstanceGroup(igName, vals.ZoneName)
+	assert.Error(t, err)
+	assert.Nil(t, ig)
+}
+
+type EnsureILBParams struct {
+	clusterName     string
+	clusterID       string
+	service         *v1.Service
+	existingFwdRule *compute.ForwardingRule
+	nodes           []*v1.Node
+}
+
+// newEnsureILBParams is the constructor of EnsureILBParams.
+func newEnsureILBParams(nodes []*v1.Node) *EnsureILBParams {
+	vals := DefaultTestClusterValues()
+	return &EnsureILBParams{
+		vals.ClusterName,
+		vals.ClusterID,
+		fakeLoadbalancerService(string(LBTypeInternal)),
+		nil,
+		nodes,
+	}
+}
+
+// TestEnsureInternalLoadBalancerErrors tests the function
+// ensureInternalLoadBalancer, making sure the system won't panic when
+// exceptions raised by gce.
+func TestEnsureInternalLoadBalancerErrors(t *testing.T) {
+	vals := DefaultTestClusterValues()
+	var params *EnsureILBParams
+
+	for desc, tc := range map[string]struct {
+		adjustParams func(*EnsureILBParams)
+		injectMock   func(*cloud.MockGCE)
+	}{
+		"Create internal instance groups failed": {
+			injectMock: func(c *cloud.MockGCE) {
+				c.MockInstanceGroups.GetHook = mock.GetInstanceGroupInternalErrHook
+			},
+		},
+		"Invalid existing forwarding rules given": {
+			adjustParams: func(params *EnsureILBParams) {
+				params.existingFwdRule = &compute.ForwardingRule{BackendService: "badBackendService"}
+			},
+			injectMock: func(c *cloud.MockGCE) {
+				c.MockRegionBackendServices.GetHook = mock.GetRegionBackendServicesErrHook
+			},
+		},
+		"EnsureInternalBackendService failed": {
+			injectMock: func(c *cloud.MockGCE) {
+				c.MockRegionBackendServices.GetHook = mock.GetRegionBackendServicesErrHook
+			},
+		},
+		"Create internal health check failed": {
+			injectMock: func(c *cloud.MockGCE) {
+				c.MockHealthChecks.GetHook = mock.GetHealthChecksInternalErrHook
+			},
+		},
+		"Create firewall failed": {
+			injectMock: func(c *cloud.MockGCE) {
+				c.MockFirewalls.InsertHook = mock.InsertFirewallsUnauthorizedErrHook
+			},
+		},
+		"Create region forwarding rule failed": {
+			injectMock: func(c *cloud.MockGCE) {
+				c.MockForwardingRules.InsertHook = mock.InsertForwardingRulesInternalErrHook
+			},
+		},
+		"Get region forwarding rule failed": {
+			injectMock: func(c *cloud.MockGCE) {
+				c.MockForwardingRules.GetHook = mock.GetForwardingRulesInternalErrHook
+			},
+		},
+		"Delete region forwarding rule failed": {
+			adjustParams: func(params *EnsureILBParams) {
+				params.existingFwdRule = &compute.ForwardingRule{BackendService: "badBackendService"}
+			},
+			injectMock: func(c *cloud.MockGCE) {
+				c.MockForwardingRules.DeleteHook = mock.DeleteForwardingRuleErrHook
+			},
+		},
+	} {
+		t.Run(desc, func(t *testing.T) {
+			gce, err := fakeGCECloud(DefaultTestClusterValues())
+			nodes, err := createAndInsertNodes(gce, []string{"test-node-1"}, vals.ZoneName)
+			require.NoError(t, err)
+			params = newEnsureILBParams(nodes)
+			if tc.adjustParams != nil {
+				tc.adjustParams(params)
+			}
+			if tc.injectMock != nil {
+				tc.injectMock(gce.c.(*cloud.MockGCE))
+			}
+			status, err := gce.ensureInternalLoadBalancer(
+				params.clusterName,
+				params.clusterID,
+				params.service,
+				params.existingFwdRule,
+				params.nodes,
+			)
+			assert.Error(t, err, "Should return an error when "+desc)
+			assert.Nil(t, status, "Should not return a status when "+desc)
+		})
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_loadbalancer_naming.go

@@ -0,0 +1,121 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"crypto/sha1"
+	"encoding/hex"
+	"fmt"
+	"strings"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+)
+
+// Internal Load Balancer
+
+// Instance groups remain legacy named to stay consistent with ingress
+func makeInstanceGroupName(clusterID string) string {
+	return fmt.Sprintf("k8s-ig--%s", clusterID)
+}
+
+func makeBackendServiceName(loadBalancerName, clusterID string, shared bool, scheme cloud.LbScheme, protocol v1.Protocol, svcAffinity v1.ServiceAffinity) string {
+	if shared {
+		hash := sha1.New()
+
+		// For every non-nil option, hash its value. Currently, only service affinity is relevant.
+		hash.Write([]byte(string(svcAffinity)))
+
+		hashed := hex.EncodeToString(hash.Sum(nil))
+		hashed = hashed[:16]
+
+		// k8s-          4
+		// {clusterid}-  17
+		// {scheme}-     9   (internal/external)
+		// {protocol}-   4   (tcp/udp)
+		// nmv1-         5   (naming convention version)
+		// {suffix}      16  (hash of settings)
+		// -----------------
+		//               55  characters used
+		return fmt.Sprintf("k8s-%s-%s-%s-nmv1-%s", clusterID, strings.ToLower(string(scheme)), strings.ToLower(string(protocol)), hashed)
+	}
+	return loadBalancerName
+}
+
+func makeHealthCheckName(loadBalancerName, clusterID string, shared bool) string {
+	if shared {
+		return fmt.Sprintf("k8s-%s-node", clusterID)
+	}
+
+	return loadBalancerName
+}
+
+func makeHealthCheckFirewallNameFromHC(healthCheckName string) string {
+	return healthCheckName + "-hc"
+}
+
+func makeHealthCheckFirewallName(loadBalancerName, clusterID string, shared bool) string {
+	if shared {
+		return fmt.Sprintf("k8s-%s-node-hc", clusterID)
+	}
+	return loadBalancerName + "-hc"
+}
+
+func makeBackendServiceDescription(nm types.NamespacedName, shared bool) string {
+	if shared {
+		return ""
+	}
+	return fmt.Sprintf(`{"kubernetes.io/service-name":"%s"}`, nm.String())
+}
+
+// External Load Balancer
+
+// makeServiceDescription is used to generate descriptions for forwarding rules and addresses.
+func makeServiceDescription(serviceName string) string {
+	return fmt.Sprintf(`{"kubernetes.io/service-name":"%s"}`, serviceName)
+}
+
+// MakeNodesHealthCheckName returns name of the health check resource used by
+// the GCE load balancers (l4) for performing health checks on nodes.
+func MakeNodesHealthCheckName(clusterID string) string {
+	return fmt.Sprintf("k8s-%v-node", clusterID)
+}
+
+func makeHealthCheckDescription(serviceName string) string {
+	return fmt.Sprintf(`{"kubernetes.io/service-name":"%s"}`, serviceName)
+}
+
+// MakeHealthCheckFirewallName returns the firewall name used by the GCE load
+// balancers (l4) for performing health checks.
+func MakeHealthCheckFirewallName(clusterID, hcName string, isNodesHealthCheck bool) string {
+	if isNodesHealthCheck {
+		return MakeNodesHealthCheckName(clusterID) + "-http-hc"
+	}
+	return "k8s-" + hcName + "-http-hc"
+}
+
+// MakeFirewallName returns the firewall name used by the GCE load
+// balancers (l4) for serving traffic.
+func MakeFirewallName(name string) string {
+	return fmt.Sprintf("k8s-fw-%s", name)
+}
+
+func makeFirewallDescription(serviceName, ipAddress string) string {
+	return fmt.Sprintf(`{"kubernetes.io/service-name":"%s", "kubernetes.io/service-ip":"%s"}`,
+		serviceName, ipAddress)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_loadbalancer_test.go

@@ -0,0 +1,171 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetLoadBalancer(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	apiService := fakeLoadbalancerService("")
+
+	// When a loadbalancer has not been created
+	status, found, err := gce.GetLoadBalancer(context.Background(), vals.ClusterName, apiService)
+	assert.Nil(t, status)
+	assert.False(t, found)
+	assert.Nil(t, err)
+
+	nodeNames := []string{"test-node-1"}
+	nodes, err := createAndInsertNodes(gce, nodeNames, vals.ZoneName)
+	require.NoError(t, err)
+	expectedStatus, err := gce.EnsureLoadBalancer(context.Background(), vals.ClusterName, apiService, nodes)
+	require.NoError(t, err)
+
+	status, found, err = gce.GetLoadBalancer(context.Background(), vals.ClusterName, apiService)
+	assert.Equal(t, expectedStatus, status)
+	assert.True(t, found)
+	assert.Nil(t, err)
+}
+
+func TestEnsureLoadBalancerCreatesExternalLb(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	nodeNames := []string{"test-node-1"}
+	nodes, err := createAndInsertNodes(gce, nodeNames, vals.ZoneName)
+	require.NoError(t, err)
+
+	apiService := fakeLoadbalancerService("")
+	status, err := gce.EnsureLoadBalancer(context.Background(), vals.ClusterName, apiService, nodes)
+	assert.NoError(t, err)
+	assert.NotEmpty(t, status.Ingress)
+	assertExternalLbResources(t, gce, apiService, vals, nodeNames)
+}
+
+func TestEnsureLoadBalancerCreatesInternalLb(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	nodeNames := []string{"test-node-1"}
+	nodes, err := createAndInsertNodes(gce, nodeNames, vals.ZoneName)
+	require.NoError(t, err)
+
+	apiService := fakeLoadbalancerService(string(LBTypeInternal))
+	status, err := gce.EnsureLoadBalancer(context.Background(), vals.ClusterName, apiService, nodes)
+	assert.NoError(t, err)
+	assert.NotEmpty(t, status.Ingress)
+	assertInternalLbResources(t, gce, apiService, vals, nodeNames)
+}
+
+func TestEnsureLoadBalancerDeletesExistingInternalLb(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	nodeNames := []string{"test-node-1"}
+	nodes, err := createAndInsertNodes(gce, nodeNames, vals.ZoneName)
+	require.NoError(t, err)
+
+	apiService := fakeLoadbalancerService("")
+	createInternalLoadBalancer(gce, apiService, nil, nodeNames, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+
+	status, err := gce.EnsureLoadBalancer(context.Background(), vals.ClusterName, apiService, nodes)
+	assert.NoError(t, err)
+	assert.NotEmpty(t, status.Ingress)
+
+	assertExternalLbResources(t, gce, apiService, vals, nodeNames)
+	assertInternalLbResourcesDeleted(t, gce, apiService, vals, false)
+}
+
+func TestEnsureLoadBalancerDeletesExistingExternalLb(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	nodeNames := []string{"test-node-1"}
+	nodes, err := createAndInsertNodes(gce, nodeNames, vals.ZoneName)
+	require.NoError(t, err)
+
+	apiService := fakeLoadbalancerService("")
+	createExternalLoadBalancer(gce, apiService, nodeNames, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+
+	apiService = fakeLoadbalancerService(string(LBTypeInternal))
+	status, err := gce.EnsureLoadBalancer(context.Background(), vals.ClusterName, apiService, nodes)
+	assert.NoError(t, err)
+	assert.NotEmpty(t, status.Ingress)
+
+	assertInternalLbResources(t, gce, apiService, vals, nodeNames)
+	assertExternalLbResourcesDeleted(t, gce, apiService, vals, false)
+}
+
+func TestEnsureLoadBalancerDeletedDeletesExternalLb(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	nodeNames := []string{"test-node-1"}
+	_, err = createAndInsertNodes(gce, nodeNames, vals.ZoneName)
+	require.NoError(t, err)
+
+	apiService := fakeLoadbalancerService("")
+	createExternalLoadBalancer(gce, apiService, nodeNames, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+
+	err = gce.EnsureLoadBalancerDeleted(context.Background(), vals.ClusterName, apiService)
+	assert.NoError(t, err)
+	assertExternalLbResourcesDeleted(t, gce, apiService, vals, true)
+}
+
+func TestEnsureLoadBalancerDeletedDeletesInternalLb(t *testing.T) {
+	t.Parallel()
+
+	vals := DefaultTestClusterValues()
+	gce, err := fakeGCECloud(vals)
+	require.NoError(t, err)
+
+	nodeNames := []string{"test-node-1"}
+	_, err = createAndInsertNodes(gce, nodeNames, vals.ZoneName)
+	require.NoError(t, err)
+
+	apiService := fakeLoadbalancerService(string(LBTypeInternal))
+	createInternalLoadBalancer(gce, apiService, nil, nodeNames, vals.ClusterName, vals.ClusterID, vals.ZoneName)
+
+	err = gce.EnsureLoadBalancerDeleted(context.Background(), vals.ClusterName, apiService)
+	assert.NoError(t, err)
+	assertInternalLbResourcesDeleted(t, gce, apiService, vals, true)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_loadbalancer_utils_test.go

@@ -0,0 +1,403 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// This file contains shared functions and variables to set up for tests for
+// ExternalLoadBalancer and InternalLoadBalancers. It currently cannot live in a
+// separate package from GCE because then it would cause a circular import.
+
+package gce
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	compute "google.golang.org/api/compute/v1"
+
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/client-go/tools/record"
+	v1_service "k8s.io/kubernetes/pkg/api/v1/service"
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/mock"
+	kubeletapis "k8s.io/kubernetes/pkg/kubelet/apis"
+)
+
+// TODO(yankaiz): Create shared error types for both test/non-test codes.
+const (
+	eventReasonManualChange = "LoadBalancerManualChange"
+	eventMsgFirewallChange  = "Firewall change required by network admin"
+	errPrefixGetTargetPool  = "error getting load balancer's target pool:"
+	errStrLbNoHosts         = "Cannot EnsureLoadBalancer() with no hosts"
+	wrongTier               = "SupremeLuxury"
+	errStrUnsupportedTier   = "unsupported network tier: \"" + wrongTier + "\""
+)
+
+type TestClusterValues struct {
+	ProjectID         string
+	Region            string
+	ZoneName          string
+	SecondaryZoneName string
+	ClusterID         string
+	ClusterName       string
+}
+
+func DefaultTestClusterValues() TestClusterValues {
+	return TestClusterValues{
+		ProjectID:         "test-project",
+		Region:            "us-central1",
+		ZoneName:          "us-central1-b",
+		SecondaryZoneName: "us-central1-c",
+		ClusterID:         "test-cluster-id",
+		ClusterName:       "Test Cluster Name",
+	}
+}
+
+func fakeLoadbalancerService(lbType string) *v1.Service {
+	return &v1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        "",
+			Annotations: map[string]string{ServiceAnnotationLoadBalancerType: lbType},
+		},
+		Spec: v1.ServiceSpec{
+			SessionAffinity: v1.ServiceAffinityClientIP,
+			Type:            v1.ServiceTypeLoadBalancer,
+			Ports:           []v1.ServicePort{{Protocol: v1.ProtocolTCP, Port: int32(123)}},
+		},
+	}
+}
+
+var (
+	FilewallChangeMsg = fmt.Sprintf("%s %s %s", v1.EventTypeNormal, eventReasonManualChange, eventMsgFirewallChange)
+)
+
+type fakeRoundTripper struct{}
+
+func (*fakeRoundTripper) RoundTrip(*http.Request) (*http.Response, error) {
+	return nil, fmt.Errorf("err: test used fake http client")
+}
+
+func fakeGCECloud(vals TestClusterValues) (*GCECloud, error) {
+	client := &http.Client{Transport: &fakeRoundTripper{}}
+
+	service, err := compute.New(client)
+	if err != nil {
+		return nil, err
+	}
+
+	// Used in disk unit tests
+	fakeManager := newFakeManager(vals.ProjectID, vals.Region)
+	zonesWithNodes := createNodeZones([]string{vals.ZoneName})
+
+	alphaFeatureGate := NewAlphaFeatureGate([]string{})
+	if err != nil {
+		return nil, err
+	}
+
+	gce := &GCECloud{
+		region:             vals.Region,
+		service:            service,
+		manager:            fakeManager,
+		managedZones:       []string{vals.ZoneName},
+		projectID:          vals.ProjectID,
+		networkProjectID:   vals.ProjectID,
+		AlphaFeatureGate:   alphaFeatureGate,
+		nodeZones:          zonesWithNodes,
+		nodeInformerSynced: func() bool { return true },
+		ClusterID:          fakeClusterID(vals.ClusterID),
+	}
+
+	c := cloud.NewMockGCE(&gceProjectRouter{gce})
+	c.MockTargetPools.AddInstanceHook = mock.AddInstanceHook
+	c.MockTargetPools.RemoveInstanceHook = mock.RemoveInstanceHook
+	c.MockForwardingRules.InsertHook = mock.InsertFwdRuleHook
+	c.MockAddresses.InsertHook = mock.InsertAddressHook
+	c.MockAlphaAddresses.InsertHook = mock.InsertAlphaAddressHook
+	c.MockAlphaAddresses.X = mock.AddressAttributes{}
+	c.MockAddresses.X = mock.AddressAttributes{}
+
+	c.MockInstanceGroups.X = mock.InstanceGroupAttributes{
+		InstanceMap: make(map[meta.Key]map[string]*compute.InstanceWithNamedPorts),
+		Lock:        &sync.Mutex{},
+	}
+	c.MockInstanceGroups.AddInstancesHook = mock.AddInstancesHook
+	c.MockInstanceGroups.RemoveInstancesHook = mock.RemoveInstancesHook
+	c.MockInstanceGroups.ListInstancesHook = mock.ListInstancesHook
+
+	c.MockRegionBackendServices.UpdateHook = mock.UpdateRegionBackendServiceHook
+	c.MockHealthChecks.UpdateHook = mock.UpdateHealthCheckHook
+	c.MockFirewalls.UpdateHook = mock.UpdateFirewallHook
+
+	keyGA := meta.GlobalKey("key-ga")
+	c.MockZones.Objects[*keyGA] = &cloud.MockZonesObj{
+		Obj: &compute.Zone{Name: vals.ZoneName, Region: gce.getRegionLink(vals.Region)},
+	}
+
+	gce.c = c
+
+	return gce, nil
+}
+
+func createAndInsertNodes(gce *GCECloud, nodeNames []string, zoneName string) ([]*v1.Node, error) {
+	nodes := []*v1.Node{}
+
+	for _, name := range nodeNames {
+		// Inserting the same node name twice causes an error - here we check if
+		// the instance exists already before insertion.
+		// TestUpdateExternalLoadBalancer inserts a new node, and relies on an older
+		// node to already have been inserted.
+		instance, _ := gce.getInstanceByName(name)
+
+		if instance == nil {
+			err := gce.InsertInstance(
+				gce.ProjectID(),
+				zoneName,
+				&compute.Instance{
+					Name: name,
+					Tags: &compute.Tags{
+						Items: []string{name},
+					},
+				},
+			)
+			if err != nil {
+				return nodes, err
+			}
+		}
+
+		nodes = append(
+			nodes,
+			&v1.Node{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: name,
+					Labels: map[string]string{
+						kubeletapis.LabelHostname:          name,
+						kubeletapis.LabelZoneFailureDomain: zoneName,
+					},
+				},
+				Status: v1.NodeStatus{
+					NodeInfo: v1.NodeSystemInfo{
+						KubeProxyVersion: "v1.7.2",
+					},
+				},
+			},
+		)
+
+	}
+
+	return nodes, nil
+}
+
+// Stubs ClusterID so that ClusterID.getOrInitialize() does not require calling
+// gce.Initialize()
+func fakeClusterID(clusterID string) ClusterID {
+	return ClusterID{
+		clusterID: &clusterID,
+		store: cache.NewStore(func(obj interface{}) (string, error) {
+			return "", nil
+		}),
+	}
+}
+
+func assertExternalLbResources(t *testing.T, gce *GCECloud, apiService *v1.Service, vals TestClusterValues, nodeNames []string) {
+	lbName := cloudprovider.GetLoadBalancerName(apiService)
+	hcName := MakeNodesHealthCheckName(vals.ClusterID)
+
+	// Check that Firewalls are created for the LoadBalancer and the HealthCheck
+	fwNames := []string{
+		MakeFirewallName(lbName), // Firewalls for external LBs are prefixed with k8s-fw-
+		MakeHealthCheckFirewallName(vals.ClusterID, hcName, true),
+	}
+
+	for _, fwName := range fwNames {
+		firewall, err := gce.GetFirewall(fwName)
+		require.NoError(t, err)
+		assert.Equal(t, nodeNames, firewall.TargetTags)
+		assert.NotEmpty(t, firewall.SourceRanges)
+	}
+
+	// Check that TargetPool is Created
+	pool, err := gce.GetTargetPool(lbName, gce.region)
+	require.NoError(t, err)
+	assert.Equal(t, lbName, pool.Name)
+	assert.NotEmpty(t, pool.HealthChecks)
+	assert.Equal(t, 1, len(pool.Instances))
+
+	// Check that HealthCheck is created
+	healthcheck, err := gce.GetHttpHealthCheck(hcName)
+	require.NoError(t, err)
+	assert.Equal(t, hcName, healthcheck.Name)
+
+	// Check that ForwardingRule is created
+	fwdRule, err := gce.GetRegionForwardingRule(lbName, gce.region)
+	require.NoError(t, err)
+	assert.Equal(t, lbName, fwdRule.Name)
+	assert.Equal(t, "TCP", fwdRule.IPProtocol)
+	assert.Equal(t, "123-123", fwdRule.PortRange)
+}
+
+func assertExternalLbResourcesDeleted(t *testing.T, gce *GCECloud, apiService *v1.Service, vals TestClusterValues, firewallsDeleted bool) {
+	lbName := cloudprovider.GetLoadBalancerName(apiService)
+	hcName := MakeNodesHealthCheckName(vals.ClusterID)
+
+	if firewallsDeleted {
+		// Check that Firewalls are deleted for the LoadBalancer and the HealthCheck
+		fwNames := []string{
+			MakeFirewallName(lbName),
+			MakeHealthCheckFirewallName(vals.ClusterID, hcName, true),
+		}
+
+		for _, fwName := range fwNames {
+			firewall, err := gce.GetFirewall(fwName)
+			require.Error(t, err)
+			assert.Nil(t, firewall)
+		}
+
+		// Check forwarding rule is deleted
+		fwdRule, err := gce.GetRegionForwardingRule(lbName, gce.region)
+		require.Error(t, err)
+		assert.Nil(t, fwdRule)
+	}
+
+	// Check that TargetPool is deleted
+	pool, err := gce.GetTargetPool(lbName, gce.region)
+	require.Error(t, err)
+	assert.Nil(t, pool)
+
+	// Check that HealthCheck is deleted
+	healthcheck, err := gce.GetHttpHealthCheck(hcName)
+	require.Error(t, err)
+	assert.Nil(t, healthcheck)
+
+}
+
+func assertInternalLbResources(t *testing.T, gce *GCECloud, apiService *v1.Service, vals TestClusterValues, nodeNames []string) {
+	lbName := cloudprovider.GetLoadBalancerName(apiService)
+
+	// Check that Instance Group is created
+	igName := makeInstanceGroupName(vals.ClusterID)
+	ig, err := gce.GetInstanceGroup(igName, vals.ZoneName)
+	assert.NoError(t, err)
+	assert.Equal(t, igName, ig.Name)
+
+	// Check that Firewalls are created for the LoadBalancer and the HealthCheck
+	fwNames := []string{
+		lbName, // Firewalls for internal LBs are named the same name as the loadbalancer.
+		makeHealthCheckFirewallName(lbName, vals.ClusterID, true),
+	}
+
+	for _, fwName := range fwNames {
+		firewall, err := gce.GetFirewall(fwName)
+		require.NoError(t, err)
+		assert.Equal(t, nodeNames, firewall.TargetTags)
+		assert.NotEmpty(t, firewall.SourceRanges)
+	}
+
+	// Check that HealthCheck is created
+	sharedHealthCheck := !v1_service.RequestsOnlyLocalTraffic(apiService)
+	hcName := makeHealthCheckName(lbName, vals.ClusterID, sharedHealthCheck)
+	healthcheck, err := gce.GetHealthCheck(hcName)
+	require.NoError(t, err)
+	assert.Equal(t, hcName, healthcheck.Name)
+
+	// Check that BackendService exists
+	sharedBackend := shareBackendService(apiService)
+	backendServiceName := makeBackendServiceName(lbName, vals.ClusterID, sharedBackend, cloud.SchemeInternal, "TCP", apiService.Spec.SessionAffinity)
+	backendServiceLink := gce.getBackendServiceLink(backendServiceName)
+
+	bs, err := gce.GetRegionBackendService(backendServiceName, gce.region)
+	require.NoError(t, err)
+	assert.Equal(t, "TCP", bs.Protocol)
+	assert.Equal(
+		t,
+		[]string{healthcheck.SelfLink},
+		bs.HealthChecks,
+	)
+
+	// Check that ForwardingRule is created
+	fwdRule, err := gce.GetRegionForwardingRule(lbName, gce.region)
+	require.NoError(t, err)
+	assert.Equal(t, lbName, fwdRule.Name)
+	assert.Equal(t, "TCP", fwdRule.IPProtocol)
+	assert.Equal(t, backendServiceLink, fwdRule.BackendService)
+	// if no Subnetwork specified, defaults to the GCE NetworkURL
+	assert.Equal(t, gce.NetworkURL(), fwdRule.Subnetwork)
+}
+
+func assertInternalLbResourcesDeleted(t *testing.T, gce *GCECloud, apiService *v1.Service, vals TestClusterValues, firewallsDeleted bool) {
+	lbName := cloudprovider.GetLoadBalancerName(apiService)
+	sharedHealthCheck := !v1_service.RequestsOnlyLocalTraffic(apiService)
+	hcName := makeHealthCheckName(lbName, vals.ClusterID, sharedHealthCheck)
+
+	// ensureExternalLoadBalancer and ensureInternalLoadBalancer both create
+	// Firewalls with the same name.
+	if firewallsDeleted {
+		// Check that Firewalls are deleted for the LoadBalancer and the HealthCheck
+		fwNames := []string{
+			MakeFirewallName(lbName),
+			MakeHealthCheckFirewallName(vals.ClusterID, hcName, true),
+		}
+
+		for _, fwName := range fwNames {
+			firewall, err := gce.GetFirewall(fwName)
+			require.Error(t, err)
+			assert.Nil(t, firewall)
+		}
+
+		// Check forwarding rule is deleted
+		fwdRule, err := gce.GetRegionForwardingRule(lbName, gce.region)
+		require.Error(t, err)
+		assert.Nil(t, fwdRule)
+	}
+
+	// Check that Instance Group is deleted
+	igName := makeInstanceGroupName(vals.ClusterID)
+	ig, err := gce.GetInstanceGroup(igName, vals.ZoneName)
+	assert.Error(t, err)
+	assert.Nil(t, ig)
+
+	// Check that HealthCheck is deleted
+	healthcheck, err := gce.GetHealthCheck(hcName)
+	require.Error(t, err)
+	assert.Nil(t, healthcheck)
+}
+
+func checkEvent(t *testing.T, recorder *record.FakeRecorder, expected string, shouldMatch bool) bool {
+	select {
+	case received := <-recorder.Events:
+		if strings.HasPrefix(received, expected) != shouldMatch {
+			t.Errorf(received)
+			if shouldMatch {
+				t.Errorf("Should receive message \"%v\" but got \"%v\".", expected, received)
+			} else {
+				t.Errorf("Unexpected event \"%v\".", received)
+			}
+		}
+		return false
+	case <-time.After(2 * time.Second):
+		if shouldMatch {
+			t.Errorf("Should receive message \"%v\" but got timed out.", expected)
+		}
+		return true
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_networkendpointgroup.go

@@ -0,0 +1,157 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"fmt"
+	"strings"
+
+	computealpha "google.golang.org/api/compute/v0.alpha"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+const (
+	NEGLoadBalancerType          = "LOAD_BALANCING"
+	NEGIPPortNetworkEndpointType = "GCE_VM_IP_PORT"
+)
+
+func newNetworkEndpointGroupMetricContext(request string, zone string) *metricContext {
+	return newGenericMetricContext("networkendpointgroup_", request, unusedMetricLabel, zone, computeAlphaVersion)
+}
+
+func (gce *GCECloud) GetNetworkEndpointGroup(name string, zone string) (*computealpha.NetworkEndpointGroup, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newNetworkEndpointGroupMetricContext("get", zone)
+	if err := gce.alphaFeatureEnabled(AlphaFeatureNetworkEndpointGroup); err != nil {
+		return nil, mc.Observe(err)
+	}
+	v, err := gce.c.AlphaNetworkEndpointGroups().Get(ctx, meta.ZonalKey(name, zone))
+	return v, mc.Observe(err)
+}
+
+func (gce *GCECloud) ListNetworkEndpointGroup(zone string) ([]*computealpha.NetworkEndpointGroup, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newNetworkEndpointGroupMetricContext("list", zone)
+	if err := gce.alphaFeatureEnabled(AlphaFeatureNetworkEndpointGroup); err != nil {
+		return nil, mc.Observe(err)
+	}
+	negs, err := gce.c.AlphaNetworkEndpointGroups().List(ctx, zone, filter.None)
+	return negs, mc.Observe(err)
+}
+
+// AggregatedListNetworkEndpointGroup returns a map of zone -> endpoint group.
+func (gce *GCECloud) AggregatedListNetworkEndpointGroup() (map[string][]*computealpha.NetworkEndpointGroup, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newNetworkEndpointGroupMetricContext("aggregated_list", "")
+	if err := gce.alphaFeatureEnabled(AlphaFeatureNetworkEndpointGroup); err != nil {
+		return nil, mc.Observe(err)
+	}
+	// TODO: filter for the region the cluster is in.
+	all, err := gce.c.AlphaNetworkEndpointGroups().AggregatedList(ctx, filter.None)
+	if err != nil {
+		return nil, mc.Observe(err)
+	}
+	ret := map[string][]*computealpha.NetworkEndpointGroup{}
+	for key, byZone := range all {
+		// key is "zones/<zone name>"
+		parts := strings.Split(key, "/")
+		if len(parts) != 2 {
+			return nil, mc.Observe(fmt.Errorf("invalid key for AggregatedListNetworkEndpointGroup: %q", key))
+		}
+		zone := parts[1]
+		ret[zone] = append(ret[zone], byZone...)
+	}
+	return ret, mc.Observe(nil)
+}
+
+func (gce *GCECloud) CreateNetworkEndpointGroup(neg *computealpha.NetworkEndpointGroup, zone string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	if err := gce.alphaFeatureEnabled(AlphaFeatureNetworkEndpointGroup); err != nil {
+		return err
+	}
+	mc := newNetworkEndpointGroupMetricContext("create", zone)
+	return mc.Observe(gce.c.AlphaNetworkEndpointGroups().Insert(ctx, meta.ZonalKey(neg.Name, zone), neg))
+}
+
+func (gce *GCECloud) DeleteNetworkEndpointGroup(name string, zone string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	if err := gce.alphaFeatureEnabled(AlphaFeatureNetworkEndpointGroup); err != nil {
+		return err
+	}
+	mc := newNetworkEndpointGroupMetricContext("delete", zone)
+	return mc.Observe(gce.c.AlphaNetworkEndpointGroups().Delete(ctx, meta.ZonalKey(name, zone)))
+}
+
+func (gce *GCECloud) AttachNetworkEndpoints(name, zone string, endpoints []*computealpha.NetworkEndpoint) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newNetworkEndpointGroupMetricContext("attach", zone)
+	if err := gce.alphaFeatureEnabled(AlphaFeatureNetworkEndpointGroup); err != nil {
+		return mc.Observe(err)
+	}
+	req := &computealpha.NetworkEndpointGroupsAttachEndpointsRequest{
+		NetworkEndpoints: endpoints,
+	}
+	return mc.Observe(gce.c.AlphaNetworkEndpointGroups().AttachNetworkEndpoints(ctx, meta.ZonalKey(name, zone), req))
+}
+
+func (gce *GCECloud) DetachNetworkEndpoints(name, zone string, endpoints []*computealpha.NetworkEndpoint) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newNetworkEndpointGroupMetricContext("detach", zone)
+	if err := gce.alphaFeatureEnabled(AlphaFeatureNetworkEndpointGroup); err != nil {
+		return mc.Observe(err)
+	}
+	req := &computealpha.NetworkEndpointGroupsDetachEndpointsRequest{
+		NetworkEndpoints: endpoints,
+	}
+	return mc.Observe(gce.c.AlphaNetworkEndpointGroups().DetachNetworkEndpoints(ctx, meta.ZonalKey(name, zone), req))
+}
+
+func (gce *GCECloud) ListNetworkEndpoints(name, zone string, showHealthStatus bool) ([]*computealpha.NetworkEndpointWithHealthStatus, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newNetworkEndpointGroupMetricContext("list_networkendpoints", zone)
+	if err := gce.alphaFeatureEnabled(AlphaFeatureNetworkEndpointGroup); err != nil {
+		return nil, mc.Observe(err)
+	}
+	healthStatus := "SKIP"
+	if showHealthStatus {
+		healthStatus = "SHOW"
+	}
+	req := &computealpha.NetworkEndpointGroupsListEndpointsRequest{
+		HealthStatus: healthStatus,
+	}
+	l, err := gce.c.AlphaNetworkEndpointGroups().ListNetworkEndpoints(ctx, meta.ZonalKey(name, zone), req, filter.None)
+	return l, mc.Observe(err)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_routes.go

@@ -0,0 +1,106 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"path"
+
+	"github.com/golang/glog"
+	compute "google.golang.org/api/compute/v1"
+	"k8s.io/apimachinery/pkg/types"
+
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func newRoutesMetricContext(request string) *metricContext {
+	return newGenericMetricContext("routes", request, unusedMetricLabel, unusedMetricLabel, computeV1Version)
+}
+
+// ListRoutes in the cloud environment.
+func (gce *GCECloud) ListRoutes(ctx context.Context, clusterName string) ([]*cloudprovider.Route, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newRoutesMetricContext("list")
+	prefix := truncateClusterName(clusterName)
+	f := filter.Regexp("name", prefix+"-.*").AndRegexp("network", gce.NetworkURL()).AndRegexp("description", k8sNodeRouteTag)
+	routes, err := gce.c.Routes().List(ctx, f)
+	if err != nil {
+		return nil, mc.Observe(err)
+	}
+	var croutes []*cloudprovider.Route
+	for _, r := range routes {
+		target := path.Base(r.NextHopInstance)
+		// TODO: Should we lastComponent(target) this?
+		targetNodeName := types.NodeName(target) // NodeName == Instance Name on GCE
+		croutes = append(croutes, &cloudprovider.Route{
+			Name:            r.Name,
+			TargetNode:      targetNodeName,
+			DestinationCIDR: r.DestRange,
+		})
+	}
+	return croutes, mc.Observe(nil)
+}
+
+// CreateRoute in the cloud environment.
+func (gce *GCECloud) CreateRoute(ctx context.Context, clusterName string, nameHint string, route *cloudprovider.Route) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newRoutesMetricContext("create")
+
+	targetInstance, err := gce.getInstanceByName(mapNodeNameToInstanceName(route.TargetNode))
+	if err != nil {
+		return mc.Observe(err)
+	}
+	cr := &compute.Route{
+		Name:            truncateClusterName(clusterName) + "-" + nameHint,
+		DestRange:       route.DestinationCIDR,
+		NextHopInstance: fmt.Sprintf("zones/%s/instances/%s", targetInstance.Zone, targetInstance.Name),
+		Network:         gce.NetworkURL(),
+		Priority:        1000,
+		Description:     k8sNodeRouteTag,
+	}
+	err = gce.c.Routes().Insert(ctx, meta.GlobalKey(cr.Name), cr)
+	if isHTTPErrorCode(err, http.StatusConflict) {
+		glog.Infof("Route %q already exists.", cr.Name)
+		err = nil
+	}
+	return mc.Observe(err)
+}
+
+// DeleteRoute from the cloud environment.
+func (gce *GCECloud) DeleteRoute(ctx context.Context, clusterName string, route *cloudprovider.Route) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newRoutesMetricContext("delete")
+	return mc.Observe(gce.c.Routes().Delete(ctx, meta.GlobalKey(route.Name)))
+}
+
+func truncateClusterName(clusterName string) string {
+	if len(clusterName) > 26 {
+		return clusterName[:26]
+	}
+	return clusterName
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_securitypolicy.go

@@ -0,0 +1,116 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	computebeta "google.golang.org/api/compute/v0.beta"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func newSecurityPolicyMetricContextWithVersion(request, version string) *metricContext {
+	return newGenericMetricContext("securitypolicy", request, "", unusedMetricLabel, version)
+}
+
+// GetBetaSecurityPolicy retrieves a security policy.
+func (gce *GCECloud) GetBetaSecurityPolicy(name string) (*computebeta.SecurityPolicy, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newSecurityPolicyMetricContextWithVersion("get", computeBetaVersion)
+	v, err := gce.c.BetaSecurityPolicies().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// ListBetaSecurityPolicy lists all security policies in the project.
+func (gce *GCECloud) ListBetaSecurityPolicy() ([]*computebeta.SecurityPolicy, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newSecurityPolicyMetricContextWithVersion("list", computeBetaVersion)
+	v, err := gce.c.BetaSecurityPolicies().List(ctx, filter.None)
+	return v, mc.Observe(err)
+}
+
+// CreateBetaSecurityPolicy creates the given security policy.
+func (gce *GCECloud) CreateBetaSecurityPolicy(sp *computebeta.SecurityPolicy) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newSecurityPolicyMetricContextWithVersion("create", computeBetaVersion)
+	return mc.Observe(gce.c.BetaSecurityPolicies().Insert(ctx, meta.GlobalKey(sp.Name), sp))
+}
+
+// DeleteBetaSecurityPolicy deletes the given security policy.
+func (gce *GCECloud) DeleteBetaSecurityPolicy(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newSecurityPolicyMetricContextWithVersion("delete", computeBetaVersion)
+	return mc.Observe(gce.c.BetaSecurityPolicies().Delete(ctx, meta.GlobalKey(name)))
+}
+
+// PatchBetaSecurityPolicy applies the given security policy as a
+// patch to an existing security policy.
+func (gce *GCECloud) PatchBetaSecurityPolicy(sp *computebeta.SecurityPolicy) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newSecurityPolicyMetricContextWithVersion("patch", computeBetaVersion)
+	return mc.Observe(gce.c.BetaSecurityPolicies().Patch(ctx, meta.GlobalKey(sp.Name), sp))
+}
+
+// GetRuleForBetaSecurityPolicy gets rule from a security policy.
+func (gce *GCECloud) GetRuleForBetaSecurityPolicy(name string) (*computebeta.SecurityPolicyRule, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newSecurityPolicyMetricContextWithVersion("get_rule", computeBetaVersion)
+	v, err := gce.c.BetaSecurityPolicies().GetRule(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// AddRuletoBetaSecurityPolicy adds the given security policy rule to
+// a security policy.
+func (gce *GCECloud) AddRuletoBetaSecurityPolicy(name string, spr *computebeta.SecurityPolicyRule) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newSecurityPolicyMetricContextWithVersion("add_rule", computeBetaVersion)
+	return mc.Observe(gce.c.BetaSecurityPolicies().AddRule(ctx, meta.GlobalKey(name), spr))
+}
+
+// PatchRuleForBetaSecurityPolicy patches the given security policy
+// rule to a security policy.
+func (gce *GCECloud) PatchRuleForBetaSecurityPolicy(name string, spr *computebeta.SecurityPolicyRule) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newSecurityPolicyMetricContextWithVersion("patch_rule", computeBetaVersion)
+	return mc.Observe(gce.c.BetaSecurityPolicies().PatchRule(ctx, meta.GlobalKey(name), spr))
+}
+
+// RemoveRuleFromBetaSecurityPolicy removes rule from a security policy.
+func (gce *GCECloud) RemoveRuleFromBetaSecurityPolicy(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newSecurityPolicyMetricContextWithVersion("remove_rule", computeBetaVersion)
+	return mc.Observe(gce.c.BetaSecurityPolicies().RemoveRule(ctx, meta.GlobalKey(name)))
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_targetpool.go

@@ -0,0 +1,80 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	compute "google.golang.org/api/compute/v1"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func newTargetPoolMetricContext(request, region string) *metricContext {
+	return newGenericMetricContext("targetpool", request, region, unusedMetricLabel, computeV1Version)
+}
+
+// GetTargetPool returns the TargetPool by name.
+func (gce *GCECloud) GetTargetPool(name, region string) (*compute.TargetPool, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetPoolMetricContext("get", region)
+	v, err := gce.c.TargetPools().Get(ctx, meta.RegionalKey(name, region))
+	return v, mc.Observe(err)
+}
+
+// CreateTargetPool creates the passed TargetPool
+func (gce *GCECloud) CreateTargetPool(tp *compute.TargetPool, region string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetPoolMetricContext("create", region)
+	return mc.Observe(gce.c.TargetPools().Insert(ctx, meta.RegionalKey(tp.Name, region), tp))
+}
+
+// DeleteTargetPool deletes TargetPool by name.
+func (gce *GCECloud) DeleteTargetPool(name, region string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetPoolMetricContext("delete", region)
+	return mc.Observe(gce.c.TargetPools().Delete(ctx, meta.RegionalKey(name, region)))
+}
+
+// AddInstancesToTargetPool adds instances by link to the TargetPool
+func (gce *GCECloud) AddInstancesToTargetPool(name, region string, instanceRefs []*compute.InstanceReference) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	req := &compute.TargetPoolsAddInstanceRequest{
+		Instances: instanceRefs,
+	}
+	mc := newTargetPoolMetricContext("add_instances", region)
+	return mc.Observe(gce.c.TargetPools().AddInstance(ctx, meta.RegionalKey(name, region), req))
+}
+
+// RemoveInstancesFromTargetPool removes instances by link to the TargetPool
+func (gce *GCECloud) RemoveInstancesFromTargetPool(name, region string, instanceRefs []*compute.InstanceReference) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	req := &compute.TargetPoolsRemoveInstanceRequest{
+		Instances: instanceRefs,
+	}
+	mc := newTargetPoolMetricContext("remove_instances", region)
+	return mc.Observe(gce.c.TargetPools().RemoveInstance(ctx, meta.RegionalKey(name, region), req))
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_targetproxy.go

@@ -0,0 +1,139 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	compute "google.golang.org/api/compute/v1"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func newTargetProxyMetricContext(request string) *metricContext {
+	return newGenericMetricContext("targetproxy", request, unusedMetricLabel, unusedMetricLabel, computeV1Version)
+}
+
+// GetTargetHttpProxy returns the UrlMap by name.
+func (gce *GCECloud) GetTargetHttpProxy(name string) (*compute.TargetHttpProxy, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetProxyMetricContext("get")
+	v, err := gce.c.TargetHttpProxies().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// CreateTargetHttpProxy creates a TargetHttpProxy
+func (gce *GCECloud) CreateTargetHttpProxy(proxy *compute.TargetHttpProxy) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetProxyMetricContext("create")
+	return mc.Observe(gce.c.TargetHttpProxies().Insert(ctx, meta.GlobalKey(proxy.Name), proxy))
+}
+
+// SetUrlMapForTargetHttpProxy sets the given UrlMap for the given TargetHttpProxy.
+func (gce *GCECloud) SetUrlMapForTargetHttpProxy(proxy *compute.TargetHttpProxy, urlMap *compute.UrlMap) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	ref := &compute.UrlMapReference{UrlMap: urlMap.SelfLink}
+	mc := newTargetProxyMetricContext("set_url_map")
+	return mc.Observe(gce.c.TargetHttpProxies().SetUrlMap(ctx, meta.GlobalKey(proxy.Name), ref))
+}
+
+// DeleteTargetHttpProxy deletes the TargetHttpProxy by name.
+func (gce *GCECloud) DeleteTargetHttpProxy(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetProxyMetricContext("delete")
+	return mc.Observe(gce.c.TargetHttpProxies().Delete(ctx, meta.GlobalKey(name)))
+}
+
+// ListTargetHttpProxies lists all TargetHttpProxies in the project.
+func (gce *GCECloud) ListTargetHttpProxies() ([]*compute.TargetHttpProxy, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetProxyMetricContext("list")
+	v, err := gce.c.TargetHttpProxies().List(ctx, filter.None)
+	return v, mc.Observe(err)
+}
+
+// TargetHttpsProxy management
+
+// GetTargetHttpsProxy returns the UrlMap by name.
+func (gce *GCECloud) GetTargetHttpsProxy(name string) (*compute.TargetHttpsProxy, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetProxyMetricContext("get")
+	v, err := gce.c.TargetHttpsProxies().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// CreateTargetHttpsProxy creates a TargetHttpsProxy
+func (gce *GCECloud) CreateTargetHttpsProxy(proxy *compute.TargetHttpsProxy) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetProxyMetricContext("create")
+	return mc.Observe(gce.c.TargetHttpsProxies().Insert(ctx, meta.GlobalKey(proxy.Name), proxy))
+}
+
+// SetUrlMapForTargetHttpsProxy sets the given UrlMap for the given TargetHttpsProxy.
+func (gce *GCECloud) SetUrlMapForTargetHttpsProxy(proxy *compute.TargetHttpsProxy, urlMap *compute.UrlMap) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetProxyMetricContext("set_url_map")
+	ref := &compute.UrlMapReference{UrlMap: urlMap.SelfLink}
+	return mc.Observe(gce.c.TargetHttpsProxies().SetUrlMap(ctx, meta.GlobalKey(proxy.Name), ref))
+}
+
+// SetSslCertificateForTargetHttpsProxy sets the given SslCertificate for the given TargetHttpsProxy.
+func (gce *GCECloud) SetSslCertificateForTargetHttpsProxy(proxy *compute.TargetHttpsProxy, sslCertURLs []string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetProxyMetricContext("set_ssl_cert")
+	req := &compute.TargetHttpsProxiesSetSslCertificatesRequest{
+		SslCertificates: sslCertURLs,
+	}
+	return mc.Observe(gce.c.TargetHttpsProxies().SetSslCertificates(ctx, meta.GlobalKey(proxy.Name), req))
+}
+
+// DeleteTargetHttpsProxy deletes the TargetHttpsProxy by name.
+func (gce *GCECloud) DeleteTargetHttpsProxy(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetProxyMetricContext("delete")
+	return mc.Observe(gce.c.TargetHttpsProxies().Delete(ctx, meta.GlobalKey(name)))
+}
+
+// ListTargetHttpsProxies lists all TargetHttpsProxies in the project.
+func (gce *GCECloud) ListTargetHttpsProxies() ([]*compute.TargetHttpsProxy, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newTargetProxyMetricContext("list")
+	v, err := gce.c.TargetHttpsProxies().List(ctx, filter.None)
+	return v, mc.Observe(err)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_test.go

@@ -0,0 +1,585 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"context"
+	"reflect"
+	"strings"
+	"testing"
+
+	"golang.org/x/oauth2/google"
+
+	"k8s.io/kubernetes/pkg/cloudprovider"
+)
+
+func TestReadConfigFile(t *testing.T) {
+	const s = `[Global]
+token-url = my-token-url
+token-body = my-token-body
+project-id = my-project
+network-project-id = my-network-project
+network-name = my-network
+subnetwork-name = my-subnetwork
+secondary-range-name = my-secondary-range
+node-tags = my-node-tag1
+node-instance-prefix = my-prefix
+multizone = true
+   `
+	reader := strings.NewReader(s)
+	config, err := readConfig(reader)
+	if err != nil {
+		t.Fatalf("Unexpected config parsing error %v", err)
+	}
+
+	expected := &ConfigFile{Global: ConfigGlobal{
+		TokenURL:           "my-token-url",
+		TokenBody:          "my-token-body",
+		ProjectID:          "my-project",
+		NetworkProjectID:   "my-network-project",
+		NetworkName:        "my-network",
+		SubnetworkName:     "my-subnetwork",
+		SecondaryRangeName: "my-secondary-range",
+		NodeTags:           []string{"my-node-tag1"},
+		NodeInstancePrefix: "my-prefix",
+		Multizone:          true,
+	}}
+
+	if !reflect.DeepEqual(expected, config) {
+		t.Fatalf("Expected config file values to be read into ConfigFile struct.  \nExpected:\n%+v\nActual:\n%+v", expected, config)
+	}
+}
+
+func TestExtraKeyInConfig(t *testing.T) {
+	const s = `[Global]
+project-id = my-project
+unknown-key = abc
+network-name = my-network
+   `
+	reader := strings.NewReader(s)
+	config, err := readConfig(reader)
+	if err != nil {
+		t.Fatalf("Unexpected config parsing error %v", err)
+	}
+	if config.Global.ProjectID != "my-project" || config.Global.NetworkName != "my-network" {
+		t.Fatalf("Expected config values to continue to be read despite extra key-value pair.")
+	}
+}
+
+func TestGetRegion(t *testing.T) {
+	zoneName := "us-central1-b"
+	regionName, err := GetGCERegion(zoneName)
+	if err != nil {
+		t.Fatalf("unexpected error from GetGCERegion: %v", err)
+	}
+	if regionName != "us-central1" {
+		t.Errorf("Unexpected region from GetGCERegion: %s", regionName)
+	}
+	gce := &GCECloud{
+		localZone: zoneName,
+		region:    regionName,
+	}
+	zones, ok := gce.Zones()
+	if !ok {
+		t.Fatalf("Unexpected missing zones impl")
+	}
+	zone, err := zones.GetZone(context.TODO())
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	if zone.Region != "us-central1" {
+		t.Errorf("Unexpected region: %s", zone.Region)
+	}
+}
+
+func TestComparingHostURLs(t *testing.T) {
+	tests := []struct {
+		host1       string
+		zone        string
+		name        string
+		expectEqual bool
+	}{
+		{
+			host1:       "https://www.googleapis.com/compute/v1/projects/1234567/zones/us-central1-f/instances/kubernetes-node-fhx1",
+			zone:        "us-central1-f",
+			name:        "kubernetes-node-fhx1",
+			expectEqual: true,
+		},
+		{
+			host1:       "https://www.googleapis.com/compute/v1/projects/cool-project/zones/us-central1-f/instances/kubernetes-node-fhx1",
+			zone:        "us-central1-f",
+			name:        "kubernetes-node-fhx1",
+			expectEqual: true,
+		},
+		{
+			host1:       "https://www.googleapis.com/compute/v23/projects/1234567/zones/us-central1-f/instances/kubernetes-node-fhx1",
+			zone:        "us-central1-f",
+			name:        "kubernetes-node-fhx1",
+			expectEqual: true,
+		},
+		{
+			host1:       "https://www.googleapis.com/compute/v24/projects/1234567/regions/us-central1/zones/us-central1-f/instances/kubernetes-node-fhx1",
+			zone:        "us-central1-f",
+			name:        "kubernetes-node-fhx1",
+			expectEqual: true,
+		},
+		{
+			host1:       "https://www.googleapis.com/compute/v1/projects/1234567/zones/us-central1-f/instances/kubernetes-node-fhx1",
+			zone:        "us-central1-c",
+			name:        "kubernetes-node-fhx1",
+			expectEqual: false,
+		},
+		{
+			host1:       "https://www.googleapis.com/compute/v1/projects/1234567/zones/us-central1-f/instances/kubernetes-node-fhx",
+			zone:        "us-central1-f",
+			name:        "kubernetes-node-fhx1",
+			expectEqual: false,
+		},
+		{
+			host1:       "https://www.googleapis.com/compute/v1/projects/1234567/zones/us-central1-f/instances/kubernetes-node-fhx1",
+			zone:        "us-central1-f",
+			name:        "kubernetes-node-fhx",
+			expectEqual: false,
+		},
+	}
+
+	for _, test := range tests {
+		link1 := hostURLToComparablePath(test.host1)
+		testInstance := &gceInstance{
+			Name: canonicalizeInstanceName(test.name),
+			Zone: test.zone,
+		}
+		link2 := testInstance.makeComparableHostPath()
+		if test.expectEqual && link1 != link2 {
+			t.Errorf("expected link1 and link2 to be equal, got %s and %s", link1, link2)
+		} else if !test.expectEqual && link1 == link2 {
+			t.Errorf("expected link1 and link2 not to be equal, got %s and %s", link1, link2)
+		}
+	}
+}
+
+func TestSplitProviderID(t *testing.T) {
+	providers := []struct {
+		providerID string
+
+		project  string
+		zone     string
+		instance string
+
+		fail bool
+	}{
+		{
+			providerID: ProviderName + "://project-example-164317/us-central1-f/kubernetes-node-fhx1",
+			project:    "project-example-164317",
+			zone:       "us-central1-f",
+			instance:   "kubernetes-node-fhx1",
+			fail:       false,
+		},
+		{
+			providerID: ProviderName + "://project-example.164317/us-central1-f/kubernetes-node-fhx1",
+			project:    "project-example.164317",
+			zone:       "us-central1-f",
+			instance:   "kubernetes-node-fhx1",
+			fail:       false,
+		},
+		{
+			providerID: ProviderName + "://project-example-164317/us-central1-fkubernetes-node-fhx1",
+			project:    "",
+			zone:       "",
+			instance:   "",
+			fail:       true,
+		},
+		{
+			providerID: ProviderName + ":/project-example-164317/us-central1-f/kubernetes-node-fhx1",
+			project:    "",
+			zone:       "",
+			instance:   "",
+			fail:       true,
+		},
+		{
+			providerID: "aws://project-example-164317/us-central1-f/kubernetes-node-fhx1",
+			project:    "",
+			zone:       "",
+			instance:   "",
+			fail:       true,
+		},
+		{
+			providerID: ProviderName + "://project-example-164317/us-central1-f/kubernetes-node-fhx1/",
+			project:    "",
+			zone:       "",
+			instance:   "",
+			fail:       true,
+		},
+		{
+			providerID: ProviderName + "://project-example.164317//kubernetes-node-fhx1",
+			project:    "",
+			zone:       "",
+			instance:   "",
+			fail:       true,
+		},
+		{
+			providerID: ProviderName + "://project-example.164317/kubernetes-node-fhx1",
+			project:    "",
+			zone:       "",
+			instance:   "",
+			fail:       true,
+		},
+	}
+
+	for _, test := range providers {
+		project, zone, instance, err := splitProviderID(test.providerID)
+		if (err != nil) != test.fail {
+			t.Errorf("Expected to fail=%t, with pattern %v", test.fail, test)
+		}
+
+		if test.fail {
+			continue
+		}
+
+		if project != test.project {
+			t.Errorf("Expected %v, but got %v", test.project, project)
+		}
+		if zone != test.zone {
+			t.Errorf("Expected %v, but got %v", test.zone, zone)
+		}
+		if instance != test.instance {
+			t.Errorf("Expected %v, but got %v", test.instance, instance)
+		}
+	}
+}
+
+func TestGetZoneByProviderID(t *testing.T) {
+	tests := []struct {
+		providerID string
+
+		expectedZone cloudprovider.Zone
+
+		fail        bool
+		description string
+	}{
+		{
+			providerID:   ProviderName + "://project-example-164317/us-central1-f/kubernetes-node-fhx1",
+			expectedZone: cloudprovider.Zone{FailureDomain: "us-central1-f", Region: "us-central1"},
+			fail:         false,
+			description:  "standard gce providerID",
+		},
+		{
+			providerID:   ProviderName + "://project-example-164317/us-central1-f/kubernetes-node-fhx1/",
+			expectedZone: cloudprovider.Zone{},
+			fail:         true,
+			description:  "too many slashes('/') trailing",
+		},
+		{
+			providerID:   ProviderName + "://project-example.164317//kubernetes-node-fhx1",
+			expectedZone: cloudprovider.Zone{},
+			fail:         true,
+			description:  "too many slashes('/') embedded",
+		},
+		{
+			providerID:   ProviderName + "://project-example-164317/uscentral1f/kubernetes-node-fhx1",
+			expectedZone: cloudprovider.Zone{},
+			fail:         true,
+			description:  "invalid name of the GCE zone",
+		},
+	}
+
+	gce := &GCECloud{
+		localZone: "us-central1-f",
+		region:    "us-central1",
+	}
+	for _, test := range tests {
+		zone, err := gce.GetZoneByProviderID(context.TODO(), test.providerID)
+		if (err != nil) != test.fail {
+			t.Errorf("Expected to fail=%t, provider ID %v, tests %s", test.fail, test, test.description)
+		}
+
+		if test.fail {
+			continue
+		}
+
+		if zone != test.expectedZone {
+			t.Errorf("Expected %v, but got %v", test.expectedZone, zone)
+		}
+	}
+}
+
+func TestGenerateCloudConfigs(t *testing.T) {
+	configBoilerplate := ConfigGlobal{
+		TokenURL:           "",
+		TokenBody:          "",
+		ProjectID:          "project-id",
+		NetworkName:        "network-name",
+		SubnetworkName:     "",
+		SecondaryRangeName: "",
+		NodeTags:           []string{"node-tag"},
+		NodeInstancePrefix: "node-prefix",
+		Multizone:          false,
+		ApiEndpoint:        "",
+		LocalZone:          "us-central1-a",
+		AlphaFeatures:      []string{},
+	}
+
+	cloudBoilerplate := CloudConfig{
+		ApiEndpoint:        "",
+		ProjectID:          "project-id",
+		NetworkProjectID:   "",
+		Region:             "us-central1",
+		Zone:               "us-central1-a",
+		ManagedZones:       []string{"us-central1-a"},
+		NetworkName:        "network-name",
+		SubnetworkName:     "",
+		NetworkURL:         "",
+		SubnetworkURL:      "",
+		SecondaryRangeName: "",
+		NodeTags:           []string{"node-tag"},
+		TokenSource:        google.ComputeTokenSource(""),
+		NodeInstancePrefix: "node-prefix",
+		UseMetadataServer:  true,
+		AlphaFeatureGate:   &AlphaFeatureGate{map[string]bool{}},
+	}
+
+	testCases := []struct {
+		name   string
+		config func() ConfigGlobal
+		cloud  func() CloudConfig
+	}{
+		{
+			name:   "Empty Config",
+			config: func() ConfigGlobal { return configBoilerplate },
+			cloud:  func() CloudConfig { return cloudBoilerplate },
+		},
+		{
+			name: "Nil token URL",
+			config: func() ConfigGlobal {
+				v := configBoilerplate
+				v.TokenURL = "nil"
+				return v
+			},
+			cloud: func() CloudConfig {
+				v := cloudBoilerplate
+				v.TokenSource = nil
+				return v
+			},
+		},
+		{
+			name: "Network Project ID",
+			config: func() ConfigGlobal {
+				v := configBoilerplate
+				v.NetworkProjectID = "my-awesome-project"
+				return v
+			},
+			cloud: func() CloudConfig {
+				v := cloudBoilerplate
+				v.NetworkProjectID = "my-awesome-project"
+				return v
+			},
+		},
+		{
+			name: "Specified API Endpint",
+			config: func() ConfigGlobal {
+				v := configBoilerplate
+				v.ApiEndpoint = "https://www.googleapis.com/compute/staging_v1/"
+				return v
+			},
+			cloud: func() CloudConfig {
+				v := cloudBoilerplate
+				v.ApiEndpoint = "https://www.googleapis.com/compute/staging_v1/"
+				return v
+			},
+		},
+		{
+			name: "Network & Subnetwork names",
+			config: func() ConfigGlobal {
+				v := configBoilerplate
+				v.NetworkName = "my-network"
+				v.SubnetworkName = "my-subnetwork"
+				return v
+			},
+			cloud: func() CloudConfig {
+				v := cloudBoilerplate
+				v.NetworkName = "my-network"
+				v.SubnetworkName = "my-subnetwork"
+				return v
+			},
+		},
+		{
+			name: "Network & Subnetwork URLs",
+			config: func() ConfigGlobal {
+				v := configBoilerplate
+				v.NetworkName = "https://www.googleapis.com/compute/v1/projects/project-id/global/networks/my-network"
+				v.SubnetworkName = "https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/subnetworks/my-subnetwork"
+				return v
+			},
+			cloud: func() CloudConfig {
+				v := cloudBoilerplate
+				v.NetworkName = ""
+				v.SubnetworkName = ""
+				v.NetworkURL = "https://www.googleapis.com/compute/v1/projects/project-id/global/networks/my-network"
+				v.SubnetworkURL = "https://www.googleapis.com/compute/v1/projects/project-id/regions/us-central1/subnetworks/my-subnetwork"
+				return v
+			},
+		},
+		{
+			name: "Multizone",
+			config: func() ConfigGlobal {
+				v := configBoilerplate
+				v.Multizone = true
+				return v
+			},
+			cloud: func() CloudConfig {
+				v := cloudBoilerplate
+				v.ManagedZones = nil
+				return v
+			},
+		},
+		{
+			name: "Secondary Range Name",
+			config: func() ConfigGlobal {
+				v := configBoilerplate
+				v.SecondaryRangeName = "my-secondary"
+				return v
+			},
+			cloud: func() CloudConfig {
+				v := cloudBoilerplate
+				v.SecondaryRangeName = "my-secondary"
+				return v
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			resultCloud, err := generateCloudConfig(&ConfigFile{Global: tc.config()})
+			if err != nil {
+				t.Fatalf("Unexpect error: %v", err)
+			}
+
+			v := tc.cloud()
+			if !reflect.DeepEqual(*resultCloud, v) {
+				t.Errorf("Got: \n%v\nWant\n%v\n", v, *resultCloud)
+			}
+		})
+	}
+}
+
+func TestNewAlphaFeatureGate(t *testing.T) {
+	testCases := []struct {
+		alphaFeatures  []string
+		expectEnabled  []string
+		expectDisabled []string
+	}{
+		// enable foo bar
+		{
+			alphaFeatures:  []string{"foo", "bar"},
+			expectEnabled:  []string{"foo", "bar"},
+			expectDisabled: []string{"aaa"},
+		},
+		// no alpha feature
+		{
+			alphaFeatures:  []string{},
+			expectEnabled:  []string{},
+			expectDisabled: []string{"foo", "bar"},
+		},
+		// unsupported alpha feature
+		{
+			alphaFeatures:  []string{"aaa", "foo"},
+			expectEnabled:  []string{"foo"},
+			expectDisabled: []string{},
+		},
+		// enable foo
+		{
+			alphaFeatures:  []string{"foo"},
+			expectEnabled:  []string{"foo"},
+			expectDisabled: []string{"bar"},
+		},
+	}
+
+	for _, tc := range testCases {
+		featureGate := NewAlphaFeatureGate(tc.alphaFeatures)
+
+		for _, key := range tc.expectEnabled {
+			if !featureGate.Enabled(key) {
+				t.Errorf("Expect %q to be enabled.", key)
+			}
+		}
+		for _, key := range tc.expectDisabled {
+			if featureGate.Enabled(key) {
+				t.Errorf("Expect %q to be disabled.", key)
+			}
+		}
+	}
+}
+
+func TestGetRegionInURL(t *testing.T) {
+	cases := map[string]string{
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/subnetworks/a": "us-central1",
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/us-west2/subnetworks/b":    "us-west2",
+		"projects/my-project/regions/asia-central1/subnetworks/c":                                     "asia-central1",
+		"regions/europe-north2":                                                                       "europe-north2",
+		"my-url":                                                                                      "",
+		"":                                                                                            "",
+	}
+	for input, output := range cases {
+		result := getRegionInURL(input)
+		if result != output {
+			t.Errorf("Actual result %q does not match expected result %q for input: %q", result, output, input)
+		}
+	}
+}
+
+func TestFindSubnetForRegion(t *testing.T) {
+	s := []string{
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/subnetworks/default-38b01f54907a15a7",
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/us-west1/subnetworks/default",
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/us-east1/subnetworks/default-277eec3815f742b6",
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/us-east4/subnetworks/default",
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/asia-northeast1/subnetworks/default",
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/asia-east1/subnetworks/default-8e020b4b8b244809",
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/australia-southeast1/subnetworks/default",
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/southamerica-east1/subnetworks/default",
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/europe-west3/subnetworks/default",
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/asia-southeast1/subnetworks/default",
+		"",
+	}
+	actual := findSubnetForRegion(s, "asia-east1")
+	expectedResult := "https://www.googleapis.com/compute/v1/projects/my-project/regions/asia-east1/subnetworks/default-8e020b4b8b244809"
+	if actual != expectedResult {
+		t.Errorf("Actual result %q does not match expected result %q", actual, expectedResult)
+	}
+
+	var nilSlice []string
+	res := findSubnetForRegion(nilSlice, "us-central1")
+	if res != "" {
+		t.Errorf("expected an empty result, got %v", res)
+	}
+}
+
+func TestLastComponent(t *testing.T) {
+	cases := map[string]string{
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/subnetworks/a": "a",
+		"https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/subnetworks/b": "b",
+		"projects/my-project/regions/us-central1/subnetworks/c":                                       "c",
+		"d": "d",
+		"":  "",
+	}
+	for input, output := range cases {
+		result := lastComponent(input)
+		if result != output {
+			t.Errorf("Actual result %q does not match expected result %q for input: %q", result, output, input)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_tpu.go

@@ -0,0 +1,189 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/golang/glog"
+	"google.golang.org/api/googleapi"
+	tpuapi "google.golang.org/api/tpu/v1"
+
+	"k8s.io/apimachinery/pkg/util/wait"
+)
+
+// newTPUService returns a new tpuService using the client to communicate with
+// the Cloud TPU APIs.
+func newTPUService(client *http.Client) (*tpuService, error) {
+	s, err := tpuapi.New(client)
+	if err != nil {
+		return nil, err
+	}
+	return &tpuService{
+		nodesService:      tpuapi.NewProjectsLocationsNodesService(s),
+		operationsService: tpuapi.NewProjectsLocationsOperationsService(s),
+	}, nil
+}
+
+// tpuService encapsulates the TPU services on nodes and the operations on the
+// nodes.
+type tpuService struct {
+	nodesService      *tpuapi.ProjectsLocationsNodesService
+	operationsService *tpuapi.ProjectsLocationsOperationsService
+}
+
+// CreateTPU creates the Cloud TPU node with the specified name in the
+// specified zone.
+func (gce *GCECloud) CreateTPU(ctx context.Context, name, zone string, node *tpuapi.Node) (*tpuapi.Node, error) {
+	var err error
+	mc := newTPUMetricContext("create", zone)
+	defer mc.Observe(err)
+
+	var op *tpuapi.Operation
+	parent := getTPUParentName(gce.projectID, zone)
+	op, err = gce.tpuService.nodesService.Create(parent, node).NodeId(name).Do()
+	if err != nil {
+		return nil, err
+	}
+	glog.V(2).Infof("Creating Cloud TPU %q in zone %q with operation %q", name, zone, op.Name)
+
+	op, err = gce.waitForTPUOp(30*time.Second, 10*time.Minute, op)
+	if err != nil {
+		return nil, err
+	}
+	err = getErrorFromTPUOp(op)
+	if err != nil {
+		return nil, err
+	}
+
+	output := new(tpuapi.Node)
+	err = json.Unmarshal(op.Response, output)
+	if err != nil {
+		err = fmt.Errorf("failed to unmarshal response from operation %q: response = %v, err = %v", op.Name, op.Response, err)
+		return nil, err
+	}
+	return output, nil
+}
+
+// DeleteTPU deletes the Cloud TPU with the specified name in the specified
+// zone.
+func (gce *GCECloud) DeleteTPU(ctx context.Context, name, zone string) error {
+	var err error
+	mc := newTPUMetricContext("delete", zone)
+	defer mc.Observe(err)
+
+	var op *tpuapi.Operation
+	name = getTPUName(gce.projectID, zone, name)
+	op, err = gce.tpuService.nodesService.Delete(name).Do()
+	if err != nil {
+		return err
+	}
+	glog.V(2).Infof("Deleting Cloud TPU %q in zone %q with operation %q", name, zone, op.Name)
+
+	op, err = gce.waitForTPUOp(30*time.Second, 10*time.Minute, op)
+	if err != nil {
+		return err
+	}
+	err = getErrorFromTPUOp(op)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// GetTPU returns the Cloud TPU with the specified name in the specified zone.
+func (gce *GCECloud) GetTPU(ctx context.Context, name, zone string) (*tpuapi.Node, error) {
+	mc := newTPUMetricContext("get", zone)
+
+	name = getTPUName(gce.projectID, zone, name)
+	node, err := gce.tpuService.nodesService.Get(name).Do()
+	if err != nil {
+		return nil, mc.Observe(err)
+	}
+	return node, mc.Observe(nil)
+}
+
+// ListTPUs returns Cloud TPUs in the specified zone.
+func (gce *GCECloud) ListTPUs(ctx context.Context, zone string) ([]*tpuapi.Node, error) {
+	mc := newTPUMetricContext("list", zone)
+
+	parent := getTPUParentName(gce.projectID, zone)
+	response, err := gce.tpuService.nodesService.List(parent).Do()
+	if err != nil {
+		return nil, mc.Observe(err)
+	}
+	return response.Nodes, mc.Observe(nil)
+}
+
+// waitForTPUOp checks whether the op is done every interval before the timeout
+// occurs.
+func (gce *GCECloud) waitForTPUOp(interval, timeout time.Duration, op *tpuapi.Operation) (*tpuapi.Operation, error) {
+	if err := wait.PollImmediate(interval, timeout, func() (bool, error) {
+		glog.V(3).Infof("Waiting for operation %q to complete...", op.Name)
+
+		start := time.Now()
+		gce.operationPollRateLimiter.Accept()
+		duration := time.Now().Sub(start)
+		if duration > 5*time.Second {
+			glog.V(2).Infof("Getting operation %q throttled for %v", op.Name, duration)
+		}
+
+		var err error
+		op, err = gce.tpuService.operationsService.Get(op.Name).Do()
+		if err != nil {
+			return true, err
+		}
+		if op.Done {
+			glog.V(3).Infof("Operation %q has completed", op.Name)
+			return true, nil
+		}
+		return false, nil
+	}); err != nil {
+		return nil, fmt.Errorf("failed to wait for operation %q: %s", op.Name, err)
+	}
+	return op, nil
+}
+
+// newTPUMetricContext returns a new metricContext used for recording metrics
+// of Cloud TPU API calls.
+func newTPUMetricContext(request, zone string) *metricContext {
+	return newGenericMetricContext("tpus", request, unusedMetricLabel, zone, "v1")
+}
+
+// getErrorFromTPUOp returns the error in the failed op, or nil if the op
+// succeed.
+func getErrorFromTPUOp(op *tpuapi.Operation) error {
+	if op != nil && op.Error != nil {
+		return &googleapi.Error{
+			Code:    op.ServerResponse.HTTPStatusCode,
+			Message: op.Error.Message,
+		}
+	}
+	return nil
+}
+
+func getTPUParentName(project, zone string) string {
+	return fmt.Sprintf("projects/%s/locations/%s", project, zone)
+}
+
+func getTPUName(project, zone, name string) string {
+	return fmt.Sprintf("projects/%s/locations/%s/nodes/%s", project, zone, name)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_urlmap.go

@@ -0,0 +1,76 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	compute "google.golang.org/api/compute/v1"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+func newUrlMapMetricContext(request string) *metricContext {
+	return newGenericMetricContext("urlmap", request, unusedMetricLabel, unusedMetricLabel, computeV1Version)
+}
+
+// GetUrlMap returns the UrlMap by name.
+func (gce *GCECloud) GetUrlMap(name string) (*compute.UrlMap, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newUrlMapMetricContext("get")
+	v, err := gce.c.UrlMaps().Get(ctx, meta.GlobalKey(name))
+	return v, mc.Observe(err)
+}
+
+// CreateUrlMap creates a url map
+func (gce *GCECloud) CreateUrlMap(urlMap *compute.UrlMap) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newUrlMapMetricContext("create")
+	return mc.Observe(gce.c.UrlMaps().Insert(ctx, meta.GlobalKey(urlMap.Name), urlMap))
+}
+
+// UpdateUrlMap applies the given UrlMap as an update
+func (gce *GCECloud) UpdateUrlMap(urlMap *compute.UrlMap) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newUrlMapMetricContext("update")
+	return mc.Observe(gce.c.UrlMaps().Update(ctx, meta.GlobalKey(urlMap.Name), urlMap))
+}
+
+// DeleteUrlMap deletes a url map by name.
+func (gce *GCECloud) DeleteUrlMap(name string) error {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newUrlMapMetricContext("delete")
+	return mc.Observe(gce.c.UrlMaps().Delete(ctx, meta.GlobalKey(name)))
+}
+
+// ListUrlMaps lists all UrlMaps in the project.
+func (gce *GCECloud) ListUrlMaps() ([]*compute.UrlMap, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newUrlMapMetricContext("list")
+	v, err := gce.c.UrlMaps().List(ctx, filter.None)
+	return v, mc.Observe(err)
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_util.go

@@ -0,0 +1,283 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"regexp"
+	"sort"
+	"strings"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+
+	"cloud.google.com/go/compute/metadata"
+	compute "google.golang.org/api/compute/v1"
+	"google.golang.org/api/googleapi"
+)
+
+type gceInstance struct {
+	Zone  string
+	Name  string
+	ID    uint64
+	Disks []*compute.AttachedDisk
+	Type  string
+}
+
+var (
+	autoSubnetIPRange = &net.IPNet{
+		IP:   net.ParseIP("10.128.0.0"),
+		Mask: net.CIDRMask(9, 32),
+	}
+)
+
+var providerIdRE = regexp.MustCompile(`^` + ProviderName + `://([^/]+)/([^/]+)/([^/]+)$`)
+
+func getProjectAndZone() (string, string, error) {
+	result, err := metadata.Get("instance/zone")
+	if err != nil {
+		return "", "", err
+	}
+	parts := strings.Split(result, "/")
+	if len(parts) != 4 {
+		return "", "", fmt.Errorf("unexpected response: %s", result)
+	}
+	zone := parts[3]
+	projectID, err := metadata.ProjectID()
+	if err != nil {
+		return "", "", err
+	}
+	return projectID, zone, nil
+}
+
+func (gce *GCECloud) raiseFirewallChangeNeededEvent(svc *v1.Service, cmd string) {
+	msg := fmt.Sprintf("Firewall change required by network admin: `%v`", cmd)
+	if gce.eventRecorder != nil && svc != nil {
+		gce.eventRecorder.Event(svc, v1.EventTypeNormal, "LoadBalancerManualChange", msg)
+	}
+}
+
+// FirewallToGCloudCreateCmd generates a gcloud command to create a firewall with specified params
+func FirewallToGCloudCreateCmd(fw *compute.Firewall, projectID string) string {
+	args := firewallToGcloudArgs(fw, projectID)
+	return fmt.Sprintf("gcloud compute firewall-rules create %v --network %v %v", fw.Name, getNameFromLink(fw.Network), args)
+}
+
+// FirewallToGCloudCreateCmd generates a gcloud command to update a firewall to specified params
+func FirewallToGCloudUpdateCmd(fw *compute.Firewall, projectID string) string {
+	args := firewallToGcloudArgs(fw, projectID)
+	return fmt.Sprintf("gcloud compute firewall-rules update %v %v", fw.Name, args)
+}
+
+// FirewallToGCloudCreateCmd generates a gcloud command to delete a firewall to specified params
+func FirewallToGCloudDeleteCmd(fwName, projectID string) string {
+	return fmt.Sprintf("gcloud compute firewall-rules delete %v --project %v", fwName, projectID)
+}
+
+func firewallToGcloudArgs(fw *compute.Firewall, projectID string) string {
+	var allPorts []string
+	for _, a := range fw.Allowed {
+		for _, p := range a.Ports {
+			allPorts = append(allPorts, fmt.Sprintf("%v:%v", a.IPProtocol, p))
+		}
+	}
+
+	// Sort all slices to prevent the event from being duped
+	sort.Strings(allPorts)
+	allow := strings.Join(allPorts, ",")
+	sort.Strings(fw.SourceRanges)
+	srcRngs := strings.Join(fw.SourceRanges, ",")
+	sort.Strings(fw.TargetTags)
+	targets := strings.Join(fw.TargetTags, ",")
+	return fmt.Sprintf("--description %q --allow %v --source-ranges %v --target-tags %v --project %v", fw.Description, allow, srcRngs, targets, projectID)
+}
+
+// Take a GCE instance 'hostname' and break it down to something that can be fed
+// to the GCE API client library.  Basically this means reducing 'kubernetes-
+// node-2.c.my-proj.internal' to 'kubernetes-node-2' if necessary.
+func canonicalizeInstanceName(name string) string {
+	ix := strings.Index(name, ".")
+	if ix != -1 {
+		name = name[:ix]
+	}
+	return name
+}
+
+// Returns the last component of a URL, i.e. anything after the last slash
+// If there is no slash, returns the whole string
+func lastComponent(s string) string {
+	lastSlash := strings.LastIndex(s, "/")
+	if lastSlash != -1 {
+		s = s[lastSlash+1:]
+	}
+	return s
+}
+
+// mapNodeNameToInstanceName maps a k8s NodeName to a GCE Instance Name
+// This is a simple string cast.
+func mapNodeNameToInstanceName(nodeName types.NodeName) string {
+	return string(nodeName)
+}
+
+// mapInstanceToNodeName maps a GCE Instance to a k8s NodeName
+func mapInstanceToNodeName(instance *compute.Instance) types.NodeName {
+	return types.NodeName(instance.Name)
+}
+
+// GetGCERegion returns region of the gce zone. Zone names
+// are of the form: ${region-name}-${ix}.
+// For example, "us-central1-b" has a region of "us-central1".
+// So we look for the last '-' and trim to just before that.
+func GetGCERegion(zone string) (string, error) {
+	ix := strings.LastIndex(zone, "-")
+	if ix == -1 {
+		return "", fmt.Errorf("unexpected zone: %s", zone)
+	}
+	return zone[:ix], nil
+}
+
+func isHTTPErrorCode(err error, code int) bool {
+	apiErr, ok := err.(*googleapi.Error)
+	return ok && apiErr.Code == code
+}
+
+func isInUsedByError(err error) bool {
+	apiErr, ok := err.(*googleapi.Error)
+	if !ok || apiErr.Code != http.StatusBadRequest {
+		return false
+	}
+	return strings.Contains(apiErr.Message, "being used by")
+}
+
+// splitProviderID splits a provider's id into core components.
+// A providerID is build out of '${ProviderName}://${project-id}/${zone}/${instance-name}'
+// See cloudprovider.GetInstanceProviderID.
+func splitProviderID(providerID string) (project, zone, instance string, err error) {
+	matches := providerIdRE.FindStringSubmatch(providerID)
+	if len(matches) != 4 {
+		return "", "", "", errors.New("error splitting providerID")
+	}
+	return matches[1], matches[2], matches[3], nil
+}
+
+func equalStringSets(x, y []string) bool {
+	if len(x) != len(y) {
+		return false
+	}
+	xString := sets.NewString(x...)
+	yString := sets.NewString(y...)
+	return xString.Equal(yString)
+}
+
+func isNotFound(err error) bool {
+	return isHTTPErrorCode(err, http.StatusNotFound)
+}
+
+func ignoreNotFound(err error) error {
+	if err == nil || isNotFound(err) {
+		return nil
+	}
+	return err
+}
+
+func isNotFoundOrInUse(err error) bool {
+	return isNotFound(err) || isInUsedByError(err)
+}
+
+func isForbidden(err error) bool {
+	return isHTTPErrorCode(err, http.StatusForbidden)
+}
+
+func makeGoogleAPINotFoundError(message string) error {
+	return &googleapi.Error{Code: http.StatusNotFound, Message: message}
+}
+
+func makeGoogleAPIError(code int, message string) error {
+	return &googleapi.Error{Code: code, Message: message}
+}
+
+// TODO(#51665): Remove this once Network Tiers becomes Beta in GCP.
+func handleAlphaNetworkTierGetError(err error) (string, error) {
+	if isForbidden(err) {
+		// Network tier is still an Alpha feature in GCP, and not every project
+		// is whitelisted to access the API. If we cannot access the API, just
+		// assume the tier is premium.
+		return cloud.NetworkTierDefault.ToGCEValue(), nil
+	}
+	// Can't get the network tier, just return an error.
+	return "", err
+}
+
+// containsCIDR returns true if outer contains inner.
+func containsCIDR(outer, inner *net.IPNet) bool {
+	return outer.Contains(firstIPInRange(inner)) && outer.Contains(lastIPInRange(inner))
+}
+
+// firstIPInRange returns the first IP in a given IP range.
+func firstIPInRange(ipNet *net.IPNet) net.IP {
+	return ipNet.IP.Mask(ipNet.Mask)
+}
+
+// lastIPInRange returns the last IP in a given IP range.
+func lastIPInRange(cidr *net.IPNet) net.IP {
+	ip := append([]byte{}, cidr.IP...)
+	for i, b := range cidr.Mask {
+		ip[i] |= ^b
+	}
+	return ip
+}
+
+// subnetsInCIDR takes a list of subnets for a single region and
+// returns subnets which exists in the specified CIDR range.
+func subnetsInCIDR(subnets []*compute.Subnetwork, cidr *net.IPNet) ([]*compute.Subnetwork, error) {
+	var res []*compute.Subnetwork
+	for _, subnet := range subnets {
+		_, subnetRange, err := net.ParseCIDR(subnet.IpCidrRange)
+		if err != nil {
+			return nil, fmt.Errorf("unable to parse CIDR %q for subnet %q: %v", subnet.IpCidrRange, subnet.Name, err)
+		}
+		if containsCIDR(cidr, subnetRange) {
+			res = append(res, subnet)
+		}
+	}
+	return res, nil
+}
+
+type netType string
+
+const (
+	netTypeLegacy netType = "LEGACY"
+	netTypeAuto   netType = "AUTO"
+	netTypeCustom netType = "CUSTOM"
+)
+
+func typeOfNetwork(network *compute.Network) netType {
+	if network.IPv4Range != "" {
+		return netTypeLegacy
+	}
+
+	if network.AutoCreateSubnetworks {
+		return netTypeAuto
+	}
+
+	return netTypeCustom
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_util_test.go

@@ -0,0 +1,114 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"net"
+	"reflect"
+	"testing"
+
+	compute "google.golang.org/api/compute/v1"
+)
+
+func TestLastIPInRange(t *testing.T) {
+	for _, tc := range []struct {
+		cidr string
+		want string
+	}{
+		{"10.1.2.3/32", "10.1.2.3"},
+		{"10.1.2.0/31", "10.1.2.1"},
+		{"10.1.0.0/30", "10.1.0.3"},
+		{"10.0.0.0/29", "10.0.0.7"},
+		{"::0/128", "::"},
+		{"::0/127", "::1"},
+		{"::0/126", "::3"},
+		{"::0/120", "::ff"},
+	} {
+		_, c, err := net.ParseCIDR(tc.cidr)
+		if err != nil {
+			t.Errorf("net.ParseCIDR(%v) = _, %v, %v; want nil", tc.cidr, c, err)
+			continue
+		}
+
+		if lastIP := lastIPInRange(c); lastIP.String() != tc.want {
+			t.Errorf("LastIPInRange(%v) = %v; want %v", tc.cidr, lastIP, tc.want)
+		}
+	}
+}
+
+func TestSubnetsInCIDR(t *testing.T) {
+	subnets := []*compute.Subnetwork{
+		{
+			Name:        "A",
+			IpCidrRange: "10.0.0.0/20",
+		},
+		{
+			Name:        "B",
+			IpCidrRange: "10.0.16.0/20",
+		},
+		{
+			Name:        "C",
+			IpCidrRange: "10.132.0.0/20",
+		},
+		{
+			Name:        "D",
+			IpCidrRange: "10.0.32.0/20",
+		},
+		{
+			Name:        "E",
+			IpCidrRange: "10.134.0.0/20",
+		},
+	}
+	expectedNames := []string{"C", "E"}
+
+	gotSubs, err := subnetsInCIDR(subnets, autoSubnetIPRange)
+	if err != nil {
+		t.Errorf("autoSubnetInList() = _, %v", err)
+	}
+
+	var gotNames []string
+	for _, v := range gotSubs {
+		gotNames = append(gotNames, v.Name)
+	}
+	if !reflect.DeepEqual(gotNames, expectedNames) {
+		t.Errorf("autoSubnetInList() = %v, expected: %v", gotNames, expectedNames)
+	}
+}
+
+func TestFirewallToGcloudArgs(t *testing.T) {
+	firewall := compute.Firewall{
+		Description:  "Last Line of Defense",
+		TargetTags:   []string{"jock-nodes", "band-nodes"},
+		SourceRanges: []string{"3.3.3.3/20", "1.1.1.1/20", "2.2.2.2/20"},
+		Allowed: []*compute.FirewallAllowed{
+			{
+				IPProtocol: "udp",
+				Ports:      []string{"321", "123-456", "123"},
+			},
+			{
+				IPProtocol: "tcp",
+				Ports:      []string{"321", "123-456", "123"},
+			},
+		},
+	}
+	got := firewallToGcloudArgs(&firewall, "my-project")
+
+	var e = `--description "Last Line of Defense" --allow tcp:123,tcp:123-456,tcp:321,udp:123,udp:123-456,udp:321 --source-ranges 1.1.1.1/20,2.2.2.2/20,3.3.3.3/20 --target-tags band-nodes,jock-nodes --project my-project`
+	if got != e {
+		t.Errorf("%q does not equal %q", got, e)
+	}
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/gce_zones.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"context"
+	"strings"
+
+	compute "google.golang.org/api/compute/v1"
+
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/kubernetes/pkg/cloudprovider"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/filter"
+)
+
+func newZonesMetricContext(request, region string) *metricContext {
+	return newGenericMetricContext("zones", request, region, unusedMetricLabel, computeV1Version)
+}
+
+// GetZone creates a cloudprovider.Zone of the current zone and region
+func (gce *GCECloud) GetZone(ctx context.Context) (cloudprovider.Zone, error) {
+	return cloudprovider.Zone{
+		FailureDomain: gce.localZone,
+		Region:        gce.region,
+	}, nil
+}
+
+// GetZoneByProviderID implements Zones.GetZoneByProviderID
+// This is particularly useful in external cloud providers where the kubelet
+// does not initialize node data.
+func (gce *GCECloud) GetZoneByProviderID(ctx context.Context, providerID string) (cloudprovider.Zone, error) {
+	_, zone, _, err := splitProviderID(providerID)
+	if err != nil {
+		return cloudprovider.Zone{}, err
+	}
+	region, err := GetGCERegion(zone)
+	if err != nil {
+		return cloudprovider.Zone{}, err
+	}
+	return cloudprovider.Zone{FailureDomain: zone, Region: region}, nil
+}
+
+// GetZoneByNodeName implements Zones.GetZoneByNodeName
+// This is particularly useful in external cloud providers where the kubelet
+// does not initialize node data.
+func (gce *GCECloud) GetZoneByNodeName(ctx context.Context, nodeName types.NodeName) (cloudprovider.Zone, error) {
+	instanceName := mapNodeNameToInstanceName(nodeName)
+	instance, err := gce.getInstanceByName(instanceName)
+	if err != nil {
+		return cloudprovider.Zone{}, err
+	}
+	region, err := GetGCERegion(instance.Zone)
+	if err != nil {
+		return cloudprovider.Zone{}, err
+	}
+	return cloudprovider.Zone{FailureDomain: instance.Zone, Region: region}, nil
+}
+
+// ListZonesInRegion returns all zones in a GCP region
+func (gce *GCECloud) ListZonesInRegion(region string) ([]*compute.Zone, error) {
+	ctx, cancel := cloud.ContextWithCallTimeout()
+	defer cancel()
+
+	mc := newZonesMetricContext("list", region)
+	list, err := gce.c.Zones().List(ctx, filter.Regexp("region", gce.getRegionLink(region)))
+	if err != nil {
+		return nil, mc.Observe(err)
+	}
+	return list, mc.Observe(err)
+}
+
+func (gce *GCECloud) getRegionLink(region string) string {
+	return gce.service.BasePath + strings.Join([]string{gce.projectID, "regions", region}, "/")
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/metrics.go

@@ -0,0 +1,105 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+const (
+	// Version strings for recording metrics.
+	computeV1Version    = "v1"
+	computeAlphaVersion = "alpha"
+	computeBetaVersion  = "beta"
+)
+
+type apiCallMetrics struct {
+	latency *prometheus.HistogramVec
+	errors  *prometheus.CounterVec
+}
+
+var (
+	metricLabels = []string{
+		"request", // API function that is begin invoked.
+		"region",  // region (optional).
+		"zone",    // zone (optional).
+		"version", // API version.
+	}
+
+	apiMetrics = registerAPIMetrics(metricLabels...)
+)
+
+type metricContext struct {
+	start time.Time
+	// The cardinalities of attributes and metricLabels (defined above) must
+	// match, or prometheus will panic.
+	attributes []string
+}
+
+// Value for an unused label in the metric dimension.
+const unusedMetricLabel = "<n/a>"
+
+// Observe the result of a API call.
+func (mc *metricContext) Observe(err error) error {
+	apiMetrics.latency.WithLabelValues(mc.attributes...).Observe(
+		time.Since(mc.start).Seconds())
+	if err != nil {
+		apiMetrics.errors.WithLabelValues(mc.attributes...).Inc()
+	}
+
+	return err
+}
+
+func newGenericMetricContext(prefix, request, region, zone, version string) *metricContext {
+	if len(zone) == 0 {
+		zone = unusedMetricLabel
+	}
+	if len(region) == 0 {
+		region = unusedMetricLabel
+	}
+	return &metricContext{
+		start:      time.Now(),
+		attributes: []string{prefix + "_" + request, region, zone, version},
+	}
+}
+
+// registerApiMetrics adds metrics definitions for a category of API calls.
+func registerAPIMetrics(attributes ...string) *apiCallMetrics {
+	metrics := &apiCallMetrics{
+		latency: prometheus.NewHistogramVec(
+			prometheus.HistogramOpts{
+				Name: "cloudprovider_gce_api_request_duration_seconds",
+				Help: "Latency of a GCE API call",
+			},
+			attributes,
+		),
+		errors: prometheus.NewCounterVec(
+			prometheus.CounterOpts{
+				Name: "cloudprovider_gce_api_request_errors",
+				Help: "Number of errors for an API call",
+			},
+			attributes,
+		),
+	}
+
+	prometheus.MustRegister(metrics.latency)
+	prometheus.MustRegister(metrics.errors)
+
+	return metrics
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/metrics_test.go

@@ -0,0 +1,28 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestVerifyMetricLabelCardinality(t *testing.T) {
+	mc := newGenericMetricContext("foo", "get", "us-central1", "<n/a>", "alpha")
+	assert.Len(t, mc.attributes, len(metricLabels), "cardinalities of labels and values must match")
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/support.go

@@ -0,0 +1,75 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"context"
+
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud"
+	"k8s.io/kubernetes/pkg/cloudprovider/providers/gce/cloud/meta"
+)
+
+// gceProjectRouter sends requests to the appropriate project ID.
+type gceProjectRouter struct {
+	gce *GCECloud
+}
+
+// ProjectID returns the project ID to be used for the given operation.
+func (r *gceProjectRouter) ProjectID(ctx context.Context, version meta.Version, service string) string {
+	switch service {
+	case "Firewalls", "Routes":
+		return r.gce.NetworkProjectID()
+	default:
+		return r.gce.projectID
+	}
+}
+
+// gceRateLimiter implements cloud.RateLimiter.
+type gceRateLimiter struct {
+	gce *GCECloud
+}
+
+// Accept blocks until the operation can be performed.
+//
+// TODO: the current cloud provider policy doesn't seem to be correct as it
+// only rate limits the polling operations, but not the /submission/ of
+// operations.
+func (l *gceRateLimiter) Accept(ctx context.Context, key *cloud.RateLimitKey) error {
+	if key.Operation == "Get" && key.Service == "Operations" {
+		// Wait a minimum amount of time regardless of rate limiter.
+		rl := &cloud.MinimumRateLimiter{
+			// Convert flowcontrol.RateLimiter into cloud.RateLimiter
+			RateLimiter: &cloud.AcceptRateLimiter{
+				Acceptor: l.gce.operationPollRateLimiter,
+			},
+			Minimum: operationPollInterval,
+		}
+		return rl.Accept(ctx, key)
+	}
+	return nil
+}
+
+// CreateGCECloudWithCloud is a helper function to create an instance of GCECloud with the
+// given Cloud interface implementation. Typical usage is to use cloud.NewMockGCE to get a
+// handle to a mock Cloud instance and then use that for testing.
+func CreateGCECloudWithCloud(config *CloudConfig, c cloud.Cloud) (*GCECloud, error) {
+	gceCloud, err := CreateGCECloud(config)
+	if err == nil {
+		gceCloud.c = c
+	}
+	return gceCloud, err
+}

vendor/k8s.io/kubernetes/pkg/cloudprovider/providers/gce/token_source.go

@@ -0,0 +1,112 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gce
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"time"
+
+	"k8s.io/client-go/util/flowcontrol"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/google"
+	"google.golang.org/api/googleapi"
+)
+
+const (
+	// Max QPS to allow through to the token URL.
+	tokenURLQPS = .05 // back off to once every 20 seconds when failing
+	// Maximum burst of requests to token URL before limiting.
+	tokenURLBurst = 3
+)
+
+var (
+	getTokenCounter = prometheus.NewCounter(
+		prometheus.CounterOpts{
+			Name: "get_token_count",
+			Help: "Counter of total Token() requests to the alternate token source",
+		},
+	)
+	getTokenFailCounter = prometheus.NewCounter(
+		prometheus.CounterOpts{
+			Name: "get_token_fail_count",
+			Help: "Counter of failed Token() requests to the alternate token source",
+		},
+	)
+)
+
+func init() {
+	prometheus.MustRegister(getTokenCounter)
+	prometheus.MustRegister(getTokenFailCounter)
+}
+
+type AltTokenSource struct {
+	oauthClient *http.Client
+	tokenURL    string
+	tokenBody   string
+	throttle    flowcontrol.RateLimiter
+}
+
+func (a *AltTokenSource) Token() (*oauth2.Token, error) {
+	a.throttle.Accept()
+	getTokenCounter.Inc()
+	t, err := a.token()
+	if err != nil {
+		getTokenFailCounter.Inc()
+	}
+	return t, err
+}
+
+func (a *AltTokenSource) token() (*oauth2.Token, error) {
+	req, err := http.NewRequest("POST", a.tokenURL, strings.NewReader(a.tokenBody))
+	if err != nil {
+		return nil, err
+	}
+	res, err := a.oauthClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+	if err := googleapi.CheckResponse(res); err != nil {
+		return nil, err
+	}
+	var tok struct {
+		AccessToken string    `json:"accessToken"`
+		ExpireTime  time.Time `json:"expireTime"`
+	}
+	if err := json.NewDecoder(res.Body).Decode(&tok); err != nil {
+		return nil, err
+	}
+	return &oauth2.Token{
+		AccessToken: tok.AccessToken,
+		Expiry:      tok.ExpireTime,
+	}, nil
+}
+
+func NewAltTokenSource(tokenURL, tokenBody string) oauth2.TokenSource {
+	client := oauth2.NewClient(oauth2.NoContext, google.ComputeTokenSource(""))
+	a := &AltTokenSource{
+		oauthClient: client,
+		tokenURL:    tokenURL,
+		tokenBody:   tokenBody,
+		throttle:    flowcontrol.NewTokenBucketRateLimiter(tokenURLQPS, tokenURLBurst),
+	}
+	return oauth2.ReuseTokenSource(nil, a)
+}