Switch to github.com/golang/dep for vendoring

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

vendor/k8s.io/kubernetes/test/e2e_node/BUILD

@@ -0,0 +1,137 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "benchmark_util.go",
+        "container.go",
+        "doc.go",
+        "image_list.go",
+        "resource_collector.go",
+        "simple_mount.go",
+        "util.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/apis/componentconfig:go_default_library",
+        "//pkg/apis/componentconfig/v1alpha1:go_default_library",
+        "//pkg/kubelet/api/v1alpha1/stats:go_default_library",
+        "//pkg/util/procfs:go_default_library",
+        "//pkg/util/uuid:go_default_library",
+        "//test/e2e/common:go_default_library",
+        "//test/e2e/framework:go_default_library",
+        "//test/e2e/perftype:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/google/cadvisor/client/v2",
+        "//vendor:github.com/google/cadvisor/info/v2",
+        "//vendor:github.com/onsi/ginkgo",
+        "//vendor:github.com/onsi/gomega",
+        "//vendor:github.com/opencontainers/runc/libcontainer/cgroups",
+        "//vendor:k8s.io/apimachinery/pkg/api/errors",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/labels",
+        "//vendor:k8s.io/apimachinery/pkg/util/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/util/sets",
+        "//vendor:k8s.io/apimachinery/pkg/util/wait",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "apparmor_test.go",
+        "cgroup_manager_test.go",
+        "container_manager_test.go",
+        "density_test.go",
+        "disk_eviction_test.go",
+        "dynamic_kubelet_configuration_test.go",
+        "e2e_node_suite_test.go",
+        "garbage_collector_test.go",
+        "image_id_test.go",
+        "inode_eviction_test.go",
+        "kubelet_test.go",
+        "lifecycle_hook_test.go",
+        "log_path_test.go",
+        "memory_eviction_test.go",
+        "mirror_pod_test.go",
+        "resource_usage_test.go",
+        "restart_test.go",
+        "runtime_conformance_test.go",
+        "summary_test.go",
+        "volume_manager_test.go",
+    ],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//pkg/api/resource:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/client/cache:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/kubelet:go_default_library",
+        "//pkg/kubelet/api/v1alpha1/stats:go_default_library",
+        "//pkg/kubelet/cm:go_default_library",
+        "//pkg/kubelet/container:go_default_library",
+        "//pkg/kubelet/dockertools:go_default_library",
+        "//pkg/kubelet/images:go_default_library",
+        "//pkg/kubelet/metrics:go_default_library",
+        "//pkg/metrics:go_default_library",
+        "//pkg/security/apparmor:go_default_library",
+        "//pkg/util/intstr:go_default_library",
+        "//pkg/util/uuid:go_default_library",
+        "//test/e2e/common:go_default_library",
+        "//test/e2e/framework:go_default_library",
+        "//test/e2e_node/services:go_default_library",
+        "//test/e2e_node/system:go_default_library",
+        "//test/utils:go_default_library",
+        "//vendor:github.com/coreos/go-systemd/util",
+        "//vendor:github.com/davecgh/go-spew/spew",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/kardianos/osext",
+        "//vendor:github.com/onsi/ginkgo",
+        "//vendor:github.com/onsi/ginkgo/config",
+        "//vendor:github.com/onsi/ginkgo/reporters",
+        "//vendor:github.com/onsi/gomega",
+        "//vendor:github.com/onsi/gomega/gstruct",
+        "//vendor:github.com/onsi/gomega/types",
+        "//vendor:github.com/spf13/pflag",
+        "//vendor:k8s.io/apimachinery/pkg/api/errors",
+        "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
+        "//vendor:k8s.io/apimachinery/pkg/labels",
+        "//vendor:k8s.io/apimachinery/pkg/runtime",
+        "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/types",
+        "//vendor:k8s.io/apimachinery/pkg/watch",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//test/e2e_node/builder:all-srcs",
+        "//test/e2e_node/environment:all-srcs",
+        "//test/e2e_node/remote:all-srcs",
+        "//test/e2e_node/runner/local:all-srcs",
+        "//test/e2e_node/runner/remote:all-srcs",
+        "//test/e2e_node/services:all-srcs",
+        "//test/e2e_node/system:all-srcs",
+    ],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/e2e_node/OWNERS

@@ -0,0 +1,4 @@
+assignees:
+  - vishh
+  - timstclair
+  - Random-Liu 

vendor/k8s.io/kubernetes/test/e2e_node/README.md

@@ -0,0 +1,3 @@
+See [e2e-node-tests](../../docs/devel/e2e-node-tests.md)
+
+[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/test/e2e_node/README.md?pixel)]()

vendor/k8s.io/kubernetes/test/e2e_node/apparmor_test.go

@@ -0,0 +1,219 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/security/apparmor"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	"github.com/davecgh/go-spew/spew"
+	"github.com/golang/glog"
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = framework.KubeDescribe("AppArmor [Feature:AppArmor]", func() {
+	if isAppArmorEnabled() {
+		BeforeEach(func() {
+			By("Loading AppArmor profiles for testing")
+			framework.ExpectNoError(loadTestProfiles(), "Could not load AppArmor test profiles")
+		})
+		Context("when running with AppArmor", func() {
+			f := framework.NewDefaultFramework("apparmor-test")
+
+			It("should reject an unloaded profile", func() {
+				status := runAppArmorTest(f, false, apparmor.ProfileNamePrefix+"non-existant-profile")
+				expectSoftRejection(status)
+			})
+			It("should enforce a profile blocking writes", func() {
+				status := runAppArmorTest(f, true, apparmor.ProfileNamePrefix+apparmorProfilePrefix+"deny-write")
+				if len(status.ContainerStatuses) == 0 {
+					framework.Failf("Unexpected pod status: %s", spew.Sdump(status))
+					return
+				}
+				state := status.ContainerStatuses[0].State.Terminated
+				Expect(state.ExitCode).To(Not(BeZero()), "ContainerStateTerminated: %+v", state)
+
+			})
+			It("should enforce a permissive profile", func() {
+				status := runAppArmorTest(f, true, apparmor.ProfileNamePrefix+apparmorProfilePrefix+"audit-write")
+				if len(status.ContainerStatuses) == 0 {
+					framework.Failf("Unexpected pod status: %s", spew.Sdump(status))
+					return
+				}
+				state := status.ContainerStatuses[0].State.Terminated
+				Expect(state.ExitCode).To(BeZero(), "ContainerStateTerminated: %+v", state)
+			})
+		})
+	} else {
+		Context("when running without AppArmor", func() {
+			f := framework.NewDefaultFramework("apparmor-test")
+
+			It("should reject a pod with an AppArmor profile", func() {
+				status := runAppArmorTest(f, false, apparmor.ProfileRuntimeDefault)
+				expectSoftRejection(status)
+			})
+		})
+	}
+})
+
+const apparmorProfilePrefix = "e2e-node-apparmor-test-"
+const testProfiles = `
+#include <tunables/global>
+
+profile e2e-node-apparmor-test-deny-write flags=(attach_disconnected) {
+  #include <abstractions/base>
+
+  file,
+
+  # Deny all file writes.
+  deny /** w,
+}
+
+profile e2e-node-apparmor-test-audit-write flags=(attach_disconnected) {
+  #include <abstractions/base>
+
+  file,
+
+  # Only audit file writes.
+  audit /** w,
+}
+`
+
+func loadTestProfiles() error {
+	f, err := ioutil.TempFile("/tmp", "apparmor")
+	if err != nil {
+		return fmt.Errorf("failed to open temp file: %v", err)
+	}
+	defer os.Remove(f.Name())
+	defer f.Close()
+
+	if _, err := f.WriteString(testProfiles); err != nil {
+		return fmt.Errorf("failed to write profiles to file: %v", err)
+	}
+
+	// TODO(random-liu): The test is run as root now, no need to use sudo here.
+	cmd := exec.Command("sudo", "apparmor_parser", "-r", "-W", f.Name())
+	stderr := &bytes.Buffer{}
+	cmd.Stderr = stderr
+	out, err := cmd.Output()
+	// apparmor_parser does not always return an error code, so consider any stderr output an error.
+	if err != nil || stderr.Len() > 0 {
+		if stderr.Len() > 0 {
+			glog.Warning(stderr.String())
+		}
+		if len(out) > 0 {
+			glog.Infof("apparmor_parser: %s", out)
+		}
+		return fmt.Errorf("failed to load profiles: %v", err)
+	}
+	glog.V(2).Infof("Loaded profiles: %v", out)
+	return nil
+}
+
+func runAppArmorTest(f *framework.Framework, shouldRun bool, profile string) v1.PodStatus {
+	pod := createPodWithAppArmor(f, profile)
+	if shouldRun {
+		// The pod needs to start before it stops, so wait for the longer start timeout.
+		framework.ExpectNoError(framework.WaitTimeoutForPodNoLongerRunningInNamespace(
+			f.ClientSet, pod.Name, f.Namespace.Name, "", framework.PodStartTimeout))
+	} else {
+		// Pod should remain in the pending state. Wait for the Reason to be set to "AppArmor".
+		w, err := f.PodClient().Watch(v1.SingleObject(v1.ObjectMeta{Name: pod.Name}))
+		framework.ExpectNoError(err)
+		_, err = watch.Until(framework.PodStartTimeout, w, func(e watch.Event) (bool, error) {
+			switch e.Type {
+			case watch.Deleted:
+				return false, errors.NewNotFound(schema.GroupResource{Resource: "pods"}, pod.Name)
+			}
+			switch t := e.Object.(type) {
+			case *v1.Pod:
+				if t.Status.Reason == "AppArmor" {
+					return true, nil
+				}
+			}
+			return false, nil
+		})
+		framework.ExpectNoError(err)
+	}
+	p, err := f.PodClient().Get(pod.Name, metav1.GetOptions{})
+	framework.ExpectNoError(err)
+	return p.Status
+}
+
+func createPodWithAppArmor(f *framework.Framework, profile string) *v1.Pod {
+	pod := &v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Name: fmt.Sprintf("test-apparmor-%s", strings.Replace(profile, "/", "-", -1)),
+			Annotations: map[string]string{
+				apparmor.ContainerAnnotationKeyPrefix + "test": profile,
+			},
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{{
+				Name:    "test",
+				Image:   "gcr.io/google_containers/busybox:1.24",
+				Command: []string{"touch", "foo"},
+			}},
+			RestartPolicy: v1.RestartPolicyNever,
+		},
+	}
+	return f.PodClient().Create(pod)
+}
+
+func expectSoftRejection(status v1.PodStatus) {
+	args := []interface{}{"PodStatus: %+v", status}
+	Expect(status.Phase).To(Equal(v1.PodPending), args...)
+	Expect(status.Reason).To(Equal("AppArmor"), args...)
+	Expect(status.Message).To(ContainSubstring("AppArmor"), args...)
+	Expect(status.ContainerStatuses[0].State.Waiting.Reason).To(Equal("Blocked"), args...)
+}
+
+func isAppArmorEnabled() bool {
+	// TODO(timstclair): Pass this through the image setup rather than hardcoding.
+	if strings.Contains(framework.TestContext.NodeName, "-gci-dev-") {
+		gciVersionRe := regexp.MustCompile("-gci-dev-([0-9]+)-")
+		matches := gciVersionRe.FindStringSubmatch(framework.TestContext.NodeName)
+		if len(matches) == 2 {
+			version, err := strconv.Atoi(matches[1])
+			if err != nil {
+				glog.Errorf("Error parsing GCI version from NodeName %q: %v", framework.TestContext.NodeName, err)
+				return false
+			}
+			return version >= 54
+		}
+		return false
+	}
+	if strings.Contains(framework.TestContext.NodeName, "-ubuntu-") {
+		return true
+	}
+	return apparmor.IsAppArmorEnabled()
+}

vendor/k8s.io/kubernetes/test/e2e_node/benchmark_util.go

@@ -0,0 +1,158 @@
+// +build linux
+
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+	"sort"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/test/e2e/framework"
+	"k8s.io/kubernetes/test/e2e/perftype"
+
+	. "github.com/onsi/gomega"
+)
+
+const (
+	// TODO(coufon): be consistent with perf_util.go version
+	currentDataVersion = "v1"
+	TimeSeriesTag      = "[Result:TimeSeries]"
+	TimeSeriesEnd      = "[Finish:TimeSeries]"
+)
+
+type NodeTimeSeries struct {
+	// value in OperationData is an array of timestamps
+	OperationData map[string][]int64         `json:"op_series,omitempty"`
+	ResourceData  map[string]*ResourceSeries `json:"resource_series,omitempty"`
+	Labels        map[string]string          `json:"labels"`
+	Version       string                     `json:"version"`
+}
+
+// logDensityTimeSeries logs the time series data of operation and resource usage
+func logDensityTimeSeries(rc *ResourceCollector, create, watch map[string]metav1.Time, testInfo map[string]string) {
+	timeSeries := &NodeTimeSeries{
+		Labels:  testInfo,
+		Version: currentDataVersion,
+	}
+	// Attach operation time series.
+	timeSeries.OperationData = map[string][]int64{
+		"create":  getCumulatedPodTimeSeries(create),
+		"running": getCumulatedPodTimeSeries(watch),
+	}
+	// Attach resource time series.
+	timeSeries.ResourceData = rc.GetResourceTimeSeries()
+	// Log time series with tags
+	framework.Logf("%s %s\n%s", TimeSeriesTag, framework.PrettyPrintJSON(timeSeries), TimeSeriesEnd)
+}
+
+type int64arr []int64
+
+func (a int64arr) Len() int           { return len(a) }
+func (a int64arr) Swap(i, j int)      { a[i], a[j] = a[j], a[i] }
+func (a int64arr) Less(i, j int) bool { return a[i] < a[j] }
+
+// getCumulatedPodTimeSeries gets the cumulative pod number time series.
+func getCumulatedPodTimeSeries(timePerPod map[string]metav1.Time) []int64 {
+	timeSeries := make(int64arr, 0)
+	for _, ts := range timePerPod {
+		timeSeries = append(timeSeries, ts.Time.UnixNano())
+	}
+	// Sort all timestamps.
+	sort.Sort(timeSeries)
+	return timeSeries
+}
+
+// getLatencyPerfData returns perf data of pod startup latency.
+func getLatencyPerfData(latency framework.LatencyMetric, testInfo map[string]string) *perftype.PerfData {
+	return &perftype.PerfData{
+		Version: currentDataVersion,
+		DataItems: []perftype.DataItem{
+			{
+				Data: map[string]float64{
+					"Perc50":  float64(latency.Perc50) / 1000000,
+					"Perc90":  float64(latency.Perc90) / 1000000,
+					"Perc99":  float64(latency.Perc99) / 1000000,
+					"Perc100": float64(latency.Perc100) / 1000000,
+				},
+				Unit: "ms",
+				Labels: map[string]string{
+					"datatype":    "latency",
+					"latencytype": "create-pod",
+				},
+			},
+		},
+		Labels: testInfo,
+	}
+}
+
+// getThroughputPerfData returns perf data of pod creation startup throughput.
+func getThroughputPerfData(batchLag time.Duration, e2eLags []framework.PodLatencyData, podsNr int, testInfo map[string]string) *perftype.PerfData {
+	return &perftype.PerfData{
+		Version: currentDataVersion,
+		DataItems: []perftype.DataItem{
+			{
+				Data: map[string]float64{
+					"batch":        float64(podsNr) / batchLag.Minutes(),
+					"single-worst": 1.0 / e2eLags[len(e2eLags)-1].Latency.Minutes(),
+				},
+				Unit: "pods/min",
+				Labels: map[string]string{
+					"datatype":    "throughput",
+					"latencytype": "create-pod",
+				},
+			},
+		},
+		Labels: testInfo,
+	}
+}
+
+// getTestNodeInfo fetches the capacity of a node from API server and returns a map of labels.
+func getTestNodeInfo(f *framework.Framework, testName string) map[string]string {
+	nodeName := framework.TestContext.NodeName
+	node, err := f.ClientSet.Core().Nodes().Get(nodeName, metav1.GetOptions{})
+	Expect(err).NotTo(HaveOccurred())
+
+	cpu, ok := node.Status.Capacity["cpu"]
+	if !ok {
+		framework.Failf("Fail to fetch CPU capacity value of test node.")
+	}
+
+	memory, ok := node.Status.Capacity["memory"]
+	if !ok {
+		framework.Failf("Fail to fetch Memory capacity value of test node.")
+	}
+
+	cpuValue, ok := cpu.AsInt64()
+	if !ok {
+		framework.Failf("Fail to fetch CPU capacity value as Int64.")
+	}
+
+	memoryValue, ok := memory.AsInt64()
+	if !ok {
+		framework.Failf("Fail to fetch Memory capacity value as Int64.")
+	}
+
+	return map[string]string{
+		"node":    nodeName,
+		"test":    testName,
+		"image":   node.Status.NodeInfo.OSImage,
+		"machine": fmt.Sprintf("cpu:%dcore,memory:%.1fGB", cpuValue, float32(memoryValue)/(1024*1024*1024)),
+	}
+}

vendor/k8s.io/kubernetes/test/e2e_node/builder/BUILD

@@ -0,0 +1,28 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["build.go"],
+    tags = ["automanaged"],
+    deps = ["//vendor:github.com/golang/glog"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/e2e_node/builder/build.go

@@ -0,0 +1,122 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package builder
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"github.com/golang/glog"
+)
+
+var k8sBinDir = flag.String("k8s-bin-dir", "", "Directory containing k8s kubelet binaries.")
+
+var buildTargets = []string{
+	"cmd/kubelet",
+	"test/e2e_node/e2e_node.test",
+	"vendor/github.com/onsi/ginkgo/ginkgo",
+}
+
+func BuildGo() error {
+	glog.Infof("Building k8s binaries...")
+	k8sRoot, err := GetK8sRootDir()
+	if err != nil {
+		return fmt.Errorf("failed to locate kubernetes root directory %v.", err)
+	}
+	targets := strings.Join(buildTargets, " ")
+	cmd := exec.Command("make", "-C", k8sRoot, fmt.Sprintf("WHAT=%s", targets))
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	err = cmd.Run()
+	if err != nil {
+		return fmt.Errorf("failed to build go packages %v\n", err)
+	}
+	return nil
+}
+
+func getK8sBin(bin string) (string, error) {
+	// Use commandline specified path
+	if *k8sBinDir != "" {
+		absPath, err := filepath.Abs(*k8sBinDir)
+		if err != nil {
+			return "", err
+		}
+		if _, err := os.Stat(filepath.Join(*k8sBinDir, bin)); err != nil {
+			return "", fmt.Errorf("Could not find %s under directory %s.", bin, absPath)
+		}
+		return filepath.Join(absPath, bin), nil
+	}
+
+	path, err := filepath.Abs(filepath.Dir(os.Args[0]))
+	if err != nil {
+		return "", fmt.Errorf("Could not find absolute path of directory containing the tests %s.", filepath.Dir(os.Args[0]))
+	}
+	if _, err := os.Stat(filepath.Join(path, bin)); err == nil {
+		return filepath.Join(path, bin), nil
+	}
+
+	buildOutputDir, err := GetK8sBuildOutputDir()
+	if err != nil {
+		return "", err
+	}
+	if _, err := os.Stat(filepath.Join(buildOutputDir, bin)); err == nil {
+		return filepath.Join(buildOutputDir, bin), nil
+	}
+
+	// Give up with error
+	return "", fmt.Errorf("Unable to locate %s.  Can be defined using --k8s-path.", bin)
+}
+
+// TODO: Dedup / merge this with comparable utilities in e2e/util.go
+func GetK8sRootDir() (string, error) {
+	// Get the directory of the current executable
+	_, testExec, _, _ := runtime.Caller(0)
+	path := filepath.Dir(testExec)
+
+	// Look for the kubernetes source root directory
+	if strings.Contains(path, "k8s.io/kubernetes") {
+		splitPath := strings.Split(path, "k8s.io/kubernetes")
+		return filepath.Join(splitPath[0], "k8s.io/kubernetes/"), nil
+	}
+
+	return "", fmt.Errorf("Could not find kubernetes source root directory.")
+}
+
+func GetK8sBuildOutputDir() (string, error) {
+	k8sRoot, err := GetK8sRootDir()
+	if err != nil {
+		return "", err
+	}
+	buildOutputDir := filepath.Join(k8sRoot, "_output/local/go/bin")
+	if _, err := os.Stat(buildOutputDir); err != nil {
+		return "", err
+	}
+	return buildOutputDir, nil
+}
+
+func GetKubeletServerBin() string {
+	bin, err := getK8sBin("kubelet")
+	if err != nil {
+		glog.Fatalf("Could not locate kubelet binary %v.", err)
+	}
+	return bin
+}

vendor/k8s.io/kubernetes/test/e2e_node/cgroup_manager_test.go

@@ -0,0 +1,291 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/kubelet/cm"
+	"k8s.io/kubernetes/pkg/util/uuid"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+// getResourceList returns a ResourceList with the
+// specified cpu and memory resource values
+func getResourceList(cpu, memory string) v1.ResourceList {
+	res := v1.ResourceList{}
+	if cpu != "" {
+		res[v1.ResourceCPU] = resource.MustParse(cpu)
+	}
+	if memory != "" {
+		res[v1.ResourceMemory] = resource.MustParse(memory)
+	}
+	return res
+}
+
+// getResourceRequirements returns a ResourceRequirements object
+func getResourceRequirements(requests, limits v1.ResourceList) v1.ResourceRequirements {
+	res := v1.ResourceRequirements{}
+	res.Requests = requests
+	res.Limits = limits
+	return res
+}
+
+// makePodToVerifyCgroups returns a pod that verifies the existence of the specified cgroups.
+func makePodToVerifyCgroups(cgroupNames []cm.CgroupName) *v1.Pod {
+	// convert the names to their literal cgroupfs forms...
+	cgroupFsNames := []string{}
+	for _, cgroupName := range cgroupNames {
+		if framework.TestContext.KubeletConfig.CgroupDriver == "systemd" {
+			cgroupFsNames = append(cgroupFsNames, cm.ConvertCgroupNameToSystemd(cgroupName, true))
+		} else {
+			cgroupFsNames = append(cgroupFsNames, string(cgroupName))
+		}
+	}
+
+	// build the pod command to either verify cgroups exist
+	command := ""
+	for _, cgroupFsName := range cgroupFsNames {
+		localCommand := "if [ ! -d /tmp/memory/" + cgroupFsName + " ] || [ ! -d /tmp/cpu/" + cgroupFsName + " ]; then exit 1; fi; "
+		command += localCommand
+	}
+
+	pod := &v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Name: "pod" + string(uuid.NewUUID()),
+		},
+		Spec: v1.PodSpec{
+			RestartPolicy: v1.RestartPolicyNever,
+			Containers: []v1.Container{
+				{
+					Image:   "gcr.io/google_containers/busybox:1.24",
+					Name:    "container" + string(uuid.NewUUID()),
+					Command: []string{"sh", "-c", command},
+					VolumeMounts: []v1.VolumeMount{
+						{
+							Name:      "sysfscgroup",
+							MountPath: "/tmp",
+						},
+					},
+				},
+			},
+			Volumes: []v1.Volume{
+				{
+					Name: "sysfscgroup",
+					VolumeSource: v1.VolumeSource{
+						HostPath: &v1.HostPathVolumeSource{Path: "/sys/fs/cgroup"},
+					},
+				},
+			},
+		},
+	}
+	return pod
+}
+
+// makePodToVerifyCgroupRemoved verfies the specified cgroup does not exist.
+func makePodToVerifyCgroupRemoved(cgroupName cm.CgroupName) *v1.Pod {
+	cgroupFsName := string(cgroupName)
+	if framework.TestContext.KubeletConfig.CgroupDriver == "systemd" {
+		cgroupFsName = cm.ConvertCgroupNameToSystemd(cm.CgroupName(cgroupName), true)
+	}
+	pod := &v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Name: "pod" + string(uuid.NewUUID()),
+		},
+		Spec: v1.PodSpec{
+			RestartPolicy: v1.RestartPolicyOnFailure,
+			Containers: []v1.Container{
+				{
+					Image:   "gcr.io/google_containers/busybox:1.24",
+					Name:    "container" + string(uuid.NewUUID()),
+					Command: []string{"sh", "-c", "for i in `seq 1 10`; do if [ ! -d /tmp/memory/" + cgroupFsName + " ] && [ ! -d /tmp/cpu/" + cgroupFsName + " ]; then exit 0; else sleep 10; fi; done; exit 1"},
+					VolumeMounts: []v1.VolumeMount{
+						{
+							Name:      "sysfscgroup",
+							MountPath: "/tmp",
+						},
+					},
+				},
+			},
+			Volumes: []v1.Volume{
+				{
+					Name: "sysfscgroup",
+					VolumeSource: v1.VolumeSource{
+						HostPath: &v1.HostPathVolumeSource{Path: "/sys/fs/cgroup"},
+					},
+				},
+			},
+		},
+	}
+	return pod
+}
+
+var _ = framework.KubeDescribe("Kubelet Cgroup Manager", func() {
+	f := framework.NewDefaultFramework("kubelet-cgroup-manager")
+	Describe("QOS containers", func() {
+		Context("On enabling QOS cgroup hierarchy", func() {
+			It("Top level QoS containers should have been created", func() {
+				if !framework.TestContext.KubeletConfig.ExperimentalCgroupsPerQOS {
+					return
+				}
+				cgroupsToVerify := []cm.CgroupName{cm.CgroupName(v1.PodQOSBurstable), cm.CgroupName(v1.PodQOSBestEffort)}
+				pod := makePodToVerifyCgroups(cgroupsToVerify)
+				f.PodClient().Create(pod)
+				err := framework.WaitForPodSuccessInNamespace(f.ClientSet, pod.Name, f.Namespace.Name)
+				Expect(err).NotTo(HaveOccurred())
+			})
+		})
+	})
+
+	Describe("Pod containers", func() {
+		Context("On scheduling a Guaranteed Pod", func() {
+			It("Pod containers should have been created under the cgroup-root", func() {
+				if !framework.TestContext.KubeletConfig.ExperimentalCgroupsPerQOS {
+					return
+				}
+				var (
+					guaranteedPod *v1.Pod
+					podUID        string
+				)
+				By("Creating a Guaranteed pod in Namespace", func() {
+					guaranteedPod = f.PodClient().Create(&v1.Pod{
+						ObjectMeta: v1.ObjectMeta{
+							Name:      "pod" + string(uuid.NewUUID()),
+							Namespace: f.Namespace.Name,
+						},
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Image:     framework.GetPauseImageName(f.ClientSet),
+									Name:      "container" + string(uuid.NewUUID()),
+									Resources: getResourceRequirements(getResourceList("100m", "100Mi"), getResourceList("100m", "100Mi")),
+								},
+							},
+						},
+					})
+					podUID = string(guaranteedPod.UID)
+				})
+				By("Checking if the pod cgroup was created", func() {
+					cgroupsToVerify := []cm.CgroupName{cm.CgroupName("pod" + podUID)}
+					pod := makePodToVerifyCgroups(cgroupsToVerify)
+					f.PodClient().Create(pod)
+					err := framework.WaitForPodSuccessInNamespace(f.ClientSet, pod.Name, f.Namespace.Name)
+					Expect(err).NotTo(HaveOccurred())
+				})
+				By("Checking if the pod cgroup was deleted", func() {
+					gp := int64(1)
+					Expect(f.PodClient().Delete(guaranteedPod.Name, &v1.DeleteOptions{GracePeriodSeconds: &gp})).NotTo(HaveOccurred())
+					pod := makePodToVerifyCgroupRemoved(cm.CgroupName("pod" + podUID))
+					f.PodClient().Create(pod)
+					err := framework.WaitForPodSuccessInNamespace(f.ClientSet, pod.Name, f.Namespace.Name)
+					Expect(err).NotTo(HaveOccurred())
+				})
+			})
+		})
+		Context("On scheduling a BestEffort Pod", func() {
+			It("Pod containers should have been created under the BestEffort cgroup", func() {
+				if !framework.TestContext.KubeletConfig.ExperimentalCgroupsPerQOS {
+					return
+				}
+				var (
+					podUID        string
+					bestEffortPod *v1.Pod
+				)
+				By("Creating a BestEffort pod in Namespace", func() {
+					bestEffortPod = f.PodClient().Create(&v1.Pod{
+						ObjectMeta: v1.ObjectMeta{
+							Name:      "pod" + string(uuid.NewUUID()),
+							Namespace: f.Namespace.Name,
+						},
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Image:     framework.GetPauseImageName(f.ClientSet),
+									Name:      "container" + string(uuid.NewUUID()),
+									Resources: getResourceRequirements(getResourceList("", ""), getResourceList("", "")),
+								},
+							},
+						},
+					})
+					podUID = string(bestEffortPod.UID)
+				})
+				By("Checking if the pod cgroup was created", func() {
+					cgroupsToVerify := []cm.CgroupName{cm.CgroupName("BestEffort/pod" + podUID)}
+					pod := makePodToVerifyCgroups(cgroupsToVerify)
+					f.PodClient().Create(pod)
+					err := framework.WaitForPodSuccessInNamespace(f.ClientSet, pod.Name, f.Namespace.Name)
+					Expect(err).NotTo(HaveOccurred())
+				})
+				By("Checking if the pod cgroup was deleted", func() {
+					gp := int64(1)
+					Expect(f.PodClient().Delete(bestEffortPod.Name, &v1.DeleteOptions{GracePeriodSeconds: &gp})).NotTo(HaveOccurred())
+					pod := makePodToVerifyCgroupRemoved(cm.CgroupName("BestEffort/pod" + podUID))
+					f.PodClient().Create(pod)
+					err := framework.WaitForPodSuccessInNamespace(f.ClientSet, pod.Name, f.Namespace.Name)
+					Expect(err).NotTo(HaveOccurred())
+				})
+			})
+		})
+		Context("On scheduling a Burstable Pod", func() {
+			It("Pod containers should have been created under the Burstable cgroup", func() {
+				if !framework.TestContext.KubeletConfig.ExperimentalCgroupsPerQOS {
+					return
+				}
+				var (
+					podUID       string
+					burstablePod *v1.Pod
+				)
+				By("Creating a Burstable pod in Namespace", func() {
+					burstablePod = f.PodClient().Create(&v1.Pod{
+						ObjectMeta: v1.ObjectMeta{
+							Name:      "pod" + string(uuid.NewUUID()),
+							Namespace: f.Namespace.Name,
+						},
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Image:     framework.GetPauseImageName(f.ClientSet),
+									Name:      "container" + string(uuid.NewUUID()),
+									Resources: getResourceRequirements(getResourceList("100m", "100Mi"), getResourceList("200m", "200Mi")),
+								},
+							},
+						},
+					})
+					podUID = string(burstablePod.UID)
+				})
+				By("Checking if the pod cgroup was created", func() {
+					cgroupsToVerify := []cm.CgroupName{cm.CgroupName("Burstable/pod" + podUID)}
+					pod := makePodToVerifyCgroups(cgroupsToVerify)
+					f.PodClient().Create(pod)
+					err := framework.WaitForPodSuccessInNamespace(f.ClientSet, pod.Name, f.Namespace.Name)
+					Expect(err).NotTo(HaveOccurred())
+				})
+				By("Checking if the pod cgroup was deleted", func() {
+					gp := int64(1)
+					Expect(f.PodClient().Delete(burstablePod.Name, &v1.DeleteOptions{GracePeriodSeconds: &gp})).NotTo(HaveOccurred())
+					pod := makePodToVerifyCgroupRemoved(cm.CgroupName("Burstable/pod" + podUID))
+					f.PodClient().Create(pod)
+					err := framework.WaitForPodSuccessInNamespace(f.ClientSet, pod.Name, f.Namespace.Name)
+					Expect(err).NotTo(HaveOccurred())
+				})
+			})
+		})
+	})
+})

vendor/k8s.io/kubernetes/test/e2e_node/conformance/build/Dockerfile

@@ -0,0 +1,42 @@
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM BASEIMAGE
+
+COPY ginkgo /usr/local/bin/
+COPY e2e_node.test /usr/local/bin
+
+# The following environment variables can be override when starting the container.
+# FOCUS is regex matching test to run. By default run all conformance test.
+# SKIP is regex matching test to skip. By default skip flaky and serial test.
+# PARALLELISM is the number of processes the test will run in parallel.
+# REPORT_PATH is the path in the container to save test result and logs.
+# FLAKE_ATTEMPTS is the time to retry when there is a test failure. By default 2.
+# TEST_ARGS is the test arguments passed into the test.
+ENV FOCUS="\[Conformance\]" \
+	   SKIP="\[Flaky\]|\[Serial\]" \
+	   PARALLELISM=8 \
+	   REPORT_PATH="/var/result" \
+	   FLAKE_ATTEMPTS=2 \
+	   TEST_ARGS=""
+
+ENTRYPOINT ginkgo --focus="$FOCUS" \
+	--skip="$SKIP" \
+	--nodes=$PARALLELISM \
+	--flakeAttempts=$FLAKE_ATTEMPTS \
+	/usr/local/bin/e2e_node.test \
+	-- --conformance=true \
+	--prepull-images=false \
+	--report-dir="$REPORT_PATH" \
+	$TEST_ARGS

vendor/k8s.io/kubernetes/test/e2e_node/conformance/build/Makefile

@@ -0,0 +1,64 @@
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Build the node-test image.
+#
+# Usage:
+#   [ARCH=amd64] [REGISTRY="gcr.io/google_containers"] [BIN_DIR="../../../../_output/bin"] make (build|push) VERSION={some_version_number e.g. 0.1}
+
+# TODO(random-liu): Add this into release progress.
+REGISTRY?=gcr.io/google_containers
+ARCH?=amd64
+# BIN_DIR is the directory to find binaries, overwrite with ../../../../_output/bin
+# for local development.
+BIN_DIR?=../../../../_output/dockerized/bin/linux/${ARCH}
+TEMP_DIR:=$(shell mktemp -d)
+
+BASEIMAGE_amd64=debian:jessie
+BASEIMAGE_arm=armel/debian:jessie
+BASEIMAGE_arm64=aarch64/debian:jessie
+BASEIMAGE_ppc64le=ppc64le/debian:jessie
+
+BASEIMAGE?=${BASEIMAGE_${ARCH}}
+
+all: build
+
+build:
+
+ifndef VERSION
+    $(error VERSION is undefined)
+endif
+	cp -r ./* ${TEMP_DIR}
+
+	cp ${BIN_DIR}/ginkgo ${TEMP_DIR}
+	cp ${BIN_DIR}/e2e_node.test ${TEMP_DIR}
+
+	cd ${TEMP_DIR} && sed -i.back "s|BASEIMAGE|${BASEIMAGE}|g" Dockerfile
+
+	# Make scripts executable before they are copied into the Docker image. If we make them executable later, in another layer
+	# they'll take up twice the space because the new executable binary differs from the old one, but everything is cached in layers.
+	cd ${TEMP_DIR} && chmod a+rx \
+		e2e_node.test \
+		ginkgo
+
+	docker build --pull -t ${REGISTRY}/node-test-${ARCH}:${VERSION} ${TEMP_DIR}
+
+push: build
+	gcloud docker push ${REGISTRY}/node-test-${ARCH}:${VERSION}
+ifeq ($(ARCH),amd64)
+	docker tag ${REGISTRY}/node-test-${ARCH}:${VERSION} ${REGISTRY}/node-test:${VERSION}
+	gcloud docker -- push ${REGISTRY}/node-test:${VERSION}
+endif
+
+.PHONY: all

vendor/k8s.io/kubernetes/test/e2e_node/conformance/run_test.sh

@@ -0,0 +1,178 @@
+#!/bin/bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script is only for demonstrating how to use the node test container. In
+# production environment, kubelet bootstrap will be more complicated, user
+# should configure the node test container accordingly.
+# In addition, this script will also be used in the node e2e test to let it use
+# the containerized test suite.
+
+# TODO(random-liu): Use standard installer to install kubelet.
+# TODO(random-liu): Use standard tool to start kubelet in production way (such
+# as systemd, supervisord etc.)
+
+# Refresh sudo credentials if not running on GCE.
+if ! ping -c 1 -q metadata.google.internal &> /dev/null; then
+  sudo -v || exit 1
+fi
+
+# FOCUS is ginkgo focus to select which tests to run. By default, FOCUS is
+# initialized as "\[Conformance\]" in the test container to run all conformance
+# test.
+FOCUS=${FOCUS:-""}
+
+# SKIP is ginkgo skip to select which tests to skip. By default, SKIP is
+# initialized as "\[Flaky\]|\[Serial\]" in the test container skipping all
+# flaky and serial test.
+SKIP=${SKIP:-""}
+
+# TEST_ARGS is the test arguments. It could be used to override default test
+# arguments in the container.
+TEST_ARGS=${TEST_ARGS:-""}
+
+# REGISTRY is the image registry for node test image.
+REGISTRY=${REGISTRY:-"gcr.io/google_containers"}
+
+# ARCH is the architecture of current machine, the script will use this to
+# select corresponding test container image.
+ARCH=${ARCH:-"amd64"}
+
+# VERSION is the version of the test container image.
+VERSION=${VERSION:-"0.2"}
+
+# KUBELET_BIN is the kubelet binary name. If it is not specified, use the
+# default binary name "kubelet".
+KUBELET_BIN=${KUBELET_BIN:-"kubelet"}
+
+# KUBELET is the kubelet binary path. If it is not specified, assume kubelet is
+# in PATH.
+KUBELET=${KUBELET:-"`which $KUBELET_BIN`"}
+
+# LOG_DIR is the absolute path of the directory where the test will collect all
+# logs to. By default, use the current directory.
+LOG_DIR=${LOG_DIR:-`pwd`}
+mkdir -p $LOG_DIR
+
+# NETWORK_PLUGIN is the network plugin used by kubelet. Do not use network
+# plugin by default.
+NETWORK_PLUGIN=${NETWORK_PLUGIN:-""}
+
+# NETWORK_PLUGIN_PATH is the path to network plugin binary.
+NETWORK_PLUGIN_PATH=${NETWORK_PLUGIN_PATH:-""}
+
+# start_kubelet starts kubelet and redirect kubelet log to $LOG_DIR/kubelet.log.
+kubelet_log=kubelet.log
+start_kubelet() {
+  echo "Starting kubelet..."
+  sudo -b $KUBELET $@ &>$LOG_DIR/$kubelet_log
+  if [ $? -ne 0 ]; then
+    echo "Failed to start kubelet"
+    exit 1
+  fi
+}
+
+# wait_kubelet retris for 10 times for kubelet to be ready by checking http://127.0.0.1:10255/healthz.
+wait_kubelet() {
+  echo "Health checking kubelet..."
+  healthCheckURL=http://127.0.0.1:10255/healthz
+  local maxRetry=10
+  local cur=1
+  while [ $cur -le $maxRetry ]; do
+    curl -s $healthCheckURL > /dev/null
+    if [ $? -eq 0 ]; then
+      echo "Kubelet is ready"
+      break
+    fi
+    if [ $cur -eq $maxRetry ]; then
+      echo "Health check exceeds max retry"
+      exit 1
+    fi
+    echo "Kubelet is not ready"
+    sleep 1
+    ((cur++))
+  done
+}
+
+# kill_kubelet kills kubelet.
+kill_kubelet() {
+  echo "Stopping kubelet..."
+  sudo pkill $KUBELET_BIN
+  if [ $? -ne 0 ]; then
+    echo "Failed to stop kubelet."
+    exit 1
+  fi
+}
+
+# run_test runs the node test container.
+run_test() {
+  env=""
+  if [ ! -z "$FOCUS" ]; then
+    env="$env -e FOCUS=\"$FOCUS\""
+  fi
+  if [ ! -z "$SKIP" ]; then
+    env="$env -e SKIP=\"$SKIP\""
+  fi
+  if [ ! -z "$TEST_ARGS" ]; then
+    env="$env -e TEST_ARGS=\"$TEST_ARGS\""
+  fi
+  # The test assumes that inside the container:
+  # * kubelet manifest path is mounted to the same path;
+  # * log collect directory is mounted to /var/result;
+  # * root file system is mounted to /rootfs.
+  sudo sh -c "docker run -it --rm --privileged=true --net=host -v /:/rootfs \
+    -v $config_dir:$config_dir -v $LOG_DIR:/var/result ${env} $REGISTRY/node-test-$ARCH:$VERSION"
+}
+
+# Check whether kubelet is running. If kubelet is running, tell the user to stop
+# it before running the test.
+pid=`pidof $KUBELET_BIN`
+if [ ! -z $pid ]; then
+  echo "Kubelet is running (pid=$pid), please stop it before running the test."
+  exit 1
+fi
+
+apiserver=http://localhost:8080
+volume_stats_agg_period=10s
+allow_privileged=true
+serialize_image_pulls=false
+config_dir=`mktemp -d`
+file_check_frequency=10s
+pod_cidr=10.180.0.0/24
+log_level=4
+start_kubelet --api-servers $apiserver \
+  --volume-stats-agg-period $volume_stats_agg_period \
+  --allow-privileged=$allow_privileged \
+  --serialize-image-pulls=$serialize_image_pulls \
+  --config $config_dir \
+  --file-check-frequency $file_check_frequency \
+  --pod-cidr=$pod_cidr \
+  --runtime-cgroups=/docker-daemon \
+  --kubelet-cgroups=/kubelet \
+  --system-cgroups=/system \
+  --cgroup-root=/ \
+  --network-plugin=$NETWORK_PLUGIN \
+  --network-plugin-dir=$NETWORK_PLUGIN_PATH \
+  --v=$log_level \
+  --logtostderr
+
+wait_kubelet
+
+run_test
+
+kill_kubelet
+
+# Clean up the kubelet config directory
+sudo rm -rf $config_dir

vendor/k8s.io/kubernetes/test/e2e_node/container.go

@@ -0,0 +1,128 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/util/uuid"
+	"k8s.io/kubernetes/test/e2e/framework"
+)
+
+// One pod one container
+// TODO: This should be migrated to the e2e framework.
+type ConformanceContainer struct {
+	Container        v1.Container
+	RestartPolicy    v1.RestartPolicy
+	Volumes          []v1.Volume
+	ImagePullSecrets []string
+
+	PodClient          *framework.PodClient
+	podName            string
+	PodSecurityContext *v1.PodSecurityContext
+}
+
+func (cc *ConformanceContainer) Create() {
+	cc.podName = cc.Container.Name + string(uuid.NewUUID())
+	imagePullSecrets := []v1.LocalObjectReference{}
+	for _, s := range cc.ImagePullSecrets {
+		imagePullSecrets = append(imagePullSecrets, v1.LocalObjectReference{Name: s})
+	}
+	pod := &v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Name: cc.podName,
+		},
+		Spec: v1.PodSpec{
+			RestartPolicy: cc.RestartPolicy,
+			Containers: []v1.Container{
+				cc.Container,
+			},
+			SecurityContext:  cc.PodSecurityContext,
+			Volumes:          cc.Volumes,
+			ImagePullSecrets: imagePullSecrets,
+		},
+	}
+	cc.PodClient.Create(pod)
+}
+
+func (cc *ConformanceContainer) Delete() error {
+	return cc.PodClient.Delete(cc.podName, v1.NewDeleteOptions(0))
+}
+
+func (cc *ConformanceContainer) IsReady() (bool, error) {
+	pod, err := cc.PodClient.Get(cc.podName, metav1.GetOptions{})
+	if err != nil {
+		return false, err
+	}
+	return v1.IsPodReady(pod), nil
+}
+
+func (cc *ConformanceContainer) GetPhase() (v1.PodPhase, error) {
+	pod, err := cc.PodClient.Get(cc.podName, metav1.GetOptions{})
+	if err != nil {
+		return v1.PodUnknown, err
+	}
+	return pod.Status.Phase, nil
+}
+
+func (cc *ConformanceContainer) GetStatus() (v1.ContainerStatus, error) {
+	pod, err := cc.PodClient.Get(cc.podName, metav1.GetOptions{})
+	if err != nil {
+		return v1.ContainerStatus{}, err
+	}
+	statuses := pod.Status.ContainerStatuses
+	if len(statuses) != 1 || statuses[0].Name != cc.Container.Name {
+		return v1.ContainerStatus{}, fmt.Errorf("unexpected container statuses %v", statuses)
+	}
+	return statuses[0], nil
+}
+
+func (cc *ConformanceContainer) Present() (bool, error) {
+	_, err := cc.PodClient.Get(cc.podName, metav1.GetOptions{})
+	if err == nil {
+		return true, nil
+	}
+	if errors.IsNotFound(err) {
+		return false, nil
+	}
+	return false, err
+}
+
+type ContainerState string
+
+const (
+	ContainerStateWaiting    ContainerState = "Waiting"
+	ContainerStateRunning    ContainerState = "Running"
+	ContainerStateTerminated ContainerState = "Terminated"
+	ContainerStateUnknown    ContainerState = "Unknown"
+)
+
+func GetContainerState(state v1.ContainerState) ContainerState {
+	if state.Waiting != nil {
+		return ContainerStateWaiting
+	}
+	if state.Running != nil {
+		return ContainerStateRunning
+	}
+	if state.Terminated != nil {
+		return ContainerStateTerminated
+	}
+	return ContainerStateUnknown
+}

vendor/k8s.io/kubernetes/test/e2e_node/container_manager_test.go

@@ -0,0 +1,223 @@
+// +build linux
+
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+	"os/exec"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/util/uuid"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+func getOOMScoreForPid(pid int) (int, error) {
+	procfsPath := path.Join("/proc", strconv.Itoa(pid), "oom_score_adj")
+	out, err := exec.Command("sudo", "cat", procfsPath).CombinedOutput()
+	if err != nil {
+		return 0, err
+	}
+	return strconv.Atoi(strings.TrimSpace(string(out)))
+}
+
+func validateOOMScoreAdjSetting(pid int, expectedOOMScoreAdj int) error {
+	oomScore, err := getOOMScoreForPid(pid)
+	if err != nil {
+		return fmt.Errorf("failed to get oom_score_adj for %d: %v", pid, err)
+	}
+	if expectedOOMScoreAdj != oomScore {
+		return fmt.Errorf("expected pid %d's oom_score_adj to be %d; found %d", pid, expectedOOMScoreAdj, oomScore)
+	}
+	return nil
+}
+
+func validateOOMScoreAdjSettingIsInRange(pid int, expectedMinOOMScoreAdj, expectedMaxOOMScoreAdj int) error {
+	oomScore, err := getOOMScoreForPid(pid)
+	if err != nil {
+		return fmt.Errorf("failed to get oom_score_adj for %d", pid)
+	}
+	if oomScore < expectedMinOOMScoreAdj {
+		return fmt.Errorf("expected pid %d's oom_score_adj to be >= %d; found %d", pid, expectedMinOOMScoreAdj, oomScore)
+	}
+	if oomScore < expectedMaxOOMScoreAdj {
+		return fmt.Errorf("expected pid %d's oom_score_adj to be < %d; found %d", pid, expectedMaxOOMScoreAdj, oomScore)
+	}
+	return nil
+}
+
+var _ = framework.KubeDescribe("Kubelet Container Manager [Serial]", func() {
+	f := framework.NewDefaultFramework("kubelet-container-manager")
+
+	Describe("Validate OOM score adjustments", func() {
+		Context("once the node is setup", func() {
+			It("docker daemon's oom-score-adj should be -999", func() {
+				dockerPids, err := getPidsForProcess(dockerProcessName, dockerPidFile)
+				Expect(err).To(BeNil(), "failed to get list of docker daemon pids")
+				for _, pid := range dockerPids {
+					Eventually(func() error {
+						return validateOOMScoreAdjSetting(pid, -999)
+					}, 5*time.Minute, 30*time.Second).Should(BeNil())
+				}
+			})
+			It("Kubelet's oom-score-adj should be -999", func() {
+				kubeletPids, err := getPidsForProcess(kubeletProcessName, "")
+				Expect(err).To(BeNil(), "failed to get list of kubelet pids")
+				Expect(len(kubeletPids)).To(Equal(1), "expected only one kubelet process; found %d", len(kubeletPids))
+				Eventually(func() error {
+					return validateOOMScoreAdjSetting(kubeletPids[0], -999)
+				}, 5*time.Minute, 30*time.Second).Should(BeNil())
+			})
+			It("pod infra containers oom-score-adj should be -998 and best effort container's should be 1000", func() {
+				var err error
+				podClient := f.PodClient()
+				podName := "besteffort" + string(uuid.NewUUID())
+				podClient.Create(&v1.Pod{
+					ObjectMeta: v1.ObjectMeta{
+						Name: podName,
+					},
+					Spec: v1.PodSpec{
+						Containers: []v1.Container{
+							{
+								Image: "gcr.io/google_containers/serve_hostname:v1.4",
+								Name:  podName,
+							},
+						},
+					},
+				})
+				var pausePids []int
+				By("checking infra container's oom-score-adj")
+				Eventually(func() error {
+					pausePids, err = getPidsForProcess("pause", "")
+					if err != nil {
+						return fmt.Errorf("failed to get list of pause pids: %v", err)
+					}
+					for _, pid := range pausePids {
+						if err := validateOOMScoreAdjSetting(pid, -998); err != nil {
+							return err
+						}
+					}
+					return nil
+				}, 2*time.Minute, time.Second*4).Should(BeNil())
+				var shPids []int
+				By("checking besteffort container's oom-score-adj")
+				Eventually(func() error {
+					shPids, err = getPidsForProcess("serve_hostname", "")
+					if err != nil {
+						return fmt.Errorf("failed to get list of serve hostname process pids: %v", err)
+					}
+					if len(shPids) != 1 {
+						return fmt.Errorf("expected only one serve_hostname process; found %d", len(shPids))
+					}
+					return validateOOMScoreAdjSetting(shPids[0], 1000)
+				}, 2*time.Minute, time.Second*4).Should(BeNil())
+
+			})
+			It("guaranteed container's oom-score-adj should be -998", func() {
+				podClient := f.PodClient()
+				podName := "guaranteed" + string(uuid.NewUUID())
+				podClient.Create(&v1.Pod{
+					ObjectMeta: v1.ObjectMeta{
+						Name: podName,
+					},
+					Spec: v1.PodSpec{
+						Containers: []v1.Container{
+							{
+								Image: "gcr.io/google_containers/nginx-slim:0.7",
+								Name:  podName,
+								Resources: v1.ResourceRequirements{
+									Limits: v1.ResourceList{
+										"cpu":    resource.MustParse("100m"),
+										"memory": resource.MustParse("50Mi"),
+									},
+								},
+							},
+						},
+					},
+				})
+				var (
+					ngPids []int
+					err    error
+				)
+				Eventually(func() error {
+					ngPids, err = getPidsForProcess("nginx", "")
+					if err != nil {
+						return fmt.Errorf("failed to get list of nginx process pids: %v", err)
+					}
+					for _, pid := range ngPids {
+						if err := validateOOMScoreAdjSetting(pid, -998); err != nil {
+							return err
+						}
+					}
+
+					return nil
+				}, 2*time.Minute, time.Second*4).Should(BeNil())
+
+			})
+			It("burstable container's oom-score-adj should be between [2, 1000)", func() {
+				podClient := f.PodClient()
+				podName := "burstable" + string(uuid.NewUUID())
+				podClient.Create(&v1.Pod{
+					ObjectMeta: v1.ObjectMeta{
+						Name: podName,
+					},
+					Spec: v1.PodSpec{
+						Containers: []v1.Container{
+							{
+								Image: "gcr.io/google_containers/test-webserver:e2e",
+								Name:  podName,
+								Resources: v1.ResourceRequirements{
+									Requests: v1.ResourceList{
+										"cpu":    resource.MustParse("100m"),
+										"memory": resource.MustParse("50Mi"),
+									},
+								},
+							},
+						},
+					},
+				})
+				var (
+					wsPids []int
+					err    error
+				)
+				Eventually(func() error {
+					wsPids, err = getPidsForProcess("test-webserver", "")
+					if err != nil {
+						return fmt.Errorf("failed to get list of test-webserver process pids: %v", err)
+					}
+					for _, pid := range wsPids {
+						if err := validateOOMScoreAdjSettingIsInRange(pid, 2, 1000); err != nil {
+							return err
+						}
+					}
+					return nil
+				}, 2*time.Minute, time.Second*4).Should(BeNil())
+
+				// TODO: Test the oom-score-adj logic for burstable more accurately.
+			})
+		})
+	})
+})

vendor/k8s.io/kubernetes/test/e2e_node/density_test.go

@@ -0,0 +1,598 @@
+// +build linux
+
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+	"sort"
+	"strconv"
+	"sync"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/cache"
+	"k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/stats"
+	kubemetrics "k8s.io/kubernetes/pkg/kubelet/metrics"
+	"k8s.io/kubernetes/pkg/metrics"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+const (
+	kubeletAddr = "localhost:10255"
+)
+
+var _ = framework.KubeDescribe("Density [Serial] [Slow]", func() {
+	const (
+		// The data collection time of resource collector and the standalone cadvisor
+		// is not synchronizated, so resource collector may miss data or
+		// collect duplicated data
+		containerStatsPollingPeriod = 500 * time.Millisecond
+	)
+
+	var (
+		rc *ResourceCollector
+	)
+
+	f := framework.NewDefaultFramework("density-test")
+
+	BeforeEach(func() {
+		// Start a standalone cadvisor pod using 'createSync', the pod is running when it returns
+		f.PodClient().CreateSync(getCadvisorPod())
+		// Resource collector monitors fine-grain CPU/memory usage by a standalone Cadvisor with
+		// 1s housingkeeping interval
+		rc = NewResourceCollector(containerStatsPollingPeriod)
+	})
+
+	Context("create a batch of pods", func() {
+		// TODO(coufon): the values are generous, set more precise limits with benchmark data
+		// and add more tests
+		dTests := []densityTest{
+			{
+				podsNr:   10,
+				interval: 0 * time.Millisecond,
+				cpuLimits: framework.ContainersCPUSummary{
+					stats.SystemContainerKubelet: {0.50: 0.30, 0.95: 0.50},
+					stats.SystemContainerRuntime: {0.50: 0.40, 0.95: 0.60},
+				},
+				memLimits: framework.ResourceUsagePerContainer{
+					stats.SystemContainerKubelet: &framework.ContainerResourceUsage{MemoryRSSInBytes: 100 * 1024 * 1024},
+					stats.SystemContainerRuntime: &framework.ContainerResourceUsage{MemoryRSSInBytes: 500 * 1024 * 1024},
+				},
+				// percentile limit of single pod startup latency
+				podStartupLimits: framework.LatencyMetric{
+					Perc50: 16 * time.Second,
+					Perc90: 18 * time.Second,
+					Perc99: 20 * time.Second,
+				},
+				// upbound of startup latency of a batch of pods
+				podBatchStartupLimit: 25 * time.Second,
+			},
+		}
+
+		for _, testArg := range dTests {
+			itArg := testArg
+			It(fmt.Sprintf("latency/resource should be within limit when create %d pods with %v interval",
+				itArg.podsNr, itArg.interval), func() {
+				itArg.createMethod = "batch"
+				testInfo := getTestNodeInfo(f, itArg.getTestName())
+
+				batchLag, e2eLags := runDensityBatchTest(f, rc, itArg, testInfo, false)
+
+				By("Verifying latency")
+				logAndVerifyLatency(batchLag, e2eLags, itArg.podStartupLimits, itArg.podBatchStartupLimit, testInfo, true)
+
+				By("Verifying resource")
+				logAndVerifyResource(f, rc, itArg.cpuLimits, itArg.memLimits, testInfo, true)
+			})
+		}
+	})
+
+	Context("create a batch of pods", func() {
+		dTests := []densityTest{
+			{
+				podsNr:   10,
+				interval: 0 * time.Millisecond,
+			},
+			{
+				podsNr:   35,
+				interval: 0 * time.Millisecond,
+			},
+			{
+				podsNr:   105,
+				interval: 0 * time.Millisecond,
+			},
+			{
+				podsNr:   10,
+				interval: 100 * time.Millisecond,
+			},
+			{
+				podsNr:   35,
+				interval: 100 * time.Millisecond,
+			},
+			{
+				podsNr:   105,
+				interval: 100 * time.Millisecond,
+			},
+			{
+				podsNr:   10,
+				interval: 300 * time.Millisecond,
+			},
+			{
+				podsNr:   35,
+				interval: 300 * time.Millisecond,
+			},
+			{
+				podsNr:   105,
+				interval: 300 * time.Millisecond,
+			},
+		}
+
+		for _, testArg := range dTests {
+			itArg := testArg
+			It(fmt.Sprintf("latency/resource should be within limit when create %d pods with %v interval [Benchmark]",
+				itArg.podsNr, itArg.interval), func() {
+				itArg.createMethod = "batch"
+				testInfo := getTestNodeInfo(f, itArg.getTestName())
+
+				batchLag, e2eLags := runDensityBatchTest(f, rc, itArg, testInfo, true)
+
+				By("Verifying latency")
+				logAndVerifyLatency(batchLag, e2eLags, itArg.podStartupLimits, itArg.podBatchStartupLimit, testInfo, false)
+
+				By("Verifying resource")
+				logAndVerifyResource(f, rc, itArg.cpuLimits, itArg.memLimits, testInfo, false)
+			})
+		}
+	})
+
+	Context("create a batch of pods with higher API QPS", func() {
+		dTests := []densityTest{
+			{
+				podsNr:      105,
+				interval:    0 * time.Millisecond,
+				APIQPSLimit: 60,
+			},
+			{
+				podsNr:      105,
+				interval:    100 * time.Millisecond,
+				APIQPSLimit: 60,
+			},
+			{
+				podsNr:      105,
+				interval:    300 * time.Millisecond,
+				APIQPSLimit: 60,
+			},
+		}
+
+		for _, testArg := range dTests {
+			itArg := testArg
+			It(fmt.Sprintf("latency/resource should be within limit when create %d pods with %v interval (QPS %d) [Benchmark]",
+				itArg.podsNr, itArg.interval, itArg.APIQPSLimit), func() {
+				itArg.createMethod = "batch"
+				testInfo := getTestNodeInfo(f, itArg.getTestName())
+				// The latency caused by API QPS limit takes a large portion (up to ~33%) of e2e latency.
+				// It makes the pod startup latency of Kubelet (creation throughput as well) under-estimated.
+				// Here we set API QPS limit from default 5 to 60 in order to test real Kubelet performance.
+				// Note that it will cause higher resource usage.
+				setKubeletAPIQPSLimit(f, int32(itArg.APIQPSLimit))
+				batchLag, e2eLags := runDensityBatchTest(f, rc, itArg, testInfo, true)
+
+				By("Verifying latency")
+				logAndVerifyLatency(batchLag, e2eLags, itArg.podStartupLimits, itArg.podBatchStartupLimit, testInfo, false)
+
+				By("Verifying resource")
+				logAndVerifyResource(f, rc, itArg.cpuLimits, itArg.memLimits, testInfo, false)
+			})
+		}
+	})
+
+	Context("create a sequence of pods", func() {
+		dTests := []densityTest{
+			{
+				podsNr:   10,
+				bgPodsNr: 50,
+				cpuLimits: framework.ContainersCPUSummary{
+					stats.SystemContainerKubelet: {0.50: 0.30, 0.95: 0.50},
+					stats.SystemContainerRuntime: {0.50: 0.40, 0.95: 0.60},
+				},
+				memLimits: framework.ResourceUsagePerContainer{
+					stats.SystemContainerKubelet: &framework.ContainerResourceUsage{MemoryRSSInBytes: 100 * 1024 * 1024},
+					stats.SystemContainerRuntime: &framework.ContainerResourceUsage{MemoryRSSInBytes: 500 * 1024 * 1024},
+				},
+				podStartupLimits: framework.LatencyMetric{
+					Perc50: 5000 * time.Millisecond,
+					Perc90: 9000 * time.Millisecond,
+					Perc99: 10000 * time.Millisecond,
+				},
+			},
+		}
+
+		for _, testArg := range dTests {
+			itArg := testArg
+			It(fmt.Sprintf("latency/resource should be within limit when create %d pods with %d background pods",
+				itArg.podsNr, itArg.bgPodsNr), func() {
+				itArg.createMethod = "sequence"
+				testInfo := getTestNodeInfo(f, itArg.getTestName())
+				batchlag, e2eLags := runDensitySeqTest(f, rc, itArg, testInfo)
+
+				By("Verifying latency")
+				logAndVerifyLatency(batchlag, e2eLags, itArg.podStartupLimits, itArg.podBatchStartupLimit, testInfo, true)
+
+				By("Verifying resource")
+				logAndVerifyResource(f, rc, itArg.cpuLimits, itArg.memLimits, testInfo, true)
+			})
+		}
+	})
+
+	Context("create a sequence of pods", func() {
+		dTests := []densityTest{
+			{
+				podsNr:   10,
+				bgPodsNr: 50,
+			},
+			{
+				podsNr:   30,
+				bgPodsNr: 50,
+			},
+			{
+				podsNr:   50,
+				bgPodsNr: 50,
+			},
+		}
+
+		for _, testArg := range dTests {
+			itArg := testArg
+			It(fmt.Sprintf("latency/resource should be within limit when create %d pods with %d background pods [Benchmark]",
+				itArg.podsNr, itArg.bgPodsNr), func() {
+				itArg.createMethod = "sequence"
+				testInfo := getTestNodeInfo(f, itArg.getTestName())
+				batchlag, e2eLags := runDensitySeqTest(f, rc, itArg, testInfo)
+
+				By("Verifying latency")
+				logAndVerifyLatency(batchlag, e2eLags, itArg.podStartupLimits, itArg.podBatchStartupLimit, testInfo, false)
+
+				By("Verifying resource")
+				logAndVerifyResource(f, rc, itArg.cpuLimits, itArg.memLimits, testInfo, false)
+			})
+		}
+	})
+})
+
+type densityTest struct {
+	// number of pods
+	podsNr int
+	// number of background pods
+	bgPodsNr int
+	// interval between creating pod (rate control)
+	interval time.Duration
+	// create pods in 'batch' or 'sequence'
+	createMethod string
+	// API QPS limit
+	APIQPSLimit int
+	// performance limits
+	cpuLimits            framework.ContainersCPUSummary
+	memLimits            framework.ResourceUsagePerContainer
+	podStartupLimits     framework.LatencyMetric
+	podBatchStartupLimit time.Duration
+}
+
+func (dt *densityTest) getTestName() string {
+	// The current default API QPS limit is 5
+	// TODO(coufon): is there any way to not hard code this?
+	APIQPSLimit := 5
+	if dt.APIQPSLimit > 0 {
+		APIQPSLimit = dt.APIQPSLimit
+	}
+	return fmt.Sprintf("density_create_%s_%d_%d_%d_%d", dt.createMethod, dt.podsNr, dt.bgPodsNr,
+		dt.interval.Nanoseconds()/1000000, APIQPSLimit)
+}
+
+// runDensityBatchTest runs the density batch pod creation test
+func runDensityBatchTest(f *framework.Framework, rc *ResourceCollector, testArg densityTest, testInfo map[string]string,
+	isLogTimeSeries bool) (time.Duration, []framework.PodLatencyData) {
+	const (
+		podType               = "density_test_pod"
+		sleepBeforeCreatePods = 30 * time.Second
+	)
+	var (
+		mutex      = &sync.Mutex{}
+		watchTimes = make(map[string]metav1.Time, 0)
+		stopCh     = make(chan struct{})
+	)
+
+	// create test pod data structure
+	pods := newTestPods(testArg.podsNr, framework.GetPauseImageNameForHostArch(), podType)
+
+	// the controller watches the change of pod status
+	controller := newInformerWatchPod(f, mutex, watchTimes, podType)
+	go controller.Run(stopCh)
+	defer close(stopCh)
+
+	// TODO(coufon): in the test we found kubelet starts while it is busy on something, as a result 'syncLoop'
+	// does not response to pod creation immediately. Creating the first pod has a delay around 5s.
+	// The node status has already been 'ready' so `wait and check node being ready does not help here.
+	// Now wait here for a grace period to let 'syncLoop' be ready
+	time.Sleep(sleepBeforeCreatePods)
+
+	rc.Start()
+	// Explicitly delete pods to prevent namespace controller cleanning up timeout
+	defer deletePodsSync(f, append(pods, getCadvisorPod()))
+	defer rc.Stop()
+
+	By("Creating a batch of pods")
+	// It returns a map['pod name']'creation time' containing the creation timestamps
+	createTimes := createBatchPodWithRateControl(f, pods, testArg.interval)
+
+	By("Waiting for all Pods to be observed by the watch...")
+
+	Eventually(func() bool {
+		return len(watchTimes) == testArg.podsNr
+	}, 10*time.Minute, 10*time.Second).Should(BeTrue())
+
+	if len(watchTimes) < testArg.podsNr {
+		framework.Failf("Timeout reached waiting for all Pods to be observed by the watch.")
+	}
+
+	// Analyze results
+	var (
+		firstCreate metav1.Time
+		lastRunning metav1.Time
+		init        = true
+		e2eLags     = make([]framework.PodLatencyData, 0)
+	)
+
+	for name, create := range createTimes {
+		watch, ok := watchTimes[name]
+		Expect(ok).To(Equal(true))
+
+		e2eLags = append(e2eLags,
+			framework.PodLatencyData{Name: name, Latency: watch.Time.Sub(create.Time)})
+
+		if !init {
+			if firstCreate.Time.After(create.Time) {
+				firstCreate = create
+			}
+			if lastRunning.Time.Before(watch.Time) {
+				lastRunning = watch
+			}
+		} else {
+			init = false
+			firstCreate, lastRunning = create, watch
+		}
+	}
+
+	sort.Sort(framework.LatencySlice(e2eLags))
+	batchLag := lastRunning.Time.Sub(firstCreate.Time)
+
+	// Log time series data.
+	if isLogTimeSeries {
+		logDensityTimeSeries(rc, createTimes, watchTimes, testInfo)
+	}
+	// Log throughput data.
+	logPodCreateThroughput(batchLag, e2eLags, testArg.podsNr, testInfo)
+
+	return batchLag, e2eLags
+}
+
+// runDensitySeqTest runs the density sequential pod creation test
+func runDensitySeqTest(f *framework.Framework, rc *ResourceCollector, testArg densityTest, testInfo map[string]string) (time.Duration, []framework.PodLatencyData) {
+	const (
+		podType               = "density_test_pod"
+		sleepBeforeCreatePods = 30 * time.Second
+	)
+	bgPods := newTestPods(testArg.bgPodsNr, framework.GetPauseImageNameForHostArch(), "background_pod")
+	testPods := newTestPods(testArg.podsNr, framework.GetPauseImageNameForHostArch(), podType)
+
+	By("Creating a batch of background pods")
+
+	// CreatBatch is synchronized, all pods are running when it returns
+	f.PodClient().CreateBatch(bgPods)
+
+	time.Sleep(sleepBeforeCreatePods)
+
+	rc.Start()
+	// Explicitly delete pods to prevent namespace controller cleanning up timeout
+	defer deletePodsSync(f, append(bgPods, append(testPods, getCadvisorPod())...))
+	defer rc.Stop()
+
+	// Create pods sequentially (back-to-back). e2eLags have been sorted.
+	batchlag, e2eLags := createBatchPodSequential(f, testPods)
+
+	// Log throughput data.
+	logPodCreateThroughput(batchlag, e2eLags, testArg.podsNr, testInfo)
+
+	return batchlag, e2eLags
+}
+
+// createBatchPodWithRateControl creates a batch of pods concurrently, uses one goroutine for each creation.
+// between creations there is an interval for throughput control
+func createBatchPodWithRateControl(f *framework.Framework, pods []*v1.Pod, interval time.Duration) map[string]metav1.Time {
+	createTimes := make(map[string]metav1.Time)
+	for _, pod := range pods {
+		createTimes[pod.ObjectMeta.Name] = metav1.Now()
+		go f.PodClient().Create(pod)
+		time.Sleep(interval)
+	}
+	return createTimes
+}
+
+// getPodStartLatency gets prometheus metric 'pod start latency' from kubelet
+func getPodStartLatency(node string) (framework.KubeletLatencyMetrics, error) {
+	latencyMetrics := framework.KubeletLatencyMetrics{}
+	ms, err := metrics.GrabKubeletMetricsWithoutProxy(node)
+	Expect(err).NotTo(HaveOccurred())
+
+	for _, samples := range ms {
+		for _, sample := range samples {
+			if sample.Metric["__name__"] == kubemetrics.KubeletSubsystem+"_"+kubemetrics.PodStartLatencyKey {
+				quantile, _ := strconv.ParseFloat(string(sample.Metric["quantile"]), 64)
+				latencyMetrics = append(latencyMetrics,
+					framework.KubeletLatencyMetric{
+						Quantile: quantile,
+						Method:   kubemetrics.PodStartLatencyKey,
+						Latency:  time.Duration(int(sample.Value)) * time.Microsecond})
+			}
+		}
+	}
+	return latencyMetrics, nil
+}
+
+// verifyPodStartupLatency verifies whether 50, 90 and 99th percentiles of PodStartupLatency are
+// within the threshold.
+func verifyPodStartupLatency(expect, actual framework.LatencyMetric) error {
+	if actual.Perc50 > expect.Perc50 {
+		return fmt.Errorf("too high pod startup latency 50th percentile: %v", actual.Perc50)
+	}
+	if actual.Perc90 > expect.Perc90 {
+		return fmt.Errorf("too high pod startup latency 90th percentile: %v", actual.Perc90)
+	}
+	if actual.Perc99 > expect.Perc99 {
+		return fmt.Errorf("too high pod startup latency 99th percentile: %v", actual.Perc99)
+	}
+	return nil
+}
+
+// newInformerWatchPod creates an informer to check whether all pods are running.
+func newInformerWatchPod(f *framework.Framework, mutex *sync.Mutex, watchTimes map[string]metav1.Time, podType string) cache.Controller {
+	ns := f.Namespace.Name
+	checkPodRunning := func(p *v1.Pod) {
+		mutex.Lock()
+		defer mutex.Unlock()
+		defer GinkgoRecover()
+
+		if p.Status.Phase == v1.PodRunning {
+			if _, found := watchTimes[p.Name]; !found {
+				watchTimes[p.Name] = metav1.Now()
+			}
+		}
+	}
+
+	_, controller := cache.NewInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				options.LabelSelector = labels.SelectorFromSet(labels.Set{"type": podType}).String()
+				obj, err := f.ClientSet.Core().Pods(ns).List(options)
+				return runtime.Object(obj), err
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				options.LabelSelector = labels.SelectorFromSet(labels.Set{"type": podType}).String()
+				return f.ClientSet.Core().Pods(ns).Watch(options)
+			},
+		},
+		&v1.Pod{},
+		0,
+		cache.ResourceEventHandlerFuncs{
+			AddFunc: func(obj interface{}) {
+				p, ok := obj.(*v1.Pod)
+				Expect(ok).To(Equal(true))
+				go checkPodRunning(p)
+			},
+			UpdateFunc: func(oldObj, newObj interface{}) {
+				p, ok := newObj.(*v1.Pod)
+				Expect(ok).To(Equal(true))
+				go checkPodRunning(p)
+			},
+		},
+	)
+	return controller
+}
+
+// createBatchPodSequential creats pods back-to-back in sequence.
+func createBatchPodSequential(f *framework.Framework, pods []*v1.Pod) (time.Duration, []framework.PodLatencyData) {
+	batchStartTime := metav1.Now()
+	e2eLags := make([]framework.PodLatencyData, 0)
+	for _, pod := range pods {
+		create := metav1.Now()
+		f.PodClient().CreateSync(pod)
+		e2eLags = append(e2eLags,
+			framework.PodLatencyData{Name: pod.Name, Latency: metav1.Now().Time.Sub(create.Time)})
+	}
+	batchLag := metav1.Now().Time.Sub(batchStartTime.Time)
+	sort.Sort(framework.LatencySlice(e2eLags))
+	return batchLag, e2eLags
+}
+
+// logAndVerifyLatency verifies that whether pod creation latency satisfies the limit.
+func logAndVerifyLatency(batchLag time.Duration, e2eLags []framework.PodLatencyData, podStartupLimits framework.LatencyMetric,
+	podBatchStartupLimit time.Duration, testInfo map[string]string, isVerify bool) {
+	framework.PrintLatencies(e2eLags, "worst client e2e total latencies")
+
+	// TODO(coufon): do not trust 'kubelet' metrics since they are not reset!
+	latencyMetrics, _ := getPodStartLatency(kubeletAddr)
+	framework.Logf("Kubelet Prometheus metrics (not reset):\n%s", framework.PrettyPrintJSON(latencyMetrics))
+
+	podCreateLatency := framework.PodStartupLatency{Latency: framework.ExtractLatencyMetrics(e2eLags)}
+
+	// log latency perf data
+	framework.PrintPerfData(getLatencyPerfData(podCreateLatency.Latency, testInfo))
+
+	if isVerify {
+		// check whether e2e pod startup time is acceptable.
+		framework.ExpectNoError(verifyPodStartupLatency(podStartupLimits, podCreateLatency.Latency))
+
+		// check bactch pod creation latency
+		if podBatchStartupLimit > 0 {
+			Expect(batchLag <= podBatchStartupLimit).To(Equal(true), "Batch creation startup time %v exceed limit %v",
+				batchLag, podBatchStartupLimit)
+		}
+	}
+}
+
+// logThroughput calculates and logs pod creation throughput.
+func logPodCreateThroughput(batchLag time.Duration, e2eLags []framework.PodLatencyData, podsNr int, testInfo map[string]string) {
+	framework.PrintPerfData(getThroughputPerfData(batchLag, e2eLags, podsNr, testInfo))
+}
+
+// increaseKubeletAPIQPSLimit sets Kubelet API QPS via ConfigMap. Kubelet will restart with the new QPS.
+func setKubeletAPIQPSLimit(f *framework.Framework, newAPIQPS int32) {
+	const restartGap = 40 * time.Second
+
+	resp := pollConfigz(2*time.Minute, 5*time.Second)
+	kubeCfg, err := decodeConfigz(resp)
+	framework.ExpectNoError(err)
+	framework.Logf("Old QPS limit is: %d\n", kubeCfg.KubeAPIQPS)
+
+	// Set new API QPS limit
+	kubeCfg.KubeAPIQPS = newAPIQPS
+	// TODO(coufon): createConfigMap should firstly check whether configmap already exists, if so, use updateConfigMap.
+	// Calling createConfigMap twice will result in error. It is fine for benchmark test because we only run one test on a new node.
+	_, err = createConfigMap(f, kubeCfg)
+	framework.ExpectNoError(err)
+
+	// Wait for Kubelet to restart
+	time.Sleep(restartGap)
+
+	// Check new QPS has been set
+	resp = pollConfigz(2*time.Minute, 5*time.Second)
+	kubeCfg, err = decodeConfigz(resp)
+	framework.ExpectNoError(err)
+	framework.Logf("New QPS limit is: %d\n", kubeCfg.KubeAPIQPS)
+
+	// TODO(coufon): check test result to see if we need to retry here
+	if kubeCfg.KubeAPIQPS != newAPIQPS {
+		framework.Failf("Fail to set new kubelet API QPS limit.")
+	}
+}

vendor/k8s.io/kubernetes/test/e2e_node/disk_eviction_test.go

@@ -0,0 +1,261 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/util/uuid"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+)
+
+const (
+	// podCheckInterval is the interval seconds between pod status checks.
+	podCheckInterval = time.Second * 2
+
+	// podDisappearTimeout is the timeout to wait node disappear.
+	podDisappearTimeout = time.Minute * 2
+
+	// containerGCPeriod is the period of container garbage collect loop. It should be the same
+	// with ContainerGCPeriod in kubelet.go. However we don't want to include kubelet package
+	// directly which will introduce a lot more dependencies.
+	containerGCPeriod = time.Minute * 1
+
+	dummyFile = "dummy."
+)
+
+// TODO: Leverage dynamic Kubelet settings when it's implemented to only modify the kubelet eviction option in this test.
+var _ = framework.KubeDescribe("Kubelet Eviction Manager [Serial] [Disruptive]", func() {
+	f := framework.NewDefaultFramework("kubelet-eviction-manager")
+	var podClient *framework.PodClient
+	var c clientset.Interface
+
+	BeforeEach(func() {
+		podClient = f.PodClient()
+		c = f.ClientSet
+	})
+
+	Describe("hard eviction test", func() {
+		Context("pod using the most disk space gets evicted when the node disk usage is above the eviction hard threshold", func() {
+			var busyPodName, idlePodName, verifyPodName string
+
+			BeforeEach(func() {
+				if !isImageSupported() {
+					framework.Skipf("test skipped because the image is not supported by the test")
+				}
+				if !evictionOptionIsSet() {
+					framework.Skipf("test skipped because eviction option is not set")
+				}
+
+				busyPodName = "to-evict" + string(uuid.NewUUID())
+				idlePodName = "idle" + string(uuid.NewUUID())
+				verifyPodName = "verify" + string(uuid.NewUUID())
+				createIdlePod(idlePodName, podClient)
+				podClient.Create(&v1.Pod{
+					ObjectMeta: v1.ObjectMeta{
+						Name: busyPodName,
+					},
+					Spec: v1.PodSpec{
+						RestartPolicy: v1.RestartPolicyNever,
+						Containers: []v1.Container{
+							{
+								Image: "gcr.io/google_containers/busybox:1.24",
+								Name:  busyPodName,
+								// Filling the disk
+								Command: []string{"sh", "-c",
+									fmt.Sprintf("for NUM in `seq 1 1 100000`; do dd if=/dev/urandom of=%s.$NUM bs=50000000 count=10; sleep 0.5; done",
+										dummyFile)},
+							},
+						},
+					},
+				})
+			})
+
+			AfterEach(func() {
+				if !isImageSupported() || !evictionOptionIsSet() { // Skip the after each
+					return
+				}
+				podClient.DeleteSync(busyPodName, &v1.DeleteOptions{}, podDisappearTimeout)
+				podClient.DeleteSync(idlePodName, &v1.DeleteOptions{}, podDisappearTimeout)
+				podClient.DeleteSync(verifyPodName, &v1.DeleteOptions{}, podDisappearTimeout)
+
+				// Wait for 2 container gc loop to ensure that the containers are deleted. The containers
+				// created in this test consume a lot of disk, we don't want them to trigger disk eviction
+				// again after the test.
+				time.Sleep(containerGCPeriod * 2)
+
+				if framework.TestContext.PrepullImages {
+					// The disk eviction test may cause the prepulled images to be evicted,
+					// prepull those images again to ensure this test not affect following tests.
+					PrePullAllImages()
+				}
+			})
+
+			It("should evict the pod using the most disk space [Slow]", func() {
+				evictionOccurred := false
+				nodeDiskPressureCondition := false
+				podRescheduleable := false
+				Eventually(func() error {
+					// Avoid the test using up all the disk space
+					err := checkDiskUsage(0.05)
+					if err != nil {
+						return err
+					}
+
+					// The pod should be evicted.
+					if !evictionOccurred {
+						podData, err := podClient.Get(busyPodName, metav1.GetOptions{})
+						if err != nil {
+							return err
+						}
+
+						err = verifyPodEviction(podData)
+						if err != nil {
+							return err
+						}
+
+						podData, err = podClient.Get(idlePodName, metav1.GetOptions{})
+						if err != nil {
+							return err
+						}
+
+						if podData.Status.Phase != v1.PodRunning {
+							err = verifyPodEviction(podData)
+							if err != nil {
+								return err
+							}
+						}
+						evictionOccurred = true
+						return fmt.Errorf("waiting for node disk pressure condition to be set")
+					}
+
+					// The node should have disk pressure condition after the pods are evicted.
+					if !nodeDiskPressureCondition {
+						if !nodeHasDiskPressure(f.ClientSet) {
+							return fmt.Errorf("expected disk pressure condition is not set")
+						}
+						nodeDiskPressureCondition = true
+						return fmt.Errorf("waiting for node disk pressure condition to be cleared")
+					}
+
+					// After eviction happens the pod is evicted so eventually the node disk pressure should be relieved.
+					if !podRescheduleable {
+						if nodeHasDiskPressure(f.ClientSet) {
+							return fmt.Errorf("expected disk pressure condition relief has not happened")
+						}
+						createIdlePod(verifyPodName, podClient)
+						podRescheduleable = true
+						return fmt.Errorf("waiting for the node to accept a new pod")
+					}
+
+					// The new pod should be able to be scheduled and run after the disk pressure is relieved.
+					podData, err := podClient.Get(verifyPodName, metav1.GetOptions{})
+					if err != nil {
+						return err
+					}
+					if podData.Status.Phase != v1.PodRunning {
+						return fmt.Errorf("waiting for the new pod to be running")
+					}
+
+					return nil
+				}, time.Minute*15 /* based on n1-standard-1 machine type */, podCheckInterval).Should(BeNil())
+			})
+		})
+	})
+})
+
+func createIdlePod(podName string, podClient *framework.PodClient) {
+	podClient.Create(&v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Name: podName,
+		},
+		Spec: v1.PodSpec{
+			RestartPolicy: v1.RestartPolicyNever,
+			Containers: []v1.Container{
+				{
+					Image: framework.GetPauseImageNameForHostArch(),
+					Name:  podName,
+				},
+			},
+		},
+	})
+}
+
+func verifyPodEviction(podData *v1.Pod) error {
+	if podData.Status.Phase != v1.PodFailed {
+		return fmt.Errorf("expected phase to be failed. got %+v", podData.Status.Phase)
+	}
+	if podData.Status.Reason != "Evicted" {
+		return fmt.Errorf("expected failed reason to be evicted. got %+v", podData.Status.Reason)
+	}
+	return nil
+}
+
+func nodeHasDiskPressure(cs clientset.Interface) bool {
+	nodeList := framework.GetReadySchedulableNodesOrDie(cs)
+	for _, condition := range nodeList.Items[0].Status.Conditions {
+		if condition.Type == v1.NodeDiskPressure {
+			return condition.Status == v1.ConditionTrue
+		}
+	}
+	return false
+}
+
+func evictionOptionIsSet() bool {
+	return len(framework.TestContext.KubeletConfig.EvictionHard) > 0
+}
+
+// TODO(random-liu): Use OSImage in node status to do the check.
+func isImageSupported() bool {
+	// TODO: Only images with image fs is selected for testing for now. When the kubelet settings can be dynamically updated,
+	// instead of skipping images the eviction thresholds should be adjusted based on the images.
+	return strings.Contains(framework.TestContext.NodeName, "-gci-dev-")
+}
+
+// checkDiskUsage verifies that the available bytes on disk are above the limit.
+func checkDiskUsage(limit float64) error {
+	summary, err := getNodeSummary()
+	if err != nil {
+		return err
+	}
+
+	if nodeFs := summary.Node.Fs; nodeFs != nil {
+		if nodeFs.AvailableBytes != nil && nodeFs.CapacityBytes != nil {
+			if float64(*nodeFs.CapacityBytes)*limit > float64(*nodeFs.AvailableBytes) {
+				return fmt.Errorf("available nodefs byte is less than %v%%", limit*float64(100))
+			}
+		}
+	}
+
+	if summary.Node.Runtime != nil {
+		if imageFs := summary.Node.Runtime.ImageFs; imageFs != nil {
+			if float64(*imageFs.CapacityBytes)*limit > float64(*imageFs.AvailableBytes) {
+				return fmt.Errorf("available imagefs byte is less than %v%%", limit*float64(100))
+			}
+		}
+	}
+
+	return nil
+}

vendor/k8s.io/kubernetes/test/e2e_node/doc.go

@@ -0,0 +1,19 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// e2e_node contains e2e tests specific to the node
+// TODO: rename this package e2e-node
+package e2e_node // import "k8s.io/kubernetes/test/e2e_node"

vendor/k8s.io/kubernetes/test/e2e_node/dynamic_kubelet_configuration_test.go

@@ -0,0 +1,62 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+)
+
+// This test is marked [Disruptive] because the Kubelet temporarily goes down as part of of this test.
+var _ = framework.KubeDescribe("DynamicKubeletConfiguration [Feature:DynamicKubeletConfig] [Serial] [Disruptive]", func() {
+	f := framework.NewDefaultFramework("dynamic-kubelet-configuration-test")
+
+	Context("When a configmap called `kubelet-<node-name>` is added to the `kube-system` namespace", func() {
+		It("The Kubelet on that node should restart to take up the new config", func() {
+			// Get the current KubeletConfiguration (known to be valid) by
+			// querying the configz endpoint for the current node.
+			kubeCfg, err := getCurrentKubeletConfig()
+			framework.ExpectNoError(err)
+			glog.Infof("KubeletConfiguration - Initial values: %+v", *kubeCfg)
+
+			// Change a safe value e.g. file check frequency.
+			// Make sure we're providing a value distinct from the current one.
+			oldFileCheckFrequency := kubeCfg.FileCheckFrequency.Duration
+			newFileCheckFrequency := 11 * time.Second
+			if kubeCfg.FileCheckFrequency.Duration == newFileCheckFrequency {
+				newFileCheckFrequency = 10 * time.Second
+			}
+			kubeCfg.FileCheckFrequency.Duration = newFileCheckFrequency
+
+			// Use the new config to create a new kube-<node-name> configmap in `kube-system` namespace.
+			// Note: setKubeletConfiguration will return an error if the Kubelet does not present the
+			//       modified configuration via /configz when it comes back up.
+			err = setKubeletConfiguration(f, kubeCfg)
+			framework.ExpectNoError(err)
+
+			// Change the config back to what it originally was.
+			kubeCfg.FileCheckFrequency.Duration = oldFileCheckFrequency
+			err = setKubeletConfiguration(f, kubeCfg)
+			framework.ExpectNoError(err)
+		})
+	})
+})

vendor/k8s.io/kubernetes/test/e2e_node/e2e_node_suite_test.go

@@ -0,0 +1,278 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// To run tests in this suite
+// NOTE: This test suite requires password-less sudo capabilities to run the kubelet and kube-apiserver.
+package e2e_node
+
+import (
+	"bytes"
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"math/rand"
+	"os"
+	"os/exec"
+	"path"
+	"syscall"
+	"testing"
+	"time"
+
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	commontest "k8s.io/kubernetes/test/e2e/common"
+	"k8s.io/kubernetes/test/e2e/framework"
+	"k8s.io/kubernetes/test/e2e_node/services"
+	"k8s.io/kubernetes/test/e2e_node/system"
+
+	"github.com/golang/glog"
+	"github.com/kardianos/osext"
+	. "github.com/onsi/ginkgo"
+	"github.com/onsi/ginkgo/config"
+	morereporters "github.com/onsi/ginkgo/reporters"
+	. "github.com/onsi/gomega"
+	"github.com/spf13/pflag"
+)
+
+var e2es *services.E2EServices
+
+// TODO(random-liu): Change the following modes to sub-command.
+var runServicesMode = flag.Bool("run-services-mode", false, "If true, only run services (etcd, apiserver) in current process, and not run test.")
+var runKubeletMode = flag.Bool("run-kubelet-mode", false, "If true, only start kubelet, and not run test.")
+var systemValidateMode = flag.Bool("system-validate-mode", false, "If true, only run system validation in current process, and not run test.")
+
+func init() {
+	framework.RegisterCommonFlags()
+	framework.RegisterNodeFlags()
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	// Mark the run-services-mode flag as hidden to prevent user from using it.
+	pflag.CommandLine.MarkHidden("run-services-mode")
+	// It's weird that if I directly use pflag in TestContext, it will report error.
+	// It seems that someone is using flag.Parse() after init() and TestMain().
+	// TODO(random-liu): Find who is using flag.Parse() and cause errors and move the following logic
+	// into TestContext.
+	pflag.CommandLine.MarkHidden("enable-cri")
+}
+
+func TestMain(m *testing.M) {
+	pflag.Parse()
+	os.Exit(m.Run())
+}
+
+// When running the containerized conformance test, we'll mount the
+// host root filesystem as readonly to /rootfs.
+const rootfs = "/rootfs"
+
+func TestE2eNode(t *testing.T) {
+	if *runServicesMode {
+		// If run-services-mode is specified, only run services in current process.
+		services.RunE2EServices()
+		return
+	}
+	if *runKubeletMode {
+		// If run-kubelet-mode is specified, only start kubelet.
+		services.RunKubelet()
+		return
+	}
+	if *systemValidateMode {
+		// If system-validate-mode is specified, only run system validation in current process.
+		if framework.TestContext.NodeConformance {
+			// Chroot to /rootfs to make system validation can check system
+			// as in the root filesystem.
+			// TODO(random-liu): Consider to chroot the whole test process to make writing
+			// test easier.
+			if err := syscall.Chroot(rootfs); err != nil {
+				glog.Exitf("chroot %q failed: %v", rootfs, err)
+			}
+		}
+		if err := system.ValidateDefault(); err != nil {
+			glog.Exitf("system validation failed: %v", err)
+		}
+		return
+	}
+	// If run-services-mode is not specified, run test.
+	rand.Seed(time.Now().UTC().UnixNano())
+	RegisterFailHandler(Fail)
+	reporters := []Reporter{}
+	reportDir := framework.TestContext.ReportDir
+	if reportDir != "" {
+		// Create the directory if it doesn't already exists
+		if err := os.MkdirAll(reportDir, 0755); err != nil {
+			glog.Errorf("Failed creating report directory: %v", err)
+		} else {
+			// Configure a junit reporter to write to the directory
+			junitFile := fmt.Sprintf("junit_%s%02d.xml", framework.TestContext.ReportPrefix, config.GinkgoConfig.ParallelNode)
+			junitPath := path.Join(reportDir, junitFile)
+			reporters = append(reporters, morereporters.NewJUnitReporter(junitPath))
+		}
+	}
+	RunSpecsWithDefaultAndCustomReporters(t, "E2eNode Suite", reporters)
+}
+
+// Setup the kubelet on the node
+var _ = SynchronizedBeforeSuite(func() []byte {
+	// Run system validation test.
+	Expect(validateSystem()).To(Succeed(), "system validation")
+
+	// Pre-pull the images tests depend on so we can fail immediately if there is an image pull issue
+	// This helps with debugging test flakes since it is hard to tell when a test failure is due to image pulling.
+	if framework.TestContext.PrepullImages {
+		glog.Infof("Pre-pulling images so that they are cached for the tests.")
+		err := PrePullAllImages()
+		Expect(err).ShouldNot(HaveOccurred())
+	}
+
+	// TODO(yifan): Temporary workaround to disable coreos from auto restart
+	// by masking the locksmithd.
+	// We should mask locksmithd when provisioning the machine.
+	maskLocksmithdOnCoreos()
+
+	if *startServices {
+		// If the services are expected to stop after test, they should monitor the test process.
+		// If the services are expected to keep running after test, they should not monitor the test process.
+		e2es = services.NewE2EServices(*stopServices)
+		Expect(e2es.Start()).To(Succeed(), "should be able to start node services.")
+		glog.Infof("Node services started.  Running tests...")
+	} else {
+		glog.Infof("Running tests without starting services.")
+	}
+
+	glog.Infof("Wait for the node to be ready")
+	waitForNodeReady()
+
+	// Reference common test to make the import valid.
+	commontest.CurrentSuite = commontest.NodeE2E
+
+	return nil
+}, func([]byte) {
+	// update test context with node configuration.
+	Expect(updateTestContext()).To(Succeed(), "update test context with node config.")
+})
+
+// Tear down the kubelet on the node
+var _ = SynchronizedAfterSuite(func() {}, func() {
+	if e2es != nil {
+		if *startServices && *stopServices {
+			glog.Infof("Stopping node services...")
+			e2es.Stop()
+		}
+	}
+
+	glog.Infof("Tests Finished")
+})
+
+// validateSystem runs system validation in a separate process and returns error if validation fails.
+func validateSystem() error {
+	testBin, err := osext.Executable()
+	if err != nil {
+		return fmt.Errorf("can't get current binary: %v", err)
+	}
+	// Pass all flags into the child process, so that it will see the same flag set.
+	output, err := exec.Command(testBin, append([]string{"--system-validate-mode"}, os.Args[1:]...)...).CombinedOutput()
+	// The output of system validation should have been formatted, directly print here.
+	fmt.Print(string(output))
+	if err != nil {
+		return fmt.Errorf("system validation failed: %v", err)
+	}
+	return nil
+}
+
+func maskLocksmithdOnCoreos() {
+	data, err := ioutil.ReadFile("/etc/os-release")
+	if err != nil {
+		// Not all distros contain this file.
+		glog.Infof("Could not read /etc/os-release: %v", err)
+		return
+	}
+	if bytes.Contains(data, []byte("ID=coreos")) {
+		output, err := exec.Command("systemctl", "mask", "--now", "locksmithd").CombinedOutput()
+		Expect(err).NotTo(HaveOccurred(), fmt.Sprintf("should be able to mask locksmithd - output: %q", string(output)))
+		glog.Infof("Locksmithd is masked successfully")
+	}
+}
+
+func waitForNodeReady() {
+	const (
+		// nodeReadyTimeout is the time to wait for node to become ready.
+		nodeReadyTimeout = 2 * time.Minute
+		// nodeReadyPollInterval is the interval to check node ready.
+		nodeReadyPollInterval = 1 * time.Second
+	)
+	client, err := getAPIServerClient()
+	Expect(err).NotTo(HaveOccurred(), "should be able to get apiserver client.")
+	Eventually(func() error {
+		node, err := getNode(client)
+		if err != nil {
+			return fmt.Errorf("failed to get node: %v", err)
+		}
+		if !v1.IsNodeReady(node) {
+			return fmt.Errorf("node is not ready: %+v", node)
+		}
+		return nil
+	}, nodeReadyTimeout, nodeReadyPollInterval).Should(Succeed())
+}
+
+// updateTestContext updates the test context with the node name.
+// TODO(random-liu): Using dynamic kubelet configuration feature to
+// update test context with node configuration.
+func updateTestContext() error {
+	client, err := getAPIServerClient()
+	if err != nil {
+		return fmt.Errorf("failed to get apiserver client: %v", err)
+	}
+	// Update test context with current node object.
+	node, err := getNode(client)
+	if err != nil {
+		return fmt.Errorf("failed to get node: %v", err)
+	}
+	framework.TestContext.NodeName = node.Name // Set node name.
+	// Update test context with current kubelet configuration.
+	// This assumes all tests which dynamically change kubelet configuration
+	// must: 1) run in serial; 2) restore kubelet configuration after test.
+	kubeletCfg, err := getCurrentKubeletConfig()
+	if err != nil {
+		return fmt.Errorf("failed to get kubelet configuration: %v", err)
+	}
+	framework.TestContext.KubeletConfig = *kubeletCfg // Set kubelet config.
+	return nil
+}
+
+// getNode gets node object from the apiserver.
+func getNode(c *clientset.Clientset) (*v1.Node, error) {
+	nodes, err := c.Nodes().List(v1.ListOptions{})
+	Expect(err).NotTo(HaveOccurred(), "should be able to list nodes.")
+	if nodes == nil {
+		return nil, fmt.Errorf("the node list is nil.")
+	}
+	Expect(len(nodes.Items) > 1).NotTo(BeTrue(), "should not be more than 1 nodes.")
+	if len(nodes.Items) == 0 {
+		return nil, fmt.Errorf("empty node list: %+v", nodes)
+	}
+	return &nodes.Items[0], nil
+}
+
+// getAPIServerClient gets a apiserver client.
+func getAPIServerClient() (*clientset.Clientset, error) {
+	config, err := framework.LoadConfig()
+	if err != nil {
+		return nil, fmt.Errorf("failed to load config: %v", err)
+	}
+	client, err := clientset.NewForConfig(config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create client: %v", err)
+	}
+	return client, nil
+}

vendor/k8s.io/kubernetes/test/e2e_node/environment/BUILD

@@ -0,0 +1,35 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+)
+
+go_binary(
+    name = "environment",
+    library = ":go_default_library",
+    tags = ["automanaged"],
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["conformance.go"],
+    tags = ["automanaged"],
+    deps = ["//pkg/kubelet/cadvisor:go_default_library"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/e2e_node/environment/conformance.go

@@ -0,0 +1,259 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Build the binary with `go build conformance.go`, then run the conformance binary on a node candidate.  If compiled
+// on a non-linux machine, must be cross compiled for the host.
+package main
+
+import (
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"os/exec"
+	"regexp"
+	"strings"
+
+	"errors"
+	"os"
+
+	"k8s.io/kubernetes/pkg/kubelet/cadvisor"
+)
+
+const success = "\033[0;32mSUCESS\033[0m"
+const failed = "\033[0;31mFAILED\033[0m"
+const notConfigured = "\033[0;34mNOT CONFIGURED\033[0m"
+const skipped = "\033[0;34mSKIPPED\033[0m"
+
+var checkFlag = flag.String(
+	"check", "all", "what to check for conformance.  One or more of all,container-runtime,daemons,dns,firewall,kernel")
+
+func init() {
+	// Set this to false to undo util/logs.go settings it to true.  Prevents cadvisor log spam.
+	// Remove this once util/logs.go stops setting the flag to true.
+	flag.Set("logtostderr", "false")
+	flag.Parse()
+}
+
+// TODO: Should we write an e2e test for this?
+func main() {
+	o := strings.Split(*checkFlag, ",")
+	errs := check(o...)
+	if len(errs) > 0 {
+		os.Exit(1)
+	} else {
+		os.Exit(0)
+	}
+}
+
+// check returns errors found while checking the provided components.  Will prevent errors to stdout.
+func check(options ...string) []error {
+	errs := []error{}
+	for _, c := range options {
+		switch c {
+		case "all":
+			errs = appendNotNil(errs, kernel())
+			errs = appendNotNil(errs, containerRuntime())
+			errs = appendNotNil(errs, daemons())
+			errs = appendNotNil(errs, firewall())
+			errs = appendNotNil(errs, dns())
+		case "containerruntime":
+			errs = appendNotNil(errs, containerRuntime())
+		case "daemons":
+			errs = appendNotNil(errs, daemons())
+		case "dns":
+			errs = appendNotNil(errs, dns())
+		case "firewall":
+			errs = appendNotNil(errs, firewall())
+		case "kernel":
+			errs = appendNotNil(errs, kernel())
+		default:
+			fmt.Printf("Unrecognized option %s", c)
+			errs = append(errs, errors.New(fmt.Sprintf("Unrecognized option %s", c)))
+		}
+	}
+	return errs
+}
+
+const dockerVersionRegex = `1\.[7-9]\.[0-9]+`
+
+// containerRuntime checks that a suitable container runtime is installed and recognized by cadvisor: docker 1.7-1.9
+func containerRuntime() error {
+	dockerRegex, err := regexp.Compile(dockerVersionRegex)
+	if err != nil {
+		// This should never happen and can only be fixed by changing the code
+		panic(err)
+	}
+
+	// Setup cadvisor to check the container environment
+	c, err := cadvisor.New(0 /*don't start the http server*/, "docker", "/var/lib/kubelet")
+	if err != nil {
+		return printError("Container Runtime Check: %s Could not start cadvisor %v", failed, err)
+	}
+
+	vi, err := c.VersionInfo()
+	if err != nil {
+		return printError("Container Runtime Check: %s Could not get VersionInfo %v", failed, err)
+	}
+
+	d := vi.DockerVersion
+	if !dockerRegex.Match([]byte(d)) {
+		return printError(
+			"Container Runtime Check: %s Docker version %s does not matching %s.  You may need to run as root or the "+
+				"user the kubelet will run under.", failed, d, dockerVersionRegex)
+	}
+
+	return printSuccess("Container Runtime Check: %s", success)
+}
+
+const kubeletClusterDnsRegexStr = `\/kubelet.*--cluster-dns=(\S+) `
+const kubeletClusterDomainRegexStr = `\/kubelet.*--cluster-domain=(\S+)`
+
+// dns checks that cluster dns has been properly configured and can resolve the kubernetes.default service
+func dns() error {
+	dnsRegex, err := regexp.Compile(kubeletClusterDnsRegexStr)
+	if err != nil {
+		// This should never happen and can only be fixed by changing the code
+		panic(err)
+	}
+	domainRegex, err := regexp.Compile(kubeletClusterDomainRegexStr)
+	if err != nil {
+		// This should never happen and can only be fixed by changing the code
+		panic(err)
+	}
+
+	h, err := net.LookupHost("kubernetes.default")
+	if err == nil {
+		return printSuccess("Dns Check (Optional): %s", success)
+	}
+	if len(h) > 0 {
+		return printSuccess("Dns Check (Optional): %s", success)
+	}
+
+	kubecmd, err := exec.Command("ps", "aux").CombinedOutput()
+
+	// look for the dns flag and parse the value
+	dns := dnsRegex.FindStringSubmatch(string(kubecmd))
+	if len(dns) < 2 {
+		return printSuccess(
+			"Dns Check (Optional): %s No hosts resolve to kubernetes.default.  kubelet will need to set "+
+				"--cluster-dns and --cluster-domain when run", notConfigured)
+	}
+
+	// look for the domain flag and parse the value
+	domain := domainRegex.FindStringSubmatch(string(kubecmd))
+	if len(domain) < 2 {
+		return printSuccess(
+			"Dns Check (Optional): %s No hosts resolve to kubernetes.default.  kubelet will need to set "+
+				"--cluster-dns and --cluster-domain when run", notConfigured)
+	}
+
+	// do a lookup with the flags the kubelet is running with
+	nsArgs := []string{"-q=a", fmt.Sprintf("kubernetes.default.%s", domain[1]), dns[1]}
+	if err = exec.Command("nslookup", nsArgs...).Run(); err != nil {
+		// Mark this as failed since there was a clear intention to set it up, but it is done so improperly
+		return printError(
+			"Dns Check (Optional): %s No hosts resolve to kubernetes.default  kubelet found, but cannot resolve "+
+				"kubernetes.default using nslookup %s error: %v", failed, strings.Join(nsArgs, " "), err)
+	}
+
+	// Can resolve kubernetes.default using the kubelete dns and domain values
+	return printSuccess("Dns Check (Optional): %s", success)
+}
+
+const cmdlineCGroupMemory = `cgroup_enable=memory`
+
+// kernel checks that the kernel has been configured correctly to support the required cgroup features
+func kernel() error {
+	cmdline, err := ioutil.ReadFile("/proc/cmdline")
+	if err != nil {
+		return printError("Kernel Command Line Check %s: Could not check /proc/cmdline", failed)
+	}
+	if !strings.Contains(string(cmdline), cmdlineCGroupMemory) {
+		return printError("Kernel Command Line Check %s: cgroup_enable=memory not enabled in /proc/cmdline", failed)
+	}
+	return printSuccess("Kernel Command Line %s", success)
+}
+
+const iptablesInputRegexStr = `Chain INPUT \(policy DROP\)`
+const iptablesForwardRegexStr = `Chain FORWARD \(policy DROP\)`
+
+// firewall checks that iptables does not have common firewall rules setup that would disrupt traffic
+func firewall() error {
+	out, err := exec.Command("iptables", "-L", "INPUT").CombinedOutput()
+	if err != nil {
+		return printSuccess("Firewall IPTables Check %s: Could not run iptables", skipped)
+	}
+	inputRegex, err := regexp.Compile(iptablesInputRegexStr)
+	if err != nil {
+		// This should never happen and can only be fixed by changing the code
+		panic(err)
+	}
+	if inputRegex.Match(out) {
+		return printError("Firewall IPTables Check %s: Found INPUT rule matching %s", failed, iptablesInputRegexStr)
+	}
+
+	// Check GCE forward rules
+	out, err = exec.Command("iptables", "-L", "FORWARD").CombinedOutput()
+	if err != nil {
+		return printSuccess("Firewall IPTables Check %s: Could not run iptables", skipped)
+	}
+	forwardRegex, err := regexp.Compile(iptablesForwardRegexStr)
+	if err != nil {
+		// This should never happen and can only be fixed by changing the code
+		panic(err)
+	}
+	if forwardRegex.Match(out) {
+		return printError("Firewall IPTables Check %s: Found FORWARD rule matching %s", failed, iptablesInputRegexStr)
+	}
+
+	return printSuccess("Firewall IPTables Check %s", success)
+}
+
+// daemons checks that the required node programs are running: kubelet, kube-proxy, and docker
+func daemons() error {
+	if exec.Command("pgrep", "-f", "kubelet").Run() != nil {
+		return printError("Daemon Check %s: kubelet process not found", failed)
+	}
+
+	if exec.Command("pgrep", "-f", "kube-proxy").Run() != nil {
+		return printError("Daemon Check %s: kube-proxy process not found", failed)
+	}
+
+	return printSuccess("Daemon Check %s", success)
+}
+
+// printError provides its arguments to print a format string to the console (newline terminated) and returns an
+// error with the same string
+func printError(s string, args ...interface{}) error {
+	es := fmt.Sprintf(s, args...)
+	fmt.Println(es)
+	return errors.New(es)
+}
+
+// printSuccess provides its arguments to print a format string to the console (newline terminated) and returns nil
+func printSuccess(s string, args ...interface{}) error {
+	fmt.Println(fmt.Sprintf(s, args...))
+	return nil
+}
+
+// appendNotNil appends err to errs iff err is not nil
+func appendNotNil(errs []error, err error) []error {
+	if err != nil {
+		return append(errs, err)
+	}
+	return errs
+}

vendor/k8s.io/kubernetes/test/e2e_node/environment/setup_host.sh

@@ -0,0 +1,110 @@
+#!/bin/bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Script used to configure node e2e test hosts from gce base images.
+# DISCLAIMER: This script is not actively tested or maintained.  No guarantees that this will work
+# on any host environment.  Contributions encouraged!  Send PRs to pwittrock (github.com).
+#
+# At some point has successfully configured the following distros:
+# - ubuntu trusty
+# - containervm (no-op)
+# - rhel 7
+# - centos 7
+# - debian jessie
+
+# RHEL os detection
+cat /etc/*-release | grep "ID=\"rhel\""
+OS_RHEL=$?
+
+# On a systemd environment, enable cpu and memory accounting for all processes by default.
+if [ -d /etc/systemd ]; then
+  cat <<EOF >kubernetes-accounting.conf
+[Manager]
+DefaultCPUAccounting=yes
+DefaultMemoryAccounting=yes
+EOF
+  sudo mkdir -p /etc/systemd/system.conf.d/
+  sudo cp kubernetes-accounting.conf /etc/systemd/system.conf.d
+  sudo systemctl daemon-reload
+fi
+
+# For coreos, disable updates
+if $(sudo systemctl status update-engine &>/dev/null); then
+  sudo systemctl mask update-engine locksmithd
+fi
+
+# Fixup sudoers require tty
+sudo grep -q "# Defaults    requiretty" /etc/sudoers
+if [ $? -ne 0 ] ; then
+  sudo sed -i 's/Defaults    requiretty/# Defaults    requiretty/' /etc/sudoers
+fi
+
+# Install nsenter for ubuntu images
+cat /etc/*-release | grep "ID=ubuntu"
+if [ $? -eq 0 ]; then
+  if ! which nsenter > /dev/null; then
+     echo "Do not find nsenter. Install it."
+     mkdir -p /tmp/nsenter-install
+     cd /tmp/nsenter-install
+     curl https://www.kernel.org/pub/linux/utils/util-linux/v2.24/util-linux-2.24.tar.gz | tar -zxf-
+     sudo apt-get update
+     sudo apt-get --yes install make
+     sudo apt-get --yes install gcc
+     cd util-linux-2.24
+     ./configure --without-ncurses
+     make nsenter
+     sudo cp nsenter /usr/local/bin
+     rm -rf /tmp/nsenter-install
+   fi
+fi
+
+# Install docker
+hash docker 2>/dev/null
+if [ $? -ne 0 ]; then
+  # RHEL platforms should always install from RHEL repository
+  # This will install the latest supported stable docker platform on RHEL
+  if [ $OS_RHEL -eq 0 ]; then
+    sudo yum install -y docker-latest
+    sudo groupadd docker
+    sudo systemctl enable docker-latest.service
+    sudo systemctl start docker-latest.service
+  else
+    curl -fsSL https://get.docker.com/ | sh
+    sudo service docker start
+    sudo systemctl enable docker.service
+  fi
+fi
+
+# Allow jenkins access to docker
+id jenkins || sudo useradd jenkins -m
+sudo usermod -a -G docker jenkins
+
+# install lxc
+cat /etc/*-release | grep "ID=debian"
+if [ $? -ne 0 ]; then
+  hash apt-get 2>/dev/null
+  if [ $? -ne 1 ]; then
+    sudo apt-get install lxc -y
+    lxc-checkconfig
+    sudo sed -i 's/GRUB_CMDLINE_LINUX="\(.*\)"/GRUB_CMDLINE_LINUX="\1 cgroup_enable=memory"/' /etc/default/grub
+    sudo update-grub  
+  fi
+fi
+
+# delete init kubelet from containervm so that is doesn't startup
+if [ -f /etc/init.d/kubelet ]; then
+  sudo rm /etc/init.d/kubelet
+fi

vendor/k8s.io/kubernetes/test/e2e_node/garbage_collector_test.go

@@ -0,0 +1,323 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api/v1"
+	docker "k8s.io/kubernetes/pkg/kubelet/dockertools"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+const (
+	defaultDockerEndpoint = "unix:///var/run/docker.sock"
+
+	//TODO (dashpole): Once dynamic config is possible, test different values for maxPerPodContainer and maxContainers
+	// Currently using default values for maxPerPodContainer and maxTotalContainers
+	maxPerPodContainer = 1
+	maxTotalContainers = -1
+
+	defaultRuntimeRequestTimeoutDuration = 1 * time.Minute
+	defaultImagePullProgressDeadline     = 1 * time.Minute
+	garbageCollectDuration               = 3 * time.Minute
+	setupDuration                        = 10 * time.Minute
+	runtimePollInterval                  = 10 * time.Second
+)
+
+type testPodSpec struct {
+	podName string
+	// containerPrefix must be unique for each pod, and cannot end in a number.
+	// containerPrefix is used to identify which containers belong to which pod in the test.
+	containerPrefix string
+	// the number of times each container should restart
+	restartCount int32
+	// the number of containers in the test pod
+	numContainers int
+	// a function that returns the number of containers currently on the node (including dead containers).
+	getContainerNames func() ([]string, error)
+}
+
+func (pod *testPodSpec) getContainerName(containerNumber int) string {
+	return fmt.Sprintf("%s%d", pod.containerPrefix, containerNumber)
+}
+
+type testRun struct {
+	// Name for logging purposes
+	testName string
+	// Pod specs for the test
+	testPods []*testPodSpec
+}
+
+// GarbageCollect tests that the Kubelet conforms to the Kubelet Garbage Collection Policy, found here:
+// http://kubernetes.io/docs/admin/garbage-collection/
+var _ = framework.KubeDescribe("GarbageCollect [Serial]", func() {
+	f := framework.NewDefaultFramework("garbage-collect-test")
+	containerNamePrefix := "gc-test-container-"
+	podNamePrefix := "gc-test-pod-"
+
+	// These suffixes are appended to pod and container names.
+	// They differentiate pods from one another, and allow filtering
+	// by names to identify which containers belong to which pods
+	// They must be unique, and must not end in a number
+	first_suffix := "one-container-no-restarts"
+	second_suffix := "many-containers-many-restarts-one-pod"
+	third_suffix := "many-containers-many-restarts-"
+	tests := []testRun{
+		{
+			testName: "One Non-restarting Container",
+			testPods: []*testPodSpec{
+				{
+					podName:         podNamePrefix + first_suffix,
+					containerPrefix: containerNamePrefix + first_suffix,
+					restartCount:    0,
+					numContainers:   1,
+				},
+			},
+		},
+		{
+			testName: "Many Restarting Containers",
+			testPods: []*testPodSpec{
+				{
+					podName:         podNamePrefix + second_suffix,
+					containerPrefix: containerNamePrefix + second_suffix,
+					restartCount:    4,
+					numContainers:   4,
+				},
+			},
+		},
+		{
+			testName: "Many Pods with Many Restarting Containers",
+			testPods: []*testPodSpec{
+				{
+					podName:         podNamePrefix + third_suffix + "one",
+					containerPrefix: containerNamePrefix + third_suffix + "one",
+					restartCount:    3,
+					numContainers:   4,
+				},
+				{
+					podName:         podNamePrefix + third_suffix + "two",
+					containerPrefix: containerNamePrefix + third_suffix + "two",
+					restartCount:    2,
+					numContainers:   6,
+				},
+				{
+					podName:         podNamePrefix + third_suffix + "three",
+					containerPrefix: containerNamePrefix + third_suffix + "three",
+					restartCount:    3,
+					numContainers:   5,
+				},
+			},
+		},
+	}
+	for _, test := range tests {
+		// TODO (dashpole): Once the Container Runtime Interface (CRI) is complete, generalize run on other runtimes (other than docker)
+		dockerContainerGCTest(f, test)
+	}
+})
+
+// Tests the following:
+// 	pods are created, and all containers restart the specified number of times
+// 	while contianers are running, the number of copies of a single container does not exceed maxPerPodContainer
+// 	while containers are running, the total number of containers does not exceed maxTotalContainers
+// 	while containers are running, if not constrained by maxPerPodContainer or maxTotalContainers, keep an extra copy of each container
+// 	once pods are killed, all containers are eventually cleaned up
+func containerGCTest(f *framework.Framework, test testRun) {
+	Context(fmt.Sprintf("Garbage Collection Test: %s", test.testName), func() {
+		BeforeEach(func() {
+			realPods := getPods(test.testPods)
+			f.PodClient().CreateBatch(realPods)
+			By("Making sure all containers restart the specified number of times")
+			Eventually(func() error {
+				for _, podSpec := range test.testPods {
+					updatedPod, err := f.ClientSet.Core().Pods(f.Namespace.Name).Get(podSpec.podName, metav1.GetOptions{})
+					if err != nil {
+						return err
+					}
+					if len(updatedPod.Status.ContainerStatuses) != podSpec.numContainers {
+						return fmt.Errorf("expected pod %s to have %d containers, actual: %d",
+							updatedPod.Name, podSpec.numContainers, len(updatedPod.Status.ContainerStatuses))
+					}
+					for _, containerStatus := range updatedPod.Status.ContainerStatuses {
+						if containerStatus.RestartCount != podSpec.restartCount {
+							return fmt.Errorf("pod %s had container with restartcount %d.  Should have been at least %d",
+								updatedPod.Name, containerStatus.RestartCount, podSpec.restartCount)
+						}
+					}
+				}
+				return nil
+			}, setupDuration, runtimePollInterval).Should(BeNil())
+		})
+
+		It(fmt.Sprintf("Should eventually garbage collect containers when we exceed the number of dead containers per container"), func() {
+			totalContainers := 0
+			for _, pod := range test.testPods {
+				totalContainers += pod.numContainers*2 + 1
+			}
+			Eventually(func() error {
+				total := 0
+				for _, pod := range test.testPods {
+					containerNames, err := pod.getContainerNames()
+					if err != nil {
+						return err
+					}
+					total += len(containerNames)
+					// Check maxPerPodContainer for each container in the pod
+					for i := 0; i < pod.numContainers; i++ {
+						containerCount := 0
+						for _, containerName := range containerNames {
+							if strings.Contains(containerName, pod.getContainerName(i)) {
+								containerCount += 1
+							}
+						}
+						if containerCount > maxPerPodContainer+1 {
+							return fmt.Errorf("expected number of copies of container: %s, to be <= maxPerPodContainer: %d; list of containers: %v",
+								pod.getContainerName(i), maxPerPodContainer, containerNames)
+						}
+					}
+				}
+				//Check maxTotalContainers.  Currently, the default is -1, so this will never happen until we can configure maxTotalContainers
+				if maxTotalContainers > 0 && totalContainers <= maxTotalContainers && total > maxTotalContainers {
+					return fmt.Errorf("expected total number of containers: %v, to be <= maxTotalContainers: %v", total, maxTotalContainers)
+				}
+				return nil
+			}, garbageCollectDuration, runtimePollInterval).Should(BeNil())
+
+			if maxPerPodContainer >= 2 && maxTotalContainers < 0 { // make sure constraints wouldn't make us gc old containers
+				By("Making sure the kubelet consistently keeps around an extra copy of each container.")
+				Consistently(func() error {
+					for _, pod := range test.testPods {
+						containerNames, err := pod.getContainerNames()
+						if err != nil {
+							return err
+						}
+						for i := 0; i < pod.numContainers; i++ {
+							containerCount := 0
+							for _, containerName := range containerNames {
+								if strings.Contains(containerName, pod.getContainerName(i)) {
+									containerCount += 1
+								}
+							}
+							if pod.restartCount > 0 && containerCount < maxPerPodContainer+1 {
+								return fmt.Errorf("expected pod %v to have extra copies of old containers", pod.podName)
+							}
+						}
+					}
+					return nil
+				}, garbageCollectDuration, runtimePollInterval).Should(BeNil())
+			}
+		})
+
+		AfterEach(func() {
+			for _, pod := range test.testPods {
+				By(fmt.Sprintf("Deleting Pod %v", pod.podName))
+				f.PodClient().DeleteSync(pod.podName, &v1.DeleteOptions{}, defaultRuntimeRequestTimeoutDuration)
+			}
+
+			By("Making sure all containers get cleaned up")
+			Eventually(func() error {
+				for _, pod := range test.testPods {
+					containerNames, err := pod.getContainerNames()
+					if err != nil {
+						return err
+					}
+					if len(containerNames) > 0 {
+						return fmt.Errorf("%v containers still remain", containerNames)
+					}
+				}
+				return nil
+			}, garbageCollectDuration, runtimePollInterval).Should(BeNil())
+
+			if CurrentGinkgoTestDescription().Failed && framework.TestContext.DumpLogsOnFailure {
+				logNodeEvents(f)
+				logPodEvents(f)
+			}
+		})
+	})
+}
+
+// Runs containerGCTest using the docker runtime.
+func dockerContainerGCTest(f *framework.Framework, test testRun) {
+	var runtime docker.DockerInterface
+	BeforeEach(func() {
+		runtime = docker.ConnectToDockerOrDie(defaultDockerEndpoint, defaultRuntimeRequestTimeoutDuration, defaultImagePullProgressDeadline)
+	})
+	for _, pod := range test.testPods {
+		// Initialize the getContainerNames function to use the dockertools api
+		thisPrefix := pod.containerPrefix
+		pod.getContainerNames = func() ([]string, error) {
+			relevantContainers := []string{}
+			dockerContainers, err := docker.GetKubeletDockerContainers(runtime, true)
+			if err != nil {
+				return relevantContainers, err
+			}
+			for _, container := range dockerContainers {
+				// only look for containers from this testspec
+				if strings.Contains(container.Names[0], thisPrefix) {
+					relevantContainers = append(relevantContainers, container.Names[0])
+				}
+			}
+			return relevantContainers, nil
+		}
+	}
+	containerGCTest(f, test)
+}
+
+func getPods(specs []*testPodSpec) (pods []*v1.Pod) {
+	for _, spec := range specs {
+		By(fmt.Sprintf("Creating %v containers with restartCount: %v", spec.numContainers, spec.restartCount))
+		containers := []v1.Container{}
+		for i := 0; i < spec.numContainers; i++ {
+			containers = append(containers, v1.Container{
+				Image: "gcr.io/google_containers/busybox:1.24",
+				Name:  spec.getContainerName(i),
+				Command: []string{
+					"sh",
+					"-c",
+					fmt.Sprintf(`
+						f=/test-empty-dir-mnt/countfile%d
+						count=$(echo 'hello' >> $f ; wc -l $f | awk {'print $1'})
+						if [ $count -lt %d ]; then
+							exit 0
+						fi
+						while true; do sleep 1; done
+					`, i, spec.restartCount+1),
+				},
+				VolumeMounts: []v1.VolumeMount{
+					{MountPath: "/test-empty-dir-mnt", Name: "test-empty-dir"},
+				},
+			})
+		}
+		pods = append(pods, &v1.Pod{
+			ObjectMeta: v1.ObjectMeta{Name: spec.podName},
+			Spec: v1.PodSpec{
+				RestartPolicy: v1.RestartPolicyAlways,
+				Containers:    containers,
+				Volumes: []v1.Volume{
+					{Name: "test-empty-dir", VolumeSource: v1.VolumeSource{EmptyDir: &v1.EmptyDirVolumeSource{}}},
+				},
+			},
+		})
+	}
+	return
+}

vendor/k8s.io/kubernetes/test/e2e_node/gubernator.sh

@@ -0,0 +1,204 @@
+#!/bin/bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Make bucket and a folder for e2e-node test logs.
+# Populate the folder from the logs stored in /tmp/_artifacts/ in the same way as a
+# jenkins build would, and then print the URL to view the test results on Gubernator
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+source cluster/lib/logging.sh
+
+
+if [[ $# -eq 0 || ! $1 =~ ^[Yy]$ ]]; then
+  read -p "Do you want to run gubernator.sh and upload logs publicly to GCS? [y/n]" yn
+  echo
+  if [[ ! $yn =~ ^[Yy]$ ]]; then
+      exit 1
+  fi
+fi
+
+# Check that user has gsutil
+if [[ $(which gsutil) == "" ]]; then
+  echo "Could not find gsutil when running \`which gsutil\`"
+  exit 1
+fi
+
+# Check that user has gcloud
+if [[ $(which gcloud) == "" ]]; then
+  echo "Could not find gcloud when running: \`which gcloud\`"
+  exit 1
+fi
+
+# Check that user has Credentialed Active account
+if ! gcloud auth list | grep -q "ACTIVE"; then
+  echo "Could not find active account when running: \`gcloud auth list\`"
+  exit 1
+fi
+
+readonly gcs_acl="public-read"
+bucket_name="${USER}-g8r-logs"
+echo ""
+V=2 kube::log::status "Using bucket ${bucket_name}"
+
+# Check if the bucket exists
+if ! gsutil ls gs:// | grep -q "gs://${bucket_name}/"; then
+  V=2 kube::log::status "Creating public bucket ${bucket_name}"
+  gsutil mb gs://${bucket_name}/
+  # Make all files in the bucket publicly readable
+  gsutil acl ch -u AllUsers:R gs://${bucket_name}
+else
+  V=2 kube::log::status "Bucket already exists"
+fi
+
+# Path for e2e-node test results
+GCS_JOBS_PATH="gs://${bucket_name}/logs/e2e-node"
+
+ARTIFACTS=${ARTIFACTS:-"/tmp/_artifacts"}
+BUILD_LOG_PATH="${ARTIFACTS}/build-log.txt"
+
+if [[ ! -e $BUILD_LOG_PATH ]]; then
+  echo "Could not find build-log.txt at ${BUILD_LOG_PATH}"
+  exit 1
+fi
+
+# Get start and end timestamps based on build-log.txt file contents
+# Line where the actual tests start
+start_line=$(grep -n -m 1 "^=" ${BUILD_LOG_PATH} | sed 's/\([0-9]*\).*/\1/')
+# Create text file starting where the tests start
+after_start=$(tail -n +${start_line} ${BUILD_LOG_PATH})
+echo "${after_start}" >> build-log-cut.txt
+# Match the first timestamp
+start_time_raw=$(grep -m 1 -o '[0-9][0-9][0-9][0-9][[:blank:]][0-9][0-9]:[0-9][0-9]:[0-9][0-9].[0-9]*' build-log-cut.txt)
+rm build-log-cut.txt
+# Make the date readable by date command (ex: 0101 00:00:00.000 -> 01/01 00:00:00.000)
+start_time=$(echo ${start_time_raw} | sed 's/^.\{2\}/&\//')
+V=2 kube::log::status "Started at ${start_time}"
+# Match the last timestamp in the build-log file
+end_time=$(grep -o '[0-9][0-9][0-9][0-9][[:blank:]][0-9][0-9]:[0-9][0-9]:[0-9][0-9].[0-9]*' ${BUILD_LOG_PATH} | tail -1 | sed 's/^.\{2\}/&\//')
+# Convert to epoch time for Gubernator
+start_time_epoch=$(date -d "${start_time}" +%s)
+end_time_epoch=$(date -d "${end_time}" +%s)
+
+# Make folder name for build from timestamp
+BUILD_STAMP=$(echo $start_time | sed 's/\///' | sed 's/ /_/')
+
+GCS_LOGS_PATH="${GCS_JOBS_PATH}/${BUILD_STAMP}"
+
+# Check if folder for same logs already exists
+if gsutil ls "${GCS_JOBS_PATH}" | grep -q "${BUILD_STAMP}"; then
+  V=2 kube::log::status "Log files already uploaded"
+  echo "Gubernator linked below:"
+  echo "k8s-gubernator.appspot.com/build/${GCS_LOGS_PATH}?local=on"
+  exit
+fi
+
+for result in $(find ${ARTIFACTS} -type d -name "results"); do
+  if [[ $result != "" && $result != "${ARTIFACTS}/results" && $result != $ARTIFACTS ]]; then
+    mv $result/* $ARTIFACTS
+  fi
+done
+
+# Upload log files
+for upload_attempt in $(seq 3); do
+  if [[ -d "${ARTIFACTS}" && -n $(ls -A "${ARTIFACTS}") ]]; then
+    V=2 kube::log::status "Uploading artifacts"
+    gsutil -m -q -o "GSUtil:use_magicfile=True" cp -a "${gcs_acl}" -r -c \
+      -z log,xml,xml "${ARTIFACTS}" "${GCS_LOGS_PATH}/artifacts" || continue
+  fi
+  break
+done
+for upload_attempt in $(seq 3); do
+  if [[ -e "${BUILD_LOG_PATH}" ]]; then
+    V=2 kube::log::status "Uploading build log"
+    gsutil -q cp -Z -a "${gcs_acl}" "${BUILD_LOG_PATH}" "${GCS_LOGS_PATH}" || continue
+  fi
+  break
+done
+
+
+# Find the k8s version for started.json
+version=""
+if [[ -e "version" ]]; then
+  version=$(cat "version")
+elif [[ -e "hack/lib/version.sh" ]]; then
+  export KUBE_ROOT="."
+  source "hack/lib/version.sh"
+  kube::version::get_version_vars
+  version="${KUBE_GIT_VERSION-}"
+fi
+if [[ -n "${version}" ]]; then
+  V=2 kube::log::status "Found Kubernetes version: ${version}"
+else
+  V=2 kube::log::status "Could not find Kubernetes version"
+fi
+
+#Find build result from build-log.txt
+if grep -Fxq "Test Suite Passed" "${BUILD_LOG_PATH}"
+  then
+    build_result="SUCCESS"
+else
+    build_result="FAILURE"
+fi
+
+V=4 kube::log::status "Build result is ${build_result}"
+
+if [[ -e "${ARTIFACTS}/started.json" ]]; then
+  rm "${ARTIFACTS}/started.json"
+fi
+
+if [[ -e "${ARTIFACTS}/finished.json" ]]; then
+  rm "${ARTIFACTS}/finished.json"
+fi
+
+V=2 kube::log::status "Constructing started.json and finished.json files"
+echo "{" >> "${ARTIFACTS}/started.json"
+echo "    \"version\": \"${version}\"," >> "${ARTIFACTS}/started.json"
+echo "    \"timestamp\": ${start_time_epoch}," >> "${ARTIFACTS}/started.json"
+echo "    \"jenkins-node\": \"${NODE_NAME:-}\"" >> "${ARTIFACTS}/started.json"
+echo "}" >> "${ARTIFACTS}/started.json"
+
+echo "{" >> "${ARTIFACTS}/finished.json"
+echo "    \"result\": \"${build_result}\"," >> "${ARTIFACTS}/finished.json"
+echo "    \"timestamp\": ${end_time_epoch}" >> "${ARTIFACTS}/finished.json"
+echo "}" >> "${ARTIFACTS}/finished.json"
+
+
+# Upload started.json
+V=2 kube::log::status "Uploading started.json and finished.json"
+V=2 kube::log::status "Run started at ${start_time}"
+json_file="${GCS_LOGS_PATH}/started.json"
+
+for upload_attempt in $(seq 3); do
+  V=2 kube::log::status "Uploading started.json to ${json_file} (attempt ${upload_attempt})"
+  gsutil -q -h "Content-Type:application/json" cp -a "${gcs_acl}" "${ARTIFACTS}/started.json" \
+    "${json_file}" || continue
+  break
+done
+
+# Upload finished.json
+for upload_attempt in $(seq 3); do
+  V=2 kube::log::status "Uploading finished.json to ${GCS_LOGS_PATH} (attempt ${upload_attempt})"
+  gsutil -q -h "Content-Type:application/json" cp -a "${gcs_acl}" "${ARTIFACTS}/finished.json" \
+    "${GCS_LOGS_PATH}/finished.json" || continue
+  break
+done
+
+
+echo "Gubernator linked below:"
+echo "k8s-gubernator.appspot.com/build/${bucket_name}/logs/e2e-node/${BUILD_STAMP}"

vendor/k8s.io/kubernetes/test/e2e_node/image_id_test.go

@@ -0,0 +1,67 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/kubelet/dockertools"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	"github.com/davecgh/go-spew/spew"
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = framework.KubeDescribe("ImageID", func() {
+
+	busyBoxImage := "gcr.io/google_containers/busybox@sha256:4bdd623e848417d96127e16037743f0cd8b528c026e9175e22a84f639eca58ff"
+
+	f := framework.NewDefaultFramework("image-id-test")
+
+	It("should be set to the manifest digest (from RepoDigests) when available", func() {
+		podDesc := &v1.Pod{
+			ObjectMeta: v1.ObjectMeta{
+				Name: "pod-with-repodigest",
+			},
+			Spec: v1.PodSpec{
+				Containers: []v1.Container{{
+					Name:    "test",
+					Image:   busyBoxImage,
+					Command: []string{"sh"},
+				}},
+				RestartPolicy: v1.RestartPolicyNever,
+			},
+		}
+
+		pod := f.PodClient().Create(podDesc)
+
+		framework.ExpectNoError(framework.WaitTimeoutForPodNoLongerRunningInNamespace(
+			f.ClientSet, pod.Name, f.Namespace.Name, "", framework.PodStartTimeout))
+		runningPod, err := f.PodClient().Get(pod.Name, metav1.GetOptions{})
+		framework.ExpectNoError(err)
+
+		status := runningPod.Status
+
+		if len(status.ContainerStatuses) == 0 {
+			framework.Failf("Unexpected pod status; %s", spew.Sdump(status))
+			return
+		}
+
+		Expect(status.ContainerStatuses[0].ImageID).To(Equal(dockertools.DockerPullablePrefix + busyBoxImage))
+	})
+})

vendor/k8s.io/kubernetes/test/e2e_node/image_list.go

@@ -0,0 +1,86 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"os/exec"
+	"os/user"
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	commontest "k8s.io/kubernetes/test/e2e/common"
+	"k8s.io/kubernetes/test/e2e/framework"
+)
+
+const (
+	// Number of attempts to pull an image.
+	maxImagePullRetries = 5
+	// Sleep duration between image pull retry attempts.
+	imagePullRetryDelay = time.Second
+)
+
+// NodeImageWhiteList is a list of images used in node e2e test. These images will be prepulled
+// before test running so that the image pulling won't fail in actual test.
+var NodeImageWhiteList = sets.NewString(
+	"google/cadvisor:latest",
+	"gcr.io/google-containers/stress:v1",
+	"gcr.io/google_containers/busybox:1.24",
+	"gcr.io/google_containers/busybox@sha256:4bdd623e848417d96127e16037743f0cd8b528c026e9175e22a84f639eca58ff",
+	"gcr.io/google_containers/nginx-slim:0.7",
+	"gcr.io/google_containers/serve_hostname:v1.4",
+	"gcr.io/google_containers/netexec:1.7",
+	framework.GetPauseImageNameForHostArch(),
+)
+
+func init() {
+	// Union NodeImageWhiteList and CommonImageWhiteList into the framework image white list.
+	framework.ImageWhiteList = NodeImageWhiteList.Union(commontest.CommonImageWhiteList)
+}
+
+// Pre-fetch all images tests depend on so that we don't fail in an actual test.
+func PrePullAllImages() error {
+	usr, err := user.Current()
+	if err != nil {
+		return err
+	}
+	images := framework.ImageWhiteList.List()
+	glog.V(4).Infof("Pre-pulling images %+v", images)
+	for _, image := range images {
+		var (
+			err    error
+			output []byte
+		)
+		for i := 0; i < maxImagePullRetries; i++ {
+			if i > 0 {
+				time.Sleep(imagePullRetryDelay)
+			}
+			// TODO(random-liu): Use docker client to get rid of docker binary dependency.
+			if output, err = exec.Command("docker", "pull", image).CombinedOutput(); err == nil {
+				break
+			}
+			glog.Warningf("Failed to pull %s as user %q, retrying in %s (%d of %d): %v",
+				image, usr.Username, imagePullRetryDelay.String(), i+1, maxImagePullRetries, err)
+		}
+		if err != nil {
+			glog.Warningf("Could not pre-pull image %s %v output:  %s", image, err, output)
+			return err
+		}
+	}
+	return nil
+}

vendor/k8s.io/kubernetes/test/e2e_node/inode_eviction_test.go

@@ -0,0 +1,326 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+	"time"
+
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+// Eviction Policy is described here:
+// https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/kubelet-eviction.md
+
+const (
+	postTestConditionMonitoringPeriod = 2 * time.Minute
+	evictionPollInterval              = 2 * time.Second
+	// pressure conditions often surface after evictions because of delay in propegation of metrics to pressure
+	// we wait this period after evictions to make sure that we wait out this delay
+	pressureDelay = 20 * time.Second
+)
+
+var _ = framework.KubeDescribe("InodeEviction [Slow] [Serial] [Disruptive] [Flaky]", func() {
+	f := framework.NewDefaultFramework("inode-eviction-test")
+
+	podTestSpecs := []podTestSpec{
+		{
+			evictionPriority: 1, // This pod should be evicted before the normal memory usage pod
+			pod: v1.Pod{
+				ObjectMeta: v1.ObjectMeta{Name: "container-inode-hog-pod"},
+				Spec: v1.PodSpec{
+					RestartPolicy: v1.RestartPolicyNever,
+					Containers: []v1.Container{
+						{
+							Image: "gcr.io/google_containers/busybox:1.24",
+							Name:  "container-inode-hog-pod",
+							Command: []string{
+								"sh",
+								"-c", // Make 100 billion small files (more than we have inodes)
+								"i=0; while [[ $i -lt 100000000000 ]]; do touch smallfile$i.txt; sleep 0.001; i=$((i+=1)); done;",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			evictionPriority: 1, // This pod should be evicted before the normal memory usage pod
+			pod: v1.Pod{
+				ObjectMeta: v1.ObjectMeta{Name: "volume-inode-hog-pod"},
+				Spec: v1.PodSpec{
+					RestartPolicy: v1.RestartPolicyNever,
+					Containers: []v1.Container{
+						{
+							Image: "gcr.io/google_containers/busybox:1.24",
+							Name:  "volume-inode-hog-pod",
+							Command: []string{
+								"sh",
+								"-c", // Make 100 billion small files (more than we have inodes)
+								"i=0; while [[ $i -lt 100000000000 ]]; do touch /test-empty-dir-mnt/smallfile$i.txt; sleep 0.001; i=$((i+=1)); done;",
+							},
+							VolumeMounts: []v1.VolumeMount{
+								{MountPath: "/test-empty-dir-mnt", Name: "test-empty-dir"},
+							},
+						},
+					},
+					Volumes: []v1.Volume{
+						{Name: "test-empty-dir", VolumeSource: v1.VolumeSource{EmptyDir: &v1.EmptyDirVolumeSource{}}},
+					},
+				},
+			},
+		},
+		{
+			evictionPriority: 0, // This pod should never be evicted
+			pod: v1.Pod{
+				ObjectMeta: v1.ObjectMeta{Name: "normal-memory-usage-pod"},
+				Spec: v1.PodSpec{
+					RestartPolicy: v1.RestartPolicyNever,
+					Containers: []v1.Container{
+						{
+							Image: "gcr.io/google_containers/busybox:1.24",
+							Name:  "normal-memory-usage-pod",
+							Command: []string{
+								"sh",
+								"-c", //make one big (5 Gb) file
+								"dd if=/dev/urandom of=largefile bs=5000000000 count=1; while true; do sleep 5; done",
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	evictionTestTimeout := 30 * time.Minute
+	testCondition := "Disk Pressure due to Inodes"
+	// Set the EvictionHard threshold lower to decrease test time
+	evictionHardLimit := "nodefs.inodesFree<50%"
+
+	runEvictionTest(f, testCondition, podTestSpecs, evictionHardLimit, evictionTestTimeout, hasInodePressure)
+})
+
+// Struct used by runEvictionTest that specifies the pod, and when that pod should be evicted, relative to other pods
+type podTestSpec struct {
+	// 0 should never be evicted, 1 shouldn't evict before 2, etc.
+	// If two are ranked at 1, either is permitted to fail before the other.
+	// The test ends when all other than the 0 have been evicted
+	evictionPriority int
+	pod              v1.Pod
+}
+
+// runEvictionTest sets up a testing environment given the provided nodes, and checks a few things:
+//		It ensures that the desired testCondition is actually triggered.
+//		It ensures that evictionPriority 0 pods are not evicted
+//		It ensures that lower evictionPriority pods are always evicted before higher evictionPriority pods (2 evicted before 1, etc.)
+//		It ensures that all lower evictionPriority pods are eventually evicted.
+// runEvictionTest then cleans up the testing environment by deleting provided nodes, and ensures that testCondition no longer exists
+func runEvictionTest(f *framework.Framework, testCondition string, podTestSpecs []podTestSpec, evictionHard string,
+	evictionTestTimeout time.Duration, hasPressureCondition func(*framework.Framework, string) (bool, error)) {
+
+	Context(fmt.Sprintf("when we run containers that should cause %s", testCondition), func() {
+
+		tempSetEvictionHard(f, evictionHard)
+		BeforeEach(func() {
+			By("seting up pods to be used by tests")
+			for _, spec := range podTestSpecs {
+				By(fmt.Sprintf("creating pod with container: %s", spec.pod.Name))
+				f.PodClient().CreateSync(&spec.pod)
+			}
+		})
+
+		It(fmt.Sprintf("should eventually see %s, and then evict all of the correct pods", testCondition), func() {
+			Eventually(func() error {
+				hasPressure, err := hasPressureCondition(f, testCondition)
+				if err != nil {
+					return err
+				}
+				if hasPressure {
+					return nil
+				}
+				return fmt.Errorf("Condition: %s not encountered", testCondition)
+			}, evictionTestTimeout, evictionPollInterval).Should(BeNil())
+
+			Eventually(func() error {
+				// Gather current information
+				updatedPodList, err := f.ClientSet.Core().Pods(f.Namespace.Name).List(v1.ListOptions{})
+				updatedPods := updatedPodList.Items
+				for _, p := range updatedPods {
+					framework.Logf("fetching pod %s; phase= %v", p.Name, p.Status.Phase)
+				}
+				_, err = hasPressureCondition(f, testCondition)
+				if err != nil {
+					return err
+				}
+
+				By("checking eviction ordering and ensuring important pods dont fail")
+				done := true
+				for _, priorityPodSpec := range podTestSpecs {
+					var priorityPod v1.Pod
+					for _, p := range updatedPods {
+						if p.Name == priorityPodSpec.pod.Name {
+							priorityPod = p
+						}
+					}
+					Expect(priorityPod).NotTo(BeNil())
+
+					// Check eviction ordering.
+					// Note: it is alright for a priority 1 and priority 2 pod (for example) to fail in the same round
+					for _, lowPriorityPodSpec := range podTestSpecs {
+						var lowPriorityPod v1.Pod
+						for _, p := range updatedPods {
+							if p.Name == lowPriorityPodSpec.pod.Name {
+								lowPriorityPod = p
+							}
+						}
+						Expect(lowPriorityPod).NotTo(BeNil())
+						if priorityPodSpec.evictionPriority < lowPriorityPodSpec.evictionPriority && lowPriorityPod.Status.Phase == v1.PodRunning {
+							Expect(priorityPod.Status.Phase).NotTo(Equal(v1.PodFailed),
+								fmt.Sprintf("%s pod failed before %s pod", priorityPodSpec.pod.Name, lowPriorityPodSpec.pod.Name))
+						}
+					}
+
+					// EvictionPriority 0 pods should not fail
+					if priorityPodSpec.evictionPriority == 0 {
+						Expect(priorityPod.Status.Phase).NotTo(Equal(v1.PodFailed),
+							fmt.Sprintf("%s pod failed (and shouldn't have failed)", priorityPod.Name))
+					}
+
+					// If a pod that is not evictionPriority 0 has not been evicted, we are not done
+					if priorityPodSpec.evictionPriority != 0 && priorityPod.Status.Phase != v1.PodFailed {
+						done = false
+					}
+				}
+				if done {
+					return nil
+				}
+				return fmt.Errorf("pods that caused %s have not been evicted.", testCondition)
+			}, evictionTestTimeout, evictionPollInterval).Should(BeNil())
+
+			// We observe pressure from the API server.  The eviction manager observes pressure from the kubelet internal stats.
+			// This means the eviction manager will observe pressure before we will, creating a delay between when the eviction manager
+			// evicts a pod, and when we observe the pressure by querrying the API server.  Add a delay here to account for this delay
+			By("making sure pressure from test has surfaced before continuing")
+			time.Sleep(pressureDelay)
+
+			By("making sure conditions eventually return to normal")
+			Eventually(func() error {
+				hasPressure, err := hasPressureCondition(f, testCondition)
+				if err != nil {
+					return err
+				}
+				if hasPressure {
+					return fmt.Errorf("Conditions havent returned to normal, we still have %s", testCondition)
+				}
+				return nil
+			}, evictionTestTimeout, evictionPollInterval).Should(BeNil())
+
+			By("making sure conditions do not return")
+			Consistently(func() error {
+				hasPressure, err := hasPressureCondition(f, testCondition)
+				if err != nil {
+					// Race conditions sometimes occur when checking pressure condition due to #38710 (Docker bug)
+					// Do not fail the test when this occurs, since this is expected to happen occasionally.
+					framework.Logf("Failed to check pressure condition. Error: %v", err)
+					return nil
+				}
+				if hasPressure {
+					return fmt.Errorf("%s dissappeared and then reappeared", testCondition)
+				}
+				return nil
+			}, postTestConditionMonitoringPeriod, evictionPollInterval).Should(BeNil())
+
+			By("making sure we can start a new pod after the test")
+			podName := "test-admit-pod"
+			f.PodClient().CreateSync(&v1.Pod{
+				ObjectMeta: v1.ObjectMeta{
+					Name: podName,
+				},
+				Spec: v1.PodSpec{
+					RestartPolicy: v1.RestartPolicyNever,
+					Containers: []v1.Container{
+						{
+							Image: framework.GetPauseImageNameForHostArch(),
+							Name:  podName,
+						},
+					},
+				},
+			})
+		})
+
+		AfterEach(func() {
+			By("deleting pods")
+			for _, spec := range podTestSpecs {
+				By(fmt.Sprintf("deleting pod: %s", spec.pod.Name))
+				f.PodClient().DeleteSync(spec.pod.Name, &v1.DeleteOptions{}, podDisappearTimeout)
+			}
+
+			if CurrentGinkgoTestDescription().Failed {
+				if framework.TestContext.DumpLogsOnFailure {
+					logPodEvents(f)
+					logNodeEvents(f)
+				}
+				By("sleeping to allow for cleanup of test")
+				time.Sleep(postTestConditionMonitoringPeriod)
+			}
+		})
+	})
+}
+
+// Returns TRUE if the node has disk pressure due to inodes exists on the node, FALSE otherwise
+func hasInodePressure(f *framework.Framework, testCondition string) (bool, error) {
+
+	nodeList, err := f.ClientSet.Core().Nodes().List(v1.ListOptions{})
+	framework.ExpectNoError(err, "getting node list")
+	if len(nodeList.Items) != 1 {
+		return false, fmt.Errorf("expected 1 node, but see %d. List: %v", len(nodeList.Items), nodeList.Items)
+	}
+
+	_, pressure := v1.GetNodeCondition(&nodeList.Items[0].Status, v1.NodeDiskPressure)
+	Expect(pressure).NotTo(BeNil())
+	hasPressure := pressure.Status == v1.ConditionTrue
+	By(fmt.Sprintf("checking if pod has %s: %v", testCondition, hasPressure))
+
+	// Additional Logging relating to Inodes
+	summary, err := getNodeSummary()
+	if err != nil {
+		return false, err
+	}
+	if summary.Node.Runtime != nil && summary.Node.Runtime.ImageFs != nil && summary.Node.Runtime.ImageFs.Inodes != nil && summary.Node.Runtime.ImageFs.InodesFree != nil {
+		framework.Logf("imageFsInfo.Inodes: %d, imageFsInfo.InodesFree: %d", *summary.Node.Runtime.ImageFs.Inodes, *summary.Node.Runtime.ImageFs.InodesFree)
+	}
+	if summary.Node.Fs != nil && summary.Node.Fs.Inodes != nil && summary.Node.Fs.InodesFree != nil {
+		framework.Logf("rootFsInfo.Inodes: %d, rootFsInfo.InodesFree: %d", *summary.Node.Fs.Inodes, *summary.Node.Fs.InodesFree)
+	}
+	for _, pod := range summary.Pods {
+		framework.Logf("Pod: %s", pod.PodRef.Name)
+		for _, container := range pod.Containers {
+			if container.Rootfs != nil && container.Rootfs.InodesUsed != nil {
+				framework.Logf("--- summary Container: %s inodeUsage: %d", container.Name, *container.Rootfs.InodesUsed)
+			}
+		}
+		for _, volume := range pod.VolumeStats {
+			if volume.FsStats.InodesUsed != nil {
+				framework.Logf("--- summary Volume: %s inodeUsage: %d", volume.Name, *volume.FsStats.InodesUsed)
+			}
+		}
+	}
+	return hasPressure, nil
+}

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/benchmark/benchmark-config.yaml

@@ -0,0 +1,92 @@
+---
+images:
+  containervm-density1:
+    image: e2e-node-containervm-v20161208-image
+    project: kubernetes-node-e2e-images
+    machine: n1-standard-1
+    tests:
+      - 'create 35 pods with 0s? interval \[Benchmark\]'
+  containervm-density2:
+    image: e2e-node-containervm-v20161208-image
+    project: kubernetes-node-e2e-images
+    machine: n1-standard-1
+    tests:
+      - 'create 105 pods with 0s? interval \[Benchmark\]'
+  containervm-density2-qps60:
+    image: e2e-node-containervm-v20161208-image
+    project: kubernetes-node-e2e-images
+    machine: n1-standard-1
+    tests:
+      - 'create 105 pods with 0s? interval \(QPS 60\) \[Benchmark\]'
+  containervm-density3:
+    image: e2e-node-containervm-v20161208-image
+    project: kubernetes-node-e2e-images
+    machine: n1-standard-2
+    tests:
+      - 'create 105 pods with 0s? interval \[Benchmark\]'
+  containervm-density4:
+    image: e2e-node-containervm-v20161208-image
+    project: kubernetes-node-e2e-images
+    machine: n1-standard-1
+    tests:
+      - 'create 105 pods with 100ms interval \[Benchmark\]'
+  containervm-resource1:
+    image: e2e-node-containervm-v20161208-image
+    project: kubernetes-node-e2e-images
+    machine: n1-standard-1
+    tests:
+      - 'resource tracking for 0 pods per node \[Benchmark\]'
+  containervm-resource2:
+    image: e2e-node-containervm-v20161208-image
+    project: kubernetes-node-e2e-images
+    machine: n1-standard-1
+    tests:
+      - 'resource tracking for 35 pods per node \[Benchmark\]'
+  containervm-resource3:
+    image: e2e-node-containervm-v20161208-image
+    project: kubernetes-node-e2e-images
+    machine: n1-standard-1
+    tests:
+      - 'resource tracking for 105 pods per node \[Benchmark\]'
+  gci-resource1:
+    image: gci-dev-56-8977-0-0
+    project: google-containers
+    machine: n1-standard-1
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"
+    tests:
+      - 'resource tracking for 0 pods per node \[Benchmark\]'
+  gci-resource2:
+    image: gci-dev-56-8977-0-0
+    project: google-containers
+    machine: n1-standard-1
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"
+    tests:
+      - 'resource tracking for 35 pods per node \[Benchmark\]'
+  gci-resource3:
+    image: gci-dev-56-8977-0-0
+    project: google-containers
+    machine: n1-standard-1
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"
+    tests:
+      - 'resource tracking for 105 pods per node \[Benchmark\]'
+  coreos-resource1:
+    image: coreos-alpha-1122-0-0-v20160727
+    project: coreos-cloud
+    metadata: "user-data<test/e2e_node/jenkins/coreos-init.json"
+    machine: n1-standard-1
+    tests:
+      - 'resource tracking for 0 pods per node \[Benchmark\]'
+  coreos-resource2:
+    image: coreos-alpha-1122-0-0-v20160727
+    project: coreos-cloud
+    metadata: "user-data<test/e2e_node/jenkins/coreos-init.json"
+    machine: n1-standard-1
+    tests:
+      - 'resource tracking for 35 pods per node \[Benchmark\]'
+  coreos-resource3:
+    image: coreos-alpha-1122-0-0-v20160727
+    project: coreos-cloud
+    metadata: "user-data<test/e2e_node/jenkins/coreos-init.json"
+    machine: n1-standard-1
+    tests:
+      - 'resource tracking for 105 pods per node \[Benchmark\]'

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/benchmark/jenkins-benchmark.properties

@@ -0,0 +1,9 @@
+GCE_HOSTS=
+GCE_IMAGE_CONFIG_PATH=test/e2e_node/jenkins/benchmark/benchmark-config.yaml
+GCE_ZONE=us-central1-f
+GCE_PROJECT=k8s-jkns-ci-node-e2e
+CLEANUP=true
+GINKGO_FLAGS='--skip="\[Flaky\]"'
+TEST_ARGS='--feature-gates=DynamicKubeletConfig=true'
+KUBELET_ARGS='--experimental-cgroups-per-qos=true --cgroup-root=/'
+PARALLELISM=1

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/conformance/conformance-jenkins.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Script executed by jenkins to run node conformance test against gce
+# Usage: test/e2e_node/jenkins/conformance-node-jenkins.sh <path to properties>
+
+set -e
+set -x
+
+: "${1:?Usage test/e2e_node/jenkins/conformance-node-jenkins.sh <path to properties>}"
+
+. $1
+
+make generated_files
+
+WORKSPACE=${WORKSPACE:-"/tmp/"}
+ARTIFACTS=${WORKSPACE}/_artifacts
+TIMEOUT=${TIMEOUT:-"45m"}
+
+mkdir -p ${ARTIFACTS}
+
+go run test/e2e_node/runner/remote/run_remote.go  conformance \
+  --logtostderr --vmodule=*=4 --ssh-env="gce" \
+  --zone="$GCE_ZONE" --project="$GCE_PROJECT" --hosts="$GCE_HOSTS" \
+  --images="$GCE_IMAGES" --image-project="$GCE_IMAGE_PROJECT" \
+  --image-config-file="$GCE_IMAGE_CONFIG_PATH" --cleanup="$CLEANUP" \
+  --results-dir="$ARTIFACTS" --test-timeout="$TIMEOUT" \
+  --test_args="--kubelet-flags=\"$KUBELET_ARGS\"" \
+  --instance-metadata="$GCE_INSTANCE_METADATA"

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/conformance/jenkins-conformance.properties

@@ -0,0 +1,6 @@
+GCE_HOSTS=
+GCE_IMAGE_CONFIG_PATH=test/e2e_node/jenkins/image-config.yaml
+GCE_ZONE=us-central1-f
+GCE_PROJECT=k8s-jkns-ci-node-e2e
+CLEANUP=true
+KUBELET_ARGS='--experimental-cgroups-per-qos=true --cgroup-root=/'

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/copy-e2e-image.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Usage: copy-e2e-image.sh <image-name> <from-project-name> <to-project-name>
+
+# See *.properties for list of images to copy,
+# typically from kubernetes-node-e2e-images
+
+set -e
+
+print_usage() {
+    echo "This script helps copy a GCE image from a source to a target project"
+    echo -e "\nUsage:\n$0 <from-image-name> <from-project-name> <to-project-name> <to-image-name>\n"
+}
+
+if [  $# -ne 4 ]; then
+    print_usage
+    exit 1
+fi
+
+FROM_IMAGE=$1
+FROM_PROJECT=$2
+TO_PROJECT=$3
+TO_IMAGE=$4
+
+echo "Copying image $FROM_IMAGE from project $FROM_PROJECT to project $TO_PROJECT as image $TO_IMAGE..."
+gcloud compute --project $TO_PROJECT disks create $TO_IMAGE --image=https://www.googleapis.com/compute/v1/projects/$FROM_PROJECT/global/images/$FROM_IMAGE
+gcloud compute --project $TO_PROJECT images create $TO_IMAGE \
+  --source-disk=$TO_IMAGE \
+  --description="Cloned from projects/$2/global/images/$1 by $USER on $(date)"
+gcloud -q compute --project $TO_PROJECT disks delete $TO_IMAGE

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/coreos-init.json

@@ -0,0 +1,29 @@
+{
+  "ignition":{"version": "2.0.0"},
+  "systemd": {
+    "units": [{
+      "name": "update-engine.service",
+      "mask": true
+    },
+    {
+      "name": "locksmithd.service",
+      "mask": true
+    },
+    {
+      "name": "docker.service",
+      "dropins": [{
+        "name": "10-disable-systemd-cgroup-driver.conf",
+        "contents": "[Service]\nCPUAccounting=yes\nMemoryAccounting=yes\nEnvironment=\"DOCKER_CGROUPS=\""
+      }]
+    }]
+  },
+  "passwd": {
+    "users": [{
+      "name": "jenkins",
+      "create": {
+        "groups": ["docker", "sudo"]
+      }
+    }]
+  }
+}
+

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/cri_validation/benchmark-config.yaml

@@ -0,0 +1,58 @@
+---
+images:
+  gci-density1:
+    image: gci-dev-56-8977-0-0
+    project: google-containers
+    machine: n1-standard-1
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"
+    tests:
+      - 'create 35 pods with 0s? interval \[Benchmark\]'
+  gci-density2:
+    image: gci-dev-56-8977-0-0
+    project: google-containers
+    machine: n1-standard-1
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"
+    tests:
+      - 'create 105 pods with 0s? interval \[Benchmark\]'
+  gci-density2-qps60:
+    image: gci-dev-56-8977-0-0
+    project: google-containers
+    machine: n1-standard-1
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"
+    tests:
+      - 'create 105 pods with 0s? interval \(QPS 60\) \[Benchmark\]'
+  gci-density3:
+    image: gci-dev-56-8977-0-0
+    project: google-containers
+    machine: n1-standard-2
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"
+    tests:
+      - 'create 105 pods with 0s? interval \[Benchmark\]'
+  gci-density4:
+    image: gci-dev-56-8977-0-0
+    project: google-containers
+    machine: n1-standard-1
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"
+    tests:
+      - 'create 105 pods with 100ms interval \[Benchmark\]'
+  gci-resource1:
+    image: gci-dev-56-8977-0-0
+    project: google-containers
+    machine: n1-standard-1
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"
+    tests:
+      - 'resource tracking for 0 pods per node \[Benchmark\]'
+  gci-resource2:
+    image: gci-dev-56-8977-0-0
+    project: google-containers
+    machine: n1-standard-1
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"
+    tests:
+      - 'resource tracking for 35 pods per node \[Benchmark\]'
+  gci-resource3:
+    image: gci-dev-56-8977-0-0
+    project: google-containers
+    machine: n1-standard-1
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"
+    tests:
+      - 'resource tracking for 105 pods per node \[Benchmark\]'

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/cri_validation/image-config.yaml

@@ -0,0 +1,11 @@
+images:
+  containervm:
+    image: e2e-node-containervm-v20161208-image
+    project: kubernetes-node-e2e-images
+  gci-family:
+    image_regex: gci-dev-56-8977-0-0
+    project: google-containers
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"
+  ubuntu-docker12:
+    image: e2e-node-ubuntu-trusty-docker12-v1-image
+    project: kubernetes-node-e2e-images

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/cri_validation/jenkins-benchmark.properties

@@ -0,0 +1,9 @@
+GCE_HOSTS=
+GCE_IMAGE_CONFIG_PATH=test/e2e_node/jenkins/cri_validation/benchmark-config.yaml
+GCE_ZONE=us-central1-f
+GCE_PROJECT=k8s-jkns-ci-node-e2e
+CLEANUP=true
+GINKGO_FLAGS='--skip="\[Flaky\]"'
+TEST_ARGS='--feature-gates=DynamicKubeletConfig=true,StreamingProxyRedirects=true'
+KUBELET_ARGS='--experimental-cri=true'
+PARALLELISM=1

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/cri_validation/jenkins-pull.properties

@@ -0,0 +1,8 @@
+GCE_HOSTS=
+GCE_IMAGE_CONFIG_PATH=test/e2e_node/jenkins/cri_validation/image-config.yaml
+GCE_ZONE=us-central1-f
+GCE_PROJECT=k8s-jkns-pr-node-e2e
+CLEANUP=true
+GINKGO_FLAGS='--skip="\[Flaky\]|\[Slow\]|\[Serial\]" --flakeAttempts=2'
+TEST_ARGS='--feature-gates=StreamingProxyRedirects=true'
+KUBELET_ARGS='--experimental-cri=true'

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/cri_validation/jenkins-serial.properties

@@ -0,0 +1,10 @@
+GCE_HOSTS=
+GCE_IMAGE_CONFIG_PATH=test/e2e_node/jenkins/cri_validation/image-config.yaml
+GCE_ZONE=us-central1-f
+GCE_PROJECT=k8s-jkns-ci-node-e2e
+CLEANUP=true
+GINKGO_FLAGS='--focus="\[Serial\]" --skip="\[Flaky\]|\[Benchmark\]"'
+TEST_ARGS='--feature-gates=DynamicKubeletConfig=true,StreamingProxyRedirects=true'
+KUBELET_ARGS='--experimental-cri=true'
+PARALLELISM=1
+TIMEOUT=3h

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/cri_validation/jenkins-validation.properties

@@ -0,0 +1,9 @@
+GCE_HOSTS=
+GCE_IMAGE_CONFIG_PATH=test/e2e_node/jenkins/cri_validation/image-config.yaml
+GCE_ZONE=us-central1-f
+GCE_PROJECT=k8s-jkns-ci-node-e2e
+CLEANUP=true
+GINKGO_FLAGS='--skip="\[Flaky\]|\[Serial\]"'
+TEST_ARGS='--feature-gates=StreamingProxyRedirects=true'
+KUBELET_ARGS='--experimental-cri=true'
+TIMEOUT=1h

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/docker_validation/jenkins-perf.properties

@@ -0,0 +1,21 @@
+#!/bin/bash
+GCI_IMAGE_PROJECT=container-vm-image-staging
+GCI_IMAGE_FAMILY=gci-canary-test
+GCI_IMAGE=$(gcloud compute images describe-from-family ${GCI_IMAGE_FAMILY} --project=${GCI_IMAGE_PROJECT} --format="value(name)")
+DOCKER_VERSION=$(curl -fsSL --retry 3 https://api.github.com/repos/docker/docker/releases | tac | tac | grep -m 1 "\"tag_name\"\:" | grep -Eo "[0-9\.rc-]+")
+GCI_CLOUD_INIT=test/e2e_node/jenkins/gci-init.yaml
+
+# Render the test config file
+GCE_IMAGE_CONFIG_PATH=`mktemp`
+CONFIG_FILE=test/e2e_node/jenkins/docker_validation/perf-config.yaml
+cp $CONFIG_FILE $GCE_IMAGE_CONFIG_PATH
+sed -i -e "s@{{IMAGE}}@${GCI_IMAGE}@g" $GCE_IMAGE_CONFIG_PATH
+sed -i -e "s@{{IMAGE_PROJECT}}@${GCI_IMAGE_PROJECT}@g" $GCE_IMAGE_CONFIG_PATH
+sed -i -e "s@{{METADATA}}@user-data<${GCI_CLOUD_INIT},gci-docker-version=${DOCKER_VERSION},gci-update-strategy=update_disabled@g" $GCE_IMAGE_CONFIG_PATH
+
+GCE_HOSTS=
+GCE_ZONE=us-central1-f
+GCE_PROJECT=k8s-jkns-ci-node-e2e
+CLEANUP=true
+GINKGO_FLAGS='--skip="\[Flaky\]"'
+PARALLELISM=1

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/docker_validation/jenkins-validation.properties

@@ -0,0 +1,17 @@
+GCI_IMAGE_PROJECT=container-vm-image-staging
+GCI_IMAGE_FAMILY=gci-canary-test
+GCI_IMAGE=$(gcloud compute images describe-from-family ${GCI_IMAGE_FAMILY} --project=${GCI_IMAGE_PROJECT} --format="value(name)")
+DOCKER_VERSION=$(curl -fsSL --retry 3 https://api.github.com/repos/docker/docker/releases | tac | tac | grep -m 1 "\"tag_name\"\:" | grep -Eo "[0-9\.rc-]+")
+GCI_CLOUD_INIT=test/e2e_node/jenkins/gci-init.yaml
+
+GCE_HOSTS=
+GCE_IMAGES=${GCI_IMAGE}
+GCE_IMAGE_PROJECT=${GCI_IMAGE_PROJECT}
+GCE_ZONE=us-central1-f
+GCE_PROJECT=k8s-jkns-ci-node-e2e
+# user-data is the GCI cloud init config file.
+# gci-docker-version specifies docker version in GCI image.
+GCE_INSTANCE_METADATA="user-data<${GCI_CLOUD_INIT},gci-docker-version=${DOCKER_VERSION},gci-update-strategy=update_disabled"
+CLEANUP=true
+GINKGO_FLAGS='--skip="\[Flaky\]|\[Serial\]"'
+TIMEOUT=1h

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/docker_validation/perf-config.yaml

@@ -0,0 +1,58 @@
+---
+images:
+  density1:
+    image: "{{IMAGE}}"
+    project: "{{IMAGE_PROJECT}}"
+    metadata: "{{METADATA}}"
+    machine: n1-standard-1
+    tests:
+      - '.*create 35 pods with 0s? interval \[Benchmark\]'
+  density2:
+    image: "{{IMAGE}}"
+    project: "{{IMAGE_PROJECT}}"
+    metadata: "{{METADATA}}"
+    machine: n1-standard-1
+    tests:
+      - '.*create 105 pods with 0s? interval \[Benchmark\]'
+  density3:
+    image: "{{IMAGE}}"
+    project: "{{IMAGE_PROJECT}}"
+    metadata: "{{METADATA}}"
+    machine: n1-standard-2
+    tests:
+      - '.*create 105 pods with 0s? interval \[Benchmark\]'
+  density4:
+    image: "{{IMAGE}}"
+    project: "{{IMAGE_PROJECT}}"
+    metadata: "{{METADATA}}"
+    machine: n1-standard-1
+    tests:
+      - '.*create 35 pods with 100ms interval \[Benchmark\]'
+  density5:
+    image: "{{IMAGE}}"
+    project: "{{IMAGE_PROJECT}}"
+    metadata: "{{METADATA}}"
+    machine: n1-standard-1
+    tests:
+      - '.*create 105 pods with 100ms interval \[Benchmark\]'
+  density6:
+    image: "{{IMAGE}}"
+    project: "{{IMAGE_PROJECT}}"
+    metadata: "{{METADATA}}"
+    machine: n1-standard-2
+    tests:
+      - '.*create 105 pods with 100ms interval \[Benchmark\]'
+  density7:
+    image: "{{IMAGE}}"
+    project: "{{IMAGE_PROJECT}}"
+    metadata: "{{METADATA}}"
+    machine: n1-standard-1
+    tests:
+      - '.*create 105 pods with 300ms interval \[Benchmark\]'
+  density8:
+    image: "{{IMAGE}}"
+    project: "{{IMAGE_PROJECT}}"
+    metadata: "{{METADATA}}"
+    machine: n1-standard-2
+    tests:
+      - '.*create 105 pods with 300ms interval \[Benchmark\]'

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/e2e-node-jenkins.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Script executed by jenkins to run node e2e tests against gce
+# Usage: test/e2e_node/jenkins/e2e-node-jenkins.sh <path to properties>
+# Properties files:
+# - test/e2e_node/jenkins/jenkins-ci.properties : for running jenkins ci
+# - test/e2e_node/jenkins/jenkins-pull.properties : for running jenkins pull request builder
+# - test/e2e_node/jenkins/template.properties : template for creating a properties file to run locally
+
+set -e
+set -x
+
+: "${1:?Usage test/e2e_node/jenkins/e2e-node-jenkins.sh <path to properties>}"
+
+. $1
+
+# indirectly generates test/e2e/generated/bindata.go too
+make generated_files
+
+# TODO converge build steps with hack/build-go some day if possible.
+go build test/e2e_node/environment/conformance.go
+
+PARALLELISM=${PARALLELISM:-8}
+WORKSPACE=${WORKSPACE:-"/tmp/"}
+ARTIFACTS=${WORKSPACE}/_artifacts
+TIMEOUT=${TIMEOUT:-"45m"}
+
+mkdir -p ${ARTIFACTS}
+
+go run test/e2e_node/runner/remote/run_remote.go  --logtostderr --vmodule=*=4 \
+  --ssh-env="gce" --ssh-user="$GCE_USER" --zone="$GCE_ZONE" --project="$GCE_PROJECT" \
+  --hosts="$GCE_HOSTS" --images="$GCE_IMAGES" --image-project="$GCE_IMAGE_PROJECT" \
+  --image-config-file="$GCE_IMAGE_CONFIG_PATH" --cleanup="$CLEANUP" \
+  --results-dir="$ARTIFACTS" --ginkgo-flags="--nodes=$PARALLELISM $GINKGO_FLAGS" \
+  --test-timeout="$TIMEOUT" --test_args="$TEST_ARGS --kubelet-flags=\"$KUBELET_ARGS\"" \
+  --instance-metadata="$GCE_INSTANCE_METADATA"

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/gci-init.yaml

@@ -0,0 +1,12 @@
+#cloud-config
+
+runcmd:
+  - mount /tmp /tmp -o remount,exec,suid
+  - usermod -a -G docker jenkins
+  - mkdir -p /home/kubernetes/bin/
+  - mount -B /home/kubernetes/bin /home/kubernetes/bin
+  - mount -B -o remount,exec /home/kubernetes/bin 
+  - wget https://storage.googleapis.com/kubernetes-release/rkt/v1.18.0/rkt -O /home/kubernetes/bin/rkt
+  - wget https://storage.googleapis.com/kubernetes-release/rkt/v1.18.0/stage1-fly.aci -O /home/kubernetes/bin/stage1-fly.aci
+  - wget https://storage.googleapis.com/kubernetes-release/gci-mounter/gci-mounter-v2.aci -O /home/kubernetes/bin/gci-mounter-v2.aci
+  - chmod a+x /home/kubernetes/bin/rkt

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/image-config.yaml

@@ -0,0 +1,21 @@
+# To copy an image between projects:
+# `gcloud compute --project <to-project> disks create <image name> --image=https://www.googleapis.com/compute/v1/projects/<from-project>/global/images/<image-name>`
+# `gcloud compute --project <to-project> images create <image-name> --source-disk=<image-name>`
+images:
+  ubuntu-docker10:
+    image: e2e-node-ubuntu-trusty-docker10-v2-image # docker 1.10.3
+    project: kubernetes-node-e2e-images
+  ubuntu-docker12:
+    image: e2e-node-ubuntu-trusty-docker12-v1-image # docker 1.12.4
+    project: kubernetes-node-e2e-images
+  coreos-alpha:
+    image: coreos-alpha-1122-0-0-v20160727 # docker 1.11.2
+    project: coreos-cloud
+    metadata: "user-data<test/e2e_node/jenkins/coreos-init.json"
+  containervm:
+    image: e2e-node-containervm-v20161208-image # docker 1.11.2
+    project: kubernetes-node-e2e-images
+  gci-family:
+    image_regex: gci-dev-56-8977-0-0 # docker 1.11.2
+    project: google-containers
+    metadata: "user-data<test/e2e_node/jenkins/gci-init.yaml,gci-update-strategy=update_disabled"

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/jenkins-ci.properties

@@ -0,0 +1,8 @@
+GCE_HOSTS=
+GCE_IMAGE_CONFIG_PATH=test/e2e_node/jenkins/image-config.yaml
+GCE_ZONE=us-central1-f
+GCE_PROJECT=k8s-jkns-ci-node-e2e
+CLEANUP=true
+GINKGO_FLAGS='--skip="\[Flaky\]|\[Serial\]"'
+KUBELET_ARGS='--experimental-cgroups-per-qos=true --cgroup-root=/'
+TIMEOUT=1h

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/jenkins-flaky.properties

@@ -0,0 +1,7 @@
+GCE_HOSTS=
+GCE_IMAGE_CONFIG_PATH=test/e2e_node/jenkins/image-config.yaml
+GCE_ZONE=us-central1-f
+GCE_PROJECT=k8s-jkns-ci-node-e2e
+CLEANUP=true
+GINKGO_FLAGS='--focus="\[Flaky\]"'
+KUBELET_ARGS='--experimental-cgroups-per-qos=true --cgroup-root=/'

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/jenkins-pull.properties

@@ -0,0 +1,8 @@
+GCE_HOSTS=
+GCE_IMAGE_CONFIG_PATH=test/e2e_node/jenkins/image-config.yaml
+GCE_ZONE=us-central1-f
+GCE_PROJECT=k8s-jkns-pr-node-e2e
+CLEANUP=true
+GINKGO_FLAGS='--skip="\[Flaky\]|\[Slow\]|\[Serial\]" --flakeAttempts=2'
+KUBELET_ARGS='--experimental-cgroups-per-qos=true --cgroup-root=/'
+

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/jenkins-serial.properties

@@ -0,0 +1,10 @@
+GCE_HOSTS=
+GCE_IMAGE_CONFIG_PATH=test/e2e_node/jenkins/image-config.yaml
+GCE_ZONE=us-central1-f
+GCE_PROJECT=k8s-jkns-ci-node-e2e
+CLEANUP=true
+GINKGO_FLAGS='--focus="\[Serial\]" --skip="\[Flaky\]|\[Benchmark\]"'
+TEST_ARGS='--feature-gates=DynamicKubeletConfig=true'
+KUBELET_ARGS='--experimental-cgroups-per-qos=true --cgroup-root=/'
+PARALLELISM=1
+TIMEOUT=3h

vendor/k8s.io/kubernetes/test/e2e_node/jenkins/template.properties

@@ -0,0 +1,25 @@
+# Copy this file to your home directory and modify
+# User used on the gce instances to run the test.
+GCE_USER=
+# Path to a yaml or json file describing images to run or empty
+GCE_IMAGE_CONFIG_PATH=
+# Names of gce hosts to test against (must be resolvable) or empty
+GCE_HOSTS=
+# Comma-separated names of gce images to test or empty (one or more of GCE_IMAGE_CONFIG_PATH, GCE_IMAGES, GCE_HOSTS is required)
+GCE_IMAGES=
+# Gce zone to use - required when using GCE_IMAGES
+GCE_ZONE=
+# Gce project to use for creating instances
+# required when using GCE_IMAGES or GCE_IMAGE_CONFIG_PATH
+GCE_PROJECT=
+# Gce project to use for GCE_IMAGES
+# required when using GCE_IMAGES
+GCE_IMAGE_PROJECT=
+# If true, delete instances created from GCE_IMAGES/GCE_IMAGE_CONFIG_PATH and files copied to GCE_HOSTS
+CLEANUP=true
+# KUBELET_ARGS are the arguments passed to kubelet. The args will override corresponding default kubelet
+# setting in the test framework and --kubelet-flags in TEST_ARGS.
+# If true QoS Cgroup Hierarchy is created and tests specifc to the cgroup hierarchy run
+KUBELET_ARGS='--experimental-cgroups-per-qos=true --cgroup-root=/'
+# TEST_ARGS are args passed to node e2e test.
+TEST_ARGS=''

vendor/k8s.io/kubernetes/test/e2e_node/kubelet_test.go

@@ -0,0 +1,154 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"bytes"
+	"fmt"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/util/uuid"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = framework.KubeDescribe("Kubelet", func() {
+	f := framework.NewDefaultFramework("kubelet-test")
+	var podClient *framework.PodClient
+	BeforeEach(func() {
+		podClient = f.PodClient()
+	})
+	Context("when scheduling a busybox command in a pod", func() {
+		podName := "busybox-scheduling-" + string(uuid.NewUUID())
+		It("it should print the output to logs [Conformance]", func() {
+			podClient.CreateSync(&v1.Pod{
+				ObjectMeta: v1.ObjectMeta{
+					Name: podName,
+				},
+				Spec: v1.PodSpec{
+					// Don't restart the Pod since it is expected to exit
+					RestartPolicy: v1.RestartPolicyNever,
+					Containers: []v1.Container{
+						{
+							Image:   "gcr.io/google_containers/busybox:1.24",
+							Name:    podName,
+							Command: []string{"sh", "-c", "echo 'Hello World' ; sleep 240"},
+						},
+					},
+				},
+			})
+			Eventually(func() string {
+				sinceTime := metav1.NewTime(time.Now().Add(time.Duration(-1 * time.Hour)))
+				rc, err := podClient.GetLogs(podName, &v1.PodLogOptions{SinceTime: &sinceTime}).Stream()
+				if err != nil {
+					return ""
+				}
+				defer rc.Close()
+				buf := new(bytes.Buffer)
+				buf.ReadFrom(rc)
+				return buf.String()
+			}, time.Minute, time.Second*4).Should(Equal("Hello World\n"))
+		})
+	})
+	Context("when scheduling a busybox command that always fails in a pod", func() {
+		var podName string
+
+		BeforeEach(func() {
+			podName = "bin-false" + string(uuid.NewUUID())
+			podClient.Create(&v1.Pod{
+				ObjectMeta: v1.ObjectMeta{
+					Name: podName,
+				},
+				Spec: v1.PodSpec{
+					// Don't restart the Pod since it is expected to exit
+					RestartPolicy: v1.RestartPolicyNever,
+					Containers: []v1.Container{
+						{
+							Image:   "gcr.io/google_containers/busybox:1.24",
+							Name:    podName,
+							Command: []string{"/bin/false"},
+						},
+					},
+				},
+			})
+		})
+
+		It("should have an error terminated reason", func() {
+			Eventually(func() error {
+				podData, err := podClient.Get(podName, metav1.GetOptions{})
+				if err != nil {
+					return err
+				}
+				if len(podData.Status.ContainerStatuses) != 1 {
+					return fmt.Errorf("expected only one container in the pod %q", podName)
+				}
+				contTerminatedState := podData.Status.ContainerStatuses[0].State.Terminated
+				if contTerminatedState == nil {
+					return fmt.Errorf("expected state to be terminated. Got pod status: %+v", podData.Status)
+				}
+				if contTerminatedState.Reason != "Error" {
+					return fmt.Errorf("expected terminated state reason to be error. Got %+v", contTerminatedState)
+				}
+				return nil
+			}, time.Minute, time.Second*4).Should(BeNil())
+		})
+
+		It("should be possible to delete", func() {
+			err := podClient.Delete(podName, &v1.DeleteOptions{})
+			Expect(err).To(BeNil(), fmt.Sprintf("Error deleting Pod %v", err))
+		})
+	})
+	Context("when scheduling a read only busybox container", func() {
+		podName := "busybox-readonly-fs" + string(uuid.NewUUID())
+		It("it should not write to root filesystem [Conformance]", func() {
+			isReadOnly := true
+			podClient.CreateSync(&v1.Pod{
+				ObjectMeta: v1.ObjectMeta{
+					Name: podName,
+				},
+				Spec: v1.PodSpec{
+					// Don't restart the Pod since it is expected to exit
+					RestartPolicy: v1.RestartPolicyNever,
+					Containers: []v1.Container{
+						{
+							Image:   "gcr.io/google_containers/busybox:1.24",
+							Name:    podName,
+							Command: []string{"sh", "-c", "echo test > /file; sleep 240"},
+							SecurityContext: &v1.SecurityContext{
+								ReadOnlyRootFilesystem: &isReadOnly,
+							},
+						},
+					},
+				},
+			})
+			Eventually(func() string {
+				rc, err := podClient.GetLogs(podName, &v1.PodLogOptions{}).Stream()
+				if err != nil {
+					return ""
+				}
+				defer rc.Close()
+				buf := new(bytes.Buffer)
+				buf.ReadFrom(rc)
+				return buf.String()
+			}, time.Minute, time.Second*4).Should(Equal("sh: can't create /file: Read-only file system\n"))
+		})
+	})
+})

vendor/k8s.io/kubernetes/test/e2e_node/lifecycle_hook_test.go

@@ -0,0 +1,237 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+	"time"
+
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/util/intstr"
+	"k8s.io/kubernetes/pkg/util/uuid"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = framework.KubeDescribe("Container Lifecycle Hook", func() {
+	f := framework.NewDefaultFramework("container-lifecycle-hook")
+	var podClient *framework.PodClient
+	const (
+		podCheckInterval     = 1 * time.Second
+		podWaitTimeout       = 2 * time.Minute
+		postStartWaitTimeout = 2 * time.Minute
+		preStopWaitTimeout   = 30 * time.Second
+	)
+	Context("when create a pod with lifecycle hook", func() {
+		BeforeEach(func() {
+			podClient = f.PodClient()
+		})
+
+		Context("when it is exec hook", func() {
+			var file string
+			testPodWithExecHook := func(podWithHook *v1.Pod) {
+				podCheckHook := getExecHookTestPod("pod-check-hook",
+					// Wait until the file is created.
+					[]string{"sh", "-c", fmt.Sprintf("while [ ! -e %s ]; do sleep 1; done", file)},
+				)
+				By("create the pod with lifecycle hook")
+				podClient.CreateSync(podWithHook)
+				if podWithHook.Spec.Containers[0].Lifecycle.PostStart != nil {
+					By("create the hook check pod")
+					podClient.Create(podCheckHook)
+					By("wait for the hook check pod to success")
+					podClient.WaitForSuccess(podCheckHook.Name, postStartWaitTimeout)
+				}
+				By("delete the pod with lifecycle hook")
+				podClient.DeleteSync(podWithHook.Name, v1.NewDeleteOptions(15), podWaitTimeout)
+				if podWithHook.Spec.Containers[0].Lifecycle.PreStop != nil {
+					By("create the hook check pod")
+					podClient.Create(podCheckHook)
+					By("wait for the prestop check pod to success")
+					podClient.WaitForSuccess(podCheckHook.Name, preStopWaitTimeout)
+				}
+			}
+
+			BeforeEach(func() {
+				file = "/tmp/test-" + string(uuid.NewUUID())
+			})
+
+			AfterEach(func() {
+				By("cleanup the temporary file created in the test.")
+				cleanupPod := getExecHookTestPod("pod-clean-up", []string{"rm", file})
+				podClient.Create(cleanupPod)
+				podClient.WaitForSuccess(cleanupPod.Name, podWaitTimeout)
+			})
+
+			It("should execute poststart exec hook properly [Conformance]", func() {
+				podWithHook := getExecHookTestPod("pod-with-poststart-exec-hook",
+					// Block forever
+					[]string{"tail", "-f", "/dev/null"},
+				)
+				podWithHook.Spec.Containers[0].Lifecycle = &v1.Lifecycle{
+					PostStart: &v1.Handler{
+						Exec: &v1.ExecAction{Command: []string{"touch", file}},
+					},
+				}
+				testPodWithExecHook(podWithHook)
+			})
+
+			It("should execute prestop exec hook properly [Conformance]", func() {
+				podWithHook := getExecHookTestPod("pod-with-prestop-exec-hook",
+					// Block forever
+					[]string{"tail", "-f", "/dev/null"},
+				)
+				podWithHook.Spec.Containers[0].Lifecycle = &v1.Lifecycle{
+					PreStop: &v1.Handler{
+						Exec: &v1.ExecAction{Command: []string{"touch", file}},
+					},
+				}
+				testPodWithExecHook(podWithHook)
+			})
+		})
+
+		Context("when it is http hook", func() {
+			var targetIP string
+			podHandleHookRequest := &v1.Pod{
+				ObjectMeta: v1.ObjectMeta{
+					Name: "pod-handle-http-request",
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{
+							Name:  "pod-handle-http-request",
+							Image: "gcr.io/google_containers/netexec:1.7",
+							Ports: []v1.ContainerPort{
+								{
+									ContainerPort: 8080,
+									Protocol:      v1.ProtocolTCP,
+								},
+							},
+						},
+					},
+				},
+			}
+			BeforeEach(func() {
+				By("create the container to handle the HTTPGet hook request.")
+				newPod := podClient.CreateSync(podHandleHookRequest)
+				targetIP = newPod.Status.PodIP
+			})
+			testPodWithHttpHook := func(podWithHook *v1.Pod) {
+				By("create the pod with lifecycle hook")
+				podClient.CreateSync(podWithHook)
+				if podWithHook.Spec.Containers[0].Lifecycle.PostStart != nil {
+					By("check poststart hook")
+					Eventually(func() error {
+						return podClient.MatchContainerOutput(podHandleHookRequest.Name, podHandleHookRequest.Spec.Containers[0].Name,
+							`GET /echo\?msg=poststart`)
+					}, postStartWaitTimeout, podCheckInterval).Should(BeNil())
+				}
+				By("delete the pod with lifecycle hook")
+				podClient.DeleteSync(podWithHook.Name, v1.NewDeleteOptions(15), podWaitTimeout)
+				if podWithHook.Spec.Containers[0].Lifecycle.PreStop != nil {
+					By("check prestop hook")
+					Eventually(func() error {
+						return podClient.MatchContainerOutput(podHandleHookRequest.Name, podHandleHookRequest.Spec.Containers[0].Name,
+							`GET /echo\?msg=prestop`)
+					}, preStopWaitTimeout, podCheckInterval).Should(BeNil())
+				}
+			}
+			It("should execute poststart http hook properly [Conformance]", func() {
+				podWithHook := &v1.Pod{
+					ObjectMeta: v1.ObjectMeta{
+						Name: "pod-with-poststart-http-hook",
+					},
+					Spec: v1.PodSpec{
+						Containers: []v1.Container{
+							{
+								Name:  "pod-with-poststart-http-hook",
+								Image: framework.GetPauseImageNameForHostArch(),
+								Lifecycle: &v1.Lifecycle{
+									PostStart: &v1.Handler{
+										HTTPGet: &v1.HTTPGetAction{
+											Path: "/echo?msg=poststart",
+											Host: targetIP,
+											Port: intstr.FromInt(8080),
+										},
+									},
+								},
+							},
+						},
+					},
+				}
+				testPodWithHttpHook(podWithHook)
+			})
+			It("should execute prestop http hook properly [Conformance]", func() {
+				podWithHook := &v1.Pod{
+					ObjectMeta: v1.ObjectMeta{
+						Name: "pod-with-prestop-http-hook",
+					},
+					Spec: v1.PodSpec{
+						Containers: []v1.Container{
+							{
+								Name:  "pod-with-prestop-http-hook",
+								Image: framework.GetPauseImageNameForHostArch(),
+								Lifecycle: &v1.Lifecycle{
+									PreStop: &v1.Handler{
+										HTTPGet: &v1.HTTPGetAction{
+											Path: "/echo?msg=prestop",
+											Host: targetIP,
+											Port: intstr.FromInt(8080),
+										},
+									},
+								},
+							},
+						},
+					},
+				}
+				testPodWithHttpHook(podWithHook)
+			})
+		})
+	})
+})
+
+func getExecHookTestPod(name string, cmd []string) *v1.Pod {
+	return &v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Name: name,
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name:  name,
+					Image: "gcr.io/google_containers/busybox:1.24",
+					VolumeMounts: []v1.VolumeMount{
+						{
+							Name:      "tmpfs",
+							MountPath: "/tmp",
+						},
+					},
+					Command: cmd,
+				},
+			},
+			RestartPolicy: v1.RestartPolicyNever,
+			Volumes: []v1.Volume{
+				{
+					Name:         "tmpfs",
+					VolumeSource: v1.VolumeSource{HostPath: &v1.HostPathVolumeSource{Path: "/tmp"}},
+				},
+			},
+		},
+	}
+}

vendor/k8s.io/kubernetes/test/e2e_node/log_path_test.go

@@ -0,0 +1,120 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/kubelet"
+	kubecontainer "k8s.io/kubernetes/pkg/kubelet/container"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+)
+
+const (
+	logString = "This is the expected log content of this node e2e test"
+
+	logPodName    = "logger-pod"
+	logContName   = "logger-container"
+	checkPodName  = "checker-pod"
+	checkContName = "checker-container"
+)
+
+var _ = framework.KubeDescribe("ContainerLogPath", func() {
+	f := framework.NewDefaultFramework("kubelet-container-log-path")
+	Describe("Pod with a container", func() {
+		Context("printed log to stdout", func() {
+			It("should print log to correct log path", func() {
+				podClient := f.PodClient()
+				ns := f.Namespace.Name
+
+				logDirVolumeName := "log-dir-vol"
+				logDir := kubelet.ContainerLogsDir
+
+				logPod := &v1.Pod{
+					ObjectMeta: v1.ObjectMeta{
+						Name: logPodName,
+					},
+					Spec: v1.PodSpec{
+						// this pod is expected to exit successfully
+						RestartPolicy: v1.RestartPolicyNever,
+						Containers: []v1.Container{
+							{
+								Image:   "gcr.io/google_containers/busybox:1.24",
+								Name:    logContName,
+								Command: []string{"sh", "-c", "echo " + logString},
+							},
+						},
+					},
+				}
+
+				podClient.Create(logPod)
+				err := framework.WaitForPodSuccessInNamespace(f.ClientSet, logPodName, ns)
+				framework.ExpectNoError(err, "Failed waiting for pod: %s to enter success state", logPodName)
+
+				// get containerID from created Pod
+				createdLogPod, err := podClient.Get(logPodName, metav1.GetOptions{})
+				logConID := kubecontainer.ParseContainerID(createdLogPod.Status.ContainerStatuses[0].ContainerID)
+				framework.ExpectNoError(err, "Failed to get pod: %s", logPodName)
+
+				expectedlogFile := logDir + "/" + logPodName + "_" + ns + "_" + logContName + "-" + logConID.ID + ".log"
+
+				checkPod := &v1.Pod{
+					ObjectMeta: v1.ObjectMeta{
+						Name: checkPodName,
+					},
+					Spec: v1.PodSpec{
+						// this pod is expected to exit successfully
+						RestartPolicy: v1.RestartPolicyNever,
+						Containers: []v1.Container{
+							{
+								Image: "gcr.io/google_containers/busybox:1.24",
+								Name:  checkContName,
+								// If we find expected log file and contains right content, exit 0
+								// else, keep checking until test timeout
+								Command: []string{"sh", "-c", "while true; do if [ -e " + expectedlogFile + " ] && grep -q " + logString + " " + expectedlogFile + "; then exit 0; fi; sleep 1; done"},
+								VolumeMounts: []v1.VolumeMount{
+									{
+										Name: logDirVolumeName,
+										// mount ContainerLogsDir to the same path in container
+										MountPath: expectedlogFile,
+										ReadOnly:  true,
+									},
+								},
+							},
+						},
+						Volumes: []v1.Volume{
+							{
+								Name: logDirVolumeName,
+								VolumeSource: v1.VolumeSource{
+									HostPath: &v1.HostPathVolumeSource{
+										Path: expectedlogFile,
+									},
+								},
+							},
+						},
+					},
+				}
+
+				podClient.Create(checkPod)
+				err = framework.WaitForPodSuccessInNamespace(f.ClientSet, checkPodName, ns)
+				framework.ExpectNoError(err, "Failed waiting for pod: %s to enter success state", checkPodName)
+			})
+		})
+	})
+})

vendor/k8s.io/kubernetes/test/e2e_node/memory_eviction_test.go

@@ -0,0 +1,272 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+	"strconv"
+	"time"
+
+	"github.com/golang/glog"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+// Eviction Policy is described here:
+// https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/kubelet-eviction.md
+
+var _ = framework.KubeDescribe("MemoryEviction [Slow] [Serial] [Disruptive]", func() {
+	f := framework.NewDefaultFramework("eviction-test")
+
+	// This is a dummy context to wrap the outer AfterEach, which will run after the inner AfterEach.
+	// We want to list all of the node and pod events, including any that occur while waiting for
+	// memory pressure reduction, even if we time out while waiting.
+	Context("", func() {
+		AfterEach(func() {
+			logNodeEvents(f)
+			logPodEvents(f)
+		})
+
+		Context("when there is memory pressure", func() {
+			AfterEach(func() {
+				// Wait for the memory pressure condition to disappear from the node status before continuing.
+				By("waiting for the memory pressure condition on the node to disappear before ending the test.")
+				Eventually(func() error {
+					nodeList, err := f.ClientSet.Core().Nodes().List(v1.ListOptions{})
+					if err != nil {
+						return fmt.Errorf("tried to get node list but got error: %v", err)
+					}
+					// Assuming that there is only one node, because this is a node e2e test.
+					if len(nodeList.Items) != 1 {
+						return fmt.Errorf("expected 1 node, but see %d. List: %v", len(nodeList.Items), nodeList.Items)
+					}
+					node := nodeList.Items[0]
+					_, pressure := v1.GetNodeCondition(&node.Status, v1.NodeMemoryPressure)
+					if pressure != nil && pressure.Status == v1.ConditionTrue {
+						return fmt.Errorf("node is still reporting memory pressure condition: %s", pressure)
+					}
+					return nil
+				}, 5*time.Minute, 15*time.Second).Should(BeNil())
+
+				// Check available memory after condition disappears, just in case:
+				// Wait for available memory to decrease to a reasonable level before ending the test.
+				// This helps prevent interference with tests that start immediately after this one.
+				By("waiting for available memory to decrease to a reasonable level before ending the test.")
+				Eventually(func() error {
+					summary, err := getNodeSummary()
+					if err != nil {
+						return err
+					}
+					if summary.Node.Memory.AvailableBytes == nil {
+						return fmt.Errorf("summary.Node.Memory.AvailableBytes was nil, cannot get memory stats.")
+					}
+					if summary.Node.Memory.WorkingSetBytes == nil {
+						return fmt.Errorf("summary.Node.Memory.WorkingSetBytes was nil, cannot get memory stats.")
+					}
+					avail := *summary.Node.Memory.AvailableBytes
+					wset := *summary.Node.Memory.WorkingSetBytes
+
+					// memory limit = avail + wset
+					limit := avail + wset
+					halflimit := limit / 2
+
+					// Wait for at least half of memory limit to be available
+					if avail >= halflimit {
+						return nil
+					}
+					return fmt.Errorf("current available memory is: %d bytes. Expected at least %d bytes available.", avail, halflimit)
+				}, 5*time.Minute, 15*time.Second).Should(BeNil())
+
+				// TODO(mtaufen): 5 minute wait to stop flaky test bleeding while we figure out what is actually going on.
+				//                If related to pressure transition period in eviction manager, probably only need to wait
+				//                just over 30s becasue that is the transition period set for node e2e tests. But since we
+				//                know 5 min works and we don't know if transition period is the problem, wait 5 min for now.
+				time.Sleep(5 * time.Minute)
+
+				// Finally, try starting a new pod and wait for it to be scheduled and running.
+				// This is the final check to try to prevent interference with subsequent tests.
+				podName := "admit-best-effort-pod"
+				f.PodClient().CreateSync(&v1.Pod{
+					ObjectMeta: v1.ObjectMeta{
+						Name: podName,
+					},
+					Spec: v1.PodSpec{
+						RestartPolicy: v1.RestartPolicyNever,
+						Containers: []v1.Container{
+							{
+								Image: framework.GetPauseImageNameForHostArch(),
+								Name:  podName,
+							},
+						},
+					},
+				})
+			})
+
+			It("should evict pods in the correct order (besteffort first, then burstable, then guaranteed)", func() {
+				By("creating a guaranteed pod, a burstable pod, and a besteffort pod.")
+
+				// A pod is guaranteed only when requests and limits are specified for all the containers and they are equal.
+				guaranteed := createMemhogPod(f, "guaranteed-", "guaranteed", v1.ResourceRequirements{
+					Requests: v1.ResourceList{
+						"cpu":    resource.MustParse("100m"),
+						"memory": resource.MustParse("100Mi"),
+					},
+					Limits: v1.ResourceList{
+						"cpu":    resource.MustParse("100m"),
+						"memory": resource.MustParse("100Mi"),
+					}})
+
+				// A pod is burstable if limits and requests do not match across all containers.
+				burstable := createMemhogPod(f, "burstable-", "burstable", v1.ResourceRequirements{
+					Requests: v1.ResourceList{
+						"cpu":    resource.MustParse("100m"),
+						"memory": resource.MustParse("100Mi"),
+					}})
+
+				// A pod is besteffort if none of its containers have specified any requests or limits.
+				besteffort := createMemhogPod(f, "besteffort-", "besteffort", v1.ResourceRequirements{})
+
+				// We poll until timeout or all pods are killed.
+				// Inside the func, we check that all pods are in a valid phase with
+				// respect to the eviction order of best effort, then burstable, then guaranteed.
+				By("polling the Status.Phase of each pod and checking for violations of the eviction order.")
+				Eventually(func() error {
+
+					gteed, gtErr := f.ClientSet.Core().Pods(f.Namespace.Name).Get(guaranteed.Name, metav1.GetOptions{})
+					framework.ExpectNoError(gtErr, fmt.Sprintf("getting pod %s", guaranteed.Name))
+					gteedPh := gteed.Status.Phase
+
+					burst, buErr := f.ClientSet.Core().Pods(f.Namespace.Name).Get(burstable.Name, metav1.GetOptions{})
+					framework.ExpectNoError(buErr, fmt.Sprintf("getting pod %s", burstable.Name))
+					burstPh := burst.Status.Phase
+
+					best, beErr := f.ClientSet.Core().Pods(f.Namespace.Name).Get(besteffort.Name, metav1.GetOptions{})
+					framework.ExpectNoError(beErr, fmt.Sprintf("getting pod %s", besteffort.Name))
+					bestPh := best.Status.Phase
+
+					glog.Infof("pod phase: guaranteed: %v, burstable: %v, besteffort: %v", gteedPh, burstPh, bestPh)
+
+					// NOTE/TODO(mtaufen): This should help us debug why burstable appears to fail before besteffort in some
+					//                     scenarios. We have seen some evidence that the eviction manager has in fact done the
+					//                     right thing and evicted the besteffort first, and attempted to change the besteffort phase
+					//                     to "Failed" when it evicts it, but that for some reason the test isn't seeing the updated
+					//                     phase. I'm trying to confirm or deny this.
+					//                     The eviction manager starts trying to evict things when the node comes under memory
+					//                     pressure, and the eviction manager reports this information in the pressure condition. If we
+					//                     see the eviction manager reporting a pressure condition for a while without the besteffort failing,
+					//                     and we see that the manager did in fact evict the besteffort (this should be in the Kubelet log), we
+					//                     will have more reason to believe the phase is out of date.
+					nodeList, err := f.ClientSet.Core().Nodes().List(v1.ListOptions{})
+					if err != nil {
+						glog.Errorf("tried to get node list but got error: %v", err)
+					}
+					if len(nodeList.Items) != 1 {
+						glog.Errorf("expected 1 node, but see %d. List: %v", len(nodeList.Items), nodeList.Items)
+					}
+					node := nodeList.Items[0]
+					_, pressure := v1.GetNodeCondition(&node.Status, v1.NodeMemoryPressure)
+					glog.Infof("node pressure condition: %s", pressure)
+
+					// NOTE/TODO(mtaufen): Also log (at least temporarily) the actual memory consumption on the node.
+					//                     I used this to plot memory usage from a successful test run and it looks the
+					//                     way I would expect. I want to see what the plot from a flake looks like.
+					summary, err := getNodeSummary()
+					if err != nil {
+						return err
+					}
+					if summary.Node.Memory.WorkingSetBytes != nil {
+						wset := *summary.Node.Memory.WorkingSetBytes
+						glog.Infof("Node's working set is (bytes): %v", wset)
+
+					}
+
+					if bestPh == v1.PodRunning {
+						Expect(burstPh).NotTo(Equal(v1.PodFailed), "burstable pod failed before best effort pod")
+						Expect(gteedPh).NotTo(Equal(v1.PodFailed), "guaranteed pod failed before best effort pod")
+					} else if burstPh == v1.PodRunning {
+						Expect(gteedPh).NotTo(Equal(v1.PodFailed), "guaranteed pod failed before burstable pod")
+					}
+
+					// When both besteffort and burstable have been evicted, the test has completed.
+					if bestPh == v1.PodFailed && burstPh == v1.PodFailed {
+						return nil
+					}
+					return fmt.Errorf("besteffort and burstable have not yet both been evicted.")
+
+				}, 60*time.Minute, 5*time.Second).Should(BeNil())
+
+			})
+		})
+	})
+
+})
+
+func createMemhogPod(f *framework.Framework, genName string, ctnName string, res v1.ResourceRequirements) *v1.Pod {
+	env := []v1.EnvVar{
+		{
+			Name: "MEMORY_LIMIT",
+			ValueFrom: &v1.EnvVarSource{
+				ResourceFieldRef: &v1.ResourceFieldSelector{
+					Resource: "limits.memory",
+				},
+			},
+		},
+	}
+
+	// If there is a limit specified, pass 80% of it for -mem-total, otherwise use the downward API
+	// to pass limits.memory, which will be the total memory available.
+	// This helps prevent a guaranteed pod from triggering an OOM kill due to it's low memory limit,
+	// which will cause the test to fail inappropriately.
+	var memLimit string
+	if limit, ok := res.Limits["memory"]; ok {
+		memLimit = strconv.Itoa(int(
+			float64(limit.Value()) * 0.8))
+	} else {
+		memLimit = "$(MEMORY_LIMIT)"
+	}
+
+	pod := &v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			GenerateName: genName,
+		},
+		Spec: v1.PodSpec{
+			RestartPolicy: v1.RestartPolicyNever,
+			Containers: []v1.Container{
+				{
+					Name:            ctnName,
+					Image:           "gcr.io/google-containers/stress:v1",
+					ImagePullPolicy: "Always",
+					Env:             env,
+					// 60 min timeout * 60s / tick per 10s = 360 ticks before timeout => ~11.11Mi/tick
+					// to fill ~4Gi of memory, so initial ballpark 12Mi/tick.
+					// We might see flakes due to timeout if the total memory on the nodes increases.
+					Args:      []string{"-mem-alloc-size", "12Mi", "-mem-alloc-sleep", "10s", "-mem-total", memLimit},
+					Resources: res,
+				},
+			},
+		},
+	}
+	// The generated pod.Name will be on the pod spec returned by CreateSync
+	pod = f.PodClient().CreateSync(pod)
+	glog.Infof("pod created with name: %s", pod.Name)
+	return pod
+}

vendor/k8s.io/kubernetes/test/e2e_node/mirror_pod_test.go

@@ -0,0 +1,190 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	goerrors "errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/util/uuid"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = framework.KubeDescribe("MirrorPod", func() {
+	f := framework.NewDefaultFramework("mirror-pod")
+	Context("when create a mirror pod ", func() {
+		var ns, manifestPath, staticPodName, mirrorPodName string
+		BeforeEach(func() {
+			ns = f.Namespace.Name
+			staticPodName = "static-pod-" + string(uuid.NewUUID())
+			mirrorPodName = staticPodName + "-" + framework.TestContext.NodeName
+
+			manifestPath = framework.TestContext.KubeletConfig.PodManifestPath
+
+			By("create the static pod")
+			err := createStaticPod(manifestPath, staticPodName, ns,
+				"gcr.io/google_containers/nginx-slim:0.7", v1.RestartPolicyAlways)
+			Expect(err).ShouldNot(HaveOccurred())
+
+			By("wait for the mirror pod to be running")
+			Eventually(func() error {
+				return checkMirrorPodRunning(f.ClientSet, mirrorPodName, ns)
+			}, 2*time.Minute, time.Second*4).Should(BeNil())
+		})
+		It("should be updated when static pod updated [Conformance]", func() {
+			By("get mirror pod uid")
+			pod, err := f.ClientSet.Core().Pods(ns).Get(mirrorPodName, metav1.GetOptions{})
+			Expect(err).ShouldNot(HaveOccurred())
+			uid := pod.UID
+
+			By("update the static pod container image")
+			image := framework.GetPauseImageNameForHostArch()
+			err = createStaticPod(manifestPath, staticPodName, ns, image, v1.RestartPolicyAlways)
+			Expect(err).ShouldNot(HaveOccurred())
+
+			By("wait for the mirror pod to be updated")
+			Eventually(func() error {
+				return checkMirrorPodRecreatedAndRunnig(f.ClientSet, mirrorPodName, ns, uid)
+			}, 2*time.Minute, time.Second*4).Should(BeNil())
+
+			By("check the mirror pod container image is updated")
+			pod, err = f.ClientSet.Core().Pods(ns).Get(mirrorPodName, metav1.GetOptions{})
+			Expect(err).ShouldNot(HaveOccurred())
+			Expect(len(pod.Spec.Containers)).Should(Equal(1))
+			Expect(pod.Spec.Containers[0].Image).Should(Equal(image))
+		})
+		It("should be recreated when mirror pod gracefully deleted [Conformance]", func() {
+			By("get mirror pod uid")
+			pod, err := f.ClientSet.Core().Pods(ns).Get(mirrorPodName, metav1.GetOptions{})
+			Expect(err).ShouldNot(HaveOccurred())
+			uid := pod.UID
+
+			By("delete the mirror pod with grace period 30s")
+			err = f.ClientSet.Core().Pods(ns).Delete(mirrorPodName, v1.NewDeleteOptions(30))
+			Expect(err).ShouldNot(HaveOccurred())
+
+			By("wait for the mirror pod to be recreated")
+			Eventually(func() error {
+				return checkMirrorPodRecreatedAndRunnig(f.ClientSet, mirrorPodName, ns, uid)
+			}, 2*time.Minute, time.Second*4).Should(BeNil())
+		})
+		It("should be recreated when mirror pod forcibly deleted [Conformance]", func() {
+			By("get mirror pod uid")
+			pod, err := f.ClientSet.Core().Pods(ns).Get(mirrorPodName, metav1.GetOptions{})
+			Expect(err).ShouldNot(HaveOccurred())
+			uid := pod.UID
+
+			By("delete the mirror pod with grace period 0s")
+			err = f.ClientSet.Core().Pods(ns).Delete(mirrorPodName, v1.NewDeleteOptions(0))
+			Expect(err).ShouldNot(HaveOccurred())
+
+			By("wait for the mirror pod to be recreated")
+			Eventually(func() error {
+				return checkMirrorPodRecreatedAndRunnig(f.ClientSet, mirrorPodName, ns, uid)
+			}, 2*time.Minute, time.Second*4).Should(BeNil())
+		})
+		AfterEach(func() {
+			By("delete the static pod")
+			err := deleteStaticPod(manifestPath, staticPodName, ns)
+			Expect(err).ShouldNot(HaveOccurred())
+
+			By("wait for the mirror pod to disappear")
+			Eventually(func() error {
+				return checkMirrorPodDisappear(f.ClientSet, mirrorPodName, ns)
+			}, 2*time.Minute, time.Second*4).Should(BeNil())
+		})
+	})
+})
+
+func staticPodPath(dir, name, namespace string) string {
+	return filepath.Join(dir, namespace+"-"+name+".yaml")
+}
+
+func createStaticPod(dir, name, namespace, image string, restart v1.RestartPolicy) error {
+	template := `
+apiVersion: v1
+kind: Pod
+metadata:
+  name: %s
+  namespace: %s
+spec:
+  containers:
+  - name: test
+    image: %s
+    restartPolicy: %s
+`
+	file := staticPodPath(dir, name, namespace)
+	podYaml := fmt.Sprintf(template, name, namespace, image, string(restart))
+
+	f, err := os.OpenFile(file, os.O_RDWR|os.O_TRUNC|os.O_CREATE, 0666)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	_, err = f.WriteString(podYaml)
+	return err
+}
+
+func deleteStaticPod(dir, name, namespace string) error {
+	file := staticPodPath(dir, name, namespace)
+	return os.Remove(file)
+}
+
+func checkMirrorPodDisappear(cl clientset.Interface, name, namespace string) error {
+	_, err := cl.Core().Pods(namespace).Get(name, metav1.GetOptions{})
+	if errors.IsNotFound(err) {
+		return nil
+	}
+	return goerrors.New("pod not disappear")
+}
+
+func checkMirrorPodRunning(cl clientset.Interface, name, namespace string) error {
+	pod, err := cl.Core().Pods(namespace).Get(name, metav1.GetOptions{})
+	if err != nil {
+		return fmt.Errorf("expected the mirror pod %q to appear: %v", name, err)
+	}
+	if pod.Status.Phase != v1.PodRunning {
+		return fmt.Errorf("expected the mirror pod %q to be running, got %q", name, pod.Status.Phase)
+	}
+	return nil
+}
+
+func checkMirrorPodRecreatedAndRunnig(cl clientset.Interface, name, namespace string, oUID types.UID) error {
+	pod, err := cl.Core().Pods(namespace).Get(name, metav1.GetOptions{})
+	if err != nil {
+		return fmt.Errorf("expected the mirror pod %q to appear: %v", name, err)
+	}
+	if pod.UID == oUID {
+		return fmt.Errorf("expected the uid of mirror pod %q to be changed, got %q", name, pod.UID)
+	}
+	if pod.Status.Phase != v1.PodRunning {
+		return fmt.Errorf("expected the mirror pod %q to be running, got %q", name, pod.Status.Phase)
+	}
+	return nil
+}

vendor/k8s.io/kubernetes/test/e2e_node/remote/BUILD

@@ -0,0 +1,39 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "node_conformance.go",
+        "node_e2e.go",
+        "remote.go",
+        "ssh.go",
+        "types.go",
+        "utils.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//test/e2e_node/builder:go_default_library",
+        "//vendor:github.com/golang/glog",
+        "//vendor:k8s.io/apimachinery/pkg/util/errors",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/e2e_node/remote/node_conformance.go

@@ -0,0 +1,298 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package remote
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/kubernetes/test/e2e_node/builder"
+)
+
+// ConformanceRemote contains the specific functions in the node conformance test suite.
+type ConformanceRemote struct{}
+
+func InitConformanceRemote() TestSuite {
+	return &ConformanceRemote{}
+}
+
+// getConformanceDirectory gets node conformance test build directory.
+func getConformanceDirectory() (string, error) {
+	k8sRoot, err := builder.GetK8sRootDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(k8sRoot, "test", "e2e_node", "conformance", "build"), nil
+}
+
+// commandToString is a helper function which formats command to string.
+func commandToString(c *exec.Cmd) string {
+	return strings.Join(append([]string{c.Path}, c.Args[1:]...), " ")
+}
+
+// Image path constants.
+const (
+	conformanceRegistry         = "gcr.io/google_containers"
+	conformanceArch             = runtime.GOARCH
+	conformanceTarfile          = "node_conformance.tar"
+	conformanceTestBinary       = "e2e_node.test"
+	conformanceImageLoadTimeout = time.Duration(30) * time.Second
+)
+
+// timestamp is used as an unique id of current test.
+var timestamp = getTimestamp()
+
+// getConformanceImageRepo returns conformance image full repo name.
+func getConformanceImageRepo() string {
+	return fmt.Sprintf("%s/node-test-%s:%s", conformanceRegistry, conformanceArch, timestamp)
+}
+
+// buildConformanceTest builds node conformance test image tarball into binDir.
+func buildConformanceTest(binDir string) error {
+	// Get node conformance directory.
+	conformancePath, err := getConformanceDirectory()
+	if err != nil {
+		return fmt.Errorf("failed to get node conformance directory: %v", err)
+	}
+	// Build docker image.
+	cmd := exec.Command("make", "-C", conformancePath, "BIN_DIR="+binDir,
+		"REGISTRY="+conformanceRegistry,
+		"ARCH="+conformanceArch,
+		"VERSION="+timestamp)
+	if output, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("failed to build node conformance docker image: command - %q, error - %v, output - %q",
+			commandToString(cmd), err, output)
+	}
+	// Save docker image into tar file.
+	cmd = exec.Command("docker", "save", "-o", filepath.Join(binDir, conformanceTarfile), getConformanceImageRepo())
+	if output, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("failed to save node conformance docker image into tar file: command - %q, error - %v, output - %q",
+			commandToString(cmd), err, output)
+	}
+	return nil
+}
+
+// SetupTestPackage sets up the test package with binaries k8s required for node conformance test
+func (c *ConformanceRemote) SetupTestPackage(tardir string) error {
+	// Build the executables
+	if err := builder.BuildGo(); err != nil {
+		return fmt.Errorf("failed to build the depedencies: %v", err)
+	}
+
+	// Make sure we can find the newly built binaries
+	buildOutputDir, err := builder.GetK8sBuildOutputDir()
+	if err != nil {
+		return fmt.Errorf("failed to locate kubernetes build output directory %v", err)
+	}
+
+	// Build node conformance tarball.
+	if err := buildConformanceTest(buildOutputDir); err != nil {
+		return fmt.Errorf("failed to build node conformance test %v", err)
+	}
+
+	// Copy files
+	requiredFiles := []string{"kubelet", conformanceTestBinary, conformanceTarfile}
+	for _, file := range requiredFiles {
+		source := filepath.Join(buildOutputDir, file)
+		if _, err := os.Stat(source); err != nil {
+			return fmt.Errorf("failed to locate test file %s: %v", file, err)
+		}
+		output, err := exec.Command("cp", source, filepath.Join(tardir, file)).CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("failed to copy %q: error - %v output - %q", file, err, output)
+		}
+	}
+
+	return nil
+}
+
+// loadConformanceImage loads node conformance image from tar file.
+func loadConformanceImage(host, workspace string) error {
+	tarfile := filepath.Join(workspace, conformanceTarfile)
+	if output, err := SSH(host, "timeout", conformanceImageLoadTimeout.String(),
+		"docker", "load", "-i", tarfile); err != nil {
+		return fmt.Errorf("failed to load node conformance image from tar file %q: error - %v output - %q",
+			tarfile, err, output)
+	}
+	return nil
+}
+
+// kubeletLauncherLog is the log of kubelet launcher.
+const kubeletLauncherLog = "kubelet-launcher.log"
+
+// kubeletPodManifestPath is a fixed known pod manifest path. We can not use the random pod
+// manifest directory generated in e2e_node.test because we need to mount the directory into
+// the conformance test container, it's easier if it's a known directory.
+// TODO(random-liu): Get rid of this once we switch to cluster e2e node bootstrap script.
+var kubeletPodManifestPath = "conformance-pod-manifest-" + timestamp
+
+// getPodManifestPath returns pod manifest full path.
+func getPodManifestPath(workspace string) string {
+	return filepath.Join(workspace, kubeletPodManifestPath)
+}
+
+// isSystemd returns whether the node is a systemd node.
+func isSystemd(host string) (bool, error) {
+	// Returns "systemd" if /run/systemd/system is found, empty string otherwise.
+	output, err := SSH(host, "test", "-e", "/run/systemd/system", "&&", "echo", "systemd", "||", "true")
+	if err != nil {
+		return false, fmt.Errorf("failed to check systemd: error - %v output - %q", err, output)
+	}
+	return strings.TrimSpace(output) != "", nil
+}
+
+// launchKubelet launches kubelet by running e2e_node.test binary in run-kubelet-mode.
+// This is a temporary solution, we should change node e2e to use the same node bootstrap
+// with cluster e2e and launch kubelet outside of the test for both regular node e2e and
+// node conformance test.
+// TODO(random-liu): Switch to use standard node bootstrap script.
+func launchKubelet(host, workspace, results, testArgs string) error {
+	podManifestPath := getPodManifestPath(workspace)
+	if output, err := SSH(host, "mkdir", podManifestPath); err != nil {
+		return fmt.Errorf("failed to create kubelet pod manifest path %q: error - %v output - %q",
+			podManifestPath, err, output)
+	}
+	startKubeletCmd := fmt.Sprintf("./%s --run-kubelet-mode --logtostderr --node-name=%s"+
+		" --report-dir=%s %s --kubelet-flags=--pod-manifest-path=%s > %s 2>&1",
+		conformanceTestBinary, host, results, testArgs, podManifestPath, filepath.Join(results, kubeletLauncherLog))
+	var cmd []string
+	systemd, err := isSystemd(host)
+	if err != nil {
+		return fmt.Errorf("failed to check systemd: %v", err)
+	}
+	if systemd {
+		cmd = []string{
+			"systemd-run", "sh", "-c", getSSHCommand(" && ",
+				// Switch to workspace.
+				fmt.Sprintf("cd %s", workspace),
+				// Launch kubelet by running e2e_node.test in run-kubelet-mode.
+				startKubeletCmd,
+			),
+		}
+	} else {
+		cmd = []string{
+			"sh", "-c", getSSHCommand(" && ",
+				// Switch to workspace.
+				fmt.Sprintf("cd %s", workspace),
+				// Launch kubelet by running e2e_node.test in run-kubelet-mode with nohup.
+				fmt.Sprintf("(nohup %s &)", startKubeletCmd),
+			),
+		}
+	}
+	glog.V(2).Infof("Launch kubelet with command: %v", cmd)
+	output, err := SSH(host, cmd...)
+	if err != nil {
+		return fmt.Errorf("failed to launch kubelet with command %v: error - %v output - %q",
+			cmd, err, output)
+	}
+	glog.Info("Successfully launch kubelet")
+	return nil
+}
+
+// kubeletStopGracePeriod is the grace period to wait before forcibly killing kubelet.
+const kubeletStopGracePeriod = 10 * time.Second
+
+// stopKubelet stops kubelet launcher and kubelet gracefully.
+func stopKubelet(host, workspace string) error {
+	glog.Info("Gracefully stop kubelet launcher")
+	if output, err := SSH(host, "pkill", conformanceTestBinary); err != nil {
+		return fmt.Errorf("failed to gracefully stop kubelet launcher: error - %v output - %q",
+			err, output)
+	}
+	glog.Info("Wait for kubelet launcher to stop")
+	stopped := false
+	for start := time.Now(); time.Since(start) < kubeletStopGracePeriod; time.Sleep(time.Second) {
+		// Check whehther the process is still running.
+		output, err := SSH(host, "pidof", conformanceTestBinary, "||", "true")
+		if err != nil {
+			return fmt.Errorf("failed to check kubelet stopping: error - %v output -%q",
+				err, output)
+		}
+		// Kubelet is stopped
+		if strings.TrimSpace(output) == "" {
+			stopped = true
+			break
+		}
+	}
+	if !stopped {
+		glog.Info("Forcibly stop kubelet")
+		if output, err := SSH(host, "pkill", "-SIGKILL", conformanceTestBinary); err != nil {
+			return fmt.Errorf("failed to forcibly stop kubelet: error - %v output - %q",
+				err, output)
+		}
+	}
+	glog.Info("Successfully stop kubelet")
+	// Clean up the pod manifest path
+	podManifestPath := getPodManifestPath(workspace)
+	if output, err := SSH(host, "rm", "-f", filepath.Join(workspace, podManifestPath)); err != nil {
+		return fmt.Errorf("failed to cleanup pod manifest directory %q: error - %v, output - %q",
+			podManifestPath, err, output)
+	}
+	return nil
+}
+
+// RunTest runs test on the node.
+func (c *ConformanceRemote) RunTest(host, workspace, results, junitFilePrefix, testArgs, _ string, timeout time.Duration) (string, error) {
+	// Install the cni plugin.
+	if err := installCNI(host, workspace); err != nil {
+		return "", err
+	}
+
+	// Configure iptables firewall rules.
+	if err := configureFirewall(host); err != nil {
+		return "", err
+	}
+
+	// Kill any running node processes.
+	cleanupNodeProcesses(host)
+
+	// Load node conformance image.
+	if err := loadConformanceImage(host, workspace); err != nil {
+		return "", err
+	}
+
+	// Launch kubelet.
+	if err := launchKubelet(host, workspace, results, testArgs); err != nil {
+		return "", err
+	}
+	// Stop kubelet.
+	defer func() {
+		if err := stopKubelet(host, workspace); err != nil {
+			// Only log an error if failed to stop kubelet because it is not critical.
+			glog.Errorf("failed to stop kubelet: %v", err)
+		}
+	}()
+
+	// Run the tests
+	glog.V(2).Infof("Starting tests on %q", host)
+	podManifestPath := getPodManifestPath(workspace)
+	cmd := fmt.Sprintf("'timeout -k 30s %fs docker run --rm --privileged=true --net=host -v /:/rootfs -v %s:%s -v %s:/var/result -e TEST_ARGS=--report-prefix=%s %s'",
+		timeout.Seconds(), podManifestPath, podManifestPath, results, junitFilePrefix, getConformanceImageRepo())
+	testOutput, err := SSH(host, "sh", "-c", cmd)
+	if err != nil {
+		return testOutput, err
+	}
+
+	return testOutput, nil
+}

vendor/k8s.io/kubernetes/test/e2e_node/remote/node_e2e.go

@@ -0,0 +1,164 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package remote
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/kubernetes/test/e2e_node/builder"
+)
+
+// NodeE2ERemote contains the specific functions in the node e2e test suite.
+type NodeE2ERemote struct{}
+
+func InitNodeE2ERemote() TestSuite {
+	// TODO: Register flags.
+	return &NodeE2ERemote{}
+}
+
+const localGCIMounterPath = "cluster/gce/gci/mounter/mounter"
+
+// SetupTestPackage sets up the test package with binaries k8s required for node e2e tests
+func (n *NodeE2ERemote) SetupTestPackage(tardir string) error {
+	// Build the executables
+	if err := builder.BuildGo(); err != nil {
+		return fmt.Errorf("failed to build the depedencies: %v", err)
+	}
+
+	// Make sure we can find the newly built binaries
+	buildOutputDir, err := builder.GetK8sBuildOutputDir()
+	if err != nil {
+		return fmt.Errorf("failed to locate kubernetes build output directory %v", err)
+	}
+
+	// Copy binaries
+	requiredBins := []string{"kubelet", "e2e_node.test", "ginkgo"}
+	for _, bin := range requiredBins {
+		source := filepath.Join(buildOutputDir, bin)
+		if _, err := os.Stat(source); err != nil {
+			return fmt.Errorf("failed to locate test binary %s: %v", bin, err)
+		}
+		out, err := exec.Command("cp", source, filepath.Join(tardir, bin)).CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("failed to copy %q: %v Output: %q", bin, err, out)
+		}
+	}
+
+	// Include the GCI mounter artifacts in the deployed tarball
+	k8sDir, err := builder.GetK8sRootDir()
+	if err != nil {
+		return fmt.Errorf("Could not find K8s root dir! Err: %v", err)
+	}
+	source := filepath.Join(k8sDir, localGCIMounterPath)
+
+	// Require the GCI mounter script, we want to make sure the remote test runner stays up to date if the mounter file moves
+	if _, err := os.Stat(source); err != nil {
+		return fmt.Errorf("Could not find GCI mounter script at %q! If this script has been (re)moved, please update the e2e node remote test runner accordingly! Err: %v", source, err)
+	}
+
+	bindir := "cluster/gce/gci/mounter"
+	bin := "mounter"
+	destdir := filepath.Join(tardir, bindir)
+	dest := filepath.Join(destdir, bin)
+	out, err := exec.Command("mkdir", "-p", filepath.Join(tardir, bindir)).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("failed to create directory %q for GCI mounter script. Err: %v. Output:\n%s", destdir, err, out)
+	}
+	out, err = exec.Command("cp", source, dest).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("failed to copy GCI mounter script to the archive bin. Err: %v. Output:\n%s", err, out)
+	}
+	return nil
+}
+
+// updateGCIMounterPath updates kubelet flags to set gci mounter path. This will only take effect for
+// GCI image.
+func updateGCIMounterPath(args, host, workspace string) (string, error) {
+	// Determine if tests will run on a GCI node.
+	output, err := SSH(host, "cat", "/etc/os-release")
+	if err != nil {
+		return args, fmt.Errorf("issue detecting node's OS via node's /etc/os-release. Err: %v, Output:\n%s", err, output)
+	}
+	if !strings.Contains(output, "ID=gci") {
+		// This is not a GCI image
+		return args, nil
+	}
+
+	// If we are testing on a GCI node, we chmod 544 the mounter and specify a different mounter path in the test args.
+	// We do this here because the local var `workspace` tells us which /tmp/node-e2e-%d is relevant to the current test run.
+
+	// Determine if the GCI mounter script exists locally.
+	k8sDir, err := builder.GetK8sRootDir()
+	if err != nil {
+		return args, fmt.Errorf("could not find K8s root dir! Err: %v", err)
+	}
+	source := filepath.Join(k8sDir, localGCIMounterPath)
+
+	// Require the GCI mounter script, we want to make sure the remote test runner stays up to date if the mounter file moves
+	if _, err = os.Stat(source); err != nil {
+		return args, fmt.Errorf("could not find GCI mounter script at %q! If this script has been (re)moved, please update the e2e node remote test runner accordingly! Err: %v", source, err)
+	}
+
+	glog.V(2).Infof("GCI node and GCI mounter both detected, modifying --experimental-mounter-path accordingly")
+	// Note this implicitly requires the script to be where we expect in the tarball, so if that location changes the error
+	// here will tell us to update the remote test runner.
+	mounterPath := filepath.Join(workspace, localGCIMounterPath)
+	output, err = SSH(host, "sh", "-c", fmt.Sprintf("'chmod 544 %s'", mounterPath))
+	if err != nil {
+		return args, fmt.Errorf("unabled to chmod 544 GCI mounter script. Err: %v, Output:\n%s", err, output)
+	}
+	// Insert args at beginning of test args, so any values from command line take precedence
+	args = fmt.Sprintf("--kubelet-flags=--experimental-mounter-path=%s ", mounterPath) + args
+	return args, nil
+}
+
+// RunTest runs test on the node.
+func (n *NodeE2ERemote) RunTest(host, workspace, results, junitFilePrefix, testArgs, ginkgoArgs string, timeout time.Duration) (string, error) {
+	// Install the cni plugin.
+	if err := installCNI(host, workspace); err != nil {
+		return "", err
+	}
+
+	// Configure iptables firewall rules
+	if err := configureFirewall(host); err != nil {
+		return "", err
+	}
+
+	// Kill any running node processes
+	cleanupNodeProcesses(host)
+
+	testArgs, err := updateGCIMounterPath(testArgs, host, workspace)
+	if err != nil {
+		return "", err
+	}
+
+	// Run the tests
+	glog.V(2).Infof("Starting tests on %q", host)
+	cmd := getSSHCommand(" && ",
+		fmt.Sprintf("cd %s", workspace),
+		fmt.Sprintf("timeout -k 30s %fs ./ginkgo %s ./e2e_node.test -- --logtostderr --v 4 --node-name=%s --report-dir=%s --report-prefix=%s %s",
+			timeout.Seconds(), ginkgoArgs, host, results, junitFilePrefix, testArgs),
+	)
+	return SSH(host, "sh", "-c", cmd)
+}

vendor/k8s.io/kubernetes/test/e2e_node/remote/remote.go

@@ -0,0 +1,196 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package remote
+
+import (
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"time"
+
+	"github.com/golang/glog"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+)
+
+var testTimeoutSeconds = flag.Duration("test-timeout", 45*time.Minute, "How long (in golang duration format) to wait for ginkgo tests to complete.")
+var resultsDir = flag.String("results-dir", "/tmp/", "Directory to scp test results to.")
+
+const archiveName = "e2e_node_test.tar.gz"
+
+func CreateTestArchive(suite TestSuite) (string, error) {
+	glog.V(2).Infof("Building archive...")
+	tardir, err := ioutil.TempDir("", "node-e2e-archive")
+	if err != nil {
+		return "", fmt.Errorf("failed to create temporary directory %v.", err)
+	}
+	defer os.RemoveAll(tardir)
+
+	// Call the suite function to setup the test package.
+	err = suite.SetupTestPackage(tardir)
+	if err != nil {
+		return "", fmt.Errorf("failed to setup test package %q: %v", tardir, err)
+	}
+
+	// Build the tar
+	out, err := exec.Command("tar", "-zcvf", archiveName, "-C", tardir, ".").CombinedOutput()
+	if err != nil {
+		return "", fmt.Errorf("failed to build tar %v.  Output:\n%s", err, out)
+	}
+
+	dir, err := os.Getwd()
+	if err != nil {
+		return "", fmt.Errorf("failed to get working directory %v.", err)
+	}
+	return filepath.Join(dir, archiveName), nil
+}
+
+// Returns the command output, whether the exit was ok, and any errors
+// TODO(random-liu): junitFilePrefix is not prefix actually, the file name is junit-junitFilePrefix.xml. Change the variable name.
+func RunRemote(suite TestSuite, archive string, host string, cleanup bool, junitFilePrefix string, testArgs string, ginkgoArgs string) (string, bool, error) {
+	// Create the temp staging directory
+	glog.V(2).Infof("Staging test binaries on %q", host)
+	workspace := fmt.Sprintf("/tmp/node-e2e-%s", getTimestamp())
+	// Do not sudo here, so that we can use scp to copy test archive to the directdory.
+	if output, err := SSHNoSudo(host, "mkdir", workspace); err != nil {
+		// Exit failure with the error
+		return "", false, fmt.Errorf("failed to create workspace directory %q on host %q: %v output: %q", workspace, host, err, output)
+	}
+	if cleanup {
+		defer func() {
+			output, err := SSH(host, "rm", "-rf", workspace)
+			if err != nil {
+				glog.Errorf("failed to cleanup workspace %q on host %q: %v.  Output:\n%s", workspace, host, err, output)
+			}
+		}()
+	}
+
+	// Copy the archive to the staging directory
+	if output, err := runSSHCommand("scp", archive, fmt.Sprintf("%s:%s/", GetHostnameOrIp(host), workspace)); err != nil {
+		// Exit failure with the error
+		return "", false, fmt.Errorf("failed to copy test archive: %v, output: %q", err, output)
+	}
+
+	// Extract the archive
+	cmd := getSSHCommand(" && ",
+		fmt.Sprintf("cd %s", workspace),
+		fmt.Sprintf("tar -xzvf ./%s", archiveName),
+	)
+	glog.V(2).Infof("Extracting tar on %q", host)
+	// Do not use sudo here, because `sudo tar -x` will recover the file ownership inside the tar ball, but
+	// we want the extracted files to be owned by the current user.
+	if output, err := SSHNoSudo(host, "sh", "-c", cmd); err != nil {
+		// Exit failure with the error
+		return "", false, fmt.Errorf("failed to extract test archive: %v, output: %q", err, output)
+	}
+
+	// Create the test result directory.
+	resultDir := filepath.Join(workspace, "results")
+	if output, err := SSHNoSudo(host, "mkdir", resultDir); err != nil {
+		// Exit failure with the error
+		return "", false, fmt.Errorf("failed to create test result directory %q on host %q: %v output: %q", resultDir, host, err, output)
+	}
+
+	glog.V(2).Infof("Running test on %q", host)
+	output, err := suite.RunTest(host, workspace, resultDir, junitFilePrefix, testArgs, ginkgoArgs, *testTimeoutSeconds)
+
+	aggErrs := []error{}
+	// Do not log the output here, let the caller deal with the test output.
+	if err != nil {
+		aggErrs = append(aggErrs, err)
+		collectSystemLog(host, workspace)
+	}
+
+	glog.V(2).Infof("Copying test artifacts from %q", host)
+	scpErr := getTestArtifacts(host, workspace)
+	if scpErr != nil {
+		aggErrs = append(aggErrs, scpErr)
+	}
+
+	return output, len(aggErrs) == 0, utilerrors.NewAggregate(aggErrs)
+}
+
+// timestampFormat is the timestamp format used in the node e2e directory name.
+const timestampFormat = "20060102T150405"
+
+func getTimestamp() string {
+	return fmt.Sprintf(time.Now().Format(timestampFormat))
+}
+
+func getTestArtifacts(host, testDir string) error {
+	logPath := filepath.Join(*resultsDir, host)
+	if err := os.MkdirAll(logPath, 0755); err != nil {
+		return fmt.Errorf("failed to create log directory %q: %v", logPath, err)
+	}
+	// Copy logs to artifacts/hostname
+	_, err := runSSHCommand("scp", "-r", fmt.Sprintf("%s:%s/results/*.log", GetHostnameOrIp(host), testDir), logPath)
+	if err != nil {
+		return err
+	}
+	// Copy junit to the top of artifacts
+	_, err = runSSHCommand("scp", fmt.Sprintf("%s:%s/results/junit*", GetHostnameOrIp(host), testDir), *resultsDir)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// collectSystemLog is a temporary hack to collect system log when encountered on
+// unexpected error.
+func collectSystemLog(host, workspace string) {
+	// Encountered an unexpected error. The remote test harness may not
+	// have finished retrieved and stored all the logs in this case. Try
+	// to get some logs for debugging purposes.
+	// TODO: This is a best-effort, temporary hack that only works for
+	// journald nodes. We should have a more robust way to collect logs.
+	var (
+		logName  = "system.log"
+		logPath  = fmt.Sprintf("/tmp/%s-%s", getTimestamp(), logName)
+		destPath = fmt.Sprintf("%s/%s-%s", *resultsDir, host, logName)
+	)
+	glog.V(2).Infof("Test failed unexpectedly. Attempting to retreiving system logs (only works for nodes with journald)")
+	// Try getting the system logs from journald and store it to a file.
+	// Don't reuse the original test directory on the remote host because
+	// it could've be been removed if the node was rebooted.
+	if output, err := SSH(host, "sh", "-c", fmt.Sprintf("'journalctl --system --all > %s'", logPath)); err == nil {
+		glog.V(2).Infof("Got the system logs from journald; copying it back...")
+		if output, err := runSSHCommand("scp", fmt.Sprintf("%s:%s", GetHostnameOrIp(host), logPath), destPath); err != nil {
+			glog.V(2).Infof("Failed to copy the log: err: %v, output: %q", err, output)
+		}
+	} else {
+		glog.V(2).Infof("Failed to run journactl (normal if it doesn't exist on the node): %v, output: %q", err, output)
+	}
+}
+
+// WriteLog is a temporary function to make it possible to write log
+// in the runner. This is used to collect serial console log.
+// TODO(random-liu): Use the log-dump script in cluster e2e.
+func WriteLog(host, filename, content string) error {
+	logPath := filepath.Join(*resultsDir, host)
+	if err := os.MkdirAll(logPath, 0755); err != nil {
+		return fmt.Errorf("failed to create log directory %q: %v", logPath, err)
+	}
+	f, err := os.Create(filepath.Join(logPath, filename))
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	_, err = f.WriteString(content)
+	return err
+}

vendor/k8s.io/kubernetes/test/e2e_node/remote/ssh.go

@@ -0,0 +1,101 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package remote
+
+import (
+	"flag"
+	"fmt"
+	"os/exec"
+	"os/user"
+	"strings"
+	"sync"
+
+	"github.com/golang/glog"
+)
+
+var sshOptions = flag.String("ssh-options", "", "Commandline options passed to ssh.")
+var sshEnv = flag.String("ssh-env", "", "Use predefined ssh options for environment.  Options: gce")
+var sshUser = flag.String("ssh-user", "", "Use predefined user for ssh.")
+
+var sshOptionsMap map[string]string
+
+func init() {
+	usr, err := user.Current()
+	if err != nil {
+		glog.Fatal(err)
+	}
+	sshOptionsMap = map[string]string{
+		"gce": fmt.Sprintf("-i %s/.ssh/google_compute_engine -o UserKnownHostsFile=/dev/null -o IdentitiesOnly=yes -o CheckHostIP=no -o StrictHostKeyChecking=no -o ServerAliveInterval=30 -o LogLevel=ERROR", usr.HomeDir),
+	}
+}
+
+var hostnameIpOverrides = struct {
+	sync.RWMutex
+	m map[string]string
+}{m: make(map[string]string)}
+
+func AddHostnameIp(hostname, ip string) {
+	hostnameIpOverrides.Lock()
+	defer hostnameIpOverrides.Unlock()
+	hostnameIpOverrides.m[hostname] = ip
+}
+
+// GetHostnameOrIp converts hostname into ip and apply user if necessary.
+func GetHostnameOrIp(hostname string) string {
+	hostnameIpOverrides.RLock()
+	defer hostnameIpOverrides.RUnlock()
+	host := hostname
+	if ip, found := hostnameIpOverrides.m[hostname]; found {
+		host = ip
+	}
+	if *sshUser != "" {
+		host = fmt.Sprintf("%s@%s", *sshUser, host)
+	}
+	return host
+}
+
+// getSSHCommand handles proper quoting so that multiple commands are executed in the same shell over ssh
+func getSSHCommand(sep string, args ...string) string {
+	return fmt.Sprintf("'%s'", strings.Join(args, sep))
+}
+
+// SSH executes ssh command with runSSHCommand as root. The `sudo` makes sure that all commands
+// are executed by root, so that there won't be permission mismatch between different commands.
+func SSH(host string, cmd ...string) (string, error) {
+	return runSSHCommand("ssh", append([]string{GetHostnameOrIp(host), "--", "sudo"}, cmd...)...)
+}
+
+// SSHNoSudo executes ssh command with runSSHCommand as normal user. Sometimes we need this,
+// for example creating a directory that we'll copy files there with scp.
+func SSHNoSudo(host string, cmd ...string) (string, error) {
+	return runSSHCommand("ssh", append([]string{GetHostnameOrIp(host), "--"}, cmd...)...)
+}
+
+// runSSHCommand executes the ssh or scp command, adding the flag provided --ssh-options
+func runSSHCommand(cmd string, args ...string) (string, error) {
+	if env, found := sshOptionsMap[*sshEnv]; found {
+		args = append(strings.Split(env, " "), args...)
+	}
+	if *sshOptions != "" {
+		args = append(strings.Split(*sshOptions, " "), args...)
+	}
+	output, err := exec.Command(cmd, args...).CombinedOutput()
+	if err != nil {
+		return string(output), fmt.Errorf("command [%s %s] failed with error: %v", cmd, strings.Join(args, " "), err)
+	}
+	return string(output), nil
+}

vendor/k8s.io/kubernetes/test/e2e_node/remote/types.go

@@ -0,0 +1,45 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package remote
+
+import (
+	"time"
+)
+
+// TestSuite is the interface of a test suite, such as node e2e, node conformance,
+// node soaking, cri validation etc.
+type TestSuite interface {
+	// SetupTestPackage setup the test package in the given directory. TestSuite
+	// should put all necessary binaries and dependencies into the path. The caller
+	// will:
+	// * create a tarball with the directory.
+	// * deploy the tarball to the testing host.
+	// * untar the tarball to the testing workspace on the testing host.
+	SetupTestPackage(path string) error
+	// RunTest runs test on the node in the given workspace and returns test output
+	// and test error if there is any.
+	// * host is the target node to run the test.
+	// * workspace is the directory on the testing host the test is running in. Note
+	// that the test package is unpacked in the workspace before running the test.
+	// * results is the directory the test should write result into. All logs should be
+	// saved as *.log, all junit file should start with junit*.
+	// * junitFilePrefix is the prefix of output junit file.
+	// * testArgs is the arguments passed to test.
+	// * ginkgoArgs is the arguments passed to ginkgo.
+	// * timeout is the test timeout.
+	RunTest(host, workspace, results, junitFilePrefix, testArgs, ginkgoArgs string, timeout time.Duration) (string, error)
+}

vendor/k8s.io/kubernetes/test/e2e_node/remote/utils.go

@@ -0,0 +1,97 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package remote
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"github.com/golang/glog"
+)
+
+// utils.go contains functions used accross test suites.
+
+const (
+	cniRelease   = "07a8a28637e97b22eb8dfe710eeae1344f69d16e"
+	cniDirectory = "cni"
+	cniURL       = "https://storage.googleapis.com/kubernetes-release/network-plugins/cni-" + cniRelease + ".tar.gz"
+)
+
+// Install the cni plugin.
+func installCNI(host, workspace string) error {
+	glog.V(2).Infof("Install CNI on %q", host)
+	cniPath := filepath.Join(workspace, cniDirectory)
+	cmd := getSSHCommand(" ; ",
+		fmt.Sprintf("mkdir -p %s", cniPath),
+		fmt.Sprintf("wget -O - %s | tar -xz -C %s", cniURL, cniPath),
+	)
+	if output, err := SSH(host, "sh", "-c", cmd); err != nil {
+		return fmt.Errorf("failed to install cni plugin on %q: %v output: %q", host, err, output)
+	}
+	return nil
+}
+
+// configureFirewall configures iptable firewall rules.
+func configureFirewall(host string) error {
+	glog.V(2).Infof("Configure iptables firewall rules on %q", host)
+	// TODO: consider calling bootstrap script to configure host based on OS
+	output, err := SSH(host, "iptables", "-L", "INPUT")
+	if err != nil {
+		return fmt.Errorf("failed to get iptables INPUT on %q: %v output: %q", host, err, output)
+	}
+	if strings.Contains(output, "Chain INPUT (policy DROP)") {
+		cmd := getSSHCommand("&&",
+			"(iptables -C INPUT -w -p TCP -j ACCEPT || iptables -A INPUT -w -p TCP -j ACCEPT)",
+			"(iptables -C INPUT -w -p UDP -j ACCEPT || iptables -A INPUT -w -p UDP -j ACCEPT)",
+			"(iptables -C INPUT -w -p ICMP -j ACCEPT || iptables -A INPUT -w -p ICMP -j ACCEPT)")
+		output, err := SSH(host, "sh", "-c", cmd)
+		if err != nil {
+			return fmt.Errorf("failed to configured firewall on %q: %v output: %v", host, err, output)
+		}
+	}
+	output, err = SSH(host, "iptables", "-L", "FORWARD")
+	if err != nil {
+		return fmt.Errorf("failed to get iptables FORWARD on %q: %v output: %q", host, err, output)
+	}
+	if strings.Contains(output, "Chain FORWARD (policy DROP)") {
+		cmd := getSSHCommand("&&",
+			"(iptables -C FORWARD -w -p TCP -j ACCEPT || iptables -A FORWARD -w -p TCP -j ACCEPT)",
+			"(iptables -C FORWARD -w -p UDP -j ACCEPT || iptables -A FORWARD -w -p UDP -j ACCEPT)",
+			"(iptables -C FORWARD -w -p ICMP -j ACCEPT || iptables -A FORWARD -w -p ICMP -j ACCEPT)")
+		output, err = SSH(host, "sh", "-c", cmd)
+		if err != nil {
+			return fmt.Errorf("failed to configured firewall on %q: %v output: %v", host, err, output)
+		}
+	}
+	return nil
+}
+
+// cleanupNodeProcesses kills all running node processes may conflict with the test.
+func cleanupNodeProcesses(host string) {
+	glog.V(2).Infof("Killing any existing node processes on %q", host)
+	cmd := getSSHCommand(" ; ",
+		"pkill kubelet",
+		"pkill kube-apiserver",
+		"pkill etcd",
+		"pkill e2e_node.test",
+	)
+	// No need to log an error if pkill fails since pkill will fail if the commands are not running.
+	// If we are unable to stop existing running k8s processes, we should see messages in the kubelet/apiserver/etcd
+	// logs about failing to bind the required ports.
+	SSH(host, "sh", "-c", cmd)
+}

vendor/k8s.io/kubernetes/test/e2e_node/resource_collector.go

@@ -0,0 +1,542 @@
+// +build linux
+
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"os"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"text/tabwriter"
+	"time"
+
+	cadvisorclient "github.com/google/cadvisor/client/v2"
+	cadvisorapiv2 "github.com/google/cadvisor/info/v2"
+	"github.com/opencontainers/runc/libcontainer/cgroups"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/stats"
+	"k8s.io/kubernetes/pkg/util/procfs"
+	"k8s.io/kubernetes/pkg/util/uuid"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/gomega"
+)
+
+const (
+	// resource monitoring
+	cadvisorImageName = "google/cadvisor:latest"
+	cadvisorPodName   = "cadvisor"
+	cadvisorPort      = 8090
+	// housekeeping interval of Cadvisor (second)
+	houseKeepingInterval = 1
+)
+
+var (
+	systemContainers map[string]string
+)
+
+type ResourceCollector struct {
+	client  *cadvisorclient.Client
+	request *cadvisorapiv2.RequestOptions
+
+	pollingInterval time.Duration
+	buffers         map[string][]*framework.ContainerResourceUsage
+	lock            sync.RWMutex
+	stopCh          chan struct{}
+}
+
+// NewResourceCollector creates a resource collector object which collects
+// resource usage periodically from Cadvisor
+func NewResourceCollector(interval time.Duration) *ResourceCollector {
+	buffers := make(map[string][]*framework.ContainerResourceUsage)
+	return &ResourceCollector{
+		pollingInterval: interval,
+		buffers:         buffers,
+	}
+}
+
+// Start starts resource collector and connects to the standalone Cadvisor pod
+// then repeatedly runs collectStats.
+func (r *ResourceCollector) Start() {
+	// Get the cgroup container names for kubelet and docker
+	kubeletContainer, err := getContainerNameForProcess(kubeletProcessName, "")
+	dockerContainer, err := getContainerNameForProcess(dockerProcessName, dockerPidFile)
+	if err == nil {
+		systemContainers = map[string]string{
+			stats.SystemContainerKubelet: kubeletContainer,
+			stats.SystemContainerRuntime: dockerContainer,
+		}
+	} else {
+		framework.Failf("Failed to get docker container name in test-e2e-node resource collector.")
+	}
+
+	wait.Poll(1*time.Second, 1*time.Minute, func() (bool, error) {
+		var err error
+		r.client, err = cadvisorclient.NewClient(fmt.Sprintf("http://localhost:%d/", cadvisorPort))
+		if err == nil {
+			return true, nil
+		}
+		return false, err
+	})
+
+	Expect(r.client).NotTo(BeNil(), "cadvisor client not ready")
+
+	r.request = &cadvisorapiv2.RequestOptions{IdType: "name", Count: 1, Recursive: false}
+	r.stopCh = make(chan struct{})
+
+	oldStatsMap := make(map[string]*cadvisorapiv2.ContainerStats)
+	go wait.Until(func() { r.collectStats(oldStatsMap) }, r.pollingInterval, r.stopCh)
+}
+
+// Stop stops resource collector collecting stats. It does not clear the buffer
+func (r *ResourceCollector) Stop() {
+	close(r.stopCh)
+}
+
+// Reset clears the stats buffer of resource collector.
+func (r *ResourceCollector) Reset() {
+	r.lock.Lock()
+	defer r.lock.Unlock()
+	for _, name := range systemContainers {
+		r.buffers[name] = []*framework.ContainerResourceUsage{}
+	}
+}
+
+// GetCPUSummary gets CPU usage in percentile.
+func (r *ResourceCollector) GetCPUSummary() framework.ContainersCPUSummary {
+	result := make(framework.ContainersCPUSummary)
+	for key, name := range systemContainers {
+		data := r.GetBasicCPUStats(name)
+		result[key] = data
+	}
+	return result
+}
+
+// LogLatest logs the latest resource usage.
+func (r *ResourceCollector) LogLatest() {
+	summary, err := r.GetLatest()
+	if err != nil {
+		framework.Logf("%v", err)
+	}
+	framework.Logf("%s", formatResourceUsageStats(summary))
+}
+
+// collectStats collects resource usage from Cadvisor.
+func (r *ResourceCollector) collectStats(oldStatsMap map[string]*cadvisorapiv2.ContainerStats) {
+	for _, name := range systemContainers {
+		ret, err := r.client.Stats(name, r.request)
+		if err != nil {
+			framework.Logf("Error getting container stats, err: %v", err)
+			return
+		}
+		cStats, ok := ret[name]
+		if !ok {
+			framework.Logf("Missing info/stats for container %q", name)
+			return
+		}
+
+		newStats := cStats.Stats[0]
+
+		if oldStats, ok := oldStatsMap[name]; ok && oldStats.Timestamp.Before(newStats.Timestamp) {
+			if oldStats.Timestamp.Equal(newStats.Timestamp) {
+				continue
+			}
+			r.buffers[name] = append(r.buffers[name], computeContainerResourceUsage(name, oldStats, newStats))
+		}
+		oldStatsMap[name] = newStats
+	}
+}
+
+// computeContainerResourceUsage computes resource usage based on new data sample.
+func computeContainerResourceUsage(name string, oldStats, newStats *cadvisorapiv2.ContainerStats) *framework.ContainerResourceUsage {
+	return &framework.ContainerResourceUsage{
+		Name:                    name,
+		Timestamp:               newStats.Timestamp,
+		CPUUsageInCores:         float64(newStats.Cpu.Usage.Total-oldStats.Cpu.Usage.Total) / float64(newStats.Timestamp.Sub(oldStats.Timestamp).Nanoseconds()),
+		MemoryUsageInBytes:      newStats.Memory.Usage,
+		MemoryWorkingSetInBytes: newStats.Memory.WorkingSet,
+		MemoryRSSInBytes:        newStats.Memory.RSS,
+		CPUInterval:             newStats.Timestamp.Sub(oldStats.Timestamp),
+	}
+}
+
+// GetLatest gets the latest resource usage from stats buffer.
+func (r *ResourceCollector) GetLatest() (framework.ResourceUsagePerContainer, error) {
+	r.lock.RLock()
+	defer r.lock.RUnlock()
+	stats := make(framework.ResourceUsagePerContainer)
+	for key, name := range systemContainers {
+		contStats, ok := r.buffers[name]
+		if !ok || len(contStats) == 0 {
+			return nil, fmt.Errorf("No resource usage data for %s container (%s)", key, name)
+		}
+		stats[key] = contStats[len(contStats)-1]
+	}
+	return stats, nil
+}
+
+type resourceUsageByCPU []*framework.ContainerResourceUsage
+
+func (r resourceUsageByCPU) Len() int           { return len(r) }
+func (r resourceUsageByCPU) Swap(i, j int)      { r[i], r[j] = r[j], r[i] }
+func (r resourceUsageByCPU) Less(i, j int) bool { return r[i].CPUUsageInCores < r[j].CPUUsageInCores }
+
+// The percentiles to report.
+var percentiles = [...]float64{0.50, 0.90, 0.95, 0.99, 1.00}
+
+// GetBasicCPUStats returns the percentiles the cpu usage in cores for
+// containerName. This method examines all data currently in the buffer.
+func (r *ResourceCollector) GetBasicCPUStats(containerName string) map[float64]float64 {
+	r.lock.RLock()
+	defer r.lock.RUnlock()
+	result := make(map[float64]float64, len(percentiles))
+
+	// We must make a copy of array, otherwise the timeseries order is changed.
+	usages := make([]*framework.ContainerResourceUsage, 0)
+	for _, usage := range r.buffers[containerName] {
+		usages = append(usages, usage)
+	}
+
+	sort.Sort(resourceUsageByCPU(usages))
+	for _, q := range percentiles {
+		index := int(float64(len(usages))*q) - 1
+		if index < 0 {
+			// We don't have enough data.
+			result[q] = 0
+			continue
+		}
+		result[q] = usages[index].CPUUsageInCores
+	}
+	return result
+}
+
+func formatResourceUsageStats(containerStats framework.ResourceUsagePerContainer) string {
+	// Example output:
+	//
+	// Resource usage for node "e2e-test-foo-node-abcde":
+	// container        cpu(cores)  memory(MB)
+	// "/"              0.363       2942.09
+	// "/docker-daemon" 0.088       521.80
+	// "/kubelet"       0.086       424.37
+	// "/system"        0.007       119.88
+	buf := &bytes.Buffer{}
+	w := tabwriter.NewWriter(buf, 1, 0, 1, ' ', 0)
+	fmt.Fprintf(w, "container\tcpu(cores)\tmemory_working_set(MB)\tmemory_rss(MB)\n")
+	for name, s := range containerStats {
+		fmt.Fprintf(w, "%q\t%.3f\t%.2f\t%.2f\n", name, s.CPUUsageInCores, float64(s.MemoryWorkingSetInBytes)/(1024*1024), float64(s.MemoryRSSInBytes)/(1024*1024))
+	}
+	w.Flush()
+	return fmt.Sprintf("Resource usage:\n%s", buf.String())
+}
+
+func formatCPUSummary(summary framework.ContainersCPUSummary) string {
+	// Example output for a node (the percentiles may differ):
+	// CPU usage of containers on node "e2e-test-foo-node-0vj7":
+	// container        5th%  50th% 90th% 95th%
+	// "/"              0.051 0.159 0.387 0.455
+	// "/runtime        0.000 0.000 0.146 0.166
+	// "/kubelet"       0.036 0.053 0.091 0.154
+	// "/misc"          0.001 0.001 0.001 0.002
+	var summaryStrings []string
+	var header []string
+	header = append(header, "container")
+	for _, p := range percentiles {
+		header = append(header, fmt.Sprintf("%.0fth%%", p*100))
+	}
+
+	buf := &bytes.Buffer{}
+	w := tabwriter.NewWriter(buf, 1, 0, 1, ' ', 0)
+	fmt.Fprintf(w, "%s\n", strings.Join(header, "\t"))
+
+	for _, containerName := range framework.TargetContainers() {
+		var s []string
+		s = append(s, fmt.Sprintf("%q", containerName))
+		data, ok := summary[containerName]
+		for _, p := range percentiles {
+			value := "N/A"
+			if ok {
+				value = fmt.Sprintf("%.3f", data[p])
+			}
+			s = append(s, value)
+		}
+		fmt.Fprintf(w, "%s\n", strings.Join(s, "\t"))
+	}
+	w.Flush()
+	summaryStrings = append(summaryStrings, fmt.Sprintf("CPU usage of containers:\n%s", buf.String()))
+
+	return strings.Join(summaryStrings, "\n")
+}
+
+// createCadvisorPod creates a standalone cadvisor pod for fine-grain resource monitoring.
+func getCadvisorPod() *v1.Pod {
+	return &v1.Pod{
+		ObjectMeta: v1.ObjectMeta{
+			Name: cadvisorPodName,
+		},
+		Spec: v1.PodSpec{
+			// It uses a host port for the tests to collect data.
+			// Currently we can not use port mapping in test-e2e-node.
+			HostNetwork:     true,
+			SecurityContext: &v1.PodSecurityContext{},
+			Containers: []v1.Container{
+				{
+					Image: cadvisorImageName,
+					Name:  cadvisorPodName,
+					Ports: []v1.ContainerPort{
+						{
+							Name:          "http",
+							HostPort:      cadvisorPort,
+							ContainerPort: cadvisorPort,
+							Protocol:      v1.ProtocolTCP,
+						},
+					},
+					VolumeMounts: []v1.VolumeMount{
+						{
+							Name:      "sys",
+							ReadOnly:  true,
+							MountPath: "/sys",
+						},
+						{
+							Name:      "var-run",
+							ReadOnly:  false,
+							MountPath: "/var/run",
+						},
+						{
+							Name:      "docker",
+							ReadOnly:  true,
+							MountPath: "/var/lib/docker/",
+						},
+						{
+							Name:      "rootfs",
+							ReadOnly:  true,
+							MountPath: "/rootfs",
+						},
+					},
+					Args: []string{
+						"--profiling",
+						fmt.Sprintf("--housekeeping_interval=%ds", houseKeepingInterval),
+						fmt.Sprintf("--port=%d", cadvisorPort),
+					},
+				},
+			},
+			Volumes: []v1.Volume{
+				{
+					Name:         "rootfs",
+					VolumeSource: v1.VolumeSource{HostPath: &v1.HostPathVolumeSource{Path: "/"}},
+				},
+				{
+					Name:         "var-run",
+					VolumeSource: v1.VolumeSource{HostPath: &v1.HostPathVolumeSource{Path: "/var/run"}},
+				},
+				{
+					Name:         "sys",
+					VolumeSource: v1.VolumeSource{HostPath: &v1.HostPathVolumeSource{Path: "/sys"}},
+				},
+				{
+					Name:         "docker",
+					VolumeSource: v1.VolumeSource{HostPath: &v1.HostPathVolumeSource{Path: "/var/lib/docker"}},
+				},
+			},
+		},
+	}
+}
+
+// deletePodsSync deletes a list of pods and block until pods disappear.
+func deletePodsSync(f *framework.Framework, pods []*v1.Pod) {
+	var wg sync.WaitGroup
+	for _, pod := range pods {
+		wg.Add(1)
+		go func(pod *v1.Pod) {
+			defer wg.Done()
+
+			err := f.PodClient().Delete(pod.ObjectMeta.Name, v1.NewDeleteOptions(30))
+			Expect(err).NotTo(HaveOccurred())
+
+			Expect(framework.WaitForPodToDisappear(f.ClientSet, f.Namespace.Name, pod.ObjectMeta.Name, labels.Everything(),
+				30*time.Second, 10*time.Minute)).NotTo(HaveOccurred())
+		}(pod)
+	}
+	wg.Wait()
+	return
+}
+
+// newTestPods creates a list of pods (specification) for test.
+func newTestPods(numPods int, imageName, podType string) []*v1.Pod {
+	var pods []*v1.Pod
+	for i := 0; i < numPods; i++ {
+		podName := "test-" + string(uuid.NewUUID())
+		labels := map[string]string{
+			"type": podType,
+			"name": podName,
+		}
+		pods = append(pods,
+			&v1.Pod{
+				ObjectMeta: v1.ObjectMeta{
+					Name:   podName,
+					Labels: labels,
+				},
+				Spec: v1.PodSpec{
+					// Restart policy is always (default).
+					Containers: []v1.Container{
+						{
+							Image: imageName,
+							Name:  podName,
+						},
+					},
+				},
+			})
+	}
+	return pods
+}
+
+// Time series of resource usage
+type ResourceSeries struct {
+	Timestamp            []int64           `json:"ts"`
+	CPUUsageInMilliCores []int64           `json:"cpu"`
+	MemoryRSSInMegaBytes []int64           `json:"memory"`
+	Units                map[string]string `json:"unit"`
+}
+
+// GetResourceSeriesWithLabels gets the time series of resource usage of each container.
+func (r *ResourceCollector) GetResourceTimeSeries() map[string]*ResourceSeries {
+	resourceSeries := make(map[string]*ResourceSeries)
+	for key, name := range systemContainers {
+		newSeries := &ResourceSeries{Units: map[string]string{
+			"cpu":    "mCPU",
+			"memory": "MB",
+		}}
+		resourceSeries[key] = newSeries
+		for _, usage := range r.buffers[name] {
+			newSeries.Timestamp = append(newSeries.Timestamp, usage.Timestamp.UnixNano())
+			newSeries.CPUUsageInMilliCores = append(newSeries.CPUUsageInMilliCores, int64(usage.CPUUsageInCores*1000))
+			newSeries.MemoryRSSInMegaBytes = append(newSeries.MemoryRSSInMegaBytes, int64(float64(usage.MemoryUsageInBytes)/(1024*1024)))
+		}
+	}
+	return resourceSeries
+}
+
+// Code for getting container name of docker, copied from pkg/kubelet/cm/container_manager_linux.go
+// since they are not exposed
+const (
+	kubeletProcessName    = "kubelet"
+	dockerProcessName     = "docker"
+	dockerPidFile         = "/var/run/docker.pid"
+	containerdProcessName = "docker-containerd"
+	containerdPidFile     = "/run/docker/libcontainerd/docker-containerd.pid"
+)
+
+func getPidsForProcess(name, pidFile string) ([]int, error) {
+	if len(pidFile) > 0 {
+		if pid, err := getPidFromPidFile(pidFile); err == nil {
+			return []int{pid}, nil
+		} else {
+			// log the error and fall back to pidof
+			runtime.HandleError(err)
+		}
+	}
+	return procfs.PidOf(name)
+}
+
+func getPidFromPidFile(pidFile string) (int, error) {
+	file, err := os.Open(pidFile)
+	if err != nil {
+		return 0, fmt.Errorf("error opening pid file %s: %v", pidFile, err)
+	}
+	defer file.Close()
+
+	data, err := ioutil.ReadAll(file)
+	if err != nil {
+		return 0, fmt.Errorf("error reading pid file %s: %v", pidFile, err)
+	}
+
+	pid, err := strconv.Atoi(string(data))
+	if err != nil {
+		return 0, fmt.Errorf("error parsing %s as a number: %v", string(data), err)
+	}
+
+	return pid, nil
+}
+
+func getContainerNameForProcess(name, pidFile string) (string, error) {
+	pids, err := getPidsForProcess(name, pidFile)
+	if err != nil {
+		return "", fmt.Errorf("failed to detect process id for %q - %v", name, err)
+	}
+	if len(pids) == 0 {
+		return "", nil
+	}
+	cont, err := getContainer(pids[0])
+	if err != nil {
+		return "", err
+	}
+	return cont, nil
+}
+
+// getContainer returns the cgroup associated with the specified pid.
+// It enforces a unified hierarchy for memory and cpu cgroups.
+// On systemd environments, it uses the name=systemd cgroup for the specified pid.
+func getContainer(pid int) (string, error) {
+	cgs, err := cgroups.ParseCgroupFile(fmt.Sprintf("/proc/%d/cgroup", pid))
+	if err != nil {
+		return "", err
+	}
+
+	cpu, found := cgs["cpu"]
+	if !found {
+		return "", cgroups.NewNotFoundError("cpu")
+	}
+	memory, found := cgs["memory"]
+	if !found {
+		return "", cgroups.NewNotFoundError("memory")
+	}
+
+	// since we use this container for accounting, we need to ensure its a unified hierarchy.
+	if cpu != memory {
+		return "", fmt.Errorf("cpu and memory cgroup hierarchy not unified.  cpu: %s, memory: %s", cpu, memory)
+	}
+
+	// on systemd, every pid is in a unified cgroup hierarchy (name=systemd as seen in systemd-cgls)
+	// cpu and memory accounting is off by default, users may choose to enable it per unit or globally.
+	// users could enable CPU and memory accounting globally via /etc/systemd/system.conf (DefaultCPUAccounting=true DefaultMemoryAccounting=true).
+	// users could also enable CPU and memory accounting per unit via CPUAccounting=true and MemoryAccounting=true
+	// we only warn if accounting is not enabled for CPU or memory so as to not break local development flows where kubelet is launched in a terminal.
+	// for example, the cgroup for the user session will be something like /user.slice/user-X.slice/session-X.scope, but the cpu and memory
+	// cgroup will be the closest ancestor where accounting is performed (most likely /) on systems that launch docker containers.
+	// as a result, on those systems, you will not get cpu or memory accounting statistics for kubelet.
+	// in addition, you would not get memory or cpu accounting for the runtime unless accounting was enabled on its unit (or globally).
+	if systemd, found := cgs["name=systemd"]; found {
+		if systemd != cpu {
+			log.Printf("CPUAccounting not enabled for pid: %d", pid)
+		}
+		if systemd != memory {
+			log.Printf("MemoryAccounting not enabled for pid: %d", pid)
+		}
+		return systemd, nil
+	}
+
+	return cpu, nil
+}

vendor/k8s.io/kubernetes/test/e2e_node/resource_usage_test.go

@@ -0,0 +1,292 @@
+// +build linux
+
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/stats"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = framework.KubeDescribe("Resource-usage [Serial] [Slow]", func() {
+	const (
+		// Interval to poll /stats/container on a node
+		containerStatsPollingPeriod = 10 * time.Second
+	)
+
+	var (
+		rc *ResourceCollector
+		om *framework.RuntimeOperationMonitor
+	)
+
+	f := framework.NewDefaultFramework("resource-usage")
+
+	BeforeEach(func() {
+		om = framework.NewRuntimeOperationMonitor(f.ClientSet)
+		// The test collects resource usage from a standalone Cadvisor pod.
+		// The Cadvsior of Kubelet has a housekeeping interval of 10s, which is too long to
+		// show the resource usage spikes. But changing its interval increases the overhead
+		// of kubelet. Hence we use a Cadvisor pod.
+		f.PodClient().CreateSync(getCadvisorPod())
+		rc = NewResourceCollector(containerStatsPollingPeriod)
+	})
+
+	AfterEach(func() {
+		result := om.GetLatestRuntimeOperationErrorRate()
+		framework.Logf("runtime operation error metrics:\n%s", framework.FormatRuntimeOperationErrorRate(result))
+	})
+
+	// This test measures and verifies the steady resource usage of node is within limit
+	// It collects data from a standalone Cadvisor with housekeeping interval 1s.
+	// It verifies CPU percentiles and the lastest memory usage.
+	Context("regular resource usage tracking", func() {
+		rTests := []resourceTest{
+			{
+				podsNr: 10,
+				cpuLimits: framework.ContainersCPUSummary{
+					stats.SystemContainerKubelet: {0.50: 0.30, 0.95: 0.35},
+					stats.SystemContainerRuntime: {0.50: 0.30, 0.95: 0.40},
+				},
+				memLimits: framework.ResourceUsagePerContainer{
+					stats.SystemContainerKubelet: &framework.ContainerResourceUsage{MemoryRSSInBytes: 100 * 1024 * 1024},
+					stats.SystemContainerRuntime: &framework.ContainerResourceUsage{MemoryRSSInBytes: 400 * 1024 * 1024},
+				},
+			},
+		}
+
+		for _, testArg := range rTests {
+			itArg := testArg
+
+			It(fmt.Sprintf("resource tracking for %d pods per node", itArg.podsNr), func() {
+				testInfo := getTestNodeInfo(f, itArg.getTestName())
+
+				runResourceUsageTest(f, rc, itArg)
+
+				// Log and verify resource usage
+				logAndVerifyResource(f, rc, itArg.cpuLimits, itArg.memLimits, testInfo, true)
+			})
+		}
+	})
+
+	Context("regular resource usage tracking", func() {
+		rTests := []resourceTest{
+			{
+				podsNr: 0,
+			},
+			{
+				podsNr: 10,
+			},
+			{
+				podsNr: 35,
+			},
+			{
+				podsNr: 105,
+			},
+		}
+
+		for _, testArg := range rTests {
+			itArg := testArg
+
+			It(fmt.Sprintf("resource tracking for %d pods per node [Benchmark]", itArg.podsNr), func() {
+				testInfo := getTestNodeInfo(f, itArg.getTestName())
+
+				runResourceUsageTest(f, rc, itArg)
+
+				// Log and verify resource usage
+				logAndVerifyResource(f, rc, itArg.cpuLimits, itArg.memLimits, testInfo, false)
+			})
+		}
+	})
+})
+
+type resourceTest struct {
+	podsNr    int
+	cpuLimits framework.ContainersCPUSummary
+	memLimits framework.ResourceUsagePerContainer
+}
+
+func (rt *resourceTest) getTestName() string {
+	return fmt.Sprintf("resource_%d", rt.podsNr)
+}
+
+// runResourceUsageTest runs the resource usage test
+func runResourceUsageTest(f *framework.Framework, rc *ResourceCollector, testArg resourceTest) {
+	const (
+		// The monitoring time for one test
+		monitoringTime = 10 * time.Minute
+		// The periodic reporting period
+		reportingPeriod = 5 * time.Minute
+		// sleep for an interval here to measure steady data
+		sleepAfterCreatePods = 10 * time.Second
+	)
+	pods := newTestPods(testArg.podsNr, framework.GetPauseImageNameForHostArch(), "test_pod")
+
+	rc.Start()
+	// Explicitly delete pods to prevent namespace controller cleanning up timeout
+	defer deletePodsSync(f, append(pods, getCadvisorPod()))
+	defer rc.Stop()
+
+	By("Creating a batch of Pods")
+	f.PodClient().CreateBatch(pods)
+
+	// wait for a while to let the node be steady
+	time.Sleep(sleepAfterCreatePods)
+
+	// Log once and flush the stats.
+	rc.LogLatest()
+	rc.Reset()
+
+	By("Start monitoring resource usage")
+	// Periodically dump the cpu summary until the deadline is met.
+	// Note that without calling framework.ResourceMonitor.Reset(), the stats
+	// would occupy increasingly more memory. This should be fine
+	// for the current test duration, but we should reclaim the
+	// entries if we plan to monitor longer (e.g., 8 hours).
+	deadline := time.Now().Add(monitoringTime)
+	for time.Now().Before(deadline) {
+		timeLeft := deadline.Sub(time.Now())
+		framework.Logf("Still running...%v left", timeLeft)
+		if timeLeft < reportingPeriod {
+			time.Sleep(timeLeft)
+		} else {
+			time.Sleep(reportingPeriod)
+		}
+		logPods(f.ClientSet)
+	}
+
+	By("Reporting overall resource usage")
+	logPods(f.ClientSet)
+}
+
+// logAndVerifyResource prints the resource usage as perf data and verifies whether resource usage satisfies the limit.
+func logAndVerifyResource(f *framework.Framework, rc *ResourceCollector, cpuLimits framework.ContainersCPUSummary,
+	memLimits framework.ResourceUsagePerContainer, testInfo map[string]string, isVerify bool) {
+	nodeName := framework.TestContext.NodeName
+
+	// Obtain memory PerfData
+	usagePerContainer, err := rc.GetLatest()
+	Expect(err).NotTo(HaveOccurred())
+	framework.Logf("%s", formatResourceUsageStats(usagePerContainer))
+
+	usagePerNode := make(framework.ResourceUsagePerNode)
+	usagePerNode[nodeName] = usagePerContainer
+
+	// Obtain CPU PerfData
+	cpuSummary := rc.GetCPUSummary()
+	framework.Logf("%s", formatCPUSummary(cpuSummary))
+
+	cpuSummaryPerNode := make(framework.NodesCPUSummary)
+	cpuSummaryPerNode[nodeName] = cpuSummary
+
+	// Print resource usage
+	framework.PrintPerfData(framework.ResourceUsageToPerfDataWithLabels(usagePerNode, testInfo))
+	framework.PrintPerfData(framework.CPUUsageToPerfDataWithLabels(cpuSummaryPerNode, testInfo))
+
+	// Verify resource usage
+	if isVerify {
+		verifyMemoryLimits(f.ClientSet, memLimits, usagePerNode)
+		verifyCPULimits(cpuLimits, cpuSummaryPerNode)
+	}
+}
+
+func verifyMemoryLimits(c clientset.Interface, expected framework.ResourceUsagePerContainer, actual framework.ResourceUsagePerNode) {
+	if expected == nil {
+		return
+	}
+	var errList []string
+	for nodeName, nodeSummary := range actual {
+		var nodeErrs []string
+		for cName, expectedResult := range expected {
+			container, ok := nodeSummary[cName]
+			if !ok {
+				nodeErrs = append(nodeErrs, fmt.Sprintf("container %q: missing", cName))
+				continue
+			}
+
+			expectedValue := expectedResult.MemoryRSSInBytes
+			actualValue := container.MemoryRSSInBytes
+			if expectedValue != 0 && actualValue > expectedValue {
+				nodeErrs = append(nodeErrs, fmt.Sprintf("container %q: expected RSS memory (MB) < %d; got %d",
+					cName, expectedValue, actualValue))
+			}
+		}
+		if len(nodeErrs) > 0 {
+			errList = append(errList, fmt.Sprintf("node %v:\n %s", nodeName, strings.Join(nodeErrs, ", ")))
+			heapStats, err := framework.GetKubeletHeapStats(c, nodeName)
+			if err != nil {
+				framework.Logf("Unable to get heap stats from %q", nodeName)
+			} else {
+				framework.Logf("Heap stats on %q\n:%v", nodeName, heapStats)
+			}
+		}
+	}
+	if len(errList) > 0 {
+		framework.Failf("Memory usage exceeding limits:\n %s", strings.Join(errList, "\n"))
+	}
+}
+
+func verifyCPULimits(expected framework.ContainersCPUSummary, actual framework.NodesCPUSummary) {
+	if expected == nil {
+		return
+	}
+	var errList []string
+	for nodeName, perNodeSummary := range actual {
+		var nodeErrs []string
+		for cName, expectedResult := range expected {
+			perContainerSummary, ok := perNodeSummary[cName]
+			if !ok {
+				nodeErrs = append(nodeErrs, fmt.Sprintf("container %q: missing", cName))
+				continue
+			}
+			for p, expectedValue := range expectedResult {
+				actualValue, ok := perContainerSummary[p]
+				if !ok {
+					nodeErrs = append(nodeErrs, fmt.Sprintf("container %q: missing percentile %v", cName, p))
+					continue
+				}
+				if actualValue > expectedValue {
+					nodeErrs = append(nodeErrs, fmt.Sprintf("container %q: expected %.0fth%% usage < %.3f; got %.3f",
+						cName, p*100, expectedValue, actualValue))
+				}
+			}
+		}
+		if len(nodeErrs) > 0 {
+			errList = append(errList, fmt.Sprintf("node %v:\n %s", nodeName, strings.Join(nodeErrs, ", ")))
+		}
+	}
+	if len(errList) > 0 {
+		framework.Failf("CPU usage exceeding limits:\n %s", strings.Join(errList, "\n"))
+	}
+}
+
+func logPods(c clientset.Interface) {
+	nodeName := framework.TestContext.NodeName
+	podList, err := framework.GetKubeletRunningPods(c, nodeName)
+	if err != nil {
+		framework.Logf("Unable to retrieve kubelet pods for node %v", nodeName)
+	}
+	framework.Logf("%d pods are running on node %v", len(podList.Items), nodeName)
+}

vendor/k8s.io/kubernetes/test/e2e_node/restart_test.go

@@ -0,0 +1,121 @@
+// +build linux
+
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"time"
+
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	"fmt"
+	"os/exec"
+
+	. "github.com/onsi/ginkgo"
+	"k8s.io/kubernetes/pkg/api/v1"
+	testutils "k8s.io/kubernetes/test/utils"
+)
+
+// waitForPods waits for timeout duration, for pod_count.
+// If the timeout is hit, it returns the list of currently running pods.
+func waitForPods(f *framework.Framework, pod_count int, timeout time.Duration) (runningPods []*v1.Pod) {
+	for start := time.Now(); time.Since(start) < timeout; time.Sleep(10 * time.Second) {
+		podList, err := f.PodClient().List(v1.ListOptions{})
+		if err != nil {
+			framework.Logf("Failed to list pods on node: %v", err)
+			continue
+		}
+
+		runningPods = []*v1.Pod{}
+		for _, pod := range podList.Items {
+			if r, err := testutils.PodRunningReady(&pod); err != nil || !r {
+				continue
+			}
+			runningPods = append(runningPods, &pod)
+		}
+		framework.Logf("Running pod count %d", len(runningPods))
+		if len(runningPods) >= pod_count {
+			break
+		}
+	}
+	return runningPods
+}
+
+var _ = framework.KubeDescribe("Restart [Serial] [Slow] [Disruptive]", func() {
+	const (
+		// Saturate the node. It's not necessary that all these pods enter
+		// Running/Ready, because we don't know the number of cores in the
+		// test node or default limits applied (if any). It's is essential
+		// that no containers end up in terminated. 100 was chosen because
+		// it's the max pods per node.
+		podCount            = 100
+		podCreationInterval = 100 * time.Millisecond
+		recoverTimeout      = 5 * time.Minute
+		startTimeout        = 3 * time.Minute
+		// restartCount is chosen so even with minPods we exhaust the default
+		// allocation of a /24.
+		minPods      = 50
+		restartCount = 6
+	)
+
+	f := framework.NewDefaultFramework("restart-test")
+	Context("Docker Daemon", func() {
+		Context("Network", func() {
+			It("should recover from ip leak", func() {
+
+				pods := newTestPods(podCount, framework.GetPauseImageNameForHostArch(), "restart-docker-test")
+				By(fmt.Sprintf("Trying to create %d pods on node", len(pods)))
+				createBatchPodWithRateControl(f, pods, podCreationInterval)
+				defer deletePodsSync(f, pods)
+
+				// Give the node some time to stabilize, assume pods that enter RunningReady within
+				// startTimeout fit on the node and the node is now saturated.
+				runningPods := waitForPods(f, podCount, startTimeout)
+				if len(runningPods) < minPods {
+					framework.Failf("Failed to start %d pods, cannot test that restarting docker doesn't leak IPs", minPods)
+				}
+
+				for i := 0; i < restartCount; i += 1 {
+					By(fmt.Sprintf("Restarting Docker Daemon iteration %d", i))
+
+					// TODO: Find a uniform way to deal with systemctl/initctl/service operations. #34494
+					if stdout, err := exec.Command("sudo", "systemctl", "restart", "docker").CombinedOutput(); err != nil {
+						framework.Logf("Failed to trigger docker restart with systemd/systemctl: %v, stdout: %q", err, string(stdout))
+						if stdout, err = exec.Command("sudo", "service", "docker", "restart").CombinedOutput(); err != nil {
+							framework.Failf("Failed to trigger docker restart with upstart/service: %v, stdout: %q", err, string(stdout))
+						}
+					}
+					time.Sleep(20 * time.Second)
+				}
+
+				By("Checking currently Running/Ready pods")
+				postRestartRunningPods := waitForPods(f, len(runningPods), recoverTimeout)
+				if len(postRestartRunningPods) == 0 {
+					framework.Failf("Failed to start *any* pods after docker restart, this might indicate an IP leak")
+				}
+				By("Confirm no containers have terminated")
+				for _, pod := range postRestartRunningPods {
+					if c := testutils.TerminatedContainers(pod); len(c) != 0 {
+						framework.Failf("Pod %q has failed containers %+v after docker restart, this might indicate an IP leak", pod.Name, c)
+					}
+				}
+				By(fmt.Sprintf("Docker restart test passed with %d pods", len(postRestartRunningPods)))
+			})
+		})
+	})
+})

vendor/k8s.io/kubernetes/test/e2e_node/runner/local/BUILD

@@ -0,0 +1,38 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+)
+
+go_binary(
+    name = "local",
+    library = ":go_default_library",
+    tags = ["automanaged"],
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["run_local.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//test/e2e_node/builder:go_default_library",
+        "//vendor:github.com/golang/glog",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/e2e_node/runner/local/run_local.go

@@ -0,0 +1,63 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"flag"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"k8s.io/kubernetes/test/e2e_node/builder"
+
+	"github.com/golang/glog"
+)
+
+var buildDependencies = flag.Bool("build-dependencies", true, "If true, build all dependencies.")
+var ginkgoFlags = flag.String("ginkgo-flags", "", "Space-separated list of arguments to pass to Ginkgo test runner.")
+var testFlags = flag.String("test-flags", "", "Space-separated list of arguments to pass to node e2e test.")
+
+func main() {
+	flag.Parse()
+
+	// Build dependencies - ginkgo, kubelet and apiserver.
+	if *buildDependencies {
+		if err := builder.BuildGo(); err != nil {
+			glog.Fatalf("Failed to build the dependencies: %v", err)
+		}
+	}
+
+	// Run node e2e test
+	outputDir, err := builder.GetK8sBuildOutputDir()
+	if err != nil {
+		glog.Fatalf("Failed to get build output directory: %v", err)
+	}
+	glog.Infof("Got build output dir: %v", outputDir)
+	ginkgo := filepath.Join(outputDir, "ginkgo")
+	test := filepath.Join(outputDir, "e2e_node.test")
+	runCommand(ginkgo, *ginkgoFlags, test, "--", *testFlags)
+	return
+}
+
+func runCommand(name string, args ...string) error {
+	glog.Infof("Running command: %v %v", name, strings.Join(args, " "))
+	cmd := exec.Command("sudo", "sh", "-c", strings.Join(append([]string{name}, args...), " "))
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}

vendor/k8s.io/kubernetes/test/e2e_node/runner/remote/BUILD

@@ -0,0 +1,43 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_binary",
+    "go_library",
+)
+
+go_binary(
+    name = "remote",
+    library = ":go_default_library",
+    tags = ["automanaged"],
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["run_remote.go"],
+    tags = ["automanaged"],
+    deps = [
+        "//test/e2e_node/remote:go_default_library",
+        "//vendor:github.com/ghodss/yaml",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/pborman/uuid",
+        "//vendor:golang.org/x/oauth2",
+        "//vendor:golang.org/x/oauth2/google",
+        "//vendor:google.golang.org/api/compute/v1",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/e2e_node/runner/remote/run_remote.go

@@ -0,0 +1,662 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// To run the node e2e tests remotely against one or more hosts on gce:
+// $ go run run_remote.go --logtostderr --v 2 --ssh-env gce --hosts <comma separated hosts>
+// To run the node e2e tests remotely against one or more images on gce and provision them:
+// $ go run run_remote.go --logtostderr --v 2 --project <project> --zone <zone> --ssh-env gce --images <comma separated images>
+package main
+
+import (
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"math/rand"
+	"net/http"
+	"os"
+	"os/exec"
+	"regexp"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"k8s.io/kubernetes/test/e2e_node/remote"
+
+	"github.com/ghodss/yaml"
+	"github.com/golang/glog"
+	"github.com/pborman/uuid"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/google"
+	compute "google.golang.org/api/compute/v1"
+)
+
+var testArgs = flag.String("test_args", "", "Space-separated list of arguments to pass to Ginkgo test runner.")
+var instanceNamePrefix = flag.String("instance-name-prefix", "", "prefix for instance names")
+var zone = flag.String("zone", "", "gce zone the hosts live in")
+var project = flag.String("project", "", "gce project the hosts live in")
+var imageConfigFile = flag.String("image-config-file", "", "yaml file describing images to run")
+var imageProject = flag.String("image-project", "", "gce project the hosts live in")
+var images = flag.String("images", "", "images to test")
+var hosts = flag.String("hosts", "", "hosts to test")
+var cleanup = flag.Bool("cleanup", true, "If true remove files from remote hosts and delete temporary instances")
+var deleteInstances = flag.Bool("delete-instances", true, "If true, delete any instances created")
+var buildOnly = flag.Bool("build-only", false, "If true, build e2e_node_test.tar.gz and exit.")
+var instanceMetadata = flag.String("instance-metadata", "", "key/value metadata for instances separated by '=' or '<', 'k=v' means the key is 'k' and the value is 'v'; 'k<p' means the key is 'k' and the value is extracted from the local path 'p', e.g. k1=v1,k2<p2")
+var gubernator = flag.Bool("gubernator", false, "If true, output Gubernator link to view logs")
+var ginkgoFlags = flag.String("ginkgo-flags", "", "Passed to ginkgo to specify additional flags such as --skip=.")
+
+const (
+	defaultMachine = "n1-standard-1"
+)
+
+var (
+	computeService *compute.Service
+	arc            Archive
+	suite          remote.TestSuite
+)
+
+type Archive struct {
+	sync.Once
+	path string
+	err  error
+}
+
+type TestResult struct {
+	output string
+	err    error
+	host   string
+	exitOk bool
+}
+
+// ImageConfig specifies what images should be run and how for these tests.
+// It can be created via the `--images` and `--image-project` flags, or by
+// specifying the `--image-config-file` flag, pointing to a json or yaml file
+// of the form:
+//
+//     images:
+//       short-name:
+//         image: gce-image-name
+//         project: gce-image-project
+//         machine: for benchmark only, the machine type (GCE instance) to run test
+//         tests: for benchmark only, a list of ginkgo focus strings to match tests
+
+// TODO(coufon): replace 'image' with 'node' in configurations
+// and we plan to support testing custom machines other than GCE by specifying host
+type ImageConfig struct {
+	Images map[string]GCEImage `json:"images"`
+}
+
+type GCEImage struct {
+	Image      string `json:"image, omitempty"`
+	Project    string `json:"project"`
+	Metadata   string `json:"metadata"`
+	ImageRegex string `json:"image_regex, omitempty"`
+	// Defaults to using only the latest image. Acceptible values are [0, # of images that match the regex).
+	// If the number of existing previous images is lesser than what is desired, the test will use that is available.
+	PreviousImages int `json:"previous_images, omitempty"`
+
+	Machine string `json:"machine, omitempty"`
+	// This test is for benchmark (no limit verification, more result log, node name has format 'machine-image-uuid') if 'Tests' is non-empty.
+	Tests []string `json:"tests, omitempty"`
+}
+
+type internalImageConfig struct {
+	images map[string]internalGCEImage
+}
+
+type internalGCEImage struct {
+	image    string
+	project  string
+	metadata *compute.Metadata
+	machine  string
+	tests    []string
+}
+
+// parseFlags parse subcommands and flags
+func parseFlags() {
+	if len(os.Args) <= 1 {
+		glog.Fatalf("Too few flags specified: %v", os.Args)
+	}
+	// Parse subcommand.
+	subcommand := os.Args[1]
+	switch subcommand {
+	case "conformance":
+		suite = remote.InitConformanceRemote()
+	// TODO: Add subcommand for node soaking, node conformance, cri validation.
+	default:
+		// Use node e2e suite by default if no subcommand is specified.
+		suite = remote.InitNodeE2ERemote()
+	}
+	// Parse test flags.
+	flag.CommandLine.Parse(os.Args[2:])
+}
+
+func main() {
+	parseFlags()
+
+	rand.Seed(time.Now().UTC().UnixNano())
+	if *buildOnly {
+		// Build the archive and exit
+		remote.CreateTestArchive(suite)
+		return
+	}
+
+	if *hosts == "" && *imageConfigFile == "" && *images == "" {
+		glog.Fatalf("Must specify one of --image-config-file, --hosts, --images.")
+	}
+	var err error
+	computeService, err = getComputeClient()
+	if err != nil {
+		glog.Fatalf("Unable to create gcloud compute service using defaults.  Make sure you are authenticated. %v", err)
+	}
+
+	gceImages := &internalImageConfig{
+		images: make(map[string]internalGCEImage),
+	}
+	if *imageConfigFile != "" {
+		// parse images
+		imageConfigData, err := ioutil.ReadFile(*imageConfigFile)
+		if err != nil {
+			glog.Fatalf("Could not read image config file provided: %v", err)
+		}
+		externalImageConfig := ImageConfig{Images: make(map[string]GCEImage)}
+		err = yaml.Unmarshal(imageConfigData, &externalImageConfig)
+		if err != nil {
+			glog.Fatalf("Could not parse image config file: %v", err)
+		}
+		for shortName, imageConfig := range externalImageConfig.Images {
+			var images []string
+			isRegex, name := false, shortName
+			if imageConfig.ImageRegex != "" && imageConfig.Image == "" {
+				isRegex = true
+				images, err = getGCEImages(imageConfig.ImageRegex, imageConfig.Project, imageConfig.PreviousImages)
+				if err != nil {
+					glog.Fatalf("Could not retrieve list of images based on image prefix %q: %v", imageConfig.ImageRegex, err)
+				}
+			} else {
+				images = []string{imageConfig.Image}
+			}
+			for _, image := range images {
+				gceImage := internalGCEImage{
+					image:    image,
+					project:  imageConfig.Project,
+					metadata: getImageMetadata(imageConfig.Metadata),
+					machine:  imageConfig.Machine,
+					tests:    imageConfig.Tests,
+				}
+				if isRegex {
+					name = shortName + "-" + image
+				}
+				gceImages.images[name] = gceImage
+			}
+		}
+	}
+
+	// Allow users to specify additional images via cli flags for local testing
+	// convenience; merge in with config file
+	if *images != "" {
+		if *imageProject == "" {
+			glog.Fatal("Must specify --image-project if you specify --images")
+		}
+		cliImages := strings.Split(*images, ",")
+		for _, img := range cliImages {
+			gceImage := internalGCEImage{
+				image:    img,
+				project:  *imageProject,
+				metadata: getImageMetadata(*instanceMetadata),
+			}
+			gceImages.images[img] = gceImage
+		}
+	}
+
+	if len(gceImages.images) != 0 && *zone == "" {
+		glog.Fatal("Must specify --zone flag")
+	}
+	for shortName, image := range gceImages.images {
+		if image.project == "" {
+			glog.Fatalf("Invalid config for %v; must specify a project", shortName)
+		}
+	}
+	if len(gceImages.images) != 0 {
+		if *project == "" {
+			glog.Fatal("Must specify --project flag to launch images into")
+		}
+	}
+	if *instanceNamePrefix == "" {
+		*instanceNamePrefix = "tmp-node-e2e-" + uuid.NewUUID().String()[:8]
+	}
+
+	// Setup coloring
+	stat, _ := os.Stdout.Stat()
+	useColor := (stat.Mode() & os.ModeCharDevice) != 0
+	blue := ""
+	noColour := ""
+	if useColor {
+		blue = "\033[0;34m"
+		noColour = "\033[0m"
+	}
+
+	go arc.getArchive()
+	defer arc.deleteArchive()
+
+	results := make(chan *TestResult)
+	running := 0
+	for shortName := range gceImages.images {
+		imageConfig := gceImages.images[shortName]
+		fmt.Printf("Initializing e2e tests using image %s.\n", shortName)
+		running++
+		go func(image *internalGCEImage, junitFilePrefix string) {
+			results <- testImage(image, junitFilePrefix)
+		}(&imageConfig, shortName)
+	}
+	if *hosts != "" {
+		for _, host := range strings.Split(*hosts, ",") {
+			fmt.Printf("Initializing e2e tests using host %s.\n", host)
+			running++
+			go func(host string, junitFilePrefix string) {
+				results <- testHost(host, *cleanup, junitFilePrefix, *ginkgoFlags)
+			}(host, host)
+		}
+	}
+
+	// Wait for all tests to complete and emit the results
+	errCount := 0
+	exitOk := true
+	for i := 0; i < running; i++ {
+		tr := <-results
+		host := tr.host
+		fmt.Println() // Print an empty line
+		fmt.Printf("%s>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>%s\n", blue, noColour)
+		fmt.Printf("%s>                              START TEST                                >%s\n", blue, noColour)
+		fmt.Printf("%s>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>%s\n", blue, noColour)
+		fmt.Printf("Start Test Suite on Host %s\n", host)
+		fmt.Printf("%s\n", tr.output)
+		if tr.err != nil {
+			errCount++
+			fmt.Printf("Failure Finished Test Suite on Host %s\n%v\n", host, tr.err)
+		} else {
+			fmt.Printf("Success Finished Test Suite on Host %s\n", host)
+		}
+		exitOk = exitOk && tr.exitOk
+		fmt.Printf("%s<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<%s\n", blue, noColour)
+		fmt.Printf("%s<                              FINISH TEST                               <%s\n", blue, noColour)
+		fmt.Printf("%s<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<%s\n", blue, noColour)
+		fmt.Println() // Print an empty line
+	}
+	// Set the exit code if there were failures
+	if !exitOk {
+		fmt.Printf("Failure: %d errors encountered.\n", errCount)
+		callGubernator(*gubernator)
+		os.Exit(1)
+	}
+	callGubernator(*gubernator)
+}
+
+func callGubernator(gubernator bool) {
+	if gubernator {
+		fmt.Println("Running gubernator.sh")
+		output, err := exec.Command("./test/e2e_node/gubernator.sh", "y").Output()
+
+		if err != nil {
+			fmt.Println("gubernator.sh Failed")
+			fmt.Println(err)
+			return
+		}
+		fmt.Printf("%s", output)
+	}
+	return
+}
+
+func (a *Archive) getArchive() (string, error) {
+	a.Do(func() { a.path, a.err = remote.CreateTestArchive(suite) })
+	return a.path, a.err
+}
+
+func (a *Archive) deleteArchive() {
+	path, err := a.getArchive()
+	if err != nil {
+		return
+	}
+	os.Remove(path)
+}
+
+func getImageMetadata(input string) *compute.Metadata {
+	if input == "" {
+		return nil
+	}
+	glog.V(3).Infof("parsing instance metadata: %q", input)
+	raw := parseInstanceMetadata(input)
+	glog.V(4).Infof("parsed instance metadata: %v", raw)
+	metadataItems := []*compute.MetadataItems{}
+	for k, v := range raw {
+		val := v
+		metadataItems = append(metadataItems, &compute.MetadataItems{
+			Key:   k,
+			Value: &val,
+		})
+	}
+	ret := compute.Metadata{Items: metadataItems}
+	return &ret
+}
+
+// Run tests in archive against host
+func testHost(host string, deleteFiles bool, junitFilePrefix string, ginkgoFlagsStr string) *TestResult {
+	instance, err := computeService.Instances.Get(*project, *zone, host).Do()
+	if err != nil {
+		return &TestResult{
+			err:    err,
+			host:   host,
+			exitOk: false,
+		}
+	}
+	if strings.ToUpper(instance.Status) != "RUNNING" {
+		err = fmt.Errorf("instance %s not in state RUNNING, was %s.", host, instance.Status)
+		return &TestResult{
+			err:    err,
+			host:   host,
+			exitOk: false,
+		}
+	}
+	externalIp := getExternalIp(instance)
+	if len(externalIp) > 0 {
+		remote.AddHostnameIp(host, externalIp)
+	}
+
+	path, err := arc.getArchive()
+	if err != nil {
+		// Don't log fatal because we need to do any needed cleanup contained in "defer" statements
+		return &TestResult{
+			err: fmt.Errorf("unable to create test archive %v.", err),
+		}
+	}
+
+	output, exitOk, err := remote.RunRemote(suite, path, host, deleteFiles, junitFilePrefix, *testArgs, ginkgoFlagsStr)
+	return &TestResult{
+		output: output,
+		err:    err,
+		host:   host,
+		exitOk: exitOk,
+	}
+}
+
+type imageObj struct {
+	creationTime time.Time
+	name         string
+}
+
+func (io imageObj) string() string {
+	return fmt.Sprintf("%q created %q", io.name, io.creationTime.String())
+}
+
+type byCreationTime []imageObj
+
+func (a byCreationTime) Len() int           { return len(a) }
+func (a byCreationTime) Less(i, j int) bool { return a[i].creationTime.After(a[j].creationTime) }
+func (a byCreationTime) Swap(i, j int)      { a[i], a[j] = a[j], a[i] }
+
+// Returns a list of image names based on regex and number of previous images requested.
+func getGCEImages(imageRegex, project string, previousImages int) ([]string, error) {
+	ilc, err := computeService.Images.List(project).Do()
+	if err != nil {
+		return nil, fmt.Errorf("Failed to list images in project %q: %v", project, err)
+	}
+	imageObjs := []imageObj{}
+	imageRe := regexp.MustCompile(imageRegex)
+	for _, instance := range ilc.Items {
+		if imageRe.MatchString(instance.Name) {
+			creationTime, err := time.Parse(time.RFC3339, instance.CreationTimestamp)
+			if err != nil {
+				return nil, fmt.Errorf("Failed to parse instance creation timestamp %q: %v", instance.CreationTimestamp, err)
+			}
+			io := imageObj{
+				creationTime: creationTime,
+				name:         instance.Name,
+			}
+			glog.V(4).Infof("Found image %q based on regex %q in project %q", io.string(), imageRegex, project)
+			imageObjs = append(imageObjs, io)
+		}
+	}
+	sort.Sort(byCreationTime(imageObjs))
+	images := []string{}
+	for _, imageObj := range imageObjs {
+		images = append(images, imageObj.name)
+		previousImages--
+		if previousImages < 0 {
+			break
+		}
+	}
+	return images, nil
+}
+
+// Provision a gce instance using image and run the tests in archive against the instance.
+// Delete the instance afterward.
+func testImage(imageConfig *internalGCEImage, junitFilePrefix string) *TestResult {
+	ginkgoFlagsStr := *ginkgoFlags
+	// Check whether the test is for benchmark.
+	if len(imageConfig.tests) > 0 {
+		// Benchmark needs machine type non-empty.
+		if imageConfig.machine == "" {
+			imageConfig.machine = defaultMachine
+		}
+		// Use the Ginkgo focus in benchmark config.
+		ginkgoFlagsStr += (" " + testsToGinkgoFocus(imageConfig.tests))
+	}
+
+	host, err := createInstance(imageConfig)
+	if *deleteInstances {
+		defer deleteInstance(host)
+	}
+	if err != nil {
+		return &TestResult{
+			err: fmt.Errorf("unable to create gce instance with running docker daemon for image %s.  %v", imageConfig.image, err),
+		}
+	}
+
+	// Only delete the files if we are keeping the instance and want it cleaned up.
+	// If we are going to delete the instance, don't bother with cleaning up the files
+	deleteFiles := !*deleteInstances && *cleanup
+
+	result := testHost(host, deleteFiles, junitFilePrefix, ginkgoFlagsStr)
+	// This is a temporary solution to collect serial node serial log. Only port 1 contains useful information.
+	// TODO(random-liu): Extract out and unify log collection logic with cluste e2e.
+	serialPortOutput, err := computeService.Instances.GetSerialPortOutput(*project, *zone, host).Port(1).Do()
+	if err != nil {
+		glog.Errorf("Failed to collect serial output from node %q: %v", host, err)
+	} else {
+		logFilename := "serial-1.log"
+		err := remote.WriteLog(host, logFilename, serialPortOutput.Contents)
+		if err != nil {
+			glog.Errorf("Failed to write serial output from node %q to %q: %v", host, logFilename, err)
+		}
+	}
+	return result
+}
+
+// Provision a gce instance using image
+func createInstance(imageConfig *internalGCEImage) (string, error) {
+	glog.V(1).Infof("Creating instance %+v", *imageConfig)
+	name := imageToInstanceName(imageConfig)
+	i := &compute.Instance{
+		Name:        name,
+		MachineType: machineType(imageConfig.machine),
+		NetworkInterfaces: []*compute.NetworkInterface{
+			{
+				AccessConfigs: []*compute.AccessConfig{
+					{
+						Type: "ONE_TO_ONE_NAT",
+						Name: "External NAT",
+					},
+				}},
+		},
+		Disks: []*compute.AttachedDisk{
+			{
+				AutoDelete: true,
+				Boot:       true,
+				Type:       "PERSISTENT",
+				InitializeParams: &compute.AttachedDiskInitializeParams{
+					SourceImage: sourceImage(imageConfig.image, imageConfig.project),
+				},
+			},
+		},
+	}
+	i.Metadata = imageConfig.metadata
+	op, err := computeService.Instances.Insert(*project, *zone, i).Do()
+	if err != nil {
+		return "", err
+	}
+	if op.Error != nil {
+		return "", fmt.Errorf("could not create instance %s: %+v", name, op.Error)
+	}
+
+	instanceRunning := false
+	for i := 0; i < 30 && !instanceRunning; i++ {
+		if i > 0 {
+			time.Sleep(time.Second * 20)
+		}
+		var instance *compute.Instance
+		instance, err = computeService.Instances.Get(*project, *zone, name).Do()
+		if err != nil {
+			continue
+		}
+		if strings.ToUpper(instance.Status) != "RUNNING" {
+			err = fmt.Errorf("instance %s not in state RUNNING, was %s.", name, instance.Status)
+			continue
+		}
+		externalIp := getExternalIp(instance)
+		if len(externalIp) > 0 {
+			remote.AddHostnameIp(name, externalIp)
+		}
+		var output string
+		output, err = remote.SSH(name, "docker", "version")
+		if err != nil {
+			err = fmt.Errorf("instance %s not running docker daemon - Command failed: %s", name, output)
+			continue
+		}
+		if !strings.Contains(output, "Server") {
+			err = fmt.Errorf("instance %s not running docker daemon - Server not found: %s", name, output)
+			continue
+		}
+		instanceRunning = true
+	}
+	return name, err
+}
+
+func getExternalIp(instance *compute.Instance) string {
+	for i := range instance.NetworkInterfaces {
+		ni := instance.NetworkInterfaces[i]
+		for j := range ni.AccessConfigs {
+			ac := ni.AccessConfigs[j]
+			if len(ac.NatIP) > 0 {
+				return ac.NatIP
+			}
+		}
+	}
+	return ""
+}
+
+func getComputeClient() (*compute.Service, error) {
+	const retries = 10
+	const backoff = time.Second * 6
+
+	// Setup the gce client for provisioning instances
+	// Getting credentials on gce jenkins is flaky, so try a couple times
+	var err error
+	var cs *compute.Service
+	for i := 0; i < retries; i++ {
+		if i > 0 {
+			time.Sleep(backoff)
+		}
+
+		var client *http.Client
+		client, err = google.DefaultClient(oauth2.NoContext, compute.ComputeScope)
+		if err != nil {
+			continue
+		}
+
+		cs, err = compute.New(client)
+		if err != nil {
+			continue
+		}
+		return cs, nil
+	}
+	return nil, err
+}
+
+func deleteInstance(host string) {
+	glog.Infof("Deleting instance %q", host)
+	_, err := computeService.Instances.Delete(*project, *zone, host).Do()
+	if err != nil {
+		glog.Errorf("Error deleting instance %q: %v", host, err)
+	}
+}
+
+func parseInstanceMetadata(str string) map[string]string {
+	metadata := make(map[string]string)
+	ss := strings.Split(str, ",")
+	for _, s := range ss {
+		kv := strings.Split(s, "=")
+		if len(kv) == 2 {
+			metadata[kv[0]] = kv[1]
+			continue
+		}
+		kp := strings.Split(s, "<")
+		if len(kp) != 2 {
+			glog.Fatalf("Invalid instance metadata: %q", s)
+			continue
+		}
+		v, err := ioutil.ReadFile(kp[1])
+		if err != nil {
+			glog.Fatalf("Failed to read metadata file %q: %v", kp[1], err)
+			continue
+		}
+		metadata[kp[0]] = string(v)
+	}
+	return metadata
+}
+
+func imageToInstanceName(imageConfig *internalGCEImage) string {
+	if imageConfig.machine == "" {
+		return *instanceNamePrefix + "-" + imageConfig.image
+	}
+	// For benchmark test, node name has the format 'machine-image-uuid' to run
+	// different machine types with the same image in parallel
+	return imageConfig.machine + "-" + imageConfig.image + "-" + uuid.NewUUID().String()[:8]
+}
+
+func sourceImage(image, imageProject string) string {
+	return fmt.Sprintf("projects/%s/global/images/%s", imageProject, image)
+}
+
+func machineType(machine string) string {
+	if machine == "" {
+		machine = defaultMachine
+	}
+	return fmt.Sprintf("zones/%s/machineTypes/%s", *zone, machine)
+}
+
+// testsToGinkgoFocus converts the test string list to Ginkgo focus
+func testsToGinkgoFocus(tests []string) string {
+	focus := "--focus=\""
+	for i, test := range tests {
+		if i == 0 {
+			focus += test
+		} else {
+			focus += ("|" + test)
+		}
+	}
+	return focus + "\""
+}

vendor/k8s.io/kubernetes/test/e2e_node/runtime_conformance_test.go

@@ -0,0 +1,324 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+	"path"
+	"time"
+
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/kubelet/images"
+	"k8s.io/kubernetes/pkg/util/uuid"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+const (
+	consistentCheckTimeout = time.Second * 5
+	retryTimeout           = time.Minute * 5
+	pollInterval           = time.Second * 1
+)
+
+var _ = framework.KubeDescribe("Container Runtime Conformance Test", func() {
+	f := framework.NewDefaultFramework("runtime-conformance")
+
+	Describe("container runtime conformance blackbox test", func() {
+		Context("when starting a container that exits", func() {
+			It("it should run with the expected status [Conformance]", func() {
+				restartCountVolumeName := "restart-count"
+				restartCountVolumePath := "/restart-count"
+				testContainer := v1.Container{
+					Image: "gcr.io/google_containers/busybox:1.24",
+					VolumeMounts: []v1.VolumeMount{
+						{
+							MountPath: restartCountVolumePath,
+							Name:      restartCountVolumeName,
+						},
+					},
+				}
+				testVolumes := []v1.Volume{
+					{
+						Name: restartCountVolumeName,
+						VolumeSource: v1.VolumeSource{
+							EmptyDir: &v1.EmptyDirVolumeSource{Medium: v1.StorageMediumMemory},
+						},
+					},
+				}
+				testCases := []struct {
+					Name          string
+					RestartPolicy v1.RestartPolicy
+					Phase         v1.PodPhase
+					State         ContainerState
+					RestartCount  int32
+					Ready         bool
+				}{
+					{"terminate-cmd-rpa", v1.RestartPolicyAlways, v1.PodRunning, ContainerStateRunning, 2, true},
+					{"terminate-cmd-rpof", v1.RestartPolicyOnFailure, v1.PodSucceeded, ContainerStateTerminated, 1, false},
+					{"terminate-cmd-rpn", v1.RestartPolicyNever, v1.PodFailed, ContainerStateTerminated, 0, false},
+				}
+				for _, testCase := range testCases {
+
+					// It failed at the 1st run, then succeeded at 2nd run, then run forever
+					cmdScripts := `
+f=%s
+count=$(echo 'hello' >> $f ; wc -l $f | awk {'print $1'})
+if [ $count -eq 1 ]; then
+	exit 1
+fi
+if [ $count -eq 2 ]; then
+	exit 0
+fi
+while true; do sleep 1; done
+`
+					tmpCmd := fmt.Sprintf(cmdScripts, path.Join(restartCountVolumePath, "restartCount"))
+					testContainer.Name = testCase.Name
+					testContainer.Command = []string{"sh", "-c", tmpCmd}
+					terminateContainer := ConformanceContainer{
+						PodClient:     f.PodClient(),
+						Container:     testContainer,
+						RestartPolicy: testCase.RestartPolicy,
+						Volumes:       testVolumes,
+						PodSecurityContext: &v1.PodSecurityContext{
+							SELinuxOptions: &v1.SELinuxOptions{
+								Level: "s0",
+							},
+						},
+					}
+					terminateContainer.Create()
+					defer terminateContainer.Delete()
+
+					By("it should get the expected 'RestartCount'")
+					Eventually(func() (int32, error) {
+						status, err := terminateContainer.GetStatus()
+						return status.RestartCount, err
+					}, retryTimeout, pollInterval).Should(Equal(testCase.RestartCount))
+
+					By("it should get the expected 'Phase'")
+					Eventually(terminateContainer.GetPhase, retryTimeout, pollInterval).Should(Equal(testCase.Phase))
+
+					By("it should get the expected 'Ready' condition")
+					Expect(terminateContainer.IsReady()).Should(Equal(testCase.Ready))
+
+					status, err := terminateContainer.GetStatus()
+					Expect(err).ShouldNot(HaveOccurred())
+
+					By("it should get the expected 'State'")
+					Expect(GetContainerState(status.State)).To(Equal(testCase.State))
+
+					By("it should be possible to delete [Conformance]")
+					Expect(terminateContainer.Delete()).To(Succeed())
+					Eventually(terminateContainer.Present, retryTimeout, pollInterval).Should(BeFalse())
+				}
+			})
+
+			It("should report termination message if TerminationMessagePath is set [Conformance]", func() {
+				name := "termination-message-container"
+				terminationMessage := "DONE"
+				terminationMessagePath := "/dev/termination-log"
+				priv := true
+				c := ConformanceContainer{
+					PodClient: f.PodClient(),
+					Container: v1.Container{
+						Image:   "gcr.io/google_containers/busybox:1.24",
+						Name:    name,
+						Command: []string{"/bin/sh", "-c"},
+						Args:    []string{fmt.Sprintf("/bin/echo -n %s > %s", terminationMessage, terminationMessagePath)},
+						TerminationMessagePath: terminationMessagePath,
+						SecurityContext: &v1.SecurityContext{
+							Privileged: &priv,
+						},
+					},
+					RestartPolicy: v1.RestartPolicyNever,
+				}
+
+				By("create the container")
+				c.Create()
+				defer c.Delete()
+
+				By("wait for the container to succeed")
+				Eventually(c.GetPhase, retryTimeout, pollInterval).Should(Equal(v1.PodSucceeded))
+
+				By("get the container status")
+				status, err := c.GetStatus()
+				Expect(err).NotTo(HaveOccurred())
+
+				By("the container should be terminated")
+				Expect(GetContainerState(status.State)).To(Equal(ContainerStateTerminated))
+
+				By("the termination message should be set")
+				Expect(status.State.Terminated.Message).Should(Equal(terminationMessage))
+
+				By("delete the container")
+				Expect(c.Delete()).To(Succeed())
+			})
+		})
+
+		Context("when running a container with a new image", func() {
+			// The service account only has pull permission
+			auth := `
+{
+	"auths": {
+		"https://gcr.io": {
+			"auth": "X2pzb25fa2V5OnsKICAidHlwZSI6ICJzZXJ2aWNlX2FjY291bnQiLAogICJwcm9qZWN0X2lkIjogImF1dGhlbnRpY2F0ZWQtaW1hZ2UtcHVsbGluZyIsCiAgInByaXZhdGVfa2V5X2lkIjogImI5ZjJhNjY0YWE5YjIwNDg0Y2MxNTg2MDYzZmVmZGExOTIyNGFjM2IiLAogICJwcml2YXRlX2tleSI6ICItLS0tLUJFR0lOIFBSSVZBVEUgS0VZLS0tLS1cbk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQzdTSG5LVEVFaVlMamZcbkpmQVBHbUozd3JCY2VJNTBKS0xxS21GWE5RL3REWGJRK2g5YVl4aldJTDhEeDBKZTc0bVovS01uV2dYRjVLWlNcbm9BNktuSU85Yi9SY1NlV2VpSXRSekkzL1lYVitPNkNjcmpKSXl4anFWam5mVzJpM3NhMzd0OUE5VEZkbGZycm5cbjR6UkpiOWl4eU1YNGJMdHFGR3ZCMDNOSWl0QTNzVlo1ODhrb1FBZmgzSmhhQmVnTWorWjRSYko0aGVpQlFUMDNcbnZVbzViRWFQZVQ5RE16bHdzZWFQV2dydDZOME9VRGNBRTl4bGNJek11MjUzUG4vSzgySFpydEx4akd2UkhNVXhcbng0ZjhwSnhmQ3h4QlN3Z1NORit3OWpkbXR2b0wwRmE3ZGducFJlODZWRDY2ejNZenJqNHlLRXRqc2hLZHl5VWRcbkl5cVhoN1JSQWdNQkFBRUNnZ0VBT3pzZHdaeENVVlFUeEFka2wvSTVTRFVidi9NazRwaWZxYjJEa2FnbmhFcG9cbjFJajJsNGlWMTByOS9uenJnY2p5VlBBd3pZWk1JeDFBZVF0RDdoUzRHWmFweXZKWUc3NkZpWFpQUm9DVlB6b3VcbmZyOGRDaWFwbDV0enJDOWx2QXNHd29DTTdJWVRjZmNWdDdjRTEyRDNRS3NGNlo3QjJ6ZmdLS251WVBmK0NFNlRcbmNNMHkwaCtYRS9kMERvSERoVy96YU1yWEhqOFRvd2V1eXRrYmJzNGYvOUZqOVBuU2dET1lQd2xhbFZUcitGUWFcbkpSd1ZqVmxYcEZBUW14M0Jyd25rWnQzQ2lXV2lGM2QrSGk5RXRVYnRWclcxYjZnK1JRT0licWFtcis4YlJuZFhcbjZWZ3FCQWtKWjhSVnlkeFVQMGQxMUdqdU9QRHhCbkhCbmM0UW9rSXJFUUtCZ1FEMUNlaWN1ZGhXdGc0K2dTeGJcbnplanh0VjFONDFtZHVjQnpvMmp5b1dHbzNQVDh3ckJPL3lRRTM0cU9WSi9pZCs4SThoWjRvSWh1K0pBMDBzNmdcblRuSXErdi9kL1RFalk4MW5rWmlDa21SUFdiWHhhWXR4UjIxS1BYckxOTlFKS2ttOHRkeVh5UHFsOE1veUdmQ1dcbjJ2aVBKS05iNkhabnY5Q3lqZEo5ZzJMRG5RS0JnUUREcVN2eURtaGViOTIzSW96NGxlZ01SK205Z2xYVWdTS2dcbkVzZlllbVJmbU5XQitDN3ZhSXlVUm1ZNU55TXhmQlZXc3dXRldLYXhjK0krYnFzZmx6elZZdFpwMThNR2pzTURcbmZlZWZBWDZCWk1zVXQ3Qmw3WjlWSjg1bnRFZHFBQ0xwWitaLzN0SVJWdWdDV1pRMWhrbmxHa0dUMDI0SkVFKytcbk55SDFnM2QzUlFLQmdRQ1J2MXdKWkkwbVBsRklva0tGTkh1YTBUcDNLb1JTU1hzTURTVk9NK2xIckcxWHJtRjZcbkMwNGNTKzQ0N0dMUkxHOFVUaEpKbTRxckh0Ti9aK2dZOTYvMm1xYjRIakpORDM3TVhKQnZFYTN5ZUxTOHEvK1JcbjJGOU1LamRRaU5LWnhQcG84VzhOSlREWTVOa1BaZGh4a2pzSHdVNGRTNjZwMVRESUU0MGd0TFpaRFFLQmdGaldcbktyblFpTnEzOS9iNm5QOFJNVGJDUUFKbmR3anhTUU5kQTVmcW1rQTlhRk9HbCtqamsxQ1BWa0tNSWxLSmdEYkpcbk9heDl2OUc2Ui9NSTFIR1hmV3QxWU56VnRocjRIdHNyQTB0U3BsbWhwZ05XRTZWejZuQURqdGZQSnMyZUdqdlhcbmpQUnArdjhjY21MK3dTZzhQTGprM3ZsN2VlNXJsWWxNQndNdUdjUHhBb0dBZWRueGJXMVJMbVZubEFpSEx1L0xcbmxtZkF3RFdtRWlJMFVnK1BMbm9Pdk81dFE1ZDRXMS94RU44bFA0cWtzcGtmZk1Rbk5oNFNZR0VlQlQzMlpxQ1RcbkpSZ2YwWGpveXZ2dXA5eFhqTWtYcnBZL3ljMXpmcVRaQzBNTzkvMVVjMWJSR2RaMmR5M2xSNU5XYXA3T1h5Zk9cblBQcE5Gb1BUWGd2M3FDcW5sTEhyR3pNPVxuLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLVxuIiwKICAiY2xpZW50X2VtYWlsIjogImltYWdlLXB1bGxpbmdAYXV0aGVudGljYXRlZC1pbWFnZS1wdWxsaW5nLmlhbS5nc2VydmljZWFjY291bnQuY29tIiwKICAiY2xpZW50X2lkIjogIjExMzc5NzkxNDUzMDA3MzI3ODcxMiIsCiAgImF1dGhfdXJpIjogImh0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbS9vL29hdXRoMi9hdXRoIiwKICAidG9rZW5fdXJpIjogImh0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbS9vL29hdXRoMi90b2tlbiIsCiAgImF1dGhfcHJvdmlkZXJfeDUwOV9jZXJ0X3VybCI6ICJodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbS9vYXV0aDIvdjEvY2VydHMiLAogICJjbGllbnRfeDUwOV9jZXJ0X3VybCI6ICJodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbS9yb2JvdC92MS9tZXRhZGF0YS94NTA5L2ltYWdlLXB1bGxpbmclNDBhdXRoZW50aWNhdGVkLWltYWdlLXB1bGxpbmcuaWFtLmdzZXJ2aWNlYWNjb3VudC5jb20iCn0=",
+			"email": "image-pulling@authenticated-image-pulling.iam.gserviceaccount.com"
+		}
+	}
+}`
+			secret := &v1.Secret{
+				Data: map[string][]byte{v1.DockerConfigJsonKey: []byte(auth)},
+				Type: v1.SecretTypeDockerConfigJson,
+			}
+			// The following images are not added into NodeImageWhiteList, because this test is
+			// testing image pulling, these images don't need to be prepulled. The ImagePullPolicy
+			// is v1.PullAlways, so it won't be blocked by framework image white list check.
+			for _, testCase := range []struct {
+				description string
+				image       string
+				secret      bool
+				phase       v1.PodPhase
+				waiting     bool
+			}{
+				{
+					description: "should not be able to pull image from invalid registry",
+					image:       "invalid.com/invalid/alpine:3.1",
+					phase:       v1.PodPending,
+					waiting:     true,
+				},
+				{
+					description: "should not be able to pull non-existing image from gcr.io",
+					image:       "gcr.io/google_containers/invalid-image:invalid-tag",
+					phase:       v1.PodPending,
+					waiting:     true,
+				},
+				{
+					description: "should be able to pull image from gcr.io",
+					image:       "gcr.io/google_containers/alpine-with-bash:1.0",
+					phase:       v1.PodRunning,
+					waiting:     false,
+				},
+				{
+					description: "should be able to pull image from docker hub",
+					image:       "alpine:3.1",
+					phase:       v1.PodRunning,
+					waiting:     false,
+				},
+				{
+					description: "should not be able to pull from private registry without secret",
+					image:       "gcr.io/authenticated-image-pulling/alpine:3.1",
+					phase:       v1.PodPending,
+					waiting:     true,
+				},
+				{
+					description: "should be able to pull from private registry with secret",
+					image:       "gcr.io/authenticated-image-pulling/alpine:3.1",
+					secret:      true,
+					phase:       v1.PodRunning,
+					waiting:     false,
+				},
+			} {
+				testCase := testCase
+				It(testCase.description+" [Conformance]", func() {
+					name := "image-pull-test"
+					command := []string{"/bin/sh", "-c", "while true; do sleep 1; done"}
+					container := ConformanceContainer{
+						PodClient: f.PodClient(),
+						Container: v1.Container{
+							Name:    name,
+							Image:   testCase.image,
+							Command: command,
+							// PullAlways makes sure that the image will always be pulled even if it is present before the test.
+							ImagePullPolicy: v1.PullAlways,
+						},
+						RestartPolicy: v1.RestartPolicyNever,
+					}
+					if testCase.secret {
+						secret.Name = "image-pull-secret-" + string(uuid.NewUUID())
+						By("create image pull secret")
+						_, err := f.ClientSet.Core().Secrets(f.Namespace.Name).Create(secret)
+						Expect(err).NotTo(HaveOccurred())
+						defer f.ClientSet.Core().Secrets(f.Namespace.Name).Delete(secret.Name, nil)
+						container.ImagePullSecrets = []string{secret.Name}
+					}
+					// checkContainerStatus checks whether the container status matches expectation.
+					checkContainerStatus := func() error {
+						status, err := container.GetStatus()
+						if err != nil {
+							return fmt.Errorf("failed to get container status: %v", err)
+						}
+						// We need to check container state first. The default pod status is pending, If we check
+						// pod phase first, and the expected pod phase is Pending, the container status may not
+						// even show up when we check it.
+						// Check container state
+						if !testCase.waiting {
+							if status.State.Running == nil {
+								return fmt.Errorf("expected container state: Running, got: %q",
+									GetContainerState(status.State))
+							}
+						}
+						if testCase.waiting {
+							if status.State.Waiting == nil {
+								return fmt.Errorf("expected container state: Waiting, got: %q",
+									GetContainerState(status.State))
+							}
+							reason := status.State.Waiting.Reason
+							if reason != images.ErrImagePull.Error() &&
+								reason != images.ErrImagePullBackOff.Error() {
+								return fmt.Errorf("unexpected waiting reason: %q", reason)
+							}
+						}
+						// Check pod phase
+						phase, err := container.GetPhase()
+						if err != nil {
+							return fmt.Errorf("failed to get pod phase: %v", err)
+						}
+						if phase != testCase.phase {
+							return fmt.Errorf("expected pod phase: %q, got: %q", testCase.phase, phase)
+						}
+						return nil
+					}
+					// The image registry is not stable, which sometimes causes the test to fail. Add retry mechanism to make this
+					// less flaky.
+					const flakeRetry = 3
+					for i := 1; i <= flakeRetry; i++ {
+						var err error
+						By("create the container")
+						container.Create()
+						By("check the container status")
+						for start := time.Now(); time.Since(start) < retryTimeout; time.Sleep(pollInterval) {
+							if err = checkContainerStatus(); err == nil {
+								break
+							}
+						}
+						By("delete the container")
+						container.Delete()
+						if err == nil {
+							break
+						}
+						if i < flakeRetry {
+							framework.Logf("No.%d attempt failed: %v, retrying...", i, err)
+						} else {
+							framework.Failf("All %d attempts failed: %v", flakeRetry, err)
+						}
+					}
+				})
+			}
+		})
+	})
+})

vendor/k8s.io/kubernetes/test/e2e_node/services/BUILD

@@ -0,0 +1,56 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "apiserver.go",
+        "etcd.go",
+        "internal_services.go",
+        "kubelet.go",
+        "namespace_controller.go",
+        "server.go",
+        "services.go",
+        "util.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//cmd/kube-apiserver/app:go_default_library",
+        "//cmd/kube-apiserver/app/options:go_default_library",
+        "//pkg/api:go_default_library",
+        "//pkg/api/v1:go_default_library",
+        "//pkg/client/clientset_generated/clientset:go_default_library",
+        "//pkg/client/restclient:go_default_library",
+        "//pkg/client/typed/dynamic:go_default_library",
+        "//pkg/controller/namespace:go_default_library",
+        "//pkg/util/config:go_default_library",
+        "//test/e2e/framework:go_default_library",
+        "//test/e2e_node/builder:go_default_library",
+        "//vendor:github.com/coreos/etcd/etcdserver",
+        "//vendor:github.com/coreos/etcd/etcdserver/api/v2http",
+        "//vendor:github.com/coreos/etcd/pkg/transport",
+        "//vendor:github.com/coreos/etcd/pkg/types",
+        "//vendor:github.com/coreos/pkg/capnslog",
+        "//vendor:github.com/golang/glog",
+        "//vendor:github.com/kardianos/osext",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/e2e_node/services/apiserver.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services
+
+import (
+	"fmt"
+	"net"
+
+	apiserver "k8s.io/kubernetes/cmd/kube-apiserver/app"
+	"k8s.io/kubernetes/cmd/kube-apiserver/app/options"
+)
+
+const (
+	clusterIPRange          = "10.0.0.1/24"
+	apiserverClientURL      = "http://localhost:8080"
+	apiserverHealthCheckURL = apiserverClientURL + "/healthz"
+)
+
+// APIServer is a server which manages apiserver.
+type APIServer struct{}
+
+// NewAPIServer creates an apiserver.
+func NewAPIServer() *APIServer {
+	return &APIServer{}
+}
+
+// Start starts the apiserver, returns when apiserver is ready.
+func (a *APIServer) Start() error {
+	config := options.NewServerRunOptions()
+	config.Etcd.StorageConfig.ServerList = []string{getEtcdClientURL()}
+	// TODO: Current setup of etcd in e2e-node tests doesn't support etcd v3
+	// protocol. We should migrate it to use the same infrastructure as all
+	// other tests (pkg/storage/etcd/testing).
+	config.Etcd.StorageConfig.Type = "etcd2"
+	_, ipnet, err := net.ParseCIDR(clusterIPRange)
+	if err != nil {
+		return err
+	}
+	config.ServiceClusterIPRange = *ipnet
+	config.AllowPrivileged = true
+	errCh := make(chan error)
+	go func() {
+		defer close(errCh)
+		err := apiserver.Run(config)
+		if err != nil {
+			errCh <- fmt.Errorf("run apiserver error: %v", err)
+		}
+	}()
+
+	err = readinessCheck("apiserver", []string{apiserverHealthCheckURL}, errCh)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// Stop stops the apiserver. Currently, there is no way to stop the apiserver.
+// The function is here only for completion.
+func (a *APIServer) Stop() error {
+	return nil
+}
+
+const apiserverName = "apiserver"
+
+func (a *APIServer) Name() string {
+	return apiserverName
+}
+
+func getAPIServerClientURL() string {
+	return apiserverClientURL
+}
+
+func getAPIServerHealthCheckURL() string {
+	return apiserverHealthCheckURL
+}

vendor/k8s.io/kubernetes/test/e2e_node/services/etcd.go

@@ -0,0 +1,165 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services
+
+import (
+	"crypto/tls"
+	"net"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/coreos/etcd/etcdserver"
+	"github.com/coreos/etcd/etcdserver/api/v2http"
+	"github.com/coreos/etcd/pkg/transport"
+	"github.com/coreos/etcd/pkg/types"
+	"github.com/coreos/pkg/capnslog"
+	"github.com/golang/glog"
+)
+
+// TODO(random-liu): Add service interface to manage services with the same behaviour.
+
+func init() {
+	// github.com/coreos/etcd/etcdserver/api package is too spammy, set the log level to NOTICE.
+	capnslog.MustRepoLogger("github.com/coreos/etcd/etcdserver/api").SetRepoLogLevel(capnslog.NOTICE)
+}
+
+// All following configurations are got from etcd source code.
+// TODO(random-liu): Use embed.NewConfig after etcd3 is supported.
+const (
+	etcdName           = "etcd"
+	clientURLStr       = "http://localhost:4001" // clientURL has listener created and handles etcd API traffic
+	peerURLStr         = "http://localhost:7001" // peerURL does't have listener created, it is used to pass Etcd validation
+	snapCount          = etcdserver.DefaultSnapCount
+	maxSnapFiles       = 5
+	maxWALFiles        = 5
+	tickMs             = 100
+	electionTicks      = 10
+	etcdHealthCheckURL = clientURLStr + "/v2/keys/" // Trailing slash is required,
+)
+
+// EtcdServer is a server which manages etcd.
+type EtcdServer struct {
+	*etcdserver.EtcdServer
+	config       *etcdserver.ServerConfig
+	clientListen net.Listener
+}
+
+// NewEtcd creates a new default etcd server using 'dataDir' for persistence.
+func NewEtcd(dataDir string) *EtcdServer {
+	clientURLs, err := types.NewURLs([]string{clientURLStr})
+	if err != nil {
+		glog.Fatalf("Failed to parse client url %q: %v", clientURLStr, err)
+	}
+	peerURLs, err := types.NewURLs([]string{peerURLStr})
+	if err != nil {
+		glog.Fatalf("Failed to parse peer url %q: %v", peerURLStr, err)
+	}
+
+	config := &etcdserver.ServerConfig{
+		Name:               etcdName,
+		ClientURLs:         clientURLs,
+		PeerURLs:           peerURLs,
+		DataDir:            dataDir,
+		InitialPeerURLsMap: map[string]types.URLs{etcdName: peerURLs},
+		NewCluster:         true,
+		SnapCount:          snapCount,
+		MaxSnapFiles:       maxSnapFiles,
+		MaxWALFiles:        maxWALFiles,
+		TickMs:             tickMs,
+		ElectionTicks:      electionTicks,
+	}
+
+	return &EtcdServer{
+		config: config,
+	}
+}
+
+// Start starts the etcd server and listening for client connections
+func (e *EtcdServer) Start() error {
+	var err error
+	e.EtcdServer, err = etcdserver.NewServer(e.config)
+	if err != nil {
+		return err
+	}
+	// create client listener, there should be only one url
+	e.clientListen, err = createListener(e.config.ClientURLs[0])
+	if err != nil {
+		return err
+	}
+
+	// start etcd
+	e.EtcdServer.Start()
+
+	// setup client listener
+	ch := v2http.NewClientHandler(e.EtcdServer, e.config.ReqTimeout())
+	errCh := make(chan error)
+	go func(l net.Listener) {
+		defer close(errCh)
+		srv := &http.Server{
+			Handler:     ch,
+			ReadTimeout: 5 * time.Minute,
+		}
+		// Serve always returns a non-nil error.
+		errCh <- srv.Serve(l)
+	}(e.clientListen)
+
+	err = readinessCheck("etcd", []string{etcdHealthCheckURL}, errCh)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// Stop closes all connections and stops the Etcd server
+func (e *EtcdServer) Stop() error {
+	if e.EtcdServer != nil {
+		e.EtcdServer.Stop()
+	}
+	if e.clientListen != nil {
+		err := e.clientListen.Close()
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Name returns the server's unique name
+func (e *EtcdServer) Name() string {
+	return etcdName
+}
+
+func createListener(url url.URL) (net.Listener, error) {
+	l, err := net.Listen("tcp", url.Host)
+	if err != nil {
+		return nil, err
+	}
+	l, err = transport.NewKeepAliveListener(l, url.Scheme, &tls.Config{})
+	if err != nil {
+		return nil, err
+	}
+	return l, nil
+}
+
+func getEtcdClientURL() string {
+	return clientURLStr
+}
+
+func getEtcdHealthCheckURL() string {
+	return etcdHealthCheckURL
+}

vendor/k8s.io/kubernetes/test/e2e_node/services/internal_services.go

@@ -0,0 +1,141 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services
+
+import (
+	"io/ioutil"
+	"os"
+
+	"github.com/golang/glog"
+)
+
+// e2eService manages e2e services in current process.
+type e2eServices struct {
+	rmDirs []string
+	// statically linked e2e services
+	etcdServer   *EtcdServer
+	apiServer    *APIServer
+	nsController *NamespaceController
+}
+
+func newE2EServices() *e2eServices {
+	return &e2eServices{}
+}
+
+// run starts all e2e services and wait for the termination signal. Once receives the
+// termination signal, it will stop the e2e services gracefully.
+func (es *e2eServices) run() error {
+	defer es.stop()
+	if err := es.start(); err != nil {
+		return err
+	}
+	// Wait until receiving a termination signal.
+	waitForTerminationSignal()
+	return nil
+}
+
+// start starts the tests embedded services or returns an error.
+func (es *e2eServices) start() error {
+	glog.Info("Starting e2e services...")
+	err := es.startEtcd()
+	if err != nil {
+		return err
+	}
+	err = es.startApiServer()
+	if err != nil {
+		return err
+	}
+	err = es.startNamespaceController()
+	if err != nil {
+		return nil
+	}
+	glog.Info("E2E services started.")
+	return nil
+}
+
+// stop stops the embedded e2e services.
+func (es *e2eServices) stop() {
+	glog.Info("Stopping e2e services...")
+	// TODO(random-liu): Use a loop to stop all services after introducing
+	// service interface.
+	glog.Info("Stopping namespace controller")
+	if es.nsController != nil {
+		if err := es.nsController.Stop(); err != nil {
+			glog.Errorf("Failed to stop %q: %v", es.nsController.Name(), err)
+		}
+	}
+
+	glog.Info("Stopping API server")
+	if es.apiServer != nil {
+		if err := es.apiServer.Stop(); err != nil {
+			glog.Errorf("Failed to stop %q: %v", es.apiServer.Name(), err)
+		}
+	}
+
+	glog.Info("Stopping etcd")
+	if es.etcdServer != nil {
+		if err := es.etcdServer.Stop(); err != nil {
+			glog.Errorf("Failed to stop %q: %v", es.etcdServer.Name(), err)
+		}
+	}
+
+	for _, d := range es.rmDirs {
+		glog.Info("Deleting directory %v", d)
+		err := os.RemoveAll(d)
+		if err != nil {
+			glog.Errorf("Failed to delete directory %s.\n%v", d, err)
+		}
+	}
+
+	glog.Info("E2E services stopped.")
+}
+
+// startEtcd starts the embedded etcd instance or returns an error.
+func (es *e2eServices) startEtcd() error {
+	glog.Info("Starting etcd")
+	// Create data directory in current working space.
+	dataDir, err := ioutil.TempDir(".", "etcd")
+	if err != nil {
+		return err
+	}
+	// Mark the dataDir as directories to remove.
+	es.rmDirs = append(es.rmDirs, dataDir)
+	es.etcdServer = NewEtcd(dataDir)
+	return es.etcdServer.Start()
+}
+
+// startApiServer starts the embedded API server or returns an error.
+func (es *e2eServices) startApiServer() error {
+	glog.Info("Starting API server")
+	es.apiServer = NewAPIServer()
+	return es.apiServer.Start()
+}
+
+// startNamespaceController starts the embedded namespace controller or returns an error.
+func (es *e2eServices) startNamespaceController() error {
+	glog.Info("Starting namespace controller")
+	es.nsController = NewNamespaceController()
+	return es.nsController.Start()
+}
+
+// getServicesHealthCheckURLs returns the health check urls for the internal services.
+func getServicesHealthCheckURLs() []string {
+	return []string{
+		getEtcdHealthCheckURL(),
+		getAPIServerHealthCheckURL(),
+	}
+}

vendor/k8s.io/kubernetes/test/e2e_node/services/kubelet.go

@@ -0,0 +1,210 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services
+
+import (
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"math/rand"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/golang/glog"
+
+	"k8s.io/kubernetes/test/e2e/framework"
+	"k8s.io/kubernetes/test/e2e_node/builder"
+)
+
+// TODO(random-liu): Replace this with standard kubelet launcher.
+
+// args is the type used to accumulate args from the flags with the same name.
+type args []string
+
+// String function of flag.Value
+func (a *args) String() string {
+	return fmt.Sprint(*a)
+}
+
+// Set function of flag.Value
+func (a *args) Set(value string) error {
+	// Someone else is calling flag.Parse after the flags are parsed in the
+	// test framework. Use this to avoid the flag being parsed twice.
+	// TODO(random-liu): Figure out who is parsing the flags.
+	if flag.Parsed() {
+		return nil
+	}
+	// Note that we assume all white space in flag string is separating fields
+	na := strings.Fields(value)
+	*a = append(*a, na...)
+	return nil
+}
+
+// kubeletArgs is the override kubelet args specified by the test runner.
+var kubeletArgs args
+
+func init() {
+	flag.Var(&kubeletArgs, "kubelet-flags", "Kubelet flags passed to kubelet, this will override default kubelet flags in the test. Flags specified in multiple kubelet-flags will be concatenate.")
+}
+
+// RunKubelet starts kubelet and waits for termination signal. Once receives the
+// termination signal, it will stop the kubelet gracefully.
+func RunKubelet() {
+	var err error
+	// Enable monitorParent to make sure kubelet will receive termination signal
+	// when test process exits.
+	e := NewE2EServices(true /* monitorParent */)
+	defer e.Stop()
+	e.kubelet, err = e.startKubelet()
+	if err != nil {
+		glog.Fatalf("Failed to start kubelet: %v", err)
+	}
+	// Wait until receiving a termination signal.
+	waitForTerminationSignal()
+}
+
+const (
+	// Ports of different e2e services.
+	kubeletPort         = "10250"
+	kubeletReadOnlyPort = "10255"
+	// Health check url of kubelet
+	kubeletHealthCheckURL = "http://127.0.0.1:" + kubeletReadOnlyPort + "/healthz"
+)
+
+// startKubelet starts the Kubelet in a separate process or returns an error
+// if the Kubelet fails to start.
+func (e *E2EServices) startKubelet() (*server, error) {
+	glog.Info("Starting kubelet")
+	// Create pod manifest path
+	manifestPath, err := createPodManifestDirectory()
+	if err != nil {
+		return nil, err
+	}
+	e.rmDirs = append(e.rmDirs, manifestPath)
+	var killCommand, restartCommand *exec.Cmd
+	var isSystemd bool
+	// Apply default kubelet flags.
+	cmdArgs := []string{}
+	if systemdRun, err := exec.LookPath("systemd-run"); err == nil {
+		// On systemd services, detection of a service / unit works reliably while
+		// detection of a process started from an ssh session does not work.
+		// Since kubelet will typically be run as a service it also makes more
+		// sense to test it that way
+		isSystemd = true
+		unitName := fmt.Sprintf("kubelet-%d.service", rand.Int31())
+		cmdArgs = append(cmdArgs, systemdRun, "--unit="+unitName, "--remain-after-exit", builder.GetKubeletServerBin())
+		killCommand = exec.Command("systemctl", "kill", unitName)
+		restartCommand = exec.Command("systemctl", "restart", unitName)
+		e.logFiles["kubelet.log"] = logFileData{
+			journalctlCommand: []string{"-u", unitName},
+		}
+	} else {
+		cmdArgs = append(cmdArgs, builder.GetKubeletServerBin())
+		cmdArgs = append(cmdArgs,
+			"--runtime-cgroups=/docker-daemon",
+			"--kubelet-cgroups=/kubelet",
+			"--cgroup-root=/",
+			"--system-cgroups=/system",
+		)
+	}
+	cmdArgs = append(cmdArgs,
+		"--api-servers", getAPIServerClientURL(),
+		"--address", "0.0.0.0",
+		"--port", kubeletPort,
+		"--read-only-port", kubeletReadOnlyPort,
+		"--volume-stats-agg-period", "10s", // Aggregate volumes frequently so tests don't need to wait as long
+		"--allow-privileged", "true",
+		"--serialize-image-pulls", "false",
+		"--config", manifestPath,
+		"--file-check-frequency", "10s", // Check file frequently so tests won't wait too long
+		"--pod-cidr", "10.180.0.0/24", // Assign a fixed CIDR to the node because there is no node controller.
+		"--eviction-pressure-transition-period", "30s",
+		// Apply test framework feature gates by default. This could also be overridden
+		// by kubelet-flags.
+		"--feature-gates", framework.TestContext.FeatureGates,
+		"--eviction-hard", "memory.available<250Mi,nodefs.available<10%,nodefs.inodesFree<5%", // The hard eviction thresholds.
+		"--eviction-minimum-reclaim", "nodefs.available=5%,nodefs.inodesFree=5%", // The minimum reclaimed resources after eviction.
+		"--v", LOG_VERBOSITY_LEVEL, "--logtostderr",
+	)
+	// Enable kubenet by default.
+	cniDir, err := getCNIDirectory()
+	if err != nil {
+		return nil, err
+	}
+	cmdArgs = append(cmdArgs,
+		"--network-plugin=kubenet",
+		"--network-plugin-dir", cniDir)
+
+	// Keep hostname override for convenience.
+	if framework.TestContext.NodeName != "" { // If node name is specified, set hostname override.
+		cmdArgs = append(cmdArgs, "--hostname-override", framework.TestContext.NodeName)
+	}
+
+	// Override the default kubelet flags.
+	cmdArgs = append(cmdArgs, kubeletArgs...)
+
+	// Adjust the args if we are running kubelet with systemd.
+	if isSystemd {
+		adjustArgsForSystemd(cmdArgs)
+	}
+
+	cmd := exec.Command(cmdArgs[0], cmdArgs[1:]...)
+	server := newServer(
+		"kubelet",
+		cmd,
+		killCommand,
+		restartCommand,
+		[]string{kubeletHealthCheckURL},
+		"kubelet.log",
+		e.monitorParent,
+		true /* restartOnExit */)
+	return server, server.start()
+}
+
+// createPodManifestDirectory creates pod manifest directory.
+func createPodManifestDirectory() (string, error) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		return "", fmt.Errorf("failed to get current working directory: %v", err)
+	}
+	path, err := ioutil.TempDir(cwd, "pod-manifest")
+	if err != nil {
+		return "", fmt.Errorf("failed to create static pod manifest directory: %v", err)
+	}
+	return path, nil
+}
+
+// getCNIDirectory returns CNI directory.
+func getCNIDirectory() (string, error) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		return "", err
+	}
+	// TODO(random-liu): Make sure the cni directory name is the same with that in remote/remote.go
+	return filepath.Join(cwd, "cni", "bin"), nil
+}
+
+// adjustArgsForSystemd escape special characters in kubelet arguments for systemd. Systemd
+// may try to do auto expansion without escaping.
+func adjustArgsForSystemd(args []string) {
+	for i := range args {
+		args[i] = strings.Replace(args[i], "%", "%%", -1)
+		args[i] = strings.Replace(args[i], "$", "$$", -1)
+	}
+}

vendor/k8s.io/kubernetes/test/e2e_node/services/namespace_controller.go

@@ -0,0 +1,74 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services
+
+import (
+	"time"
+
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
+	"k8s.io/kubernetes/pkg/client/restclient"
+	"k8s.io/kubernetes/pkg/client/typed/dynamic"
+	namespacecontroller "k8s.io/kubernetes/pkg/controller/namespace"
+	"k8s.io/kubernetes/test/e2e/framework"
+)
+
+const (
+	// ncName is the name of namespace controller
+	ncName = "namespace-controller"
+	// ncResyncPeriod is resync period of the namespace controller
+	ncResyncPeriod = 5 * time.Minute
+	// ncConcurrency is concurrency of the namespace controller
+	ncConcurrency = 2
+)
+
+// NamespaceController is a server which manages namespace controller.
+type NamespaceController struct {
+	stopCh chan struct{}
+}
+
+// NewNamespaceController creates a new namespace controller.
+func NewNamespaceController() *NamespaceController {
+	return &NamespaceController{stopCh: make(chan struct{})}
+}
+
+// Start starts the namespace controller.
+func (n *NamespaceController) Start() error {
+	// Use the default QPS
+	config := restclient.AddUserAgent(&restclient.Config{Host: framework.TestContext.Host}, ncName)
+	client, err := clientset.NewForConfig(config)
+	if err != nil {
+		return err
+	}
+	clientPool := dynamic.NewClientPool(config, api.Registry.RESTMapper(), dynamic.LegacyAPIPathResolverFunc)
+	discoverResourcesFn := client.Discovery().ServerPreferredNamespacedResources
+	nc := namespacecontroller.NewNamespaceController(client, clientPool, discoverResourcesFn, ncResyncPeriod, v1.FinalizerKubernetes)
+	go nc.Run(ncConcurrency, n.stopCh)
+	return nil
+}
+
+// Stop stops the namespace controller.
+func (n *NamespaceController) Stop() error {
+	close(n.stopCh)
+	return nil
+}
+
+// Name returns the name of namespace controller.
+func (n *NamespaceController) Name() string {
+	return ncName
+}

vendor/k8s.io/kubernetes/test/e2e_node/services/server.go

@@ -0,0 +1,361 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services
+
+import (
+	"flag"
+	"fmt"
+	"net/http"
+	"os"
+	"os/exec"
+	"path"
+	"reflect"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/golang/glog"
+
+	"k8s.io/kubernetes/test/e2e/framework"
+)
+
+var serverStartTimeout = flag.Duration("server-start-timeout", time.Second*120, "Time to wait for each server to become healthy.")
+
+// A server manages a separate server process started and killed with
+// commands.
+type server struct {
+	// name is the name of the server, it is only used for logging.
+	name string
+	// startCommand is the command used to start the server
+	startCommand *exec.Cmd
+	// killCommand is the command used to stop the server. It is not required. If it
+	// is not specified, `kill` will be used to stop the server.
+	killCommand *exec.Cmd
+	// restartCommand is the command used to restart the server. If provided, it will be used
+	// instead of startCommand when restarting the server.
+	restartCommand *exec.Cmd
+	// healthCheckUrls is the urls used to check whether the server is ready.
+	healthCheckUrls []string
+	// outFilename is the name of the log file. The stdout and stderr of the server
+	// will be redirected to this file.
+	outFilename string
+	// monitorParent determines whether the server should watch its parent process and exit
+	// if its parent is gone.
+	monitorParent bool
+	// restartOnExit determines whether a restart loop is launched with the server
+	restartOnExit bool
+	// Writing to this channel, if it is not nil, stops the restart loop.
+	// When tearing down a server, you should check for this channel and write to it if it exists.
+	stopRestartingCh chan<- bool
+	// Read from this to confirm that the restart loop has stopped.
+	ackStopRestartingCh <-chan bool
+}
+
+// newServer returns a new server with the given name, commands, health check
+// URLs, etc.
+func newServer(name string, start, kill, restart *exec.Cmd, urls []string, outputFileName string, monitorParent, restartOnExit bool) *server {
+	return &server{
+		name:            name,
+		startCommand:    start,
+		killCommand:     kill,
+		restartCommand:  restart,
+		healthCheckUrls: urls,
+		outFilename:     outputFileName,
+		monitorParent:   monitorParent,
+		restartOnExit:   restartOnExit,
+	}
+}
+
+// commandToString format command to string.
+func commandToString(c *exec.Cmd) string {
+	if c == nil {
+		return ""
+	}
+	return strings.Join(append([]string{c.Path}, c.Args[1:]...), " ")
+}
+
+func (s *server) String() string {
+	return fmt.Sprintf("server %q start-command: `%s`, kill-command: `%s`, restart-command: `%s`, health-check: %v, output-file: %q", s.name,
+		commandToString(s.startCommand), commandToString(s.killCommand), commandToString(s.restartCommand), s.healthCheckUrls, s.outFilename)
+}
+
+// readinessCheck checks whether services are ready via the supplied health
+// check URLs. Once there is an error in errCh, the function will stop waiting
+// and return the error.
+// TODO(random-liu): Move this to util
+func readinessCheck(name string, urls []string, errCh <-chan error) error {
+	glog.Infof("Running readiness check for service %q", name)
+	endTime := time.Now().Add(*serverStartTimeout)
+	blockCh := make(chan error)
+	defer close(blockCh)
+	for endTime.After(time.Now()) {
+		select {
+		// We *always* want to run the health check if there is no error on the channel.
+		// With systemd, reads from errCh report nil because cmd.Run() waits
+		// on systemd-run, rather than the service process. systemd-run quickly
+		// exits with status 0, causing the channel to be closed with no error. In
+		// this case, you want to wait for the health check to complete, rather
+		// than returning from readinessCheck as soon as the channel is closed.
+		case err, ok := <-errCh:
+			if ok { // The channel is not closed, this is a real error
+				if err != nil { // If there is an error, return it
+					return err
+				}
+				// If not, keep checking readiness.
+			} else { // The channel is closed, this is only a zero value.
+				// Replace the errCh with blockCh to avoid busy loop,
+				// and keep checking readiness.
+				errCh = blockCh
+			}
+		case <-time.After(time.Second):
+			ready := true
+			for _, url := range urls {
+				resp, err := http.Head(url)
+				if err != nil || resp.StatusCode != http.StatusOK {
+					ready = false
+					break
+				}
+			}
+			if ready {
+				return nil
+			}
+		}
+	}
+	return fmt.Errorf("e2e service %q readiness check timeout %v", name, *serverStartTimeout)
+}
+
+// start starts the server by running its commands, monitors it with a health
+// check, and ensures that it is restarted if applicable.
+//
+// Note: restartOnExit == true requires len(s.healthCheckUrls) > 0 to work properly.
+func (s *server) start() error {
+	glog.Infof("Starting server %q with command %q", s.name, commandToString(s.startCommand))
+	errCh := make(chan error)
+
+	// Set up restart channels if the server is configured for restart on exit.
+	var stopRestartingCh, ackStopRestartingCh chan bool
+	if s.restartOnExit {
+		if len(s.healthCheckUrls) == 0 {
+			return fmt.Errorf("Tried to start %s which has s.restartOnExit == true, but no health check urls provided.", s)
+		}
+
+		stopRestartingCh = make(chan bool)
+		ackStopRestartingCh = make(chan bool)
+
+		s.stopRestartingCh = stopRestartingCh
+		s.ackStopRestartingCh = ackStopRestartingCh
+	}
+
+	// This goroutine actually runs the start command for the server.
+	go func() {
+		defer close(errCh)
+
+		// Create the output filename
+		outPath := path.Join(framework.TestContext.ReportDir, s.outFilename)
+		outfile, err := os.Create(outPath)
+		if err != nil {
+			errCh <- fmt.Errorf("failed to create file %q for `%s` %v.", outPath, s, err)
+			return
+		} else {
+			glog.Infof("Output file for server %q: %v", s.name, outfile.Name())
+		}
+		defer outfile.Close()
+		defer outfile.Sync()
+
+		// Set the command to write the output file
+		s.startCommand.Stdout = outfile
+		s.startCommand.Stderr = outfile
+
+		// If monitorParent is set, set Pdeathsig when starting the server.
+		if s.monitorParent {
+			// Death of this test process should kill the server as well.
+			attrs := &syscall.SysProcAttr{}
+			// Hack to set linux-only field without build tags.
+			deathSigField := reflect.ValueOf(attrs).Elem().FieldByName("Pdeathsig")
+			if deathSigField.IsValid() {
+				deathSigField.Set(reflect.ValueOf(syscall.SIGTERM))
+			} else {
+				errCh <- fmt.Errorf("failed to set Pdeathsig field (non-linux build)")
+				return
+			}
+			s.startCommand.SysProcAttr = attrs
+		}
+
+		// Start the command
+		err = s.startCommand.Start()
+		if err != nil {
+			errCh <- fmt.Errorf("failed to run %s: %v", s, err)
+			return
+		}
+		if !s.restartOnExit {
+			glog.Infof("Waiting for server %q start command to complete", s.name)
+			// If we aren't planning on restarting, ok to Wait() here to release resources.
+			// Otherwise, we Wait() in the restart loop.
+			err = s.startCommand.Wait()
+			if err != nil {
+				errCh <- fmt.Errorf("failed to run start command for server %q: %v", s.name, err)
+				return
+			}
+		} else {
+			usedStartCmd := true
+			for {
+				glog.Infof("Running health check for service %q", s.name)
+				// Wait for an initial health check to pass, so that we are sure the server started.
+				err := readinessCheck(s.name, s.healthCheckUrls, nil)
+				if err != nil {
+					if usedStartCmd {
+						glog.Infof("Waiting for server %q start command to complete after initial health check failed", s.name)
+						s.startCommand.Wait() // Release resources if necessary.
+					}
+					// This should not happen, immediately stop the e2eService process.
+					glog.Fatalf("Restart loop readinessCheck failed for %s", s)
+				} else {
+					glog.Infof("Initial health check passed for service %q", s.name)
+				}
+
+				// Initial health check passed, wait until a health check fails again.
+			stillAlive:
+				for {
+					select {
+					case <-stopRestartingCh:
+						ackStopRestartingCh <- true
+						return
+					case <-time.After(time.Second):
+						for _, url := range s.healthCheckUrls {
+							resp, err := http.Head(url)
+							if err != nil || resp.StatusCode != http.StatusOK {
+								break stillAlive
+							}
+						}
+					}
+				}
+
+				if usedStartCmd {
+					s.startCommand.Wait() // Release resources from last cmd
+					usedStartCmd = false
+				}
+				if s.restartCommand != nil {
+					// Always make a fresh copy of restartCommand before
+					// running, we may have to restart multiple times
+					s.restartCommand = &exec.Cmd{
+						Path:        s.restartCommand.Path,
+						Args:        s.restartCommand.Args,
+						Env:         s.restartCommand.Env,
+						Dir:         s.restartCommand.Dir,
+						Stdin:       s.restartCommand.Stdin,
+						Stdout:      s.restartCommand.Stdout,
+						Stderr:      s.restartCommand.Stderr,
+						ExtraFiles:  s.restartCommand.ExtraFiles,
+						SysProcAttr: s.restartCommand.SysProcAttr,
+					}
+					// Run and wait for exit. This command is assumed to have
+					// short duration, e.g. systemctl restart
+					glog.Infof("Restarting server %q with restart command", s.name)
+					err = s.restartCommand.Run()
+					if err != nil {
+						// This should not happen, immediately stop the e2eService process.
+						glog.Fatalf("Restarting server %s with restartCommand failed. Error: %v.", s, err)
+					}
+				} else {
+					s.startCommand = &exec.Cmd{
+						Path:        s.startCommand.Path,
+						Args:        s.startCommand.Args,
+						Env:         s.startCommand.Env,
+						Dir:         s.startCommand.Dir,
+						Stdin:       s.startCommand.Stdin,
+						Stdout:      s.startCommand.Stdout,
+						Stderr:      s.startCommand.Stderr,
+						ExtraFiles:  s.startCommand.ExtraFiles,
+						SysProcAttr: s.startCommand.SysProcAttr,
+					}
+					glog.Infof("Restarting server %q with start command", s.name)
+					err = s.startCommand.Start()
+					usedStartCmd = true
+					if err != nil {
+						// This should not happen, immediately stop the e2eService process.
+						glog.Fatalf("Restarting server %s with startCommand failed. Error: %v.", s, err)
+					}
+				}
+			}
+		}
+	}()
+
+	return readinessCheck(s.name, s.healthCheckUrls, errCh)
+}
+
+// kill runs the server's kill command.
+func (s *server) kill() error {
+	glog.Infof("Kill server %q", s.name)
+	name := s.name
+	cmd := s.startCommand
+
+	// If s has a restart loop, turn it off.
+	if s.restartOnExit {
+		s.stopRestartingCh <- true
+		<-s.ackStopRestartingCh
+	}
+
+	if s.killCommand != nil {
+		return s.killCommand.Run()
+	}
+
+	if cmd == nil {
+		return fmt.Errorf("could not kill %q because both `killCommand` and `startCommand` are nil", name)
+	}
+
+	if cmd.Process == nil {
+		glog.V(2).Infof("%q not running", name)
+		return nil
+	}
+	pid := cmd.Process.Pid
+	if pid <= 1 {
+		return fmt.Errorf("invalid PID %d for %q", pid, name)
+	}
+
+	// Attempt to shut down the process in a friendly manner before forcing it.
+	waitChan := make(chan error)
+	go func() {
+		_, err := cmd.Process.Wait()
+		waitChan <- err
+		close(waitChan)
+	}()
+
+	const timeout = 10 * time.Second
+	for _, signal := range []string{"-TERM", "-KILL"} {
+		glog.V(2).Infof("Killing process %d (%s) with %s", pid, name, signal)
+		cmd := exec.Command("kill", signal, strconv.Itoa(pid))
+		_, err := cmd.Output()
+		if err != nil {
+			glog.Errorf("Error signaling process %d (%s) with %s: %v", pid, name, signal, err)
+			continue
+		}
+
+		select {
+		case err := <-waitChan:
+			if err != nil {
+				return fmt.Errorf("error stopping %q: %v", name, err)
+			}
+			// Success!
+			return nil
+		case <-time.After(timeout):
+			// Continue.
+		}
+	}
+
+	return fmt.Errorf("unable to stop %q", name)
+}

vendor/k8s.io/kubernetes/test/e2e_node/services/services.go

@@ -0,0 +1,206 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path"
+
+	"github.com/golang/glog"
+	"github.com/kardianos/osext"
+
+	utilconfig "k8s.io/kubernetes/pkg/util/config"
+	"k8s.io/kubernetes/test/e2e/framework"
+)
+
+// E2EServices starts and stops e2e services in a separate process. The test
+// uses it to start and stop all e2e services.
+type E2EServices struct {
+	// monitorParent determines whether the sub-processes should watch and die with the current
+	// process.
+	rmDirs        []string
+	monitorParent bool
+	services      *server
+	kubelet       *server
+	logFiles      map[string]logFileData
+}
+
+// logFileData holds data about logfiles to fetch with a journalctl command or
+// symlink from a node's file system.
+type logFileData struct {
+	files             []string
+	journalctlCommand []string
+}
+
+// NewE2EServices returns a new E2EServices instance.
+func NewE2EServices(monitorParent bool) *E2EServices {
+	return &E2EServices{
+		monitorParent: monitorParent,
+		// Special log files that need to be collected for additional debugging.
+		logFiles: map[string]logFileData{
+			"kern.log":       {[]string{"/var/log/kern.log"}, []string{"-k"}},
+			"docker.log":     {[]string{"/var/log/docker.log", "/var/log/upstart/docker.log"}, []string{"-u", "docker"}},
+			"cloud-init.log": {[]string{"/var/log/cloud-init.log"}, []string{"-u", "cloud*"}},
+		},
+	}
+}
+
+// Start starts the e2e services in another process by calling back into the
+// test binary.  Returns when all e2e services are ready or an error.
+//
+// We want to statically link e2e services into the test binary, but we don't
+// want their glog output to pollute the test result. So we run the binary in
+// run-services-mode to start e2e services in another process.
+// The function starts 2 processes:
+// * internal e2e services: services which statically linked in the test binary - apiserver, etcd and
+// namespace controller.
+// * kubelet: kubelet binary is outside. (We plan to move main kubelet start logic out when we have
+// standard kubelet launcher)
+func (e *E2EServices) Start() error {
+	var err error
+	if !framework.TestContext.NodeConformance {
+		// Start kubelet
+		e.kubelet, err = e.startKubelet()
+		if err != nil {
+			return fmt.Errorf("failed to start kubelet: %v", err)
+		}
+	}
+	e.services, err = e.startInternalServices()
+	return err
+}
+
+// Stop stops the e2e services.
+func (e *E2EServices) Stop() {
+	defer func() {
+		if !framework.TestContext.NodeConformance {
+			// Collect log files.
+			e.getLogFiles()
+		}
+	}()
+	if e.services != nil {
+		if err := e.services.kill(); err != nil {
+			glog.Errorf("Failed to stop services: %v", err)
+		}
+	}
+	if e.kubelet != nil {
+		if err := e.kubelet.kill(); err != nil {
+			glog.Errorf("Failed to stop kubelet: %v", err)
+		}
+	}
+	if e.rmDirs != nil {
+		for _, d := range e.rmDirs {
+			err := os.RemoveAll(d)
+			if err != nil {
+				glog.Errorf("Failed to delete directory %s: %v", d, err)
+			}
+		}
+	}
+}
+
+// RunE2EServices actually start the e2e services. This function is used to
+// start e2e services in current process. This is only used in run-services-mode.
+func RunE2EServices() {
+	// Populate global DefaultFeatureGate with value from TestContext.FeatureGates.
+	// This way, statically-linked components see the same feature gate config as the test context.
+	utilconfig.DefaultFeatureGate.Set(framework.TestContext.FeatureGates)
+	e := newE2EServices()
+	if err := e.run(); err != nil {
+		glog.Fatalf("Failed to run e2e services: %v", err)
+	}
+}
+
+const (
+	// services.log is the combined log of all services
+	servicesLogFile = "services.log"
+	// LOG_VERBOSITY_LEVEL is consistent with the level used in a cluster e2e test.
+	LOG_VERBOSITY_LEVEL = "4"
+)
+
+// startInternalServices starts the internal services in a separate process.
+func (e *E2EServices) startInternalServices() (*server, error) {
+	testBin, err := osext.Executable()
+	if err != nil {
+		return nil, fmt.Errorf("can't get current binary: %v", err)
+	}
+	// Pass all flags into the child process, so that it will see the same flag set.
+	startCmd := exec.Command(testBin, append([]string{"--run-services-mode"}, os.Args[1:]...)...)
+	server := newServer("services", startCmd, nil, nil, getServicesHealthCheckURLs(), servicesLogFile, e.monitorParent, false)
+	return server, server.start()
+}
+
+// getLogFiles gets logs of interest either via journalctl or by creating sym
+// links. Since we scp files from the remote directory, symlinks will be
+// treated as normal files and file contents will be copied over.
+func (e *E2EServices) getLogFiles() {
+	// Nothing to do if report dir is not specified.
+	if framework.TestContext.ReportDir == "" {
+		return
+	}
+	glog.Info("Fetching log files...")
+	journaldFound := isJournaldAvailable()
+	for targetFileName, logFileData := range e.logFiles {
+		targetLink := path.Join(framework.TestContext.ReportDir, targetFileName)
+		if journaldFound {
+			// Skip log files that do not have an equivalent in journald-based machines.
+			if len(logFileData.journalctlCommand) == 0 {
+				continue
+			}
+			glog.Infof("Get log file %q with journalctl command %v.", targetFileName, logFileData.journalctlCommand)
+			out, err := exec.Command("journalctl", logFileData.journalctlCommand...).CombinedOutput()
+			if err != nil {
+				glog.Errorf("failed to get %q from journald: %v, %v", targetFileName, string(out), err)
+			} else {
+				if err = ioutil.WriteFile(targetLink, out, 0644); err != nil {
+					glog.Errorf("failed to write logs to %q: %v", targetLink, err)
+				}
+			}
+			continue
+		}
+		for _, file := range logFileData.files {
+			if _, err := os.Stat(file); err != nil {
+				// Expected file not found on this distro.
+				continue
+			}
+			if err := copyLogFile(file, targetLink); err != nil {
+				glog.Error(err)
+			} else {
+				break
+			}
+		}
+	}
+}
+
+// isJournaldAvailable returns whether the system executing the tests uses
+// journald.
+func isJournaldAvailable() bool {
+	_, err := exec.LookPath("journalctl")
+	return err == nil
+}
+
+func copyLogFile(src, target string) error {
+	// If not a journald based distro, then just symlink files.
+	if out, err := exec.Command("cp", src, target).CombinedOutput(); err != nil {
+		return fmt.Errorf("failed to copy %q to %q: %v, %v", src, target, out, err)
+	}
+	if out, err := exec.Command("chmod", "a+r", target).CombinedOutput(); err != nil {
+		return fmt.Errorf("failed to make log file %q world readable: %v, %v", target, out, err)
+	}
+	return nil
+}

vendor/k8s.io/kubernetes/test/e2e_node/services/util.go

@@ -0,0 +1,34 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package services
+
+import (
+	"os"
+	"os/signal"
+	"syscall"
+)
+
+// terminationSignals are signals that cause the program to exit in the
+// supported platforms (linux, darwin, windows).
+var terminationSignals = []os.Signal{syscall.SIGHUP, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT}
+
+// waitForTerminationSignal waits for termination signal.
+func waitForTerminationSignal() {
+	sig := make(chan os.Signal, 1)
+	signal.Notify(sig, terminationSignals...)
+	<-sig
+}

vendor/k8s.io/kubernetes/test/e2e_node/simple_mount.go

@@ -0,0 +1,70 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+)
+
+var _ = framework.KubeDescribe("SimpleMount", func() {
+	f := framework.NewDefaultFramework("simple-mount-test")
+
+	// This is a very simple test that exercises the Kubelet's mounter code path.
+	// If the mount fails, the pod will not be able to run, and CreateSync will timeout.
+	It("should be able to mount an emptydir on a container", func() {
+		pod := &v1.Pod{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       "Pod",
+				APIVersion: "v1",
+			},
+			ObjectMeta: v1.ObjectMeta{
+				Name: "simple-mount-pod",
+			},
+			Spec: v1.PodSpec{
+				Containers: []v1.Container{
+					{
+						Name:  "simple-mount-container",
+						Image: framework.GetPauseImageNameForHostArch(),
+						VolumeMounts: []v1.VolumeMount{
+							{
+								Name:      "simply-mounted-volume",
+								MountPath: "/opt/",
+							},
+						},
+					},
+				},
+				Volumes: []v1.Volume{
+					{
+						Name: "simply-mounted-volume",
+						VolumeSource: v1.VolumeSource{
+							EmptyDir: &v1.EmptyDirVolumeSource{
+								Medium: "Memory",
+							},
+						},
+					},
+				},
+			},
+		}
+		podClient := f.PodClient()
+		pod = podClient.CreateSync(pod)
+
+	})
+})

vendor/k8s.io/kubernetes/test/e2e_node/summary_test.go

@@ -0,0 +1,296 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"fmt"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api/resource"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/stats"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	systemdutil "github.com/coreos/go-systemd/util"
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	"github.com/onsi/gomega/gstruct"
+	"github.com/onsi/gomega/types"
+)
+
+var _ = framework.KubeDescribe("Summary API", func() {
+	f := framework.NewDefaultFramework("summary-test")
+	Context("when querying /stats/summary", func() {
+		AfterEach(func() {
+			if CurrentGinkgoTestDescription().Failed && framework.TestContext.DumpLogsOnFailure {
+				framework.LogFailedContainers(f.ClientSet, f.Namespace.Name, framework.Logf)
+			}
+		})
+		It("should report resource usage through the stats api", func() {
+			const pod0 = "stats-busybox-0"
+			const pod1 = "stats-busybox-1"
+
+			By("Creating test pods")
+			createSummaryTestPods(f, pod0, pod1)
+			// Wait for cAdvisor to collect 2 stats points
+			time.Sleep(15 * time.Second)
+
+			// Setup expectations.
+			const (
+				kb int64 = 1000
+				mb int64 = 1000 * kb
+				gb int64 = 1000 * mb
+				tb int64 = 1000 * gb
+
+				maxStartAge = time.Hour * 24 * 365 // 1 year
+				maxStatsAge = time.Minute
+			)
+			fsCapacityBounds := bounded(100*mb, 100*gb)
+			// Expectations for system containers.
+			sysContExpectations := gstruct.MatchAllFields(gstruct.Fields{
+				"Name":      gstruct.Ignore(),
+				"StartTime": recent(maxStartAge),
+				"CPU": ptrMatchAllFields(gstruct.Fields{
+					"Time":                 recent(maxStatsAge),
+					"UsageNanoCores":       bounded(10000, 2E9),
+					"UsageCoreNanoSeconds": bounded(10000000, 1E15),
+				}),
+				"Memory": ptrMatchAllFields(gstruct.Fields{
+					"Time": recent(maxStatsAge),
+					// We don't limit system container memory.
+					"AvailableBytes":  BeNil(),
+					"UsageBytes":      bounded(1*mb, 10*gb),
+					"WorkingSetBytes": bounded(1*mb, 10*gb),
+					"RSSBytes":        bounded(1*mb, 1*gb),
+					"PageFaults":      bounded(1000, 1E9),
+					"MajorPageFaults": bounded(0, 100000),
+				}),
+				"Rootfs":             BeNil(),
+				"Logs":               BeNil(),
+				"UserDefinedMetrics": BeEmpty(),
+			})
+			systemContainers := gstruct.Elements{
+				"kubelet": sysContExpectations,
+				"runtime": sysContExpectations,
+			}
+			// The Kubelet only manages the 'misc' system container if the host is not running systemd.
+			if !systemdutil.IsRunningSystemd() {
+				framework.Logf("Host not running systemd; expecting 'misc' system container.")
+				systemContainers["misc"] = sysContExpectations
+			}
+			// Expectations for pods.
+			podExpectations := gstruct.MatchAllFields(gstruct.Fields{
+				"PodRef":    gstruct.Ignore(),
+				"StartTime": recent(maxStartAge),
+				"Containers": gstruct.MatchAllElements(summaryObjectID, gstruct.Elements{
+					"busybox-container": gstruct.MatchAllFields(gstruct.Fields{
+						"Name":      Equal("busybox-container"),
+						"StartTime": recent(maxStartAge),
+						"CPU": ptrMatchAllFields(gstruct.Fields{
+							"Time":                 recent(maxStatsAge),
+							"UsageNanoCores":       bounded(100000, 100000000),
+							"UsageCoreNanoSeconds": bounded(10000000, 1000000000),
+						}),
+						"Memory": ptrMatchAllFields(gstruct.Fields{
+							"Time":            recent(maxStatsAge),
+							"AvailableBytes":  bounded(1*mb, 10*mb),
+							"UsageBytes":      bounded(10*kb, 5*mb),
+							"WorkingSetBytes": bounded(10*kb, mb),
+							"RSSBytes":        bounded(1*kb, mb),
+							"PageFaults":      bounded(100, 100000),
+							"MajorPageFaults": bounded(0, 10),
+						}),
+						"Rootfs": ptrMatchAllFields(gstruct.Fields{
+							"AvailableBytes": fsCapacityBounds,
+							"CapacityBytes":  fsCapacityBounds,
+							"UsedBytes":      bounded(kb, 10*mb),
+							"InodesFree":     bounded(1E4, 1E8),
+							"Inodes":         bounded(1E4, 1E8),
+							"InodesUsed":     bounded(0, 1E8),
+						}),
+						"Logs": ptrMatchAllFields(gstruct.Fields{
+							"AvailableBytes": fsCapacityBounds,
+							"CapacityBytes":  fsCapacityBounds,
+							"UsedBytes":      bounded(kb, 10*mb),
+							"InodesFree":     bounded(1E4, 1E8),
+							"Inodes":         bounded(1E4, 1E8),
+							"InodesUsed":     bounded(0, 1E8),
+						}),
+						"UserDefinedMetrics": BeEmpty(),
+					}),
+				}),
+				"Network": ptrMatchAllFields(gstruct.Fields{
+					"Time":     recent(maxStatsAge),
+					"RxBytes":  bounded(10, 10*mb),
+					"RxErrors": bounded(0, 1000),
+					"TxBytes":  bounded(10, 10*mb),
+					"TxErrors": bounded(0, 1000),
+				}),
+				"VolumeStats": gstruct.MatchAllElements(summaryObjectID, gstruct.Elements{
+					"test-empty-dir": gstruct.MatchAllFields(gstruct.Fields{
+						"Name": Equal("test-empty-dir"),
+						"FsStats": gstruct.MatchAllFields(gstruct.Fields{
+							"AvailableBytes": fsCapacityBounds,
+							"CapacityBytes":  fsCapacityBounds,
+							"UsedBytes":      bounded(kb, 1*mb),
+							"InodesFree":     bounded(1E4, 1E8),
+							"Inodes":         bounded(1E4, 1E8),
+							"InodesUsed":     bounded(0, 1E8),
+						}),
+					}),
+				}),
+			})
+			matchExpectations := ptrMatchAllFields(gstruct.Fields{
+				"Node": gstruct.MatchAllFields(gstruct.Fields{
+					"NodeName":         Equal(framework.TestContext.NodeName),
+					"StartTime":        recent(maxStartAge),
+					"SystemContainers": gstruct.MatchAllElements(summaryObjectID, systemContainers),
+					"CPU": ptrMatchAllFields(gstruct.Fields{
+						"Time":                 recent(maxStatsAge),
+						"UsageNanoCores":       bounded(100E3, 2E9),
+						"UsageCoreNanoSeconds": bounded(1E9, 1E15),
+					}),
+					"Memory": ptrMatchAllFields(gstruct.Fields{
+						"Time":            recent(maxStatsAge),
+						"AvailableBytes":  bounded(100*mb, 100*gb),
+						"UsageBytes":      bounded(10*mb, 10*gb),
+						"WorkingSetBytes": bounded(10*mb, 10*gb),
+						"RSSBytes":        bounded(1*kb, 1*gb),
+						"PageFaults":      bounded(1000, 1E9),
+						"MajorPageFaults": bounded(0, 100000),
+					}),
+					// TODO(#28407): Handle non-eth0 network interface names.
+					"Network": Or(BeNil(), ptrMatchAllFields(gstruct.Fields{
+						"Time":     recent(maxStatsAge),
+						"RxBytes":  bounded(1*mb, 100*gb),
+						"RxErrors": bounded(0, 100000),
+						"TxBytes":  bounded(10*kb, 10*gb),
+						"TxErrors": bounded(0, 100000),
+					})),
+					"Fs": ptrMatchAllFields(gstruct.Fields{
+						"AvailableBytes": fsCapacityBounds,
+						"CapacityBytes":  fsCapacityBounds,
+						"UsedBytes":      bounded(kb, 10*gb),
+						"InodesFree":     bounded(1E4, 1E8),
+						"Inodes":         bounded(1E4, 1E8),
+						"InodesUsed":     bounded(0, 1E8),
+					}),
+					"Runtime": ptrMatchAllFields(gstruct.Fields{
+						"ImageFs": ptrMatchAllFields(gstruct.Fields{
+							"AvailableBytes": fsCapacityBounds,
+							"CapacityBytes":  fsCapacityBounds,
+							"UsedBytes":      bounded(kb, 10*gb),
+							"InodesFree":     bounded(1E4, 1E8),
+							"Inodes":         bounded(1E4, 1E8),
+							"InodesUsed":     bounded(0, 1E8),
+						}),
+					}),
+				}),
+				// Ignore extra pods since the tests run in parallel.
+				"Pods": gstruct.MatchElements(summaryObjectID, gstruct.IgnoreExtras, gstruct.Elements{
+					fmt.Sprintf("%s::%s", f.Namespace.Name, pod0): podExpectations,
+					fmt.Sprintf("%s::%s", f.Namespace.Name, pod1): podExpectations,
+				}),
+			})
+
+			By("Validating /stats/summary")
+			// Give pods a minute to actually start up.
+			Eventually(getNodeSummary, 1*time.Minute, 15*time.Second).Should(matchExpectations)
+			// Then the summary should match the expectations a few more times.
+			Consistently(getNodeSummary, 30*time.Second, 15*time.Second).Should(matchExpectations)
+		})
+	})
+})
+
+func createSummaryTestPods(f *framework.Framework, names ...string) {
+	pods := make([]*v1.Pod, 0, len(names))
+	for _, name := range names {
+		pods = append(pods, &v1.Pod{
+			ObjectMeta: v1.ObjectMeta{
+				Name: name,
+			},
+			Spec: v1.PodSpec{
+				RestartPolicy: v1.RestartPolicyAlways,
+				Containers: []v1.Container{
+					{
+						Name:    "busybox-container",
+						Image:   "gcr.io/google_containers/busybox:1.24",
+						Command: []string{"sh", "-c", "ping -c 1 google.com; while true; do echo 'hello world' >> /test-empty-dir-mnt/file ; sleep 1; done"},
+						Resources: v1.ResourceRequirements{
+							Limits: v1.ResourceList{
+								// Must set memory limit to get MemoryStats.AvailableBytes
+								v1.ResourceMemory: resource.MustParse("10M"),
+							},
+						},
+						VolumeMounts: []v1.VolumeMount{
+							{MountPath: "/test-empty-dir-mnt", Name: "test-empty-dir"},
+						},
+					},
+				},
+				SecurityContext: &v1.PodSecurityContext{
+					SELinuxOptions: &v1.SELinuxOptions{
+						Level: "s0",
+					},
+				},
+				Volumes: []v1.Volume{
+					// TODO(#28393): Test secret volumes
+					// TODO(#28394): Test hostpath volumes
+					{Name: "test-empty-dir", VolumeSource: v1.VolumeSource{EmptyDir: &v1.EmptyDirVolumeSource{}}},
+				},
+			},
+		})
+	}
+	f.PodClient().CreateBatch(pods)
+}
+
+// Mapping function for gstruct.MatchAllElements
+func summaryObjectID(element interface{}) string {
+	switch el := element.(type) {
+	case stats.PodStats:
+		return fmt.Sprintf("%s::%s", el.PodRef.Namespace, el.PodRef.Name)
+	case stats.ContainerStats:
+		return el.Name
+	case stats.VolumeStats:
+		return el.Name
+	case stats.UserDefinedMetric:
+		return el.Name
+	default:
+		framework.Failf("Unknown type: %T", el)
+		return "???"
+	}
+}
+
+// Convenience functions for common matcher combinations.
+func ptrMatchAllFields(fields gstruct.Fields) types.GomegaMatcher {
+	return gstruct.PointTo(gstruct.MatchAllFields(fields))
+}
+
+func bounded(lower, upper interface{}) types.GomegaMatcher {
+	return gstruct.PointTo(And(
+		BeNumerically(">=", lower),
+		BeNumerically("<=", upper)))
+}
+
+func recent(d time.Duration) types.GomegaMatcher {
+	return WithTransform(func(t metav1.Time) time.Time {
+		return t.Time
+	}, And(
+		BeTemporally(">=", time.Now().Add(-d)),
+		// Now() is the test start time, not the match time, so permit a few extra minutes.
+		BeTemporally("<", time.Now().Add(2*time.Minute))))
+}

vendor/k8s.io/kubernetes/test/e2e_node/system/BUILD

@@ -0,0 +1,59 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "cgroup_validator.go",
+        "docker_validator.go",
+        "kernel_validator.go",
+        "os_validator.go",
+        "report.go",
+        "types.go",
+        "validators.go",
+    ],
+    tags = ["automanaged"],
+    deps = [
+        "//vendor:github.com/docker/engine-api/client",
+        "//vendor:github.com/docker/engine-api/types",
+        "//vendor:github.com/golang/glog",
+        "//vendor:golang.org/x/net/context",
+        "//vendor:k8s.io/apimachinery/pkg/util/errors",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "cgroup_validator_test.go",
+        "docker_validator_test.go",
+        "kernel_validator_test.go",
+        "os_validator_test.go",
+    ],
+    library = ":go_default_library",
+    tags = ["automanaged"],
+    deps = [
+        "//vendor:github.com/docker/engine-api/types",
+        "//vendor:github.com/stretchr/testify/assert",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/e2e_node/system/cgroup_validator.go

@@ -0,0 +1,95 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package system
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"strings"
+)
+
+var _ Validator = &CgroupsValidator{}
+
+type CgroupsValidator struct {
+	Reporter Reporter
+}
+
+func (c *CgroupsValidator) Name() string {
+	return "cgroups"
+}
+
+const (
+	cgroupsConfigPrefix = "CGROUPS_"
+)
+
+func (c *CgroupsValidator) Validate(spec SysSpec) error {
+	subsystems, err := c.getCgroupSubsystems()
+	if err != nil {
+		return fmt.Errorf("failed to get cgroup subsystems: %v", err)
+	}
+	return c.validateCgroupSubsystems(spec.Cgroups, subsystems)
+}
+
+func (c *CgroupsValidator) validateCgroupSubsystems(cgroupSpec, subsystems []string) error {
+	missing := []string{}
+	for _, cgroup := range cgroupSpec {
+		found := false
+		for _, subsystem := range subsystems {
+			if cgroup == subsystem {
+				found = true
+				break
+			}
+		}
+		item := cgroupsConfigPrefix + strings.ToUpper(cgroup)
+		if found {
+			c.Reporter.Report(item, "enabled", good)
+		} else {
+			c.Reporter.Report(item, "missing", bad)
+			missing = append(missing, cgroup)
+		}
+	}
+	if len(missing) > 0 {
+		return fmt.Errorf("missing cgroups: %s", strings.Join(missing, " "))
+	}
+	return nil
+
+}
+
+func (c *CgroupsValidator) getCgroupSubsystems() ([]string, error) {
+	f, err := os.Open("/proc/cgroups")
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	subsystems := []string{}
+	s := bufio.NewScanner(f)
+	for s.Scan() {
+		if err := s.Err(); err != nil {
+			return nil, err
+		}
+		text := s.Text()
+		if text[0] != '#' {
+			parts := strings.Fields(text)
+			if len(parts) >= 4 && parts[3] != "0" {
+				subsystems = append(subsystems, parts[0])
+			}
+		}
+	}
+	return subsystems, nil
+}

vendor/k8s.io/kubernetes/test/e2e_node/system/cgroup_validator_test.go

@@ -0,0 +1,56 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package system
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestValidateCgroupSubsystem(t *testing.T) {
+	v := &CgroupsValidator{
+		Reporter: DefaultReporter,
+	}
+	cgroupSpec := []string{"system1", "system2"}
+	for desc, test := range map[string]struct {
+		cgroupSpec []string
+		subsystems []string
+		err        bool
+	}{
+		"missing cgroup subsystem should report error": {
+			subsystems: []string{"system1"},
+			err:        true,
+		},
+		"extra cgroup subsystems should not report error": {
+			subsystems: []string{"system1", "system2", "system3"},
+			err:        false,
+		},
+		"subsystems the same with spec should not report error": {
+			subsystems: []string{"system1", "system2"},
+			err:        false,
+		},
+	} {
+		err := v.validateCgroupSubsystems(cgroupSpec, test.subsystems)
+		if !test.err {
+			assert.Nil(t, err, "%q: Expect error not to occur with cgroup", desc)
+		} else {
+			assert.NotNil(t, err, "%q: Expect error to occur with docker info", desc)
+		}
+
+	}
+}

vendor/k8s.io/kubernetes/test/e2e_node/system/docker_validator.go

@@ -0,0 +1,86 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package system
+
+import (
+	"fmt"
+	"regexp"
+
+	"github.com/docker/engine-api/client"
+	"github.com/docker/engine-api/types"
+	"golang.org/x/net/context"
+)
+
+var _ Validator = &DockerValidator{}
+
+// DockerValidator validates docker configuration.
+type DockerValidator struct {
+	Reporter Reporter
+}
+
+func (d *DockerValidator) Name() string {
+	return "docker"
+}
+
+const (
+	dockerEndpoint     = "unix:///var/run/docker.sock"
+	dockerConfigPrefix = "DOCKER_"
+)
+
+// TODO(random-liu): Add more validating items.
+func (d *DockerValidator) Validate(spec SysSpec) error {
+	if spec.RuntimeSpec.DockerSpec == nil {
+		// If DockerSpec is not specified, assume current runtime is not
+		// docker, skip the docker configuration validation.
+		return nil
+	}
+	c, err := client.NewClient(dockerEndpoint, "", nil, nil)
+	if err != nil {
+		return fmt.Errorf("failed to create docker client: %v", err)
+	}
+	info, err := c.Info(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to get docker info: %v", err)
+	}
+	return d.validateDockerInfo(spec.RuntimeSpec.DockerSpec, info)
+}
+
+func (d *DockerValidator) validateDockerInfo(spec *DockerSpec, info types.Info) error {
+	// Validate docker version.
+	matched := false
+	for _, v := range spec.Version {
+		r := regexp.MustCompile(v)
+		if r.MatchString(info.ServerVersion) {
+			d.Reporter.Report(dockerConfigPrefix+"VERSION", info.ServerVersion, good)
+			matched = true
+		}
+	}
+	if !matched {
+		d.Reporter.Report(dockerConfigPrefix+"VERSION", info.ServerVersion, bad)
+		return fmt.Errorf("unsupported docker version: %s", info.ServerVersion)
+	}
+	// Validate graph driver.
+	item := dockerConfigPrefix + "GRAPH_DRIVER"
+	for _, gd := range spec.GraphDriver {
+		if info.Driver == gd {
+			d.Reporter.Report(item, info.Driver, good)
+			return nil
+		}
+	}
+	d.Reporter.Report(item, info.Driver, bad)
+	return fmt.Errorf("unsupported graph driver: %s", info.Driver)
+}

vendor/k8s.io/kubernetes/test/e2e_node/system/docker_validator_test.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package system
+
+import (
+	"testing"
+
+	"github.com/docker/engine-api/types"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestValidateDockerInfo(t *testing.T) {
+	v := &DockerValidator{
+		Reporter: DefaultReporter,
+	}
+	spec := &DockerSpec{
+		Version:     []string{`1\.(9|\d{2,})\..*`},
+		GraphDriver: []string{"driver_1", "driver_2"},
+	}
+	for _, test := range []struct {
+		info types.Info
+		err  bool
+	}{
+		{
+			info: types.Info{Driver: "driver_1", ServerVersion: "1.10.1"},
+			err:  false,
+		},
+		{
+			info: types.Info{Driver: "bad_driver", ServerVersion: "1.9.1"},
+			err:  true,
+		},
+		{
+			info: types.Info{Driver: "driver_2", ServerVersion: "1.8.1"},
+			err:  true,
+		},
+	} {
+		err := v.validateDockerInfo(spec, test.info)
+		if !test.err {
+			assert.Nil(t, err, "Expect error not to occur with docker info %+v", test.info)
+		} else {
+			assert.NotNil(t, err, "Expect error to occur with docker info %+v", test.info)
+		}
+
+	}
+}

vendor/k8s.io/kubernetes/test/e2e_node/system/kernel_validator.go

@@ -0,0 +1,255 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package system
+
+import (
+	"bufio"
+	"bytes"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/golang/glog"
+	"k8s.io/apimachinery/pkg/util/errors"
+)
+
+var _ Validator = &KernelValidator{}
+
+// KernelValidator validates kernel. Currently only validate kernel version
+// and kernel configuration.
+type KernelValidator struct {
+	kernelRelease string
+	Reporter      Reporter
+}
+
+func (k *KernelValidator) Name() string {
+	return "kernel"
+}
+
+// kConfigOption is the possible kernel config option.
+type kConfigOption string
+
+const (
+	builtIn  kConfigOption = "y"
+	asModule kConfigOption = "m"
+	leftOut  kConfigOption = "n"
+
+	// validKConfigRegex is the regex matching kernel configuration line.
+	validKConfigRegex = "^CONFIG_[A-Z0-9_]+=[myn]"
+	// kConfigPrefix is the prefix of kernel configuration.
+	kConfigPrefix = "CONFIG_"
+)
+
+func (k *KernelValidator) Validate(spec SysSpec) error {
+	release, err := exec.Command("uname", "-r").CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("failed to get kernel release: %v", err)
+	}
+	k.kernelRelease = strings.TrimSpace(string(release))
+	var errs []error
+	errs = append(errs, k.validateKernelVersion(spec.KernelSpec))
+	errs = append(errs, k.validateKernelConfig(spec.KernelSpec))
+	return errors.NewAggregate(errs)
+}
+
+// validateKernelVersion validates the kernel version.
+func (k *KernelValidator) validateKernelVersion(kSpec KernelSpec) error {
+	glog.Infof("Validating kernel version")
+	versionRegexps := kSpec.Versions
+	for _, versionRegexp := range versionRegexps {
+		r := regexp.MustCompile(versionRegexp)
+		if r.MatchString(k.kernelRelease) {
+			k.Reporter.Report("KERNEL_VERSION", k.kernelRelease, good)
+			return nil
+		}
+	}
+	k.Reporter.Report("KERNEL_VERSION", k.kernelRelease, bad)
+	return fmt.Errorf("unsupported kernel release: %s", k.kernelRelease)
+}
+
+// validateKernelConfig validates the kernel configurations.
+func (k *KernelValidator) validateKernelConfig(kSpec KernelSpec) error {
+	glog.Infof("Validating kernel config")
+	allConfig, err := k.getKernelConfig()
+	if err != nil {
+		return fmt.Errorf("failed to parse kernel config: %v", err)
+	}
+	return k.validateCachedKernelConfig(allConfig, kSpec)
+}
+
+// validateCachedKernelConfig validates the kernel confgiurations cached in internal data type.
+func (k *KernelValidator) validateCachedKernelConfig(allConfig map[string]kConfigOption, kSpec KernelSpec) error {
+	badConfigs := []string{}
+	// reportAndRecord is a helper function to record bad config when
+	// report.
+	reportAndRecord := func(name, msg, desc string, result ValidationResultType) {
+		if result == bad {
+			badConfigs = append(badConfigs, name)
+		}
+		// report description when the config is bad or warn.
+		if result != good && desc != "" {
+			msg = msg + " - " + desc
+		}
+		k.Reporter.Report(name, msg, result)
+	}
+	const (
+		required = iota
+		optional
+		forbidden
+	)
+	validateOpt := func(config KernelConfig, expect int) {
+		var found, missing ValidationResultType
+		switch expect {
+		case required:
+			found, missing = good, bad
+		case optional:
+			found, missing = good, warn
+		case forbidden:
+			found, missing = bad, good
+		}
+		var name string
+		var opt kConfigOption
+		var ok bool
+		for _, name = range append([]string{config.Name}, config.Aliases...) {
+			name = kConfigPrefix + name
+			if opt, ok = allConfig[name]; ok {
+				break
+			}
+		}
+		if !ok {
+			reportAndRecord(name, "not set", config.Description, missing)
+			return
+		}
+		switch opt {
+		case builtIn:
+			reportAndRecord(name, "enabled", config.Description, found)
+		case asModule:
+			reportAndRecord(name, "enabled (as module)", config.Description, found)
+		case leftOut:
+			reportAndRecord(name, "disabled", config.Description, missing)
+		default:
+			reportAndRecord(name, fmt.Sprintf("unknown option: %s", opt), config.Description, missing)
+		}
+	}
+	for _, config := range kSpec.Required {
+		validateOpt(config, required)
+	}
+	for _, config := range kSpec.Optional {
+		validateOpt(config, optional)
+	}
+	for _, config := range kSpec.Forbidden {
+		validateOpt(config, forbidden)
+	}
+	if len(badConfigs) > 0 {
+		return fmt.Errorf("unexpected kernel config: %s", strings.Join(badConfigs, " "))
+	}
+	return nil
+}
+
+// getKernelConfigReader search kernel config file in a predefined list. Once the kernel config
+// file is found it will read the configurations into a byte buffer and return. If the kernel
+// config file is not found, it will try to load kernel config module and retry again.
+func (k *KernelValidator) getKernelConfigReader() (io.Reader, error) {
+	possibePaths := []string{
+		"/proc/config.gz",
+		"/boot/config-" + k.kernelRelease,
+		"/usr/src/linux-" + k.kernelRelease + "/.config",
+		"/usr/src/linux/.config",
+	}
+	configsModule := "configs"
+	modprobeCmd := "modprobe"
+	// loadModule indicates whether we've tried to load kernel config module ourselves.
+	loadModule := false
+	for {
+		for _, path := range possibePaths {
+			_, err := os.Stat(path)
+			if err != nil {
+				continue
+			}
+			// Buffer the whole file, so that we can close the file and unload
+			// kernel config module in this function.
+			b, err := ioutil.ReadFile(path)
+			if err != nil {
+				return nil, err
+			}
+			var r io.Reader
+			r = bytes.NewReader(b)
+			// This is a gzip file (config.gz), unzip it.
+			if filepath.Ext(path) == ".gz" {
+				r, err = gzip.NewReader(r)
+				if err != nil {
+					return nil, err
+				}
+			}
+			return r, nil
+		}
+		// If we've tried to load kernel config module, break and return error.
+		if loadModule {
+			break
+		}
+		// If the kernel config file is not found, try to load the kernel
+		// config module and check again.
+		output, err := exec.Command(modprobeCmd, configsModule).CombinedOutput()
+		if err != nil {
+			return nil, fmt.Errorf("unable to load kernel module %q: output - %q, err - %v",
+				configsModule, output, err)
+		}
+		// Unload the kernel config module to make sure the validation have no side effect.
+		defer exec.Command(modprobeCmd, "-r", configsModule).Run()
+		loadModule = true
+	}
+	return nil, fmt.Errorf("no config path in %v is available", possibePaths)
+}
+
+// getKernelConfig gets kernel config from kernel config file and convert kernel config to internal type.
+func (k *KernelValidator) getKernelConfig() (map[string]kConfigOption, error) {
+	r, err := k.getKernelConfigReader()
+	if err != nil {
+		return nil, err
+	}
+	return k.parseKernelConfig(r)
+}
+
+// parseKernelConfig converts kernel config to internal type.
+func (k *KernelValidator) parseKernelConfig(r io.Reader) (map[string]kConfigOption, error) {
+	config := map[string]kConfigOption{}
+	regex := regexp.MustCompile(validKConfigRegex)
+	s := bufio.NewScanner(r)
+	for s.Scan() {
+		if err := s.Err(); err != nil {
+			return nil, err
+		}
+		line := strings.TrimSpace(s.Text())
+		if !regex.MatchString(line) {
+			continue
+		}
+		fields := strings.Split(line, "=")
+		if len(fields) != 2 {
+			glog.Errorf("Unexpected fields number in config %q", line)
+			continue
+		}
+		config[fields[0]] = kConfigOption(fields[1])
+	}
+	return config, nil
+
+}

vendor/k8s.io/kubernetes/test/e2e_node/system/kernel_validator_test.go

@@ -0,0 +1,197 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package system
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestValidateKernelVersion(t *testing.T) {
+	v := &KernelValidator{
+		Reporter: DefaultReporter,
+	}
+	// Currently, testRegex is align with DefaultSysSpec.KernelVersion, but in the future
+	// they may be different.
+	// This is fine, because the test mainly tests the kernel version validation logic,
+	// not the DefaultSysSpec. The DefaultSysSpec should be tested with node e2e.
+	testRegex := []string{`3\.[1-9][0-9].*`, `4\..*`}
+	for _, test := range []struct {
+		version string
+		err     bool
+	}{
+		// first version regex matches
+		{
+			version: "3.19.9-99-test",
+			err:     false,
+		},
+		// one of version regexes matches
+		{
+			version: "4.4.14+",
+			err:     false,
+		},
+		// no version regex matches
+		{
+			version: "2.0.0",
+			err:     true,
+		},
+		{
+			version: "5.0.0",
+			err:     true,
+		},
+		{
+			version: "3.9.0",
+			err:     true,
+		},
+	} {
+		v.kernelRelease = test.version
+		err := v.validateKernelVersion(KernelSpec{Versions: testRegex})
+		if !test.err {
+			assert.Nil(t, err, "Expect error not to occur with kernel version %q", test.version)
+		} else {
+			assert.NotNil(t, err, "Expect error to occur with kenrel version %q", test.version)
+		}
+	}
+}
+
+func TestValidateCachedKernelConfig(t *testing.T) {
+	v := &KernelValidator{
+		Reporter: DefaultReporter,
+	}
+	testKernelSpec := KernelSpec{
+		Required: []KernelConfig{{Name: "REQUIRED_1"}, {Name: "REQUIRED_2", Aliases: []string{"ALIASE_REQUIRED_2"}}},
+		Optional: []KernelConfig{{Name: "OPTIONAL_1"}, {Name: "OPTIONAL_2"}},
+		Forbidden: []KernelConfig{
+			{Name: "FORBIDDEN_1", Description: "TEST FORBIDDEN"},
+			{Name: "FORBIDDEN_2", Aliases: []string{"ALIASE_FORBIDDEN_2"}},
+		},
+	}
+	for c, test := range []struct {
+		desc   string
+		config map[string]kConfigOption
+		err    bool
+	}{
+		{
+			desc: "meet all required configurations should not report error.",
+			config: map[string]kConfigOption{
+				"REQUIRED_1": builtIn,
+				"REQUIRED_2": asModule,
+			},
+			err: false,
+		},
+		{
+			desc: "one required configuration disabled should report error.",
+			config: map[string]kConfigOption{
+				"REQUIRED_1": leftOut,
+				"REQUIRED_2": builtIn,
+			},
+			err: true,
+		},
+		{
+			desc: "one required configuration missing should report error.",
+			config: map[string]kConfigOption{
+				"REQUIRED_1": builtIn,
+			},
+			err: true,
+		},
+		{
+			desc: "alias of required configuration should not report error.",
+			config: map[string]kConfigOption{
+				"REQUIRED_1":        builtIn,
+				"ALIASE_REQUIRED_2": asModule,
+			},
+			err: false,
+		},
+		{
+			desc: "optional configuration set or not should not report error.",
+			config: map[string]kConfigOption{
+				"REQUIRED_1": builtIn,
+				"REQUIRED_2": asModule,
+				"OPTIONAL_1": builtIn,
+			},
+			err: false,
+		},
+		{
+			desc: "forbidden configuration disabled should not report error.",
+			config: map[string]kConfigOption{
+				"REQUIRED_1":  builtIn,
+				"REQUIRED_2":  asModule,
+				"FORBIDDEN_1": leftOut,
+			},
+			err: false,
+		},
+		{
+			desc: "forbidden configuration built-in should report error.",
+			config: map[string]kConfigOption{
+				"REQUIRED_1":  builtIn,
+				"REQUIRED_2":  asModule,
+				"FORBIDDEN_1": builtIn,
+			},
+			err: true,
+		},
+		{
+			desc: "forbidden configuration built as module should report error.",
+			config: map[string]kConfigOption{
+				"REQUIRED_1":  builtIn,
+				"REQUIRED_2":  asModule,
+				"FORBIDDEN_1": asModule,
+			},
+			err: true,
+		},
+		{
+			desc: "alias of forbidden configuration should report error.",
+			config: map[string]kConfigOption{
+				"REQUIRED_1":         builtIn,
+				"REQUIRED_2":         asModule,
+				"ALIASE_FORBIDDEN_2": asModule,
+			},
+			err: true,
+		},
+	} {
+		t.Logf("TestCase #%d %s", c, test.desc)
+		// Add kernel config prefix.
+		for k, v := range test.config {
+			delete(test.config, k)
+			test.config[kConfigPrefix+k] = v
+		}
+		err := v.validateCachedKernelConfig(test.config, testKernelSpec)
+		if !test.err {
+			assert.Nil(t, err, "Expect error not to occur with kernel config %q", test.config)
+		} else {
+			assert.NotNil(t, err, "Expect error to occur with kenrel config %q", test.config)
+		}
+	}
+}
+
+func TestValidateParseKernelConfig(t *testing.T) {
+	config := `CONFIG_1=y
+CONFIG_2=m
+CONFIG_3=n`
+	expected := map[string]kConfigOption{
+		"CONFIG_1": builtIn,
+		"CONFIG_2": asModule,
+		"CONFIG_3": leftOut,
+	}
+	v := &KernelValidator{
+		Reporter: DefaultReporter,
+	}
+	got, err := v.parseKernelConfig(bytes.NewReader([]byte(config)))
+	assert.Nil(t, err, "Expect error not to occur when parse kernel configuration %q", config)
+	assert.Equal(t, expected, got)
+}

vendor/k8s.io/kubernetes/test/e2e_node/system/os_validator.go

@@ -0,0 +1,50 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package system
+
+import (
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+var _ Validator = &OSValidator{}
+
+type OSValidator struct {
+	Reporter Reporter
+}
+
+func (o *OSValidator) Name() string {
+	return "os"
+}
+
+func (o *OSValidator) Validate(spec SysSpec) error {
+	os, err := exec.Command("uname").CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("failed to get os name: %v", err)
+	}
+	return o.validateOS(strings.TrimSpace(string(os)), spec.OS)
+}
+
+func (o *OSValidator) validateOS(os, specOS string) error {
+	if os != specOS {
+		o.Reporter.Report("OS", os, bad)
+		return fmt.Errorf("unsupported operating system: %s", os)
+	}
+	o.Reporter.Report("OS", os, good)
+	return nil
+}

vendor/k8s.io/kubernetes/test/e2e_node/system/os_validator_test.go

@@ -0,0 +1,54 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package system
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestValidateOS(t *testing.T) {
+	v := &OSValidator{
+		Reporter: DefaultReporter,
+	}
+	specOS := "Linux"
+	for _, test := range []struct {
+		os  string
+		err bool
+	}{
+		{
+			os:  "Linux",
+			err: false,
+		},
+		{
+			os:  "Windows",
+			err: true,
+		},
+		{
+			os:  "Darwin",
+			err: true,
+		},
+	} {
+		err := v.validateOS(test.os, specOS)
+		if !test.err {
+			assert.Nil(t, err, "Expect error not to occur with os %q", test.os)
+		} else {
+			assert.NotNil(t, err, "Expect error to occur with os %q", test.os)
+		}
+	}
+}

vendor/k8s.io/kubernetes/test/e2e_node/system/report.go

@@ -0,0 +1,78 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package system
+
+import (
+	"fmt"
+	"io"
+	"os"
+)
+
+// ValidationResultType is type of the validation result. Different validation results
+// corresponds to different colors.
+type ValidationResultType int32
+
+const (
+	good ValidationResultType = iota
+	bad
+	warn
+)
+
+// color is the color of the message.
+type color int32
+
+const (
+	red    color = 31
+	green        = 32
+	yellow       = 33
+	white        = 37
+)
+
+func colorize(s string, c color) string {
+	return fmt.Sprintf("\033[0;%dm%s\033[0m", c, s)
+}
+
+// The default reporter for the system verification test
+type StreamReporter struct {
+	// The stream that this reporter is writing to
+	WriteStream io.Writer
+}
+
+func (dr *StreamReporter) Report(key, value string, resultType ValidationResultType) error {
+	var c color
+	switch resultType {
+	case good:
+		c = green
+	case bad:
+		c = red
+	case warn:
+		c = yellow
+	default:
+		c = white
+	}
+	if dr.WriteStream == nil {
+		return fmt.Errorf("WriteStream has to be defined for this reporter")
+	}
+
+	fmt.Fprintf(dr.WriteStream, "%s: %s\n", colorize(key, white), colorize(value, c))
+	return nil
+}
+
+// DefaultReporter is the default Reporter
+var DefaultReporter = &StreamReporter{
+	WriteStream: os.Stdout,
+}

vendor/k8s.io/kubernetes/test/e2e_node/system/types.go

@@ -0,0 +1,122 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package system
+
+// KernelConfig defines one kernel configration item.
+type KernelConfig struct {
+	// Name is the general name of the kernel configuration. It is used to
+	// match kernel configuration.
+	Name string
+	// Aliases are aliases of the kernel configuration. Some configuration
+	// has different names in different kernel version. Names of different
+	// versions will be treated as aliases.
+	Aliases []string
+	// Description is the description of the kernel configuration, for example:
+	//  * What is it used for?
+	//  * Why is it needed?
+	//  * Who needs it?
+	Description string
+}
+
+// KernelSpec defines the specification for the kernel. Currently, it contains
+// specification for:
+//   * Kernel Version
+//   * Kernel Configuration
+type KernelSpec struct {
+	// Versions define supported kernel version. It is a group of regexps.
+	Versions []string
+	// Required contains all kernel configurations required to be enabled
+	// (built in or as module).
+	Required []KernelConfig
+	// Optional contains all kernel configurations are required for optional
+	// features.
+	Optional []KernelConfig
+	// Forbidden contains all kernel configurations which areforbidden (disabled
+	// or not set)
+	Forbidden []KernelConfig
+}
+
+// DockerSpec defines the requirement configuration for docker. Currently, it only
+// contains spec for graph driver.
+type DockerSpec struct {
+	// Version is a group of regex matching supported docker versions.
+	Version []string
+	// GraphDriver is the graph drivers supported by kubelet.
+	GraphDriver []string
+}
+
+// RuntimeSpec is the abstract layer for different runtimes. Different runtimes
+// should put their spec inside the RuntimeSpec.
+type RuntimeSpec struct {
+	*DockerSpec
+}
+
+// SysSpec defines the requirement of supported system. Currently, it only contains
+// spec for OS, Kernel and Cgroups.
+type SysSpec struct {
+	// OS is the operating system of the SysSpec.
+	OS string
+	// KernelConfig defines the spec for kernel.
+	KernelSpec KernelSpec
+	// Cgroups is the required cgroups.
+	Cgroups []string
+	// RuntimeSpec defines the spec for runtime.
+	RuntimeSpec RuntimeSpec
+}
+
+// DefaultSysSpec is the default SysSpec.
+var DefaultSysSpec = SysSpec{
+	OS: "Linux",
+	KernelSpec: KernelSpec{
+		Versions: []string{`3\.[1-9][0-9].*`, `4\..*`}, // Requires 3.10+ or 4+
+		// TODO(random-liu): Add more config
+		// TODO(random-liu): Add description for each kernel configuration:
+		Required: []KernelConfig{
+			{Name: "NAMESPACES"},
+			{Name: "NET_NS"},
+			{Name: "PID_NS"},
+			{Name: "IPC_NS"},
+			{Name: "UTS_NS"},
+			{Name: "CGROUPS"},
+			{Name: "CGROUP_CPUACCT"},
+			{Name: "CGROUP_DEVICE"},
+			{Name: "CGROUP_FREEZER"},
+			{Name: "CGROUP_SCHED"},
+			{Name: "CPUSETS"},
+			{Name: "MEMCG"},
+			{Name: "INET"},
+			{Name: "EXT4_FS"},
+			{Name: "PROC_FS"},
+			{Name: "NETFILTER_XT_TARGET_REDIRECT", Aliases: []string{"IP_NF_TARGET_REDIRECT"}},
+			{Name: "NETFILTER_XT_MATCH_COMMENT"},
+		},
+		Optional: []KernelConfig{
+			{Name: "OVERLAY_FS", Aliases: []string{"OVERLAYFS_FS"}, Description: "Required for overlayfs."},
+			{Name: "AUFS_FS", Description: "Required for aufs."},
+			{Name: "BLK_DEV_DM", Description: "Required for devicemapper."},
+		},
+		Forbidden: []KernelConfig{},
+	},
+	Cgroups: []string{"cpu", "cpuacct", "cpuset", "devices", "freezer", "memory"},
+	RuntimeSpec: RuntimeSpec{
+		DockerSpec: &DockerSpec{
+			Version: []string{`1\.(9|\d{2,})\..*`}, // Requires 1.9+
+			// TODO(random-liu): Validate overlay2.
+			GraphDriver: []string{"aufs", "overlay", "devicemapper"},
+		},
+	},
+}

vendor/k8s.io/kubernetes/test/e2e_node/system/validators.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package system
+
+import (
+	"github.com/golang/glog"
+	"k8s.io/apimachinery/pkg/util/errors"
+)
+
+// Validator is the interface for all validators.
+type Validator interface {
+	// Name is the name of the validator.
+	Name() string
+	// Validate is the validate function.
+	Validate(SysSpec) error
+}
+
+// Reporter is the interface for the reporters for the validators.
+type Reporter interface {
+	// Report reports the results of the system verification
+	Report(string, string, ValidationResultType) error
+}
+
+// Validate uses all validators to validate the system.
+func Validate(spec SysSpec, report Reporter) error {
+	var errs []error
+	// validators are all the validators.
+	var validators = []Validator{
+		&OSValidator{Reporter: report},
+		&KernelValidator{Reporter: report},
+		&CgroupsValidator{Reporter: report},
+		&DockerValidator{Reporter: report},
+	}
+
+	for _, v := range validators {
+		glog.Infof("Validating %s...", v.Name())
+		errs = append(errs, v.Validate(spec))
+	}
+	return errors.NewAggregate(errs)
+}
+
+// ValidateDefault uses all default validators to validate the system and writes to stdout.
+func ValidateDefault() error {
+	return Validate(DefaultSysSpec, DefaultReporter)
+}

vendor/k8s.io/kubernetes/test/e2e_node/util.go

@@ -0,0 +1,294 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"reflect"
+	"strings"
+	"time"
+
+	"github.com/golang/glog"
+
+	k8serr "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/apis/componentconfig"
+	v1alpha1 "k8s.io/kubernetes/pkg/apis/componentconfig/v1alpha1"
+	"k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/stats"
+	// utilconfig "k8s.io/kubernetes/pkg/util/config"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+// TODO(random-liu): Get this automatically from kubelet flag.
+var kubeletAddress = flag.String("kubelet-address", "http://127.0.0.1:10255", "Host and port of the kubelet")
+
+var startServices = flag.Bool("start-services", true, "If true, start local node services")
+var stopServices = flag.Bool("stop-services", true, "If true, stop local node services after running tests")
+
+func getNodeSummary() (*stats.Summary, error) {
+	req, err := http.NewRequest("GET", *kubeletAddress+"/stats/summary", nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to build http request: %v", err)
+	}
+	req.Header.Add("Accept", "application/json")
+
+	client := &http.Client{}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get /stats/summary: %v", err)
+	}
+
+	defer resp.Body.Close()
+	contentsBytes, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read /stats/summary: %+v", resp)
+	}
+
+	decoder := json.NewDecoder(strings.NewReader(string(contentsBytes)))
+	summary := stats.Summary{}
+	err = decoder.Decode(&summary)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse /stats/summary to go struct: %+v", resp)
+	}
+	return &summary, nil
+}
+
+// Returns the current KubeletConfiguration
+func getCurrentKubeletConfig() (*componentconfig.KubeletConfiguration, error) {
+	resp := pollConfigz(5*time.Minute, 5*time.Second)
+	kubeCfg, err := decodeConfigz(resp)
+	if err != nil {
+		return nil, err
+	}
+	return kubeCfg, nil
+}
+
+// Convenience method to set the evictionHard threshold during the current context.
+func tempSetEvictionHard(f *framework.Framework, evictionHard string) {
+	tempSetCurrentKubeletConfig(f, func(initialConfig *componentconfig.KubeletConfiguration) {
+		initialConfig.EvictionHard = evictionHard
+	})
+}
+
+// Must be called within a Context. Allows the function to modify the KubeletConfiguration during the BeforeEach of the context.
+// The change is reverted in the AfterEach of the context.
+func tempSetCurrentKubeletConfig(f *framework.Framework, updateFunction func(initialConfig *componentconfig.KubeletConfiguration)) {
+	var oldCfg *componentconfig.KubeletConfiguration
+	BeforeEach(func() {
+		configEnabled, err := isKubeletConfigEnabled(f)
+		framework.ExpectNoError(err)
+		if configEnabled {
+			oldCfg, err = getCurrentKubeletConfig()
+			framework.ExpectNoError(err)
+			clone, err := api.Scheme.DeepCopy(oldCfg)
+			framework.ExpectNoError(err)
+			newCfg := clone.(*componentconfig.KubeletConfiguration)
+			updateFunction(newCfg)
+			framework.ExpectNoError(setKubeletConfiguration(f, newCfg))
+		} else {
+			framework.Logf("The Dynamic Kubelet Configuration feature is not enabled.\n" +
+				"Pass --feature-gates=DynamicKubeletConfig=true to the Kubelet to enable this feature.\n" +
+				"For `make test-e2e-node`, you can set `TEST_ARGS='--feature-gates=DynamicKubeletConfig=true'`.")
+		}
+	})
+	AfterEach(func() {
+		if oldCfg != nil {
+			err := setKubeletConfiguration(f, oldCfg)
+			framework.ExpectNoError(err)
+		}
+	})
+}
+
+// Returns true if kubeletConfig is enabled, false otherwise or if we cannot determine if it is.
+func isKubeletConfigEnabled(f *framework.Framework) (bool, error) {
+	cfgz, err := getCurrentKubeletConfig()
+	if err != nil {
+		return false, fmt.Errorf("could not determine whether 'DynamicKubeletConfig' feature is enabled, err: %v", err)
+	}
+	return strings.Contains(cfgz.FeatureGates, "DynamicKubeletConfig=true"), nil
+}
+
+// Queries the API server for a Kubelet configuration for the node described by framework.TestContext.NodeName
+func getCurrentKubeletConfigMap(f *framework.Framework) (*v1.ConfigMap, error) {
+	return f.ClientSet.Core().ConfigMaps("kube-system").Get(fmt.Sprintf("kubelet-%s", framework.TestContext.NodeName), metav1.GetOptions{})
+}
+
+// Creates or updates the configmap for KubeletConfiguration, waits for the Kubelet to restart
+// with the new configuration. Returns an error if the configuration after waiting 40 seconds
+// doesn't match what you attempted to set, or if the dynamic configuration feature is disabled.
+func setKubeletConfiguration(f *framework.Framework, kubeCfg *componentconfig.KubeletConfiguration) error {
+	const (
+		restartGap = 30 * time.Second
+	)
+
+	// Make sure Dynamic Kubelet Configuration feature is enabled on the Kubelet we are about to reconfigure
+	configEnabled, err := isKubeletConfigEnabled(f)
+	if err != nil {
+		return fmt.Errorf("could not determine whether 'DynamicKubeletConfig' feature is enabled, err: %v", err)
+	}
+	if !configEnabled {
+		return fmt.Errorf("The Dynamic Kubelet Configuration feature is not enabled.\n" +
+			"Pass --feature-gates=DynamicKubeletConfig=true to the Kubelet to enable this feature.\n" +
+			"For `make test-e2e-node`, you can set `TEST_ARGS='--feature-gates=DynamicKubeletConfig=true'`.")
+	}
+
+	// Check whether a configmap for KubeletConfiguration already exists
+	_, err = getCurrentKubeletConfigMap(f)
+
+	if k8serr.IsNotFound(err) {
+		_, err := createConfigMap(f, kubeCfg)
+		if err != nil {
+			return err
+		}
+	} else if err != nil {
+		return err
+	} else {
+		// The configmap exists, update it instead of creating it.
+		_, err := updateConfigMap(f, kubeCfg)
+		if err != nil {
+			return err
+		}
+	}
+
+	// Wait for the Kubelet to restart.
+	time.Sleep(restartGap)
+
+	// Retrieve the new config and compare it to the one we attempted to set
+	newKubeCfg, err := getCurrentKubeletConfig()
+	if err != nil {
+		return err
+	}
+
+	// Return an error if the desired config is not in use by now
+	if !reflect.DeepEqual(*kubeCfg, *newKubeCfg) {
+		return fmt.Errorf("either the Kubelet did not restart or it did not present the modified configuration via /configz after restarting.")
+	}
+	return nil
+}
+
+// Causes the test to fail, or returns a status 200 response from the /configz endpoint
+func pollConfigz(timeout time.Duration, pollInterval time.Duration) *http.Response {
+	endpoint := fmt.Sprintf("http://127.0.0.1:8080/api/v1/proxy/nodes/%s/configz", framework.TestContext.NodeName)
+	client := &http.Client{}
+	req, err := http.NewRequest("GET", endpoint, nil)
+	framework.ExpectNoError(err)
+	req.Header.Add("Accept", "application/json")
+
+	var resp *http.Response
+	Eventually(func() bool {
+		resp, err = client.Do(req)
+		if err != nil {
+			glog.Errorf("Failed to get /configz, retrying. Error: %v", err)
+			return false
+		}
+		if resp.StatusCode != 200 {
+			glog.Errorf("/configz response status not 200, retrying. Response was: %+v", resp)
+			return false
+		}
+		return true
+	}, timeout, pollInterval).Should(Equal(true))
+	return resp
+}
+
+// Decodes the http response from /configz and returns a componentconfig.KubeletConfiguration (internal type).
+func decodeConfigz(resp *http.Response) (*componentconfig.KubeletConfiguration, error) {
+	// This hack because /configz reports the following structure:
+	// {"componentconfig": {the JSON representation of v1alpha1.KubeletConfiguration}}
+	type configzWrapper struct {
+		ComponentConfig v1alpha1.KubeletConfiguration `json:"componentconfig"`
+	}
+
+	configz := configzWrapper{}
+	kubeCfg := componentconfig.KubeletConfiguration{}
+
+	contentsBytes, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	err = json.Unmarshal(contentsBytes, &configz)
+	if err != nil {
+		return nil, err
+	}
+
+	err = api.Scheme.Convert(&configz.ComponentConfig, &kubeCfg, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return &kubeCfg, nil
+}
+
+// Constructs a Kubelet ConfigMap targeting the current node running the node e2e tests
+func makeKubeletConfigMap(nodeName string, kubeCfg *componentconfig.KubeletConfiguration) *v1.ConfigMap {
+	kubeCfgExt := v1alpha1.KubeletConfiguration{}
+	api.Scheme.Convert(kubeCfg, &kubeCfgExt, nil)
+
+	bytes, err := json.Marshal(kubeCfgExt)
+	framework.ExpectNoError(err)
+
+	cmap := &v1.ConfigMap{
+		ObjectMeta: v1.ObjectMeta{
+			Name: fmt.Sprintf("kubelet-%s", nodeName),
+		},
+		Data: map[string]string{
+			"kubelet.config": string(bytes),
+		},
+	}
+	return cmap
+}
+
+// Uses KubeletConfiguration to create a `kubelet-<node-name>` ConfigMap in the "kube-system" namespace.
+func createConfigMap(f *framework.Framework, kubeCfg *componentconfig.KubeletConfiguration) (*v1.ConfigMap, error) {
+	cmap := makeKubeletConfigMap(framework.TestContext.NodeName, kubeCfg)
+	cmap, err := f.ClientSet.Core().ConfigMaps("kube-system").Create(cmap)
+	if err != nil {
+		return nil, err
+	}
+	return cmap, nil
+}
+
+// Similar to createConfigMap, except this updates an existing ConfigMap.
+func updateConfigMap(f *framework.Framework, kubeCfg *componentconfig.KubeletConfiguration) (*v1.ConfigMap, error) {
+	cmap := makeKubeletConfigMap(framework.TestContext.NodeName, kubeCfg)
+	cmap, err := f.ClientSet.Core().ConfigMaps("kube-system").Update(cmap)
+	if err != nil {
+		return nil, err
+	}
+	return cmap, nil
+}
+
+func logPodEvents(f *framework.Framework) {
+	framework.Logf("Summary of pod events during the test:")
+	err := framework.ListNamespaceEvents(f.ClientSet, f.Namespace.Name)
+	framework.ExpectNoError(err)
+}
+
+func logNodeEvents(f *framework.Framework) {
+	framework.Logf("Summary of node events during the test:")
+	err := framework.ListNamespaceEvents(f.ClientSet, "")
+	framework.ExpectNoError(err)
+}

vendor/k8s.io/kubernetes/test/e2e_node/volume_manager_test.go

@@ -0,0 +1,127 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_node
+
+import (
+	"time"
+
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/util/uuid"
+	"k8s.io/kubernetes/test/e2e/framework"
+
+	"fmt"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = framework.KubeDescribe("Kubelet Volume Manager", func() {
+	f := framework.NewDefaultFramework("kubelet-volume-manager")
+	Describe("Volume Manager", func() {
+		Context("On terminatation of pod with memory backed volume", func() {
+			It("should remove the volume from the node", func() {
+				var (
+					memoryBackedPod *v1.Pod
+					volumeName      string
+				)
+				By("Creating a pod with a memory backed volume that exits success without restart", func() {
+					volumeName = "memory-volume"
+					memoryBackedPod = f.PodClient().Create(&v1.Pod{
+						ObjectMeta: v1.ObjectMeta{
+							Name:      "pod" + string(uuid.NewUUID()),
+							Namespace: f.Namespace.Name,
+						},
+						Spec: v1.PodSpec{
+							RestartPolicy: v1.RestartPolicyNever,
+							Containers: []v1.Container{
+								{
+									Image:   "gcr.io/google_containers/busybox:1.24",
+									Name:    "container" + string(uuid.NewUUID()),
+									Command: []string{"sh", "-c", "echo"},
+									VolumeMounts: []v1.VolumeMount{
+										{
+											Name:      volumeName,
+											MountPath: "/tmp",
+										},
+									},
+								},
+							},
+							Volumes: []v1.Volume{
+								{
+									Name: volumeName,
+									VolumeSource: v1.VolumeSource{
+										EmptyDir: &v1.EmptyDirVolumeSource{Medium: v1.StorageMediumMemory},
+									},
+								},
+							},
+						},
+					})
+					err := framework.WaitForPodSuccessInNamespace(f.ClientSet, memoryBackedPod.Name, f.Namespace.Name)
+					Expect(err).NotTo(HaveOccurred())
+				})
+				By("Verifying the memory backed volume was removed from node", func() {
+					volumePath := fmt.Sprintf("/tmp/%s/volumes/kubernetes.io~empty-dir/%s", string(memoryBackedPod.UID), volumeName)
+					var err error
+					for i := 0; i < 10; i++ {
+						// need to create a new verification pod on each pass since updates
+						//to the HostPath volume aren't propogated to the pod
+						pod := f.PodClient().Create(&v1.Pod{
+							ObjectMeta: v1.ObjectMeta{
+								Name:      "pod" + string(uuid.NewUUID()),
+								Namespace: f.Namespace.Name,
+							},
+							Spec: v1.PodSpec{
+								RestartPolicy: v1.RestartPolicyNever,
+								Containers: []v1.Container{
+									{
+										Image:   "gcr.io/google_containers/busybox:1.24",
+										Name:    "container" + string(uuid.NewUUID()),
+										Command: []string{"sh", "-c", "if [ -d " + volumePath + " ]; then exit 1; fi;"},
+										VolumeMounts: []v1.VolumeMount{
+											{
+												Name:      "kubelet-pods",
+												MountPath: "/tmp",
+											},
+										},
+									},
+								},
+								Volumes: []v1.Volume{
+									{
+										Name: "kubelet-pods",
+										VolumeSource: v1.VolumeSource{
+											// TODO: remove hardcoded kubelet volume directory path
+											// framework.TestContext.KubeVolumeDir is currently not populated for node e2e
+											HostPath: &v1.HostPathVolumeSource{Path: "/var/lib/kubelet/pods"},
+										},
+									},
+								},
+							},
+						})
+						err = framework.WaitForPodSuccessInNamespace(f.ClientSet, pod.Name, f.Namespace.Name)
+						gp := int64(1)
+						f.PodClient().Delete(pod.Name, &v1.DeleteOptions{GracePeriodSeconds: &gp})
+						if err == nil {
+							break
+						}
+						<-time.After(10 * time.Second)
+					}
+					Expect(err).NotTo(HaveOccurred())
+				})
+			})
+		})
+	})
+})