Replace godep with dep

vendor/k8s.io/kubernetes/test/integration/BUILD

@@ -0,0 +1,64 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "utils.go",
+    ],
+    deps = [
+        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes/typed/core/v1:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//test/integration/apiserver:all-srcs",
+        "//test/integration/auth:all-srcs",
+        "//test/integration/client:all-srcs",
+        "//test/integration/configmap:all-srcs",
+        "//test/integration/defaulttolerationseconds:all-srcs",
+        "//test/integration/deployment:all-srcs",
+        "//test/integration/etcd:all-srcs",
+        "//test/integration/evictions:all-srcs",
+        "//test/integration/examples:all-srcs",
+        "//test/integration/federation:all-srcs",
+        "//test/integration/framework:all-srcs",
+        "//test/integration/garbagecollector:all-srcs",
+        "//test/integration/kubectl:all-srcs",
+        "//test/integration/master:all-srcs",
+        "//test/integration/metrics:all-srcs",
+        "//test/integration/objectmeta:all-srcs",
+        "//test/integration/openshift:all-srcs",
+        "//test/integration/pods:all-srcs",
+        "//test/integration/quota:all-srcs",
+        "//test/integration/replicaset:all-srcs",
+        "//test/integration/replicationcontroller:all-srcs",
+        "//test/integration/scheduler:all-srcs",
+        "//test/integration/scheduler_perf:all-srcs",
+        "//test/integration/secrets:all-srcs",
+        "//test/integration/serviceaccount:all-srcs",
+        "//test/integration/storageclasses:all-srcs",
+        "//test/integration/ttlcontroller:all-srcs",
+        "//test/integration/volume:all-srcs",
+    ],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/apiserver/BUILD

@@ -0,0 +1,53 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "apiserver_test.go",
+        "main_test.go",
+        "patch_test.go",
+    ],
+    tags = [
+        "etcd",
+        "integration",
+    ],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/github.com/pborman/uuid:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/api/extensions/v1beta1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/endpoints/handlers:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/features:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/util/feature:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/tools/pager:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/apiserver/apiserver_test.go

@@ -0,0 +1,234 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apiserver
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"testing"
+
+	"github.com/golang/glog"
+	"k8s.io/api/core/v1"
+	"k8s.io/api/extensions/v1beta1"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	genericfeatures "k8s.io/apiserver/pkg/features"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/pager"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func setup(t *testing.T) (*httptest.Server, clientset.Interface, framework.CloseFunc) {
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	masterConfig.ExtraConfig.EnableCoreControllers = false
+	_, s, closeFn := framework.RunAMaster(masterConfig)
+
+	clientSet, err := clientset.NewForConfig(&restclient.Config{Host: s.URL})
+	if err != nil {
+		t.Fatalf("Error in create clientset: %v", err)
+	}
+	return s, clientSet, closeFn
+}
+
+func verifyStatusCode(t *testing.T, verb, URL, body string, expectedStatusCode int) {
+	// We dont use the typed Go client to send this request to be able to verify the response status code.
+	bodyBytes := bytes.NewReader([]byte(body))
+	req, err := http.NewRequest(verb, URL, bodyBytes)
+	if err != nil {
+		t.Fatalf("unexpected error: %v in sending req with verb: %s, URL: %s and body: %s", err, verb, URL, body)
+	}
+	transport := http.DefaultTransport
+	glog.Infof("Sending request: %v", req)
+	resp, err := transport.RoundTrip(req)
+	if err != nil {
+		t.Fatalf("unexpected error: %v in req: %v", err, req)
+	}
+	defer resp.Body.Close()
+	b, _ := ioutil.ReadAll(resp.Body)
+	if resp.StatusCode != expectedStatusCode {
+		t.Errorf("Expected status %v, but got %v", expectedStatusCode, resp.StatusCode)
+		t.Errorf("Body: %v", string(b))
+	}
+}
+
+func path(resource, namespace, name string) string {
+	return testapi.Extensions.ResourcePath(resource, namespace, name)
+}
+
+func newRS(namespace string) *v1beta1.ReplicaSet {
+	return &v1beta1.ReplicaSet{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "ReplicaSet",
+			APIVersion: "extensions/v1beta1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:    namespace,
+			GenerateName: "apiserver-test",
+		},
+		Spec: v1beta1.ReplicaSetSpec{
+			Template: v1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{"name": "test"},
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{
+							Name:  "fake-name",
+							Image: "fakeimage",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+var cascDel = `
+{
+  "kind": "DeleteOptions",
+  "apiVersion": "` + testapi.Groups[api.GroupName].GroupVersion().String() + `",
+  "orphanDependents": false
+}
+`
+
+// Tests that the apiserver returns 202 status code as expected.
+func Test202StatusCode(t *testing.T) {
+	s, clientSet, closeFn := setup(t)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("status-code", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	rsClient := clientSet.Extensions().ReplicaSets(ns.Name)
+
+	// 1. Create the resource without any finalizer and then delete it without setting DeleteOptions.
+	// Verify that server returns 200 in this case.
+	rs, err := rsClient.Create(newRS(ns.Name))
+	if err != nil {
+		t.Fatalf("Failed to create rs: %v", err)
+	}
+	verifyStatusCode(t, "DELETE", s.URL+path("replicasets", ns.Name, rs.Name), "", 200)
+
+	// 2. Create the resource with a finalizer so that the resource is not immediately deleted and then delete it without setting DeleteOptions.
+	// Verify that the apiserver still returns 200 since DeleteOptions.OrphanDependents is not set.
+	rs = newRS(ns.Name)
+	rs.ObjectMeta.Finalizers = []string{"kube.io/dummy-finalizer"}
+	rs, err = rsClient.Create(rs)
+	if err != nil {
+		t.Fatalf("Failed to create rs: %v", err)
+	}
+	verifyStatusCode(t, "DELETE", s.URL+path("replicasets", ns.Name, rs.Name), "", 200)
+
+	// 3. Create the resource and then delete it with DeleteOptions.OrphanDependents=false.
+	// Verify that the server still returns 200 since the resource is immediately deleted.
+	rs = newRS(ns.Name)
+	rs, err = rsClient.Create(rs)
+	if err != nil {
+		t.Fatalf("Failed to create rs: %v", err)
+	}
+	verifyStatusCode(t, "DELETE", s.URL+path("replicasets", ns.Name, rs.Name), cascDel, 200)
+
+	// 4. Create the resource with a finalizer so that the resource is not immediately deleted and then delete it with DeleteOptions.OrphanDependents=false.
+	// Verify that the server returns 202 in this case.
+	rs = newRS(ns.Name)
+	rs.ObjectMeta.Finalizers = []string{"kube.io/dummy-finalizer"}
+	rs, err = rsClient.Create(rs)
+	if err != nil {
+		t.Fatalf("Failed to create rs: %v", err)
+	}
+	verifyStatusCode(t, "DELETE", s.URL+path("replicasets", ns.Name, rs.Name), cascDel, 202)
+}
+
+func TestAPIListChunking(t *testing.T) {
+	if err := utilfeature.DefaultFeatureGate.Set(string(genericfeatures.APIListChunking) + "=true"); err != nil {
+		t.Fatal(err)
+	}
+	s, clientSet, closeFn := setup(t)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("list-paging", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	rsClient := clientSet.Extensions().ReplicaSets(ns.Name)
+
+	for i := 0; i < 4; i++ {
+		rs := newRS(ns.Name)
+		rs.Name = fmt.Sprintf("test-%d", i)
+		if _, err := rsClient.Create(rs); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	calls := 0
+	firstRV := ""
+	p := &pager.ListPager{
+		PageSize: 1,
+		PageFn: pager.SimplePageFunc(func(opts metav1.ListOptions) (runtime.Object, error) {
+			calls++
+			list, err := rsClient.List(opts)
+			if err != nil {
+				return nil, err
+			}
+			if calls == 1 {
+				firstRV = list.ResourceVersion
+			}
+			if calls == 2 {
+				rs := newRS(ns.Name)
+				rs.Name = "test-5"
+				if _, err := rsClient.Create(rs); err != nil {
+					t.Fatal(err)
+				}
+			}
+			return list, err
+		}),
+	}
+	listObj, err := p.List(context.Background(), metav1.ListOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if calls != 4 {
+		t.Errorf("unexpected list invocations: %d", calls)
+	}
+	list := listObj.(metav1.ListInterface)
+	if len(list.GetContinue()) != 0 {
+		t.Errorf("unexpected continue: %s", list.GetContinue())
+	}
+	if list.GetResourceVersion() != firstRV {
+		t.Errorf("unexpected resource version: %s instead of %s", list.GetResourceVersion(), firstRV)
+	}
+	var names []string
+	if err := meta.EachListItem(listObj, func(obj runtime.Object) error {
+		rs := obj.(*v1beta1.ReplicaSet)
+		names = append(names, rs.Name)
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(names, []string{"test-0", "test-1", "test-2", "test-3"}) {
+		t.Errorf("unexpected items: %#v", list)
+	}
+}

vendor/k8s.io/kubernetes/test/integration/apiserver/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apiserver
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/apiserver/patch_test.go

@@ -0,0 +1,114 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apiserver
+
+import (
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/pborman/uuid"
+
+	"reflect"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apiserver/pkg/endpoints/handlers"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+// Tests that the apiserver retries non-overlapping conflicts on patches
+func TestPatchConflicts(t *testing.T) {
+	s, clientSet, closeFn := setup(t)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("status-code", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	// Create the object we're going to conflict on
+	clientSet.Core().Secrets(ns.Name).Create(&v1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test",
+			// Populate annotations so the strategic patch descends, compares, and notices the $patch directive
+			Annotations: map[string]string{"initial": "value"},
+		},
+	})
+	client := clientSet.Core().RESTClient()
+
+	successes := int32(0)
+
+	// Run a lot of simultaneous patch operations to exercise internal API server retry of patch application.
+	// Internally, a patch API call retries up to MaxRetryWhenPatchConflicts times if the resource version of the object has changed.
+	// If the resource version of the object changed between attempts, that means another one of our patch requests succeeded.
+	// That means if we run 2*MaxRetryWhenPatchConflicts patch attempts, we should see at least MaxRetryWhenPatchConflicts succeed.
+	wg := sync.WaitGroup{}
+	for i := 0; i < (2 * handlers.MaxRetryWhenPatchConflicts); i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			annotationName := fmt.Sprintf("annotation-%d", i)
+			labelName := fmt.Sprintf("label-%d", i)
+			value := uuid.NewRandom().String()
+
+			obj, err := client.Patch(types.StrategicMergePatchType).
+				Namespace(ns.Name).
+				Resource("secrets").
+				Name("test").
+				Body([]byte(fmt.Sprintf(`{"metadata":{"labels":{"%s":"%s"}, "annotations":{"$patch":"replace","%s":"%s"}}}`, labelName, value, annotationName, value))).
+				Do().
+				Get()
+
+			if errors.IsConflict(err) {
+				t.Logf("tolerated conflict error patching %s: %v", "secrets", err)
+				return
+			}
+			if err != nil {
+				t.Errorf("error patching %s: %v", "secrets", err)
+				return
+			}
+
+			accessor, err := meta.Accessor(obj)
+			if err != nil {
+				t.Errorf("error getting object from %s: %v", "secrets", err)
+				return
+			}
+			// make sure the label we wanted was effective
+			if accessor.GetLabels()[labelName] != value {
+				t.Errorf("patch of %s was ineffective, expected %s=%s, got labels %#v", "secrets", labelName, value, accessor.GetLabels())
+				return
+			}
+			// make sure the patch directive didn't get lost, and that the entire annotation map was replaced
+			if !reflect.DeepEqual(accessor.GetAnnotations(), map[string]string{annotationName: value}) {
+				t.Errorf("patch of %s with $patch directive was ineffective, didn't replace entire annotations map: %#v", "secrets", accessor.GetAnnotations())
+			}
+
+			atomic.AddInt32(&successes, 1)
+		}(i)
+	}
+	wg.Wait()
+
+	if successes < handlers.MaxRetryWhenPatchConflicts {
+		t.Errorf("Expected at least %d successful patches for %s, got %d", handlers.MaxRetryWhenPatchConflicts, "secrets", successes)
+	} else {
+		t.Logf("Got %d successful patches for %s", successes, "secrets")
+	}
+
+}

vendor/k8s.io/kubernetes/test/integration/auth/BUILD

@@ -0,0 +1,86 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "accessreview_test.go",
+        "auth_test.go",
+        "bootstraptoken_test.go",
+        "main_test.go",
+        "node_test.go",
+        "rbac_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//pkg/apis/authorization:go_default_library",
+        "//pkg/apis/autoscaling:go_default_library",
+        "//pkg/apis/extensions:go_default_library",
+        "//pkg/apis/policy:go_default_library",
+        "//pkg/apis/rbac:go_default_library",
+        "//pkg/auth/authorizer/abac:go_default_library",
+        "//pkg/auth/nodeidentifier:go_default_library",
+        "//pkg/bootstrap/api:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset:go_default_library",
+        "//pkg/client/informers/informers_generated/internalversion:go_default_library",
+        "//pkg/kubeapiserver/authorizer:go_default_library",
+        "//pkg/master:go_default_library",
+        "//pkg/registry/rbac/clusterrole:go_default_library",
+        "//pkg/registry/rbac/clusterrole/storage:go_default_library",
+        "//pkg/registry/rbac/clusterrolebinding:go_default_library",
+        "//pkg/registry/rbac/clusterrolebinding/storage:go_default_library",
+        "//pkg/registry/rbac/role:go_default_library",
+        "//pkg/registry/rbac/role/storage:go_default_library",
+        "//pkg/registry/rbac/rolebinding:go_default_library",
+        "//pkg/registry/rbac/rolebinding/storage:go_default_library",
+        "//plugin/pkg/admission/admit:go_default_library",
+        "//plugin/pkg/admission/noderestriction:go_default_library",
+        "//plugin/pkg/auth/authenticator/token/bootstrap:go_default_library",
+        "//plugin/pkg/auth/authorizer/rbac:go_default_library",
+        "//test/e2e/lifecycle/bootstrap:go_default_library",
+        "//test/integration:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/k8s.io/api/authentication/v1beta1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/watch:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/authenticator:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/group:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/request/bearertoken:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/serviceaccount:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/token/tokenfile:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authorization/authorizerfactory:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/registry/generic:go_default_library",
+        "//vendor/k8s.io/apiserver/plugin/pkg/authenticator/token/tokentest:go_default_library",
+        "//vendor/k8s.io/apiserver/plugin/pkg/authenticator/token/webhook:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/tools/clientcmd/api/v1:go_default_library",
+        "//vendor/k8s.io/client-go/transport:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/auth/accessreview_test.go

@@ -0,0 +1,347 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apiserver/pkg/authentication/authenticator"
+	"k8s.io/apiserver/pkg/authentication/user"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	authorizationapi "k8s.io/kubernetes/pkg/apis/authorization"
+	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
+	"k8s.io/kubernetes/plugin/pkg/admission/admit"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+// Inject into master an authorizer that uses user info.
+// TODO(etune): remove this test once a more comprehensive built-in authorizer is implemented.
+type sarAuthorizer struct{}
+
+func (sarAuthorizer) Authorize(a authorizer.Attributes) (bool, string, error) {
+	if a.GetUser().GetName() == "dave" {
+		return false, "no", errors.New("I'm sorry, Dave")
+	}
+
+	return true, "you're not dave", nil
+}
+
+func alwaysAlice(req *http.Request) (user.Info, bool, error) {
+	return &user.DefaultInfo{
+		Name: "alice",
+	}, true, nil
+}
+
+func TestSubjectAccessReview(t *testing.T) {
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	masterConfig.GenericConfig.Authenticator = authenticator.RequestFunc(alwaysAlice)
+	masterConfig.GenericConfig.Authorizer = sarAuthorizer{}
+	masterConfig.GenericConfig.AdmissionControl = admit.NewAlwaysAdmit()
+	_, s, closeFn := framework.RunAMaster(masterConfig)
+	defer closeFn()
+
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[api.GroupName].GroupVersion()}})
+
+	tests := []struct {
+		name           string
+		sar            *authorizationapi.SubjectAccessReview
+		expectedError  string
+		expectedStatus authorizationapi.SubjectAccessReviewStatus
+	}{
+		{
+			name: "simple allow",
+			sar: &authorizationapi.SubjectAccessReview{
+				Spec: authorizationapi.SubjectAccessReviewSpec{
+					ResourceAttributes: &authorizationapi.ResourceAttributes{
+						Verb:     "list",
+						Group:    api.GroupName,
+						Version:  "v1",
+						Resource: "pods",
+					},
+					User: "alice",
+				},
+			},
+			expectedStatus: authorizationapi.SubjectAccessReviewStatus{
+				Allowed: true,
+				Reason:  "you're not dave",
+			},
+		},
+		{
+			name: "simple deny",
+			sar: &authorizationapi.SubjectAccessReview{
+				Spec: authorizationapi.SubjectAccessReviewSpec{
+					ResourceAttributes: &authorizationapi.ResourceAttributes{
+						Verb:     "list",
+						Group:    api.GroupName,
+						Version:  "v1",
+						Resource: "pods",
+					},
+					User: "dave",
+				},
+			},
+			expectedStatus: authorizationapi.SubjectAccessReviewStatus{
+				Allowed:         false,
+				Reason:          "no",
+				EvaluationError: "I'm sorry, Dave",
+			},
+		},
+		{
+			name: "simple error",
+			sar: &authorizationapi.SubjectAccessReview{
+				Spec: authorizationapi.SubjectAccessReviewSpec{
+					ResourceAttributes: &authorizationapi.ResourceAttributes{
+						Verb:     "list",
+						Group:    api.GroupName,
+						Version:  "v1",
+						Resource: "pods",
+					},
+				},
+			},
+			expectedError: "at least one of user or group must be specified",
+		},
+	}
+
+	for _, test := range tests {
+		response, err := clientset.Authorization().SubjectAccessReviews().Create(test.sar)
+		switch {
+		case err == nil && len(test.expectedError) == 0:
+
+		case err != nil && strings.Contains(err.Error(), test.expectedError):
+			continue
+
+		case err != nil && len(test.expectedError) != 0:
+			t.Errorf("%s: unexpected error: %v", test.name, err)
+			continue
+		default:
+			t.Errorf("%s: expected %v, got %v", test.name, test.expectedError, err)
+			continue
+		}
+		if response.Status != test.expectedStatus {
+			t.Errorf("%s: expected %v, got %v", test.name, test.expectedStatus, response.Status)
+			continue
+		}
+	}
+}
+
+func TestSelfSubjectAccessReview(t *testing.T) {
+	username := "alice"
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	masterConfig.GenericConfig.Authenticator = authenticator.RequestFunc(func(req *http.Request) (user.Info, bool, error) {
+		return &user.DefaultInfo{Name: username}, true, nil
+	})
+	masterConfig.GenericConfig.Authorizer = sarAuthorizer{}
+	masterConfig.GenericConfig.AdmissionControl = admit.NewAlwaysAdmit()
+	_, s, closeFn := framework.RunAMaster(masterConfig)
+	defer closeFn()
+
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[api.GroupName].GroupVersion()}})
+
+	tests := []struct {
+		name           string
+		username       string
+		sar            *authorizationapi.SelfSubjectAccessReview
+		expectedError  string
+		expectedStatus authorizationapi.SubjectAccessReviewStatus
+	}{
+		{
+			name:     "simple allow",
+			username: "alice",
+			sar: &authorizationapi.SelfSubjectAccessReview{
+				Spec: authorizationapi.SelfSubjectAccessReviewSpec{
+					ResourceAttributes: &authorizationapi.ResourceAttributes{
+						Verb:     "list",
+						Group:    api.GroupName,
+						Version:  "v1",
+						Resource: "pods",
+					},
+				},
+			},
+			expectedStatus: authorizationapi.SubjectAccessReviewStatus{
+				Allowed: true,
+				Reason:  "you're not dave",
+			},
+		},
+		{
+			name:     "simple deny",
+			username: "dave",
+			sar: &authorizationapi.SelfSubjectAccessReview{
+				Spec: authorizationapi.SelfSubjectAccessReviewSpec{
+					ResourceAttributes: &authorizationapi.ResourceAttributes{
+						Verb:     "list",
+						Group:    api.GroupName,
+						Version:  "v1",
+						Resource: "pods",
+					},
+				},
+			},
+			expectedStatus: authorizationapi.SubjectAccessReviewStatus{
+				Allowed:         false,
+				Reason:          "no",
+				EvaluationError: "I'm sorry, Dave",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		username = test.username
+
+		response, err := clientset.Authorization().SelfSubjectAccessReviews().Create(test.sar)
+		switch {
+		case err == nil && len(test.expectedError) == 0:
+
+		case err != nil && strings.Contains(err.Error(), test.expectedError):
+			continue
+
+		case err != nil && len(test.expectedError) != 0:
+			t.Errorf("%s: unexpected error: %v", test.name, err)
+			continue
+		default:
+			t.Errorf("%s: expected %v, got %v", test.name, test.expectedError, err)
+			continue
+		}
+		if response.Status != test.expectedStatus {
+			t.Errorf("%s: expected %v, got %v", test.name, test.expectedStatus, response.Status)
+			continue
+		}
+	}
+}
+
+func TestLocalSubjectAccessReview(t *testing.T) {
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	masterConfig.GenericConfig.Authenticator = authenticator.RequestFunc(alwaysAlice)
+	masterConfig.GenericConfig.Authorizer = sarAuthorizer{}
+	masterConfig.GenericConfig.AdmissionControl = admit.NewAlwaysAdmit()
+	_, s, closeFn := framework.RunAMaster(masterConfig)
+	defer closeFn()
+
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[api.GroupName].GroupVersion()}})
+
+	tests := []struct {
+		name           string
+		namespace      string
+		sar            *authorizationapi.LocalSubjectAccessReview
+		expectedError  string
+		expectedStatus authorizationapi.SubjectAccessReviewStatus
+	}{
+		{
+			name:      "simple allow",
+			namespace: "foo",
+			sar: &authorizationapi.LocalSubjectAccessReview{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "foo"},
+				Spec: authorizationapi.SubjectAccessReviewSpec{
+					ResourceAttributes: &authorizationapi.ResourceAttributes{
+						Verb:      "list",
+						Group:     api.GroupName,
+						Version:   "v1",
+						Resource:  "pods",
+						Namespace: "foo",
+					},
+					User: "alice",
+				},
+			},
+			expectedStatus: authorizationapi.SubjectAccessReviewStatus{
+				Allowed: true,
+				Reason:  "you're not dave",
+			},
+		},
+		{
+			name:      "simple deny",
+			namespace: "foo",
+			sar: &authorizationapi.LocalSubjectAccessReview{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "foo"},
+				Spec: authorizationapi.SubjectAccessReviewSpec{
+					ResourceAttributes: &authorizationapi.ResourceAttributes{
+						Verb:      "list",
+						Group:     api.GroupName,
+						Version:   "v1",
+						Resource:  "pods",
+						Namespace: "foo",
+					},
+					User: "dave",
+				},
+			},
+			expectedStatus: authorizationapi.SubjectAccessReviewStatus{
+				Allowed:         false,
+				Reason:          "no",
+				EvaluationError: "I'm sorry, Dave",
+			},
+		},
+		{
+			name:      "conflicting namespace",
+			namespace: "foo",
+			sar: &authorizationapi.LocalSubjectAccessReview{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "foo"},
+				Spec: authorizationapi.SubjectAccessReviewSpec{
+					ResourceAttributes: &authorizationapi.ResourceAttributes{
+						Verb:      "list",
+						Group:     api.GroupName,
+						Version:   "v1",
+						Resource:  "pods",
+						Namespace: "bar",
+					},
+					User: "dave",
+				},
+			},
+			expectedError: "must match metadata.namespace",
+		},
+		{
+			name:      "missing namespace",
+			namespace: "foo",
+			sar: &authorizationapi.LocalSubjectAccessReview{
+				ObjectMeta: metav1.ObjectMeta{Namespace: "foo"},
+				Spec: authorizationapi.SubjectAccessReviewSpec{
+					ResourceAttributes: &authorizationapi.ResourceAttributes{
+						Verb:     "list",
+						Group:    api.GroupName,
+						Version:  "v1",
+						Resource: "pods",
+					},
+					User: "dave",
+				},
+			},
+			expectedError: "must match metadata.namespace",
+		},
+	}
+
+	for _, test := range tests {
+		response, err := clientset.Authorization().LocalSubjectAccessReviews(test.namespace).Create(test.sar)
+		switch {
+		case err == nil && len(test.expectedError) == 0:
+
+		case err != nil && strings.Contains(err.Error(), test.expectedError):
+			continue
+
+		case err != nil && len(test.expectedError) != 0:
+			t.Errorf("%s: unexpected error: %v", test.name, err)
+			continue
+		default:
+			t.Errorf("%s: expected %v, got %v", test.name, test.expectedError, err)
+			continue
+		}
+		if response.Status != test.expectedStatus {
+			t.Errorf("%s: expected %#v, got %#v", test.name, test.expectedStatus, response.Status)
+			continue
+		}
+	}
+}

vendor/k8s.io/kubernetes/test/integration/auth/bootstraptoken_test.go

@@ -0,0 +1,188 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apiserver/pkg/authentication/request/bearertoken"
+	"k8s.io/kubernetes/pkg/api"
+	bootstrapapi "k8s.io/kubernetes/pkg/bootstrap/api"
+	"k8s.io/kubernetes/plugin/pkg/admission/admit"
+	"k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/bootstrap"
+	bootstraputil "k8s.io/kubernetes/test/e2e/lifecycle/bootstrap"
+	"k8s.io/kubernetes/test/integration"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+type bootstrapSecrets []*api.Secret
+
+func (b bootstrapSecrets) List(selector labels.Selector) (ret []*api.Secret, err error) {
+	return b, nil
+}
+
+func (b bootstrapSecrets) Get(name string) (*api.Secret, error) {
+	return b[0], nil
+}
+
+// TestBootstrapTokenAuth tests the bootstrap token auth provider
+func TestBootstrapTokenAuth(t *testing.T) {
+	tokenId, err := bootstraputil.GenerateTokenId()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	secret, err := bootstraputil.GenerateTokenSecret()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	var bootstrapSecretValid = &api.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: metav1.NamespaceSystem,
+			Name:      bootstrapapi.BootstrapTokenSecretPrefix,
+		},
+		Type: api.SecretTypeBootstrapToken,
+		Data: map[string][]byte{
+			bootstrapapi.BootstrapTokenIDKey:               []byte(tokenId),
+			bootstrapapi.BootstrapTokenSecretKey:           []byte(secret),
+			bootstrapapi.BootstrapTokenUsageAuthentication: []byte("true"),
+		},
+	}
+	var bootstrapSecretInvalid = &api.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: metav1.NamespaceSystem,
+			Name:      bootstrapapi.BootstrapTokenSecretPrefix,
+		},
+		Type: api.SecretTypeBootstrapToken,
+		Data: map[string][]byte{
+			bootstrapapi.BootstrapTokenIDKey:               []byte(tokenId),
+			bootstrapapi.BootstrapTokenSecretKey:           []byte("invalid"),
+			bootstrapapi.BootstrapTokenUsageAuthentication: []byte("true"),
+		},
+	}
+	var expiredBootstrapToken = &api.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: metav1.NamespaceSystem,
+			Name:      bootstrapapi.BootstrapTokenSecretPrefix,
+		},
+		Type: api.SecretTypeBootstrapToken,
+		Data: map[string][]byte{
+			bootstrapapi.BootstrapTokenIDKey:               []byte(tokenId),
+			bootstrapapi.BootstrapTokenSecretKey:           []byte("invalid"),
+			bootstrapapi.BootstrapTokenUsageAuthentication: []byte("true"),
+			bootstrapapi.BootstrapTokenExpirationKey:       []byte(bootstraputil.TimeStringFromNow(-time.Hour)),
+		},
+	}
+	type request struct {
+		verb        string
+		URL         string
+		body        string
+		statusCodes map[int]bool // Set of expected resp.StatusCode if all goes well.
+	}
+	tests := []struct {
+		name    string
+		request request
+		secret  *api.Secret
+	}{
+		{
+			name:    "valid token",
+			request: request{verb: "GET", URL: path("pods", "", ""), body: "", statusCodes: integration.Code200},
+			secret:  bootstrapSecretValid,
+		},
+		{
+			name:    "invalid token format",
+			request: request{verb: "GET", URL: path("pods", "", ""), body: "", statusCodes: integration.Code401},
+			secret:  bootstrapSecretInvalid,
+		},
+		{
+			name:    "invalid token expired",
+			request: request{verb: "GET", URL: path("pods", "", ""), body: "", statusCodes: integration.Code401},
+			secret:  expiredBootstrapToken,
+		},
+	}
+	for _, test := range tests {
+
+		authenticator := bearertoken.New(bootstrap.NewTokenAuthenticator(bootstrapSecrets{test.secret}))
+		// Set up a master
+		masterConfig := framework.NewIntegrationTestMasterConfig()
+		masterConfig.GenericConfig.Authenticator = authenticator
+		masterConfig.GenericConfig.AdmissionControl = admit.NewAlwaysAdmit()
+		_, s, closeFn := framework.RunAMaster(masterConfig)
+		defer closeFn()
+
+		ns := framework.CreateTestingNamespace("auth-bootstrap-token", s, t)
+		defer framework.DeleteTestingNamespace(ns, s, t)
+
+		previousResourceVersion := make(map[string]float64)
+		transport := http.DefaultTransport
+
+		token := tokenId + "." + secret
+		var bodyStr string
+		if test.request.body != "" {
+			sub := ""
+			if test.request.verb == "PUT" {
+				// For update operations, insert previous resource version
+				if resVersion := previousResourceVersion[getPreviousResourceVersionKey(test.request.URL, "")]; resVersion != 0 {
+					sub += fmt.Sprintf(",\r\n\"resourceVersion\": \"%v\"", resVersion)
+				}
+				sub += fmt.Sprintf(",\r\n\"namespace\": %q", ns.Name)
+			}
+			bodyStr = fmt.Sprintf(test.request.body, sub)
+		}
+		test.request.body = bodyStr
+		bodyBytes := bytes.NewReader([]byte(bodyStr))
+		req, err := http.NewRequest(test.request.verb, s.URL+test.request.URL, bodyBytes)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
+		if test.request.verb == "PATCH" {
+			req.Header.Set("Content-Type", "application/merge-patch+json")
+		}
+
+		func() {
+			resp, err := transport.RoundTrip(req)
+			defer resp.Body.Close()
+			if err != nil {
+				t.Logf("case %v", test.name)
+				t.Fatalf("unexpected error: %v", err)
+			}
+			b, _ := ioutil.ReadAll(resp.Body)
+			if _, ok := test.request.statusCodes[resp.StatusCode]; !ok {
+				t.Logf("case %v", test.name)
+				t.Errorf("Expected status one of %v, but got %v", test.request.statusCodes, resp.StatusCode)
+				t.Errorf("Body: %v", string(b))
+			} else {
+				if test.request.verb == "POST" {
+					// For successful create operations, extract resourceVersion
+					id, currentResourceVersion, err := parseResourceVersion(b)
+					if err == nil {
+						key := getPreviousResourceVersionKey(test.request.URL, id)
+						previousResourceVersion[key] = currentResourceVersion
+					}
+				}
+			}
+
+		}()
+	}
+}

vendor/k8s.io/kubernetes/test/integration/auth/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/auth/node_test.go

@@ -0,0 +1,366 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"runtime"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apiserver/pkg/authentication/request/bearertoken"
+	"k8s.io/apiserver/pkg/authentication/token/tokenfile"
+	"k8s.io/apiserver/pkg/authentication/user"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/apis/policy"
+	"k8s.io/kubernetes/pkg/auth/nodeidentifier"
+	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
+	informers "k8s.io/kubernetes/pkg/client/informers/informers_generated/internalversion"
+	"k8s.io/kubernetes/pkg/kubeapiserver/authorizer"
+	"k8s.io/kubernetes/plugin/pkg/admission/noderestriction"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestNodeAuthorizer(t *testing.T) {
+	// Start the server so we know the address
+	h := &framework.MasterHolder{Initialized: make(chan struct{})}
+	apiServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		<-h.Initialized
+		h.M.GenericAPIServer.Handler.ServeHTTP(w, req)
+	}))
+
+	const (
+		// Define credentials
+		tokenMaster      = "master-token"
+		tokenNodeUnknown = "unknown-token"
+		tokenNode1       = "node1-token"
+		tokenNode2       = "node2-token"
+	)
+
+	authenticator := bearertoken.New(tokenfile.New(map[string]*user.DefaultInfo{
+		tokenMaster:      {Name: "admin", Groups: []string{"system:masters"}},
+		tokenNodeUnknown: {Name: "unknown", Groups: []string{"system:nodes"}},
+		tokenNode1:       {Name: "system:node:node1", Groups: []string{"system:nodes"}},
+		tokenNode2:       {Name: "system:node:node2", Groups: []string{"system:nodes"}},
+	}))
+
+	// Build client config, clientset, and informers
+	clientConfig := &restclient.Config{Host: apiServer.URL, ContentConfig: restclient.ContentConfig{NegotiatedSerializer: api.Codecs}}
+	superuserClient := clientsetForToken(tokenMaster, clientConfig)
+	informerFactory := informers.NewSharedInformerFactory(superuserClient, time.Minute)
+
+	// Set up Node+RBAC authorizer
+	authorizerConfig := &authorizer.AuthorizationConfig{
+		AuthorizationModes: []string{"Node", "RBAC"},
+		InformerFactory:    informerFactory,
+	}
+	nodeRBACAuthorizer, _, err := authorizerConfig.New()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Set up NodeRestriction admission
+	nodeRestrictionAdmission := noderestriction.NewPlugin(nodeidentifier.NewDefaultNodeIdentifier())
+	nodeRestrictionAdmission.SetInternalKubeClientSet(superuserClient)
+	if err := nodeRestrictionAdmission.Validate(); err != nil {
+		t.Fatal(err)
+	}
+
+	// Start the server
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	masterConfig.GenericConfig.Authenticator = authenticator
+
+	masterConfig.GenericConfig.Authorizer = nodeRBACAuthorizer
+	masterConfig.GenericConfig.AdmissionControl = nodeRestrictionAdmission
+	_, _, closeFn := framework.RunAMasterUsingServer(masterConfig, apiServer, h)
+	defer closeFn()
+
+	// Start the informers
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+	informerFactory.Start(stopCh)
+
+	// Wait for a healthy server
+	for {
+		result := superuserClient.Core().RESTClient().Get().AbsPath("/healthz").Do()
+		_, err := result.Raw()
+		if err == nil {
+			break
+		}
+		t.Log(err)
+		time.Sleep(time.Second)
+	}
+
+	// Create objects
+	if _, err := superuserClient.Core().Secrets("ns").Create(&api.Secret{ObjectMeta: metav1.ObjectMeta{Name: "mysecret"}}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := superuserClient.Core().Secrets("ns").Create(&api.Secret{ObjectMeta: metav1.ObjectMeta{Name: "mypvsecret"}}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := superuserClient.Core().ConfigMaps("ns").Create(&api.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "myconfigmap"}}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := superuserClient.Core().PersistentVolumeClaims("ns").Create(&api.PersistentVolumeClaim{
+		ObjectMeta: metav1.ObjectMeta{Name: "mypvc"},
+		Spec: api.PersistentVolumeClaimSpec{
+			AccessModes: []api.PersistentVolumeAccessMode{api.ReadOnlyMany},
+			Resources:   api.ResourceRequirements{Requests: api.ResourceList{api.ResourceStorage: resource.MustParse("1")}},
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := superuserClient.Core().PersistentVolumes().Create(&api.PersistentVolume{
+		ObjectMeta: metav1.ObjectMeta{Name: "mypv"},
+		Spec: api.PersistentVolumeSpec{
+			AccessModes:            []api.PersistentVolumeAccessMode{api.ReadOnlyMany},
+			Capacity:               api.ResourceList{api.ResourceStorage: resource.MustParse("1")},
+			ClaimRef:               &api.ObjectReference{Namespace: "ns", Name: "mypvc"},
+			PersistentVolumeSource: api.PersistentVolumeSource{AzureFile: &api.AzureFilePersistentVolumeSource{ShareName: "default", SecretName: "mypvsecret"}},
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	getSecret := func(client clientset.Interface) error {
+		_, err := client.Core().Secrets("ns").Get("mysecret", metav1.GetOptions{})
+		return err
+	}
+	getPVSecret := func(client clientset.Interface) error {
+		_, err := client.Core().Secrets("ns").Get("mypvsecret", metav1.GetOptions{})
+		return err
+	}
+	getConfigMap := func(client clientset.Interface) error {
+		_, err := client.Core().ConfigMaps("ns").Get("myconfigmap", metav1.GetOptions{})
+		return err
+	}
+	getPVC := func(client clientset.Interface) error {
+		_, err := client.Core().PersistentVolumeClaims("ns").Get("mypvc", metav1.GetOptions{})
+		return err
+	}
+	getPV := func(client clientset.Interface) error {
+		_, err := client.Core().PersistentVolumes().Get("mypv", metav1.GetOptions{})
+		return err
+	}
+
+	createNode2NormalPod := func(client clientset.Interface) error {
+		_, err := client.Core().Pods("ns").Create(&api.Pod{
+			ObjectMeta: metav1.ObjectMeta{Name: "node2normalpod"},
+			Spec: api.PodSpec{
+				NodeName:   "node2",
+				Containers: []api.Container{{Name: "image", Image: "busybox"}},
+				Volumes: []api.Volume{
+					{Name: "secret", VolumeSource: api.VolumeSource{Secret: &api.SecretVolumeSource{SecretName: "mysecret"}}},
+					{Name: "cm", VolumeSource: api.VolumeSource{ConfigMap: &api.ConfigMapVolumeSource{LocalObjectReference: api.LocalObjectReference{Name: "myconfigmap"}}}},
+					{Name: "pvc", VolumeSource: api.VolumeSource{PersistentVolumeClaim: &api.PersistentVolumeClaimVolumeSource{ClaimName: "mypvc"}}},
+				},
+			},
+		})
+		return err
+	}
+	updateNode2NormalPodStatus := func(client clientset.Interface) error {
+		startTime := metav1.NewTime(time.Now())
+		_, err := client.Core().Pods("ns").UpdateStatus(&api.Pod{
+			ObjectMeta: metav1.ObjectMeta{Name: "node2normalpod"},
+			Status:     api.PodStatus{StartTime: &startTime},
+		})
+		return err
+	}
+	deleteNode2NormalPod := func(client clientset.Interface) error {
+		zero := int64(0)
+		return client.Core().Pods("ns").Delete("node2normalpod", &metav1.DeleteOptions{GracePeriodSeconds: &zero})
+	}
+
+	createNode2MirrorPod := func(client clientset.Interface) error {
+		_, err := client.Core().Pods("ns").Create(&api.Pod{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:        "node2mirrorpod",
+				Annotations: map[string]string{api.MirrorPodAnnotationKey: "true"},
+			},
+			Spec: api.PodSpec{
+				NodeName:   "node2",
+				Containers: []api.Container{{Name: "image", Image: "busybox"}},
+			},
+		})
+		return err
+	}
+	deleteNode2MirrorPod := func(client clientset.Interface) error {
+		zero := int64(0)
+		return client.Core().Pods("ns").Delete("node2mirrorpod", &metav1.DeleteOptions{GracePeriodSeconds: &zero})
+	}
+
+	createNode2 := func(client clientset.Interface) error {
+		_, err := client.Core().Nodes().Create(&api.Node{ObjectMeta: metav1.ObjectMeta{Name: "node2"}})
+		return err
+	}
+	updateNode2Status := func(client clientset.Interface) error {
+		_, err := client.Core().Nodes().UpdateStatus(&api.Node{
+			ObjectMeta: metav1.ObjectMeta{Name: "node2"},
+			Status:     api.NodeStatus{},
+		})
+		return err
+	}
+	deleteNode2 := func(client clientset.Interface) error {
+		return client.Core().Nodes().Delete("node2", nil)
+	}
+	createNode2NormalPodEviction := func(client clientset.Interface) error {
+		return client.Policy().Evictions("ns").Evict(&policy.Eviction{
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "policy/v1beta1",
+				Kind:       "Eviction",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "node2normalpod",
+				Namespace: "ns",
+			},
+		})
+	}
+	createNode2MirrorPodEviction := func(client clientset.Interface) error {
+		return client.Policy().Evictions("ns").Evict(&policy.Eviction{
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "policy/v1beta1",
+				Kind:       "Eviction",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "node2mirrorpod",
+				Namespace: "ns",
+			},
+		})
+	}
+
+	nodeanonClient := clientsetForToken(tokenNodeUnknown, clientConfig)
+	node1Client := clientsetForToken(tokenNode1, clientConfig)
+	node2Client := clientsetForToken(tokenNode2, clientConfig)
+
+	// all node requests from node1 and unknown node fail
+	expectForbidden(t, getSecret(nodeanonClient))
+	expectForbidden(t, getPVSecret(nodeanonClient))
+	expectForbidden(t, getConfigMap(nodeanonClient))
+	expectForbidden(t, getPVC(nodeanonClient))
+	expectForbidden(t, getPV(nodeanonClient))
+	expectForbidden(t, createNode2NormalPod(nodeanonClient))
+	expectForbidden(t, createNode2MirrorPod(nodeanonClient))
+	expectForbidden(t, deleteNode2NormalPod(nodeanonClient))
+	expectForbidden(t, deleteNode2MirrorPod(nodeanonClient))
+	expectForbidden(t, createNode2MirrorPodEviction(nodeanonClient))
+	expectForbidden(t, createNode2(nodeanonClient))
+	expectForbidden(t, updateNode2Status(nodeanonClient))
+	expectForbidden(t, deleteNode2(nodeanonClient))
+
+	expectForbidden(t, getSecret(node1Client))
+	expectForbidden(t, getPVSecret(node1Client))
+	expectForbidden(t, getConfigMap(node1Client))
+	expectForbidden(t, getPVC(node1Client))
+	expectForbidden(t, getPV(node1Client))
+	expectForbidden(t, createNode2NormalPod(nodeanonClient))
+	expectForbidden(t, createNode2MirrorPod(node1Client))
+	expectNotFound(t, deleteNode2MirrorPod(node1Client))
+	expectNotFound(t, createNode2MirrorPodEviction(node1Client))
+	expectForbidden(t, createNode2(node1Client))
+	expectForbidden(t, updateNode2Status(node1Client))
+	expectForbidden(t, deleteNode2(node1Client))
+
+	// related object requests from node2 fail
+	expectForbidden(t, getSecret(node2Client))
+	expectForbidden(t, getPVSecret(node2Client))
+	expectForbidden(t, getConfigMap(node2Client))
+	expectForbidden(t, getPVC(node2Client))
+	expectForbidden(t, getPV(node2Client))
+	expectForbidden(t, createNode2NormalPod(nodeanonClient))
+	// mirror pod and self node lifecycle is allowed
+	expectAllowed(t, createNode2MirrorPod(node2Client))
+	expectAllowed(t, deleteNode2MirrorPod(node2Client))
+	expectAllowed(t, createNode2MirrorPod(node2Client))
+	expectAllowed(t, createNode2MirrorPodEviction(node2Client))
+	expectAllowed(t, createNode2(node2Client))
+	expectAllowed(t, updateNode2Status(node2Client))
+	expectAllowed(t, deleteNode2(node2Client))
+
+	// create a pod as an admin to add object references
+	expectAllowed(t, createNode2NormalPod(superuserClient))
+
+	// unidentifiable node and node1 are still forbidden
+	expectForbidden(t, getSecret(nodeanonClient))
+	expectForbidden(t, getPVSecret(nodeanonClient))
+	expectForbidden(t, getConfigMap(nodeanonClient))
+	expectForbidden(t, getPVC(nodeanonClient))
+	expectForbidden(t, getPV(nodeanonClient))
+	expectForbidden(t, createNode2NormalPod(nodeanonClient))
+	expectForbidden(t, updateNode2NormalPodStatus(nodeanonClient))
+	expectForbidden(t, deleteNode2NormalPod(nodeanonClient))
+	expectForbidden(t, createNode2NormalPodEviction(nodeanonClient))
+	expectForbidden(t, createNode2MirrorPod(nodeanonClient))
+	expectForbidden(t, deleteNode2MirrorPod(nodeanonClient))
+	expectForbidden(t, createNode2MirrorPodEviction(nodeanonClient))
+
+	expectForbidden(t, getSecret(node1Client))
+	expectForbidden(t, getPVSecret(node1Client))
+	expectForbidden(t, getConfigMap(node1Client))
+	expectForbidden(t, getPVC(node1Client))
+	expectForbidden(t, getPV(node1Client))
+	expectForbidden(t, createNode2NormalPod(node1Client))
+	expectForbidden(t, updateNode2NormalPodStatus(node1Client))
+	expectForbidden(t, deleteNode2NormalPod(node1Client))
+	expectForbidden(t, createNode2NormalPodEviction(node1Client))
+	expectForbidden(t, createNode2MirrorPod(node1Client))
+	expectNotFound(t, deleteNode2MirrorPod(node1Client))
+	expectNotFound(t, createNode2MirrorPodEviction(node1Client))
+
+	// node2 can get referenced objects now
+	expectAllowed(t, getSecret(node2Client))
+	expectAllowed(t, getPVSecret(node2Client))
+	expectAllowed(t, getConfigMap(node2Client))
+	expectAllowed(t, getPVC(node2Client))
+	expectAllowed(t, getPV(node2Client))
+	expectForbidden(t, createNode2NormalPod(node2Client))
+	expectAllowed(t, updateNode2NormalPodStatus(node2Client))
+	expectAllowed(t, deleteNode2NormalPod(node2Client))
+	expectAllowed(t, createNode2MirrorPod(node2Client))
+	expectAllowed(t, deleteNode2MirrorPod(node2Client))
+	// recreate as an admin to test eviction
+	expectAllowed(t, createNode2NormalPod(superuserClient))
+	expectAllowed(t, createNode2MirrorPod(superuserClient))
+	expectAllowed(t, createNode2NormalPodEviction(node2Client))
+	expectAllowed(t, createNode2MirrorPodEviction(node2Client))
+}
+
+func expectForbidden(t *testing.T, err error) {
+	if !errors.IsForbidden(err) {
+		_, file, line, _ := runtime.Caller(1)
+		t.Errorf("%s:%d: Expected forbidden error, got %v", filepath.Base(file), line, err)
+	}
+}
+
+func expectNotFound(t *testing.T, err error) {
+	if !errors.IsNotFound(err) {
+		_, file, line, _ := runtime.Caller(1)
+		t.Errorf("%s:%d: Expected notfound error, got %v", filepath.Base(file), line, err)
+	}
+}
+
+func expectAllowed(t *testing.T, err error) {
+	if err != nil {
+		_, file, line, _ := runtime.Caller(1)
+		t.Errorf("%s:%d: Expected no error, got %v", filepath.Base(file), line, err)
+	}
+}

vendor/k8s.io/kubernetes/test/integration/auth/rbac_test.go

@@ -0,0 +1,561 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"net/http/httputil"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/golang/glog"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/apiserver/pkg/authentication/request/bearertoken"
+	"k8s.io/apiserver/pkg/authentication/token/tokenfile"
+	"k8s.io/apiserver/pkg/authentication/user"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+	"k8s.io/apiserver/pkg/registry/generic"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/transport"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	rbacapi "k8s.io/kubernetes/pkg/apis/rbac"
+	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
+	"k8s.io/kubernetes/pkg/master"
+	"k8s.io/kubernetes/pkg/registry/rbac/clusterrole"
+	clusterrolestore "k8s.io/kubernetes/pkg/registry/rbac/clusterrole/storage"
+	"k8s.io/kubernetes/pkg/registry/rbac/clusterrolebinding"
+	clusterrolebindingstore "k8s.io/kubernetes/pkg/registry/rbac/clusterrolebinding/storage"
+	"k8s.io/kubernetes/pkg/registry/rbac/role"
+	rolestore "k8s.io/kubernetes/pkg/registry/rbac/role/storage"
+	"k8s.io/kubernetes/pkg/registry/rbac/rolebinding"
+	rolebindingstore "k8s.io/kubernetes/pkg/registry/rbac/rolebinding/storage"
+	"k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func clientForToken(user string) *http.Client {
+	return &http.Client{
+		Transport: transport.NewBearerAuthRoundTripper(
+			user,
+			transport.DebugWrappers(http.DefaultTransport),
+		),
+	}
+}
+
+func clientsetForToken(user string, config *restclient.Config) clientset.Interface {
+	configCopy := *config
+	configCopy.BearerToken = user
+	return clientset.NewForConfigOrDie(&configCopy)
+}
+
+type testRESTOptionsGetter struct {
+	config *master.Config
+}
+
+func (getter *testRESTOptionsGetter) GetRESTOptions(resource schema.GroupResource) (generic.RESTOptions, error) {
+	storageConfig, err := getter.config.ExtraConfig.StorageFactory.NewConfig(resource)
+	if err != nil {
+		return generic.RESTOptions{}, fmt.Errorf("failed to get storage: %v", err)
+	}
+	return generic.RESTOptions{StorageConfig: storageConfig, Decorator: generic.UndecoratedStorage, ResourcePrefix: resource.Resource}, nil
+}
+
+func newRBACAuthorizer(config *master.Config) authorizer.Authorizer {
+	optsGetter := &testRESTOptionsGetter{config}
+	roleRegistry := role.AuthorizerAdapter{Registry: role.NewRegistry(rolestore.NewREST(optsGetter))}
+	roleBindingRegistry := rolebinding.AuthorizerAdapter{Registry: rolebinding.NewRegistry(rolebindingstore.NewREST(optsGetter))}
+	clusterRoleRegistry := clusterrole.AuthorizerAdapter{Registry: clusterrole.NewRegistry(clusterrolestore.NewREST(optsGetter))}
+	clusterRoleBindingRegistry := clusterrolebinding.AuthorizerAdapter{Registry: clusterrolebinding.NewRegistry(clusterrolebindingstore.NewREST(optsGetter))}
+	return rbac.New(roleRegistry, roleBindingRegistry, clusterRoleRegistry, clusterRoleBindingRegistry)
+}
+
+// bootstrapRoles are a set of RBAC roles which will be populated before the test.
+type bootstrapRoles struct {
+	roles               []rbacapi.Role
+	roleBindings        []rbacapi.RoleBinding
+	clusterRoles        []rbacapi.ClusterRole
+	clusterRoleBindings []rbacapi.ClusterRoleBinding
+}
+
+// bootstrap uses the provided client to create the bootstrap roles and role bindings.
+//
+// client should be authenticated as the RBAC super user.
+func (b bootstrapRoles) bootstrap(client clientset.Interface) error {
+	for _, r := range b.clusterRoles {
+		_, err := client.Rbac().ClusterRoles().Create(&r)
+		if err != nil {
+			return fmt.Errorf("failed to make request: %v", err)
+		}
+	}
+	for _, r := range b.roles {
+		_, err := client.Rbac().Roles(r.Namespace).Create(&r)
+		if err != nil {
+			return fmt.Errorf("failed to make request: %v", err)
+		}
+	}
+	for _, r := range b.clusterRoleBindings {
+		_, err := client.Rbac().ClusterRoleBindings().Create(&r)
+		if err != nil {
+			return fmt.Errorf("failed to make request: %v", err)
+		}
+	}
+	for _, r := range b.roleBindings {
+		_, err := client.Rbac().RoleBindings(r.Namespace).Create(&r)
+		if err != nil {
+			return fmt.Errorf("failed to make request: %v", err)
+		}
+	}
+
+	return nil
+}
+
+// request is a test case which can.
+type request struct {
+	// The bearer token sent as part of the request
+	token string
+
+	// Resource metadata
+	verb      string
+	apiGroup  string
+	resource  string
+	namespace string
+	name      string
+
+	// The actual resource.
+	body string
+
+	// The expected return status of this request.
+	expectedStatus int
+}
+
+func (r request) String() string {
+	return fmt.Sprintf("%s %s %s", r.token, r.verb, r.resource)
+}
+
+type statusCode int
+
+func (s statusCode) String() string {
+	return fmt.Sprintf("%d %s", int(s), http.StatusText(int(s)))
+}
+
+// Declare a set of raw objects to use.
+var (
+	// Make a role binding with the version enabled in testapi.Rbac
+	// This assumes testapi is using rbac.authorization.k8s.io/v1beta1 or rbac.authorization.k8s.io/v1, which are identical in structure.
+	// TODO: rework or remove testapi usage to allow writing integration tests that don't depend on envvars
+	writeJobsRoleBinding = `
+{
+  "apiVersion": "` + testapi.Rbac.GroupVersion().String() + `",
+  "kind": "RoleBinding",
+  "metadata": {
+    "name": "pi"%s
+  },
+  "roleRef": {
+    "apiGroup": "rbac.authorization.k8s.io",
+    "kind": "ClusterRole",
+    "name": "write-jobs"
+  },
+  "subjects": [{
+    "apiGroup": "rbac.authorization.k8s.io",
+    "kind": "User",
+    "name": "admin"
+  }]
+}`
+
+	aJob = `
+{
+  "apiVersion": "batch/v1",
+  "kind": "Job",
+  "metadata": {
+    "name": "pi"%s
+  },
+  "spec": {
+    "template": {
+      "metadata": {
+        "name": "a",
+        "labels": {
+          "name": "pijob"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "name": "pi",
+            "image": "perl",
+            "command": [
+              "perl",
+              "-Mbignum=bpi",
+              "-wle",
+              "print bpi(2000)"
+            ]
+          }
+        ],
+        "restartPolicy": "Never"
+      }
+    }
+  }
+}
+`
+	podNamespace = `
+{
+  "apiVersion": "` + testapi.Groups[api.GroupName].GroupVersion().String() + `",
+  "kind": "Namespace",
+  "metadata": {
+	"name": "pod-namespace"%s
+  }
+}
+`
+	jobNamespace = `
+{
+  "apiVersion": "` + testapi.Groups[api.GroupName].GroupVersion().String() + `",
+  "kind": "Namespace",
+  "metadata": {
+	"name": "job-namespace"%s
+  }
+}
+`
+	forbiddenNamespace = `
+{
+  "apiVersion": "` + testapi.Groups[api.GroupName].GroupVersion().String() + `",
+  "kind": "Namespace",
+  "metadata": {
+	"name": "forbidden-namespace"%s
+  }
+}
+`
+)
+
+// Declare some PolicyRules beforehand.
+var (
+	ruleAllowAll  = rbacapi.NewRule("*").Groups("*").Resources("*").RuleOrDie()
+	ruleReadPods  = rbacapi.NewRule("list", "get", "watch").Groups("").Resources("pods").RuleOrDie()
+	ruleWriteJobs = rbacapi.NewRule("*").Groups("batch").Resources("*").RuleOrDie()
+)
+
+func TestRBAC(t *testing.T) {
+	superUser := "admin/system:masters"
+
+	tests := []struct {
+		bootstrapRoles bootstrapRoles
+
+		requests []request
+	}{
+		{
+			bootstrapRoles: bootstrapRoles{
+				clusterRoles: []rbacapi.ClusterRole{
+					{
+						ObjectMeta: metav1.ObjectMeta{Name: "allow-all"},
+						Rules:      []rbacapi.PolicyRule{ruleAllowAll},
+					},
+					{
+						ObjectMeta: metav1.ObjectMeta{Name: "read-pods"},
+						Rules:      []rbacapi.PolicyRule{ruleReadPods},
+					},
+				},
+				clusterRoleBindings: []rbacapi.ClusterRoleBinding{
+					{
+						ObjectMeta: metav1.ObjectMeta{Name: "read-pods"},
+						Subjects: []rbacapi.Subject{
+							{Kind: "User", Name: "pod-reader"},
+						},
+						RoleRef: rbacapi.RoleRef{Kind: "ClusterRole", Name: "read-pods"},
+					},
+				},
+			},
+			requests: []request{
+				// Create the namespace used later in the test
+				{superUser, "POST", "", "namespaces", "", "", podNamespace, http.StatusCreated},
+
+				{superUser, "GET", "", "pods", "", "", "", http.StatusOK},
+				{superUser, "GET", "", "pods", "pod-namespace", "a", "", http.StatusNotFound},
+				{superUser, "POST", "", "pods", "pod-namespace", "", aPod, http.StatusCreated},
+				{superUser, "GET", "", "pods", "pod-namespace", "a", "", http.StatusOK},
+
+				{"bob", "GET", "", "pods", "", "", "", http.StatusForbidden},
+				{"bob", "GET", "", "pods", "pod-namespace", "a", "", http.StatusForbidden},
+
+				{"pod-reader", "GET", "", "pods", "", "", "", http.StatusOK},
+				{"pod-reader", "POST", "", "pods", "pod-namespace", "", aPod, http.StatusForbidden},
+			},
+		},
+		{
+			bootstrapRoles: bootstrapRoles{
+				clusterRoles: []rbacapi.ClusterRole{
+					{
+						ObjectMeta: metav1.ObjectMeta{Name: "write-jobs"},
+						Rules:      []rbacapi.PolicyRule{ruleWriteJobs},
+					},
+					{
+						ObjectMeta: metav1.ObjectMeta{Name: "create-rolebindings"},
+						Rules: []rbacapi.PolicyRule{
+							rbacapi.NewRule("create").Groups("rbac.authorization.k8s.io").Resources("rolebindings").RuleOrDie(),
+						},
+					},
+					{
+						ObjectMeta: metav1.ObjectMeta{Name: "bind-any-clusterrole"},
+						Rules: []rbacapi.PolicyRule{
+							rbacapi.NewRule("bind").Groups("rbac.authorization.k8s.io").Resources("clusterroles").RuleOrDie(),
+						},
+					},
+				},
+				clusterRoleBindings: []rbacapi.ClusterRoleBinding{
+					{
+						ObjectMeta: metav1.ObjectMeta{Name: "write-jobs"},
+						Subjects:   []rbacapi.Subject{{Kind: "User", Name: "job-writer"}},
+						RoleRef:    rbacapi.RoleRef{Kind: "ClusterRole", Name: "write-jobs"},
+					},
+					{
+						ObjectMeta: metav1.ObjectMeta{Name: "create-rolebindings"},
+						Subjects: []rbacapi.Subject{
+							{Kind: "User", Name: "job-writer"},
+							{Kind: "User", Name: "nonescalating-rolebinding-writer"},
+							{Kind: "User", Name: "any-rolebinding-writer"},
+						},
+						RoleRef: rbacapi.RoleRef{Kind: "ClusterRole", Name: "create-rolebindings"},
+					},
+					{
+						ObjectMeta: metav1.ObjectMeta{Name: "bind-any-clusterrole"},
+						Subjects:   []rbacapi.Subject{{Kind: "User", Name: "any-rolebinding-writer"}},
+						RoleRef:    rbacapi.RoleRef{Kind: "ClusterRole", Name: "bind-any-clusterrole"},
+					},
+				},
+				roleBindings: []rbacapi.RoleBinding{
+					{
+						ObjectMeta: metav1.ObjectMeta{Name: "write-jobs", Namespace: "job-namespace"},
+						Subjects:   []rbacapi.Subject{{Kind: "User", Name: "job-writer-namespace"}},
+						RoleRef:    rbacapi.RoleRef{Kind: "ClusterRole", Name: "write-jobs"},
+					},
+					{
+						ObjectMeta: metav1.ObjectMeta{Name: "create-rolebindings", Namespace: "job-namespace"},
+						Subjects: []rbacapi.Subject{
+							{Kind: "User", Name: "job-writer-namespace"},
+							{Kind: "User", Name: "any-rolebinding-writer-namespace"},
+						},
+						RoleRef: rbacapi.RoleRef{Kind: "ClusterRole", Name: "create-rolebindings"},
+					},
+					{
+						ObjectMeta: metav1.ObjectMeta{Name: "bind-any-clusterrole", Namespace: "job-namespace"},
+						Subjects:   []rbacapi.Subject{{Kind: "User", Name: "any-rolebinding-writer-namespace"}},
+						RoleRef:    rbacapi.RoleRef{Kind: "ClusterRole", Name: "bind-any-clusterrole"},
+					},
+				},
+			},
+			requests: []request{
+				// Create the namespace used later in the test
+				{superUser, "POST", "", "namespaces", "", "", jobNamespace, http.StatusCreated},
+				{superUser, "POST", "", "namespaces", "", "", forbiddenNamespace, http.StatusCreated},
+
+				{"user-with-no-permissions", "POST", "batch", "jobs", "job-namespace", "", aJob, http.StatusForbidden},
+				{"user-with-no-permissions", "GET", "batch", "jobs", "job-namespace", "pi", "", http.StatusForbidden},
+
+				// job-writer-namespace cannot write to the "forbidden-namespace"
+				{"job-writer-namespace", "GET", "batch", "jobs", "forbidden-namespace", "", "", http.StatusForbidden},
+				{"job-writer-namespace", "GET", "batch", "jobs", "forbidden-namespace", "pi", "", http.StatusForbidden},
+				{"job-writer-namespace", "POST", "batch", "jobs", "forbidden-namespace", "", aJob, http.StatusForbidden},
+				{"job-writer-namespace", "GET", "batch", "jobs", "forbidden-namespace", "pi", "", http.StatusForbidden},
+
+				// job-writer can write to any namespace
+				{"job-writer", "GET", "batch", "jobs", "forbidden-namespace", "", "", http.StatusOK},
+				{"job-writer", "GET", "batch", "jobs", "forbidden-namespace", "pi", "", http.StatusNotFound},
+				{"job-writer", "POST", "batch", "jobs", "forbidden-namespace", "", aJob, http.StatusCreated},
+				{"job-writer", "GET", "batch", "jobs", "forbidden-namespace", "pi", "", http.StatusOK},
+
+				{"job-writer-namespace", "GET", "batch", "jobs", "job-namespace", "", "", http.StatusOK},
+				{"job-writer-namespace", "GET", "batch", "jobs", "job-namespace", "pi", "", http.StatusNotFound},
+				{"job-writer-namespace", "POST", "batch", "jobs", "job-namespace", "", aJob, http.StatusCreated},
+				{"job-writer-namespace", "GET", "batch", "jobs", "job-namespace", "pi", "", http.StatusOK},
+
+				// cannot bind role anywhere
+				{"user-with-no-permissions", "POST", "rbac.authorization.k8s.io", "rolebindings", "job-namespace", "", writeJobsRoleBinding, http.StatusForbidden},
+				// can only bind role in namespace where they have explicit bind permission
+				{"any-rolebinding-writer-namespace", "POST", "rbac.authorization.k8s.io", "rolebindings", "forbidden-namespace", "", writeJobsRoleBinding, http.StatusForbidden},
+				// can only bind role in namespace where they have covering permissions
+				{"job-writer-namespace", "POST", "rbac.authorization.k8s.io", "rolebindings", "forbidden-namespace", "", writeJobsRoleBinding, http.StatusForbidden},
+				{"job-writer-namespace", "POST", "rbac.authorization.k8s.io", "rolebindings", "job-namespace", "", writeJobsRoleBinding, http.StatusCreated},
+				{superUser, "DELETE", "rbac.authorization.k8s.io", "rolebindings", "job-namespace", "pi", "", http.StatusOK},
+				// can bind role in any namespace where they have covering permissions
+				{"job-writer", "POST", "rbac.authorization.k8s.io", "rolebindings", "forbidden-namespace", "", writeJobsRoleBinding, http.StatusCreated},
+				{superUser, "DELETE", "rbac.authorization.k8s.io", "rolebindings", "forbidden-namespace", "pi", "", http.StatusOK},
+				// cannot bind role because they don't have covering permissions
+				{"nonescalating-rolebinding-writer", "POST", "rbac.authorization.k8s.io", "rolebindings", "job-namespace", "", writeJobsRoleBinding, http.StatusForbidden},
+				// can bind role because they have explicit bind permission
+				{"any-rolebinding-writer", "POST", "rbac.authorization.k8s.io", "rolebindings", "job-namespace", "", writeJobsRoleBinding, http.StatusCreated},
+				{superUser, "DELETE", "rbac.authorization.k8s.io", "rolebindings", "job-namespace", "pi", "", http.StatusOK},
+				{"any-rolebinding-writer-namespace", "POST", "rbac.authorization.k8s.io", "rolebindings", "job-namespace", "", writeJobsRoleBinding, http.StatusCreated},
+				{superUser, "DELETE", "rbac.authorization.k8s.io", "rolebindings", "job-namespace", "pi", "", http.StatusOK},
+			},
+		},
+	}
+
+	for i, tc := range tests {
+		// Create an API Server.
+		masterConfig := framework.NewIntegrationTestMasterConfig()
+		masterConfig.GenericConfig.Authorizer = newRBACAuthorizer(masterConfig)
+		masterConfig.GenericConfig.Authenticator = bearertoken.New(tokenfile.New(map[string]*user.DefaultInfo{
+			superUser:                          {Name: "admin", Groups: []string{"system:masters"}},
+			"any-rolebinding-writer":           {Name: "any-rolebinding-writer"},
+			"any-rolebinding-writer-namespace": {Name: "any-rolebinding-writer-namespace"},
+			"bob":                              {Name: "bob"},
+			"job-writer":                       {Name: "job-writer"},
+			"job-writer-namespace":             {Name: "job-writer-namespace"},
+			"nonescalating-rolebinding-writer": {Name: "nonescalating-rolebinding-writer"},
+			"pod-reader":                       {Name: "pod-reader"},
+			"user-with-no-permissions":         {Name: "user-with-no-permissions"},
+		}))
+		_, s, closeFn := framework.RunAMaster(masterConfig)
+		defer closeFn()
+
+		clientConfig := &restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{NegotiatedSerializer: api.Codecs}}
+
+		// Bootstrap the API Server with the test case's initial roles.
+		if err := tc.bootstrapRoles.bootstrap(clientsetForToken(superUser, clientConfig)); err != nil {
+			t.Errorf("case %d: failed to apply initial roles: %v", i, err)
+			continue
+		}
+		previousResourceVersion := make(map[string]float64)
+
+		for j, r := range tc.requests {
+			testGroup, ok := testapi.Groups[r.apiGroup]
+			if !ok {
+				t.Errorf("case %d %d: unknown api group %q, %s", i, j, r.apiGroup, r)
+				continue
+			}
+			path := testGroup.ResourcePath(r.resource, r.namespace, r.name)
+
+			var body io.Reader
+			if r.body != "" {
+				sub := ""
+				if r.verb == "PUT" {
+					// For update operations, insert previous resource version
+					if resVersion := previousResourceVersion[getPreviousResourceVersionKey(path, "")]; resVersion != 0 {
+						sub += fmt.Sprintf(",\"resourceVersion\": \"%v\"", resVersion)
+					}
+				}
+				body = strings.NewReader(fmt.Sprintf(r.body, sub))
+			}
+
+			req, err := http.NewRequest(r.verb, s.URL+path, body)
+			if err != nil {
+				t.Fatalf("failed to create request: %v", err)
+			}
+
+			func() {
+				reqDump, err := httputil.DumpRequest(req, true)
+				if err != nil {
+					t.Fatalf("failed to dump request: %v", err)
+					return
+				}
+
+				resp, err := clientForToken(r.token).Do(req)
+				if err != nil {
+					t.Errorf("case %d, req %d: failed to make request: %v", i, j, err)
+					return
+				}
+				defer resp.Body.Close()
+
+				respDump, err := httputil.DumpResponse(resp, true)
+				if err != nil {
+					t.Fatalf("failed to dump response: %v", err)
+					return
+				}
+
+				if resp.StatusCode != r.expectedStatus {
+					// When debugging is on, dump the entire request and response. Very helpful for
+					// debugging malformed test cases.
+					//
+					// To turn on debugging, use the '-args' flag.
+					//
+					//    go test -v -tags integration -run RBAC -args -v 10
+					//
+					glog.V(8).Infof("case %d, req %d: %s\n%s\n", i, j, reqDump, respDump)
+					t.Errorf("case %d, req %d: %s expected %q got %q", i, j, r, statusCode(r.expectedStatus), statusCode(resp.StatusCode))
+				}
+
+				b, _ := ioutil.ReadAll(resp.Body)
+
+				if r.verb == "POST" && (resp.StatusCode/100) == 2 {
+					// For successful create operations, extract resourceVersion
+					id, currentResourceVersion, err := parseResourceVersion(b)
+					if err == nil {
+						key := getPreviousResourceVersionKey(path, id)
+						previousResourceVersion[key] = currentResourceVersion
+					} else {
+						t.Logf("error in trying to extract resource version: %s", err)
+					}
+				}
+			}()
+		}
+	}
+}
+
+func TestBootstrapping(t *testing.T) {
+	superUser := "admin/system:masters"
+
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	masterConfig.GenericConfig.Authorizer = newRBACAuthorizer(masterConfig)
+	masterConfig.GenericConfig.Authenticator = bearertoken.New(tokenfile.New(map[string]*user.DefaultInfo{
+		superUser: {Name: "admin", Groups: []string{"system:masters"}},
+	}))
+	_, s, closeFn := framework.RunAMaster(masterConfig)
+	defer closeFn()
+
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{BearerToken: superUser, Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[api.GroupName].GroupVersion()}})
+
+	watcher, err := clientset.Rbac().ClusterRoles().Watch(metav1.ListOptions{ResourceVersion: "0"})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	_, err = watch.Until(30*time.Second, watcher, func(event watch.Event) (bool, error) {
+		if event.Type != watch.Added {
+			return false, nil
+		}
+		return true, nil
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	clusterRoles, err := clientset.Rbac().ClusterRoles().List(metav1.ListOptions{})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(clusterRoles.Items) == 0 {
+		t.Fatalf("missing cluster roles")
+	}
+
+	for _, clusterRole := range clusterRoles.Items {
+		if clusterRole.Name == "cluster-admin" {
+			return
+		}
+	}
+
+	t.Errorf("missing cluster-admin: %v", clusterRoles)
+
+	healthBytes, err := clientset.Discovery().RESTClient().Get().AbsPath("/healthz/poststarthooks/rbac/bootstrap-roles").DoRaw()
+	if err != nil {
+		t.Error(err)
+	}
+	t.Errorf("expected %v, got %v", "asdf", string(healthBytes))
+}

vendor/k8s.io/kubernetes/test/integration/benchmark-controller.json

@@ -0,0 +1,25 @@
+{
+  "kind": "ReplicationController",
+  "apiVersion": "v1",
+  "metadata": {
+     "name": "test-controller",
+     "namespace": "test",
+     "labels": {"name": "test-controller"}
+  },
+  "spec": {
+    "replicas": 0,
+    "selector": {"name": "test-pod"},
+    "template": {
+       "metadata": {
+          "namespace": "test",
+          "labels": {"name": "test-pod"}
+       },
+       "spec": {
+           "containers": [{
+             "name": "test-container",
+             "image": "gcr.io/google_containers/pause-amd64:3.0"
+           }]
+       }
+    }
+  }
+}

vendor/k8s.io/kubernetes/test/integration/client/BUILD

@@ -0,0 +1,52 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "client_test.go",
+        "dynamic_client_test.go",
+        "main_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//pkg/version:go_default_library",
+        "//test/e2e/framework:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/fields:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/watch:go_default_library",
+        "//vendor/k8s.io/client-go/dynamic:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/client/client_test.go

@@ -0,0 +1,837 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package client
+
+import (
+	"fmt"
+	"log"
+	"reflect"
+	rt "runtime"
+	"sync"
+	"testing"
+	"time"
+
+	"k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/apimachinery/pkg/watch"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/pkg/version"
+	e2e "k8s.io/kubernetes/test/e2e/framework"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestClient(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	ns := framework.CreateTestingNamespace("client", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	info, err := client.Discovery().ServerVersion()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if e, a := version.Get(), *info; !reflect.DeepEqual(e, a) {
+		t.Errorf("expected %#v, got %#v", e, a)
+	}
+
+	pods, err := client.Core().Pods(ns.Name).List(metav1.ListOptions{})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(pods.Items) != 0 {
+		t.Errorf("expected no pods, got %#v", pods)
+	}
+
+	// get a validation error
+	pod := &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			GenerateName: "test",
+			Namespace:    ns.Name,
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name: "test",
+				},
+			},
+		},
+	}
+
+	got, err := client.Core().Pods(ns.Name).Create(pod)
+	if err == nil {
+		t.Fatalf("unexpected non-error: %v", got)
+	}
+
+	// get a created pod
+	pod.Spec.Containers[0].Image = "an-image"
+	got, err = client.Core().Pods(ns.Name).Create(pod)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got.Name == "" {
+		t.Errorf("unexpected empty pod Name %v", got)
+	}
+
+	// pod is shown, but not scheduled
+	pods, err = client.Core().Pods(ns.Name).List(metav1.ListOptions{})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(pods.Items) != 1 {
+		t.Errorf("expected one pod, got %#v", pods)
+	}
+	actual := pods.Items[0]
+	if actual.Name != got.Name {
+		t.Errorf("expected pod %#v, got %#v", got, actual)
+	}
+	if actual.Spec.NodeName != "" {
+		t.Errorf("expected pod to be unscheduled, got %#v", actual)
+	}
+}
+
+func TestAtomicPut(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	c := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	ns := framework.CreateTestingNamespace("atomic-put", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	rcBody := v1.ReplicationController{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: c.Core().RESTClient().APIVersion().String(),
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "atomicrc",
+			Namespace: ns.Name,
+			Labels: map[string]string{
+				"name": "atomicrc",
+			},
+		},
+		Spec: v1.ReplicationControllerSpec{
+			Replicas: func(i int32) *int32 { return &i }(0),
+			Selector: map[string]string{
+				"foo": "bar",
+			},
+			Template: &v1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						"foo": "bar",
+					},
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{Name: "name", Image: "image"},
+					},
+				},
+			},
+		},
+	}
+	rcs := c.Core().ReplicationControllers(ns.Name)
+	rc, err := rcs.Create(&rcBody)
+	if err != nil {
+		t.Fatalf("Failed creating atomicRC: %v", err)
+	}
+	testLabels := labels.Set{
+		"foo": "bar",
+	}
+	for i := 0; i < 5; i++ {
+		// a: z, b: y, etc...
+		testLabels[string([]byte{byte('a' + i)})] = string([]byte{byte('z' - i)})
+	}
+	var wg sync.WaitGroup
+	wg.Add(len(testLabels))
+	for label, value := range testLabels {
+		go func(l, v string) {
+			defer wg.Done()
+			for {
+				tmpRC, err := rcs.Get(rc.Name, metav1.GetOptions{})
+				if err != nil {
+					t.Errorf("Error getting atomicRC: %v", err)
+					continue
+				}
+				if tmpRC.Spec.Selector == nil {
+					tmpRC.Spec.Selector = map[string]string{l: v}
+					tmpRC.Spec.Template.Labels = map[string]string{l: v}
+				} else {
+					tmpRC.Spec.Selector[l] = v
+					tmpRC.Spec.Template.Labels[l] = v
+				}
+				tmpRC, err = rcs.Update(tmpRC)
+				if err != nil {
+					if apierrors.IsConflict(err) {
+						// This is what we expect.
+						continue
+					}
+					t.Errorf("Unexpected error putting atomicRC: %v", err)
+					continue
+				}
+				return
+			}
+		}(label, value)
+	}
+	wg.Wait()
+	rc, err = rcs.Get(rc.Name, metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("Failed getting atomicRC after writers are complete: %v", err)
+	}
+	if !reflect.DeepEqual(testLabels, labels.Set(rc.Spec.Selector)) {
+		t.Errorf("Selector PUTs were not atomic: wanted %v, got %v", testLabels, rc.Spec.Selector)
+	}
+}
+
+func TestPatch(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	c := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	ns := framework.CreateTestingNamespace("patch", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	name := "patchpod"
+	resource := "pods"
+	podBody := v1.Pod{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: c.Core().RESTClient().APIVersion().String(),
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: ns.Name,
+			Labels:    map[string]string{},
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{Name: "name", Image: "image"},
+			},
+		},
+	}
+	pods := c.Core().Pods(ns.Name)
+	pod, err := pods.Create(&podBody)
+	if err != nil {
+		t.Fatalf("Failed creating patchpods: %v", err)
+	}
+
+	patchBodies := map[schema.GroupVersion]map[types.PatchType]struct {
+		AddLabelBody        []byte
+		RemoveLabelBody     []byte
+		RemoveAllLabelsBody []byte
+	}{
+		v1.SchemeGroupVersion: {
+			types.JSONPatchType: {
+				[]byte(`[{"op":"add","path":"/metadata/labels","value":{"foo":"bar","baz":"qux"}}]`),
+				[]byte(`[{"op":"remove","path":"/metadata/labels/foo"}]`),
+				[]byte(`[{"op":"remove","path":"/metadata/labels"}]`),
+			},
+			types.MergePatchType: {
+				[]byte(`{"metadata":{"labels":{"foo":"bar","baz":"qux"}}}`),
+				[]byte(`{"metadata":{"labels":{"foo":null}}}`),
+				[]byte(`{"metadata":{"labels":null}}`),
+			},
+			types.StrategicMergePatchType: {
+				[]byte(`{"metadata":{"labels":{"foo":"bar","baz":"qux"}}}`),
+				[]byte(`{"metadata":{"labels":{"foo":null}}}`),
+				[]byte(`{"metadata":{"labels":{"$patch":"replace"}}}`),
+			},
+		},
+	}
+
+	pb := patchBodies[c.Core().RESTClient().APIVersion()]
+
+	execPatch := func(pt types.PatchType, body []byte) error {
+		result := c.Core().RESTClient().Patch(pt).
+			Resource(resource).
+			Namespace(ns.Name).
+			Name(name).
+			Body(body).
+			Do()
+		if result.Error() != nil {
+			return result.Error()
+		}
+
+		// trying to chase flakes, this should give us resource versions of objects as we step through
+		jsonObj, err := result.Raw()
+		if err != nil {
+			t.Log(err)
+		} else {
+			t.Logf("%v", string(jsonObj))
+		}
+
+		obj, err := result.Get()
+		if err != nil {
+			t.Fatal(err)
+		}
+		metadata, err := meta.Accessor(obj)
+		if err != nil {
+			t.Fatal(err)
+		}
+		// this call waits for the resourceVersion to be reached in the cache before returning.  We need to do this because
+		// the patch gets its initial object from the storage, and the cache serves that.  If it is out of date,
+		// then our initial patch is applied to an old resource version, which conflicts and then the updated object shows
+		// a conflicting diff, which permanently fails the patch.  This gives expected stability in the patch without
+		// retrying on an known number of conflicts below in the test.
+		if _, err := c.Core().Pods(ns.Name).Get(name, metav1.GetOptions{ResourceVersion: metadata.GetResourceVersion()}); err != nil {
+			t.Fatal(err)
+		}
+
+		return nil
+	}
+
+	for k, v := range pb {
+		// add label
+		err := execPatch(k, v.AddLabelBody)
+		if err != nil {
+			t.Fatalf("Failed updating patchpod with patch type %s: %v", k, err)
+		}
+		pod, err = pods.Get(name, metav1.GetOptions{})
+		if err != nil {
+			t.Fatalf("Failed getting patchpod: %v", err)
+		}
+		if len(pod.Labels) != 2 || pod.Labels["foo"] != "bar" || pod.Labels["baz"] != "qux" {
+			t.Errorf("Failed updating patchpod with patch type %s: labels are: %v", k, pod.Labels)
+		}
+
+		// remove one label
+		err = execPatch(k, v.RemoveLabelBody)
+		if err != nil {
+			t.Fatalf("Failed updating patchpod with patch type %s: %v", k, err)
+		}
+		pod, err = pods.Get(name, metav1.GetOptions{})
+		if err != nil {
+			t.Fatalf("Failed getting patchpod: %v", err)
+		}
+		if len(pod.Labels) != 1 || pod.Labels["baz"] != "qux" {
+			t.Errorf("Failed updating patchpod with patch type %s: labels are: %v", k, pod.Labels)
+		}
+
+		// remove all labels
+		err = execPatch(k, v.RemoveAllLabelsBody)
+		if err != nil {
+			t.Fatalf("Failed updating patchpod with patch type %s: %v", k, err)
+		}
+		pod, err = pods.Get(name, metav1.GetOptions{})
+		if err != nil {
+			t.Fatalf("Failed getting patchpod: %v", err)
+		}
+		if pod.Labels != nil {
+			t.Errorf("Failed remove all labels from patchpod with patch type %s: %v", k, pod.Labels)
+		}
+	}
+}
+
+func TestPatchWithCreateOnUpdate(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	c := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	ns := framework.CreateTestingNamespace("patch-with-create", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	endpointTemplate := &v1.Endpoints{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "patchendpoint",
+			Namespace: ns.Name,
+		},
+		Subsets: []v1.EndpointSubset{
+			{
+				Addresses: []v1.EndpointAddress{{IP: "1.2.3.4"}},
+				Ports:     []v1.EndpointPort{{Port: 80, Protocol: v1.ProtocolTCP}},
+			},
+		},
+	}
+
+	patchEndpoint := func(json []byte) (runtime.Object, error) {
+		return c.Core().RESTClient().Patch(types.MergePatchType).Resource("endpoints").Namespace(ns.Name).Name("patchendpoint").Body(json).Do().Get()
+	}
+
+	// Make sure patch doesn't get to CreateOnUpdate
+	{
+		endpointJSON, err := runtime.Encode(api.Codecs.LegacyCodec(v1.SchemeGroupVersion), endpointTemplate)
+		if err != nil {
+			t.Fatalf("Failed creating endpoint JSON: %v", err)
+		}
+		if obj, err := patchEndpoint(endpointJSON); !apierrors.IsNotFound(err) {
+			t.Errorf("Expected notfound creating from patch, got error=%v and object: %#v", err, obj)
+		}
+	}
+
+	// Create the endpoint (endpoints set AllowCreateOnUpdate=true) to get a UID and resource version
+	createdEndpoint, err := c.Core().Endpoints(ns.Name).Update(endpointTemplate)
+	if err != nil {
+		t.Fatalf("Failed creating endpoint: %v", err)
+	}
+
+	// Make sure identity patch is accepted
+	{
+		endpointJSON, err := runtime.Encode(api.Codecs.LegacyCodec(v1.SchemeGroupVersion), createdEndpoint)
+		if err != nil {
+			t.Fatalf("Failed creating endpoint JSON: %v", err)
+		}
+		if _, err := patchEndpoint(endpointJSON); err != nil {
+			t.Errorf("Failed patching endpoint: %v", err)
+		}
+	}
+
+	// Make sure patch complains about a mismatched resourceVersion
+	{
+		endpointTemplate.Name = ""
+		endpointTemplate.UID = ""
+		endpointTemplate.ResourceVersion = "1"
+		endpointJSON, err := runtime.Encode(api.Codecs.LegacyCodec(v1.SchemeGroupVersion), endpointTemplate)
+		if err != nil {
+			t.Fatalf("Failed creating endpoint JSON: %v", err)
+		}
+		if _, err := patchEndpoint(endpointJSON); !apierrors.IsConflict(err) {
+			t.Errorf("Expected error, got %#v", err)
+		}
+	}
+
+	// Make sure patch complains about mutating the UID
+	{
+		endpointTemplate.Name = ""
+		endpointTemplate.UID = "abc"
+		endpointTemplate.ResourceVersion = ""
+		endpointJSON, err := runtime.Encode(api.Codecs.LegacyCodec(v1.SchemeGroupVersion), endpointTemplate)
+		if err != nil {
+			t.Fatalf("Failed creating endpoint JSON: %v", err)
+		}
+		if _, err := patchEndpoint(endpointJSON); !apierrors.IsInvalid(err) {
+			t.Errorf("Expected error, got %#v", err)
+		}
+	}
+
+	// Make sure patch complains about a mismatched name
+	{
+		endpointTemplate.Name = "changedname"
+		endpointTemplate.UID = ""
+		endpointTemplate.ResourceVersion = ""
+		endpointJSON, err := runtime.Encode(api.Codecs.LegacyCodec(v1.SchemeGroupVersion), endpointTemplate)
+		if err != nil {
+			t.Fatalf("Failed creating endpoint JSON: %v", err)
+		}
+		if _, err := patchEndpoint(endpointJSON); !apierrors.IsBadRequest(err) {
+			t.Errorf("Expected error, got %#v", err)
+		}
+	}
+
+	// Make sure patch containing originally submitted JSON is accepted
+	{
+		endpointTemplate.Name = ""
+		endpointTemplate.UID = ""
+		endpointTemplate.ResourceVersion = ""
+		endpointJSON, err := runtime.Encode(api.Codecs.LegacyCodec(v1.SchemeGroupVersion), endpointTemplate)
+		if err != nil {
+			t.Fatalf("Failed creating endpoint JSON: %v", err)
+		}
+		if _, err := patchEndpoint(endpointJSON); err != nil {
+			t.Errorf("Failed patching endpoint: %v", err)
+		}
+	}
+}
+
+func TestAPIVersions(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	c := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	clientVersion := c.Core().RESTClient().APIVersion().String()
+	g, err := c.Discovery().ServerGroups()
+	if err != nil {
+		t.Fatalf("Failed to get api versions: %v", err)
+	}
+	versions := metav1.ExtractGroupVersions(g)
+
+	// Verify that the server supports the API version used by the client.
+	for _, version := range versions {
+		if version == clientVersion {
+			return
+		}
+	}
+	t.Errorf("Server does not support APIVersion used by client. Server supported APIVersions: '%v', client APIVersion: '%v'", versions, clientVersion)
+}
+
+func TestSingleWatch(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("single-watch", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	mkEvent := func(i int) *v1.Event {
+		name := fmt.Sprintf("event-%v", i)
+		return &v1.Event{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: ns.Name,
+				Name:      name,
+			},
+			InvolvedObject: v1.ObjectReference{
+				Namespace: ns.Name,
+				Name:      name,
+			},
+			Reason: fmt.Sprintf("event %v", i),
+		}
+	}
+
+	rv1 := ""
+	for i := 0; i < 10; i++ {
+		event := mkEvent(i)
+		got, err := client.Core().Events(ns.Name).Create(event)
+		if err != nil {
+			t.Fatalf("Failed creating event %#q: %v", event, err)
+		}
+		if rv1 == "" {
+			rv1 = got.ResourceVersion
+			if rv1 == "" {
+				t.Fatal("did not get a resource version.")
+			}
+		}
+		t.Logf("Created event %#v", got.ObjectMeta)
+	}
+
+	w, err := client.Core().RESTClient().Get().
+		Namespace(ns.Name).
+		Resource("events").
+		VersionedParams(&metav1.ListOptions{
+			ResourceVersion: rv1,
+			Watch:           true,
+			FieldSelector:   fields.OneTermEqualSelector("metadata.name", "event-9").String(),
+		}, metav1.ParameterCodec).
+		Watch()
+
+	if err != nil {
+		t.Fatalf("Failed watch: %v", err)
+	}
+	defer w.Stop()
+
+	select {
+	case <-time.After(wait.ForeverTestTimeout):
+		t.Fatalf("watch took longer than %s", wait.ForeverTestTimeout.String())
+	case got, ok := <-w.ResultChan():
+		if !ok {
+			t.Fatal("Watch channel closed unexpectedly.")
+		}
+
+		// We expect to see an ADD of event-9 and only event-9. (This
+		// catches a bug where all the events would have been sent down
+		// the channel.)
+		if e, a := watch.Added, got.Type; e != a {
+			t.Errorf("Wanted %v, got %v", e, a)
+		}
+		switch o := got.Object.(type) {
+		case *v1.Event:
+			if e, a := "event-9", o.Name; e != a {
+				t.Errorf("Wanted %v, got %v", e, a)
+			}
+		default:
+			t.Fatalf("Unexpected watch event containing object %#q", got)
+		}
+	}
+}
+
+func TestMultiWatch(t *testing.T) {
+	// Disable this test as long as it demonstrates a problem.
+	// TODO: Reenable this test when we get #6059 resolved.
+	t.Skip()
+
+	const watcherCount = 50
+	rt.GOMAXPROCS(watcherCount)
+
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("multi-watch", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	dummyEvent := func(i int) *v1.Event {
+		name := fmt.Sprintf("unrelated-%v", i)
+		return &v1.Event{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      fmt.Sprintf("%v.%x", name, time.Now().UnixNano()),
+				Namespace: ns.Name,
+			},
+			InvolvedObject: v1.ObjectReference{
+				Name:      name,
+				Namespace: ns.Name,
+			},
+			Reason: fmt.Sprintf("unrelated change %v", i),
+		}
+	}
+
+	type timePair struct {
+		t    time.Time
+		name string
+	}
+
+	receivedTimes := make(chan timePair, watcherCount*2)
+	watchesStarted := sync.WaitGroup{}
+
+	// make a bunch of pods and watch them
+	for i := 0; i < watcherCount; i++ {
+		watchesStarted.Add(1)
+		name := fmt.Sprintf("multi-watch-%v", i)
+		got, err := client.Core().Pods(ns.Name).Create(&v1.Pod{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:   name,
+				Labels: labels.Set{"watchlabel": name},
+			},
+			Spec: v1.PodSpec{
+				Containers: []v1.Container{{
+					Name:  "pause",
+					Image: e2e.GetPauseImageName(client),
+				}},
+			},
+		})
+
+		if err != nil {
+			t.Fatalf("Couldn't make %v: %v", name, err)
+		}
+		go func(name, rv string) {
+			options := metav1.ListOptions{
+				LabelSelector:   labels.Set{"watchlabel": name}.AsSelector().String(),
+				ResourceVersion: rv,
+			}
+			w, err := client.Core().Pods(ns.Name).Watch(options)
+			if err != nil {
+				panic(fmt.Sprintf("watch error for %v: %v", name, err))
+			}
+			defer w.Stop()
+			watchesStarted.Done()
+			e, ok := <-w.ResultChan() // should get the update (that we'll do below)
+			if !ok {
+				panic(fmt.Sprintf("%v ended early?", name))
+			}
+			if e.Type != watch.Modified {
+				panic(fmt.Sprintf("Got unexpected watch notification:\n%v: %+v %+v", name, e, e.Object))
+			}
+			receivedTimes <- timePair{time.Now(), name}
+		}(name, got.ObjectMeta.ResourceVersion)
+	}
+	log.Printf("%v: %v pods made and watchers started", time.Now(), watcherCount)
+
+	// wait for watches to start before we start spamming the system with
+	// objects below, otherwise we'll hit the watch window restriction.
+	watchesStarted.Wait()
+
+	const (
+		useEventsAsUnrelatedType = false
+		usePodsAsUnrelatedType   = true
+	)
+
+	// make a bunch of unrelated changes in parallel
+	if useEventsAsUnrelatedType {
+		const unrelatedCount = 3000
+		var wg sync.WaitGroup
+		defer wg.Wait()
+		changeToMake := make(chan int, unrelatedCount*2)
+		changeMade := make(chan int, unrelatedCount*2)
+		go func() {
+			for i := 0; i < unrelatedCount; i++ {
+				changeToMake <- i
+			}
+			close(changeToMake)
+		}()
+		for i := 0; i < 50; i++ {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				for {
+					i, ok := <-changeToMake
+					if !ok {
+						return
+					}
+					if _, err := client.Core().Events(ns.Name).Create(dummyEvent(i)); err != nil {
+						panic(fmt.Sprintf("couldn't make an event: %v", err))
+					}
+					changeMade <- i
+				}
+			}()
+		}
+
+		for i := 0; i < 2000; i++ {
+			<-changeMade
+			if (i+1)%50 == 0 {
+				log.Printf("%v: %v unrelated changes made", time.Now(), i+1)
+			}
+		}
+	}
+	if usePodsAsUnrelatedType {
+		const unrelatedCount = 3000
+		var wg sync.WaitGroup
+		defer wg.Wait()
+		changeToMake := make(chan int, unrelatedCount*2)
+		changeMade := make(chan int, unrelatedCount*2)
+		go func() {
+			for i := 0; i < unrelatedCount; i++ {
+				changeToMake <- i
+			}
+			close(changeToMake)
+		}()
+		for i := 0; i < 50; i++ {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				for {
+					i, ok := <-changeToMake
+					if !ok {
+						return
+					}
+					name := fmt.Sprintf("unrelated-%v", i)
+					_, err := client.Core().Pods(ns.Name).Create(&v1.Pod{
+						ObjectMeta: metav1.ObjectMeta{
+							Name: name,
+						},
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{{
+								Name:  "nothing",
+								Image: e2e.GetPauseImageName(client),
+							}},
+						},
+					})
+
+					if err != nil {
+						panic(fmt.Sprintf("couldn't make unrelated pod: %v", err))
+					}
+					changeMade <- i
+				}
+			}()
+		}
+
+		for i := 0; i < 2000; i++ {
+			<-changeMade
+			if (i+1)%50 == 0 {
+				log.Printf("%v: %v unrelated changes made", time.Now(), i+1)
+			}
+		}
+	}
+
+	// Now we still have changes being made in parallel, but at least 1000 have been made.
+	// Make some updates to send down the watches.
+	sentTimes := make(chan timePair, watcherCount*2)
+	for i := 0; i < watcherCount; i++ {
+		go func(i int) {
+			name := fmt.Sprintf("multi-watch-%v", i)
+			pod, err := client.Core().Pods(ns.Name).Get(name, metav1.GetOptions{})
+			if err != nil {
+				panic(fmt.Sprintf("Couldn't get %v: %v", name, err))
+			}
+			pod.Spec.Containers[0].Image = e2e.GetPauseImageName(client)
+			sentTimes <- timePair{time.Now(), name}
+			if _, err := client.Core().Pods(ns.Name).Update(pod); err != nil {
+				panic(fmt.Sprintf("Couldn't make %v: %v", name, err))
+			}
+		}(i)
+	}
+
+	sent := map[string]time.Time{}
+	for i := 0; i < watcherCount; i++ {
+		tp := <-sentTimes
+		sent[tp.name] = tp.t
+	}
+	log.Printf("all changes made")
+	dur := map[string]time.Duration{}
+	for i := 0; i < watcherCount; i++ {
+		tp := <-receivedTimes
+		delta := tp.t.Sub(sent[tp.name])
+		dur[tp.name] = delta
+		log.Printf("%v: %v", tp.name, delta)
+	}
+	log.Printf("all watches ended")
+	t.Errorf("durations: %v", dur)
+}
+
+func runSelfLinkTestOnNamespace(t *testing.T, c clientset.Interface, namespace string) {
+	podBody := v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "selflinktest",
+			Namespace: namespace,
+			Labels: map[string]string{
+				"name": "selflinktest",
+			},
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{Name: "name", Image: "image"},
+			},
+		},
+	}
+	pod, err := c.Core().Pods(namespace).Create(&podBody)
+	if err != nil {
+		t.Fatalf("Failed creating selflinktest pod: %v", err)
+	}
+	if err = c.Core().RESTClient().Get().RequestURI(pod.SelfLink).Do().Into(pod); err != nil {
+		t.Errorf("Failed listing pod with supplied self link '%v': %v", pod.SelfLink, err)
+	}
+
+	podList, err := c.Core().Pods(namespace).List(metav1.ListOptions{})
+	if err != nil {
+		t.Errorf("Failed listing pods: %v", err)
+	}
+
+	if err = c.Core().RESTClient().Get().RequestURI(podList.SelfLink).Do().Into(podList); err != nil {
+		t.Errorf("Failed listing pods with supplied self link '%v': %v", podList.SelfLink, err)
+	}
+
+	found := false
+	for i := range podList.Items {
+		item := &podList.Items[i]
+		if item.Name != "selflinktest" {
+			continue
+		}
+		found = true
+		err = c.Core().RESTClient().Get().RequestURI(item.SelfLink).Do().Into(pod)
+		if err != nil {
+			t.Errorf("Failed listing pod with supplied self link '%v': %v", item.SelfLink, err)
+		}
+		break
+	}
+	if !found {
+		t.Errorf("never found selflinktest pod in namespace %s", namespace)
+	}
+}
+
+func TestSelfLinkOnNamespace(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("selflink", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	c := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	runSelfLinkTestOnNamespace(t, c, ns.Name)
+}

vendor/k8s.io/kubernetes/test/integration/client/dynamic_client_test.go

@@ -0,0 +1,156 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package client
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/dynamic"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestDynamicClient(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("dynamic-client", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	gv := testapi.Groups[v1.GroupName].GroupVersion()
+	config := &restclient.Config{
+		Host:          s.URL,
+		ContentConfig: restclient.ContentConfig{GroupVersion: gv},
+	}
+
+	client := clientset.NewForConfigOrDie(config)
+	dynamicClient, err := dynamic.NewClient(config)
+	_ = dynamicClient
+	if err != nil {
+		t.Fatalf("unexpected error creating dynamic client: %v", err)
+	}
+
+	// Find the Pod resource
+	resources, err := client.Discovery().ServerResourcesForGroupVersion(gv.String())
+	if err != nil {
+		t.Fatalf("unexpected error listing resources: %v", err)
+	}
+
+	var resource metav1.APIResource
+	for _, r := range resources.APIResources {
+		if r.Kind == "Pod" {
+			resource = r
+			break
+		}
+	}
+
+	if len(resource.Name) == 0 {
+		t.Fatalf("could not find the pod resource in group/version %q", gv.String())
+	}
+
+	// Create a Pod with the normal client
+	pod := &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			GenerateName: "test",
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name:  "test",
+					Image: "test-image",
+				},
+			},
+		},
+	}
+
+	actual, err := client.Core().Pods(ns.Name).Create(pod)
+	if err != nil {
+		t.Fatalf("unexpected error when creating pod: %v", err)
+	}
+
+	// check dynamic list
+	obj, err := dynamicClient.Resource(&resource, ns.Name).List(metav1.ListOptions{})
+	unstructuredList, ok := obj.(*unstructured.UnstructuredList)
+	if !ok {
+		t.Fatalf("expected *unstructured.UnstructuredList, got %#v", obj)
+	}
+	if err != nil {
+		t.Fatalf("unexpected error when listing pods: %v", err)
+	}
+
+	if len(unstructuredList.Items) != 1 {
+		t.Fatalf("expected one pod, got %d", len(unstructuredList.Items))
+	}
+
+	got, err := unstructuredToPod(&unstructuredList.Items[0])
+	if err != nil {
+		t.Fatalf("unexpected error converting Unstructured to v1.Pod: %v", err)
+	}
+
+	if !reflect.DeepEqual(actual, got) {
+		t.Fatalf("unexpected pod in list. wanted %#v, got %#v", actual, got)
+	}
+
+	// check dynamic get
+	unstruct, err := dynamicClient.Resource(&resource, ns.Name).Get(actual.Name, metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("unexpected error when getting pod %q: %v", actual.Name, err)
+	}
+
+	got, err = unstructuredToPod(unstruct)
+	if err != nil {
+		t.Fatalf("unexpected error converting Unstructured to v1.Pod: %v", err)
+	}
+
+	if !reflect.DeepEqual(actual, got) {
+		t.Fatalf("unexpected pod in list. wanted %#v, got %#v", actual, got)
+	}
+
+	// delete the pod dynamically
+	err = dynamicClient.Resource(&resource, ns.Name).Delete(actual.Name, nil)
+	if err != nil {
+		t.Fatalf("unexpected error when deleting pod: %v", err)
+	}
+
+	list, err := client.Core().Pods(ns.Name).List(metav1.ListOptions{})
+	if err != nil {
+		t.Fatalf("unexpected error when listing pods: %v", err)
+	}
+
+	if len(list.Items) != 0 {
+		t.Fatalf("expected zero pods, got %d", len(list.Items))
+	}
+}
+
+func unstructuredToPod(obj *unstructured.Unstructured) (*v1.Pod, error) {
+	json, err := runtime.Encode(unstructured.UnstructuredJSONScheme, obj)
+	if err != nil {
+		return nil, err
+	}
+	pod := new(v1.Pod)
+	err = runtime.DecodeInto(testapi.Default.Codec(), json, pod)
+	pod.Kind = ""
+	pod.APIVersion = ""
+	return pod, err
+}

vendor/k8s.io/kubernetes/test/integration/client/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package client
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/configmap/BUILD

@@ -0,0 +1,38 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "configmap_test.go",
+        "main_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//pkg/api/testapi:go_default_library",
+        "//test/integration:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/configmap/configmap_test.go

@@ -0,0 +1,124 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package configmap
+
+// This file tests use of the configMap API resource.
+
+import (
+	"testing"
+
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/test/integration"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+// TestConfigMap tests apiserver-side behavior of creation of ConfigMaps and pods that consume them.
+func TestConfigMap(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	ns := framework.CreateTestingNamespace("config-map", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	DoTestConfigMap(t, client, ns)
+}
+
+func DoTestConfigMap(t *testing.T, client clientset.Interface, ns *v1.Namespace) {
+	cfg := v1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "configmap",
+			Namespace: ns.Name,
+		},
+		Data: map[string]string{
+			"data-1": "value-1",
+			"data-2": "value-2",
+			"data-3": "value-3",
+		},
+	}
+
+	if _, err := client.Core().ConfigMaps(cfg.Namespace).Create(&cfg); err != nil {
+		t.Errorf("unable to create test configMap: %v", err)
+	}
+	defer deleteConfigMapOrErrorf(t, client, cfg.Namespace, cfg.Name)
+
+	pod := &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "XXX",
+			Namespace: ns.Name,
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name:  "fake-name",
+					Image: "fakeimage",
+					Env: []v1.EnvVar{
+						{
+							Name: "CONFIG_DATA_1",
+							ValueFrom: &v1.EnvVarSource{
+								ConfigMapKeyRef: &v1.ConfigMapKeySelector{
+									LocalObjectReference: v1.LocalObjectReference{
+										Name: "configmap",
+									},
+									Key: "data-1",
+								},
+							},
+						},
+						{
+							Name: "CONFIG_DATA_2",
+							ValueFrom: &v1.EnvVarSource{
+								ConfigMapKeyRef: &v1.ConfigMapKeySelector{
+									LocalObjectReference: v1.LocalObjectReference{
+										Name: "configmap",
+									},
+									Key: "data-2",
+								},
+							},
+						}, {
+							Name: "CONFIG_DATA_3",
+							ValueFrom: &v1.EnvVarSource{
+								ConfigMapKeyRef: &v1.ConfigMapKeySelector{
+									LocalObjectReference: v1.LocalObjectReference{
+										Name: "configmap",
+									},
+									Key: "data-3",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	pod.ObjectMeta.Name = "uses-configmap"
+	if _, err := client.Core().Pods(ns.Name).Create(pod); err != nil {
+		t.Errorf("Failed to create pod: %v", err)
+	}
+	defer integration.DeletePodOrErrorf(t, client, ns.Name, pod.Name)
+}
+
+func deleteConfigMapOrErrorf(t *testing.T, c clientset.Interface, ns, name string) {
+	if err := c.Core().ConfigMaps(ns).Delete(name, nil); err != nil {
+		t.Errorf("unable to delete ConfigMap %v: %v", name, err)
+	}
+}

vendor/k8s.io/kubernetes/test/integration/configmap/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package configmap
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/defaulttolerationseconds/BUILD

@@ -0,0 +1,43 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "defaulttolerationseconds_test.go",
+        "main_test.go",
+    ],
+    tags = [
+        "etcd",
+        "integration",
+    ],
+    deps = [
+        "//pkg/api/helper:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//plugin/pkg/admission/defaulttolerationseconds:go_default_library",
+        "//plugin/pkg/scheduler/algorithm:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/defaulttolerationseconds/defaulttolerationseconds_test.go

@@ -0,0 +1,104 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package defaulttolerationseconds
+
+import (
+	"testing"
+
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/kubernetes/pkg/api/helper"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/plugin/pkg/admission/defaulttolerationseconds"
+	"k8s.io/kubernetes/plugin/pkg/scheduler/algorithm"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestAdmission(t *testing.T) {
+	masterConfig := framework.NewMasterConfig()
+	masterConfig.GenericConfig.EnableProfiling = true
+	masterConfig.GenericConfig.EnableMetrics = true
+	masterConfig.GenericConfig.AdmissionControl = defaulttolerationseconds.NewDefaultTolerationSeconds()
+	_, s, closeFn := framework.RunAMaster(masterConfig)
+	defer closeFn()
+
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	ns := framework.CreateTestingNamespace("default-toleration-seconds", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	pod := v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: ns.Name,
+			Name:      "foo",
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name:  "test",
+					Image: "an-image",
+				},
+			},
+		},
+	}
+
+	updatedPod, err := client.Core().Pods(pod.Namespace).Create(&pod)
+	if err != nil {
+		t.Fatalf("error creating pod: %v", err)
+	}
+
+	var defaultSeconds int64 = 300
+	nodeNotReady := v1.Toleration{
+		Key:               algorithm.TaintNodeNotReady,
+		Operator:          v1.TolerationOpExists,
+		Effect:            v1.TaintEffectNoExecute,
+		TolerationSeconds: &defaultSeconds,
+	}
+
+	nodeUnreachable := v1.Toleration{
+		Key:               algorithm.TaintNodeUnreachable,
+		Operator:          v1.TolerationOpExists,
+		Effect:            v1.TaintEffectNoExecute,
+		TolerationSeconds: &defaultSeconds,
+	}
+
+	found := 0
+	tolerations := updatedPod.Spec.Tolerations
+	for i := range tolerations {
+		if found == 2 {
+			break
+		}
+		if tolerations[i].MatchToleration(&nodeNotReady) {
+			if helper.Semantic.DeepEqual(tolerations[i], nodeNotReady) {
+				found++
+				continue
+			}
+		}
+		if tolerations[i].MatchToleration(&nodeUnreachable) {
+			if helper.Semantic.DeepEqual(tolerations[i], nodeUnreachable) {
+				found++
+				continue
+			}
+		}
+	}
+
+	if found != 2 {
+		t.Fatalf("unexpected tolerations: %v\n", updatedPod.Spec.Tolerations)
+	}
+}

vendor/k8s.io/kubernetes/test/integration/defaulttolerationseconds/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package defaulttolerationseconds
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/deployment/BUILD

@@ -0,0 +1,57 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "deployment_test.go",
+        "main_test.go",
+    ],
+    library = ":go_default_library",
+    deps = [
+        "//pkg/controller/deployment/util:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/api/extensions/v1beta1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+    ],
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["util.go"],
+    deps = [
+        "//pkg/api/v1/pod:go_default_library",
+        "//pkg/controller/deployment:go_default_library",
+        "//pkg/controller/deployment/util:go_default_library",
+        "//pkg/controller/replicaset:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//test/utils:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/api/extensions/v1beta1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/deployment/OWNERS

@@ -0,0 +1,7 @@
+reviewers:
+  - janetkuo
+  - kargakis
+  - tnozicka
+approvers:
+  - janetkuo
+  - kargakis

vendor/k8s.io/kubernetes/test/integration/deployment/deployment_test.go

@@ -0,0 +1,321 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deployment
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	deploymentutil "k8s.io/kubernetes/pkg/controller/deployment/util"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestNewDeployment(t *testing.T) {
+	s, closeFn, rm, dc, informers, c := dcSetup(t)
+	defer closeFn()
+	name := "test-new-deployment"
+	ns := framework.CreateTestingNamespace(name, s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	replicas := int32(20)
+	tester := &deploymentTester{t: t, c: c, deployment: newDeployment(name, ns.Name, replicas)}
+	tester.deployment.Spec.MinReadySeconds = 4
+
+	tester.deployment.Annotations = map[string]string{"test": "should-copy-to-replica-set", v1.LastAppliedConfigAnnotation: "should-not-copy-to-replica-set"}
+	var err error
+	tester.deployment, err = c.ExtensionsV1beta1().Deployments(ns.Name).Create(tester.deployment)
+	if err != nil {
+		t.Fatalf("failed to create deployment %s: %v", tester.deployment.Name, err)
+	}
+
+	// Start informer and controllers
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+	informers.Start(stopCh)
+	go rm.Run(5, stopCh)
+	go dc.Run(5, stopCh)
+
+	// Wait for the Deployment to be updated to revision 1
+	if err := tester.waitForDeploymentRevisionAndImage("1", fakeImage); err != nil {
+		t.Fatal(err)
+	}
+
+	// Make sure the Deployment status becomes valid while manually marking Deployment pods as ready at the same time
+	if err := tester.waitForDeploymentStatusValidAndMarkPodsReady(); err != nil {
+		t.Fatal(err)
+	}
+
+	// Check new RS annotations
+	newRS, err := tester.expectNewReplicaSet()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if newRS.Annotations["test"] != "should-copy-to-replica-set" {
+		t.Errorf("expected new ReplicaSet annotations copied from Deployment %s, got: %v", tester.deployment.Name, newRS.Annotations)
+	}
+	if newRS.Annotations[v1.LastAppliedConfigAnnotation] != "" {
+		t.Errorf("expected new ReplicaSet last-applied annotation not copied from Deployment %s", tester.deployment.Name)
+	}
+}
+
+// selectors are IMMUTABLE for all API versions except apps/v1beta1 and extensions/v1beta1
+func TestDeploymentSelectorImmutability(t *testing.T) {
+	s, closeFn, c := dcSimpleSetup(t)
+	defer closeFn()
+	name := "test-deployment-selector-immutability"
+	ns := framework.CreateTestingNamespace(name, s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	tester := &deploymentTester{t: t, c: c, deployment: newDeployment(name, ns.Name, int32(20))}
+	deploymentExtensionsV1beta1, err := c.ExtensionsV1beta1().Deployments(ns.Name).Create(tester.deployment)
+	if err != nil {
+		t.Fatalf("failed to create extensions/v1beta1 deployment %s: %v", tester.deployment.Name, err)
+	}
+
+	// test to ensure extensions/v1beta1 selector is mutable
+	newSelectorLabels := map[string]string{"name_extensions_v1beta1": "test_extensions_v1beta1"}
+	deploymentExtensionsV1beta1.Spec.Selector.MatchLabels = newSelectorLabels
+	deploymentExtensionsV1beta1.Spec.Template.Labels = newSelectorLabels
+	updatedDeploymentExtensionsV1beta1, err := c.ExtensionsV1beta1().Deployments(ns.Name).Update(deploymentExtensionsV1beta1)
+	if err != nil {
+		t.Fatalf("failed to update extensions/v1beta1 deployment %s: %v", deploymentExtensionsV1beta1.Name, err)
+	}
+	if !reflect.DeepEqual(updatedDeploymentExtensionsV1beta1.Spec.Selector.MatchLabels, newSelectorLabels) {
+		t.Errorf("selector should be changed for extensions/v1beta1, expected: %v, got: %v", newSelectorLabels, updatedDeploymentExtensionsV1beta1.Spec.Selector.MatchLabels)
+	}
+
+	// test to ensure apps/v1beta1 selector is mutable
+	deploymentAppsV1beta1, err := c.AppsV1beta1().Deployments(ns.Name).Get(updatedDeploymentExtensionsV1beta1.Name, metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("failed to get apps/v1beta1 deployment %s: %v", updatedDeploymentExtensionsV1beta1.Name, err)
+	}
+
+	newSelectorLabels = map[string]string{"name_apps_v1beta1": "test_apps_v1beta1"}
+	deploymentAppsV1beta1.Spec.Selector.MatchLabels = newSelectorLabels
+	deploymentAppsV1beta1.Spec.Template.Labels = newSelectorLabels
+	updatedDeploymentAppsV1beta1, err := c.AppsV1beta1().Deployments(ns.Name).Update(deploymentAppsV1beta1)
+	if err != nil {
+		t.Fatalf("failed to update apps/v1beta1 deployment %s: %v", deploymentAppsV1beta1.Name, err)
+	}
+	if !reflect.DeepEqual(updatedDeploymentAppsV1beta1.Spec.Selector.MatchLabels, newSelectorLabels) {
+		t.Errorf("selector should be changed for apps/v1beta1, expected: %v, got: %v", newSelectorLabels, updatedDeploymentAppsV1beta1.Spec.Selector.MatchLabels)
+	}
+
+	// test to ensure apps/v1beta2 selector is immutable
+	deploymentAppsV1beta2, err := c.AppsV1beta2().Deployments(ns.Name).Get(updatedDeploymentAppsV1beta1.Name, metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("failed to get apps/v1beta2 deployment %s: %v", updatedDeploymentAppsV1beta1.Name, err)
+	}
+	newSelectorLabels = map[string]string{"name_apps_v1beta2": "test_apps_v1beta2"}
+	deploymentAppsV1beta2.Spec.Selector.MatchLabels = newSelectorLabels
+	deploymentAppsV1beta2.Spec.Template.Labels = newSelectorLabels
+	_, err = c.AppsV1beta2().Deployments(ns.Name).Update(deploymentAppsV1beta2)
+	if err == nil {
+		t.Fatalf("failed to provide validation error when changing immutable selector when updating apps/v1beta2 deployment %s", deploymentAppsV1beta2.Name)
+	}
+	expectedErrType := "Invalid value"
+	expectedErrDetail := "field is immutable"
+	if !strings.Contains(err.Error(), expectedErrType) || !strings.Contains(err.Error(), expectedErrDetail) {
+		t.Errorf("error message does not match, expected type: %s, expected detail: %s, got: %s", expectedErrType, expectedErrDetail, err.Error())
+	}
+}
+
+// Paused deployment should not start new rollout
+func TestPausedDeployment(t *testing.T) {
+	s, closeFn, rm, dc, informers, c := dcSetup(t)
+	defer closeFn()
+	name := "test-paused-deployment"
+	ns := framework.CreateTestingNamespace(name, s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	replicas := int32(1)
+	tester := &deploymentTester{t: t, c: c, deployment: newDeployment(name, ns.Name, replicas)}
+	tester.deployment.Spec.Paused = true
+	tgps := int64(1)
+	tester.deployment.Spec.Template.Spec.TerminationGracePeriodSeconds = &tgps
+
+	var err error
+	tester.deployment, err = c.ExtensionsV1beta1().Deployments(ns.Name).Create(tester.deployment)
+	if err != nil {
+		t.Fatalf("failed to create deployment %s: %v", tester.deployment.Name, err)
+	}
+
+	// Start informer and controllers
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+	informers.Start(stopCh)
+	go rm.Run(5, stopCh)
+	go dc.Run(5, stopCh)
+
+	// Verify that the paused deployment won't create new replica set.
+	if err := tester.expectNoNewReplicaSet(); err != nil {
+		t.Fatal(err)
+	}
+
+	// Resume the deployment
+	tester.deployment, err = tester.updateDeployment(resumeFn())
+	if err != nil {
+		t.Fatalf("failed to resume deployment %s: %v", tester.deployment.Name, err)
+	}
+
+	// Wait for the controller to notice the resume.
+	if err := tester.waitForObservedDeployment(tester.deployment.Generation); err != nil {
+		t.Fatal(err)
+	}
+
+	// Wait for the Deployment to be updated to revision 1
+	if err := tester.waitForDeploymentRevisionAndImage("1", fakeImage); err != nil {
+		t.Fatal(err)
+	}
+
+	// Make sure the Deployment status becomes valid while manually marking Deployment pods as ready at the same time
+	if err := tester.waitForDeploymentStatusValidAndMarkPodsReady(); err != nil {
+		t.Fatal(err)
+	}
+
+	// A new replicaset should be created.
+	if _, err := tester.expectNewReplicaSet(); err != nil {
+		t.Fatal(err)
+	}
+
+	// Pause the deployment.
+	// The paused deployment shouldn't trigger a new rollout.
+	tester.deployment, err = tester.updateDeployment(pauseFn())
+	if err != nil {
+		t.Fatalf("failed to pause deployment %s: %v", tester.deployment.Name, err)
+	}
+
+	// Wait for the controller to notice the pause.
+	if err := tester.waitForObservedDeployment(tester.deployment.Generation); err != nil {
+		t.Fatal(err)
+	}
+
+	// Update the deployment template
+	newTGPS := int64(0)
+	tester.deployment, err = tester.updateDeployment(func(update *v1beta1.Deployment) {
+		update.Spec.Template.Spec.TerminationGracePeriodSeconds = &newTGPS
+	})
+	if err != nil {
+		t.Fatalf("failed updating template of deployment %s: %v", tester.deployment.Name, err)
+	}
+
+	// Wait for the controller to notice the rollout.
+	if err := tester.waitForObservedDeployment(tester.deployment.Generation); err != nil {
+		t.Fatal(err)
+	}
+
+	// Verify that the paused deployment won't create new replica set.
+	if err := tester.expectNoNewReplicaSet(); err != nil {
+		t.Fatal(err)
+	}
+
+	_, allOldRs, err := deploymentutil.GetOldReplicaSets(tester.deployment, c.ExtensionsV1beta1())
+	if err != nil {
+		t.Fatalf("failed retrieving old replicasets of deployment %s: %v", tester.deployment.Name, err)
+	}
+	if len(allOldRs) != 1 {
+		t.Errorf("expected an old replica set, got %v", allOldRs)
+	}
+	if *allOldRs[0].Spec.Template.Spec.TerminationGracePeriodSeconds == newTGPS {
+		t.Errorf("TerminationGracePeriodSeconds on the replica set should be %d, got %d", tgps, newTGPS)
+	}
+}
+
+// Paused deployment can be scaled
+func TestScalePausedDeployment(t *testing.T) {
+	s, closeFn, rm, dc, informers, c := dcSetup(t)
+	defer closeFn()
+	name := "test-scale-paused-deployment"
+	ns := framework.CreateTestingNamespace(name, s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	replicas := int32(1)
+	tester := &deploymentTester{t: t, c: c, deployment: newDeployment(name, ns.Name, replicas)}
+	tgps := int64(1)
+	tester.deployment.Spec.Template.Spec.TerminationGracePeriodSeconds = &tgps
+
+	var err error
+	tester.deployment, err = c.ExtensionsV1beta1().Deployments(ns.Name).Create(tester.deployment)
+	if err != nil {
+		t.Fatalf("failed to create deployment %s: %v", tester.deployment.Name, err)
+	}
+
+	// Start informer and controllers
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+	informers.Start(stopCh)
+	go rm.Run(5, stopCh)
+	go dc.Run(5, stopCh)
+
+	// Wait for the Deployment to be updated to revision 1
+	if err := tester.waitForDeploymentRevisionAndImage("1", fakeImage); err != nil {
+		t.Fatal(err)
+	}
+
+	// Make sure the Deployment status becomes valid while manually marking Deployment pods as ready at the same time
+	if err := tester.waitForDeploymentStatusValidAndMarkPodsReady(); err != nil {
+		t.Fatal(err)
+	}
+
+	// A new replicaset should be created.
+	if _, err := tester.expectNewReplicaSet(); err != nil {
+		t.Fatal(err)
+	}
+
+	// Pause the deployment.
+	tester.deployment, err = tester.updateDeployment(pauseFn())
+	if err != nil {
+		t.Fatalf("failed to pause deployment %s: %v", tester.deployment.Name, err)
+	}
+
+	// Wait for the controller to notice the scale.
+	if err := tester.waitForObservedDeployment(tester.deployment.Generation); err != nil {
+		t.Fatal(err)
+	}
+
+	// Scale the paused deployment.
+	newReplicas := int32(10)
+	tester.deployment, err = tester.updateDeployment(func(update *v1beta1.Deployment) {
+		update.Spec.Replicas = &newReplicas
+	})
+	if err != nil {
+		t.Fatalf("failed updating deployment %s: %v", tester.deployment.Name, err)
+	}
+
+	// Wait for the controller to notice the scale.
+	if err := tester.waitForObservedDeployment(tester.deployment.Generation); err != nil {
+		t.Fatal(err)
+	}
+
+	// Verify that the new replicaset is scaled.
+	rs, err := tester.expectNewReplicaSet()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if *rs.Spec.Replicas != newReplicas {
+		t.Errorf("expected new replicaset replicas = %d, got %d", newReplicas, *rs.Spec.Replicas)
+	}
+
+	// Make sure the Deployment status becomes valid while manually marking Deployment pods as ready at the same time
+	if err := tester.waitForDeploymentStatusValidAndMarkPodsReady(); err != nil {
+		t.Fatal(err)
+	}
+}

vendor/k8s.io/kubernetes/test/integration/deployment/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deployment
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/deployment/util.go

@@ -0,0 +1,262 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deployment
+
+import (
+	"fmt"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/informers"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	podutil "k8s.io/kubernetes/pkg/api/v1/pod"
+	"k8s.io/kubernetes/pkg/controller/deployment"
+	deploymentutil "k8s.io/kubernetes/pkg/controller/deployment/util"
+	"k8s.io/kubernetes/pkg/controller/replicaset"
+	"k8s.io/kubernetes/test/integration/framework"
+	testutil "k8s.io/kubernetes/test/utils"
+)
+
+const (
+	pollInterval = 1 * time.Second
+	pollTimeout  = 60 * time.Second
+
+	fakeImageName = "fake-name"
+	fakeImage     = "fakeimage"
+)
+
+type deploymentTester struct {
+	t          *testing.T
+	c          clientset.Interface
+	deployment *v1beta1.Deployment
+}
+
+func testLabels() map[string]string {
+	return map[string]string{"name": "test"}
+}
+
+// newDeployment returns a RollingUpdate Deployment with with a fake container image
+func newDeployment(name, ns string, replicas int32) *v1beta1.Deployment {
+	return &v1beta1.Deployment{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Deployment",
+			APIVersion: "extensions/v1beta1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: ns,
+			Name:      name,
+		},
+		Spec: v1beta1.DeploymentSpec{
+			Replicas: &replicas,
+			Selector: &metav1.LabelSelector{MatchLabels: testLabels()},
+			Strategy: v1beta1.DeploymentStrategy{
+				Type: v1beta1.RollingUpdateDeploymentStrategyType,
+			},
+			Template: v1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: testLabels(),
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{
+							Name:  fakeImageName,
+							Image: fakeImage,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+// dcSetup sets up necessities for Deployment integration test, including master, apiserver, informers, and clientset
+func dcSetup(t *testing.T) (*httptest.Server, framework.CloseFunc, *replicaset.ReplicaSetController, *deployment.DeploymentController, informers.SharedInformerFactory, clientset.Interface) {
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	_, s, closeFn := framework.RunAMaster(masterConfig)
+
+	config := restclient.Config{Host: s.URL}
+	clientSet, err := clientset.NewForConfig(&config)
+	if err != nil {
+		t.Fatalf("error in create clientset: %v", err)
+	}
+	resyncPeriod := 12 * time.Hour
+	informers := informers.NewSharedInformerFactory(clientset.NewForConfigOrDie(restclient.AddUserAgent(&config, "deployment-informers")), resyncPeriod)
+
+	dc := deployment.NewDeploymentController(
+		informers.Extensions().V1beta1().Deployments(),
+		informers.Extensions().V1beta1().ReplicaSets(),
+		informers.Core().V1().Pods(),
+		clientset.NewForConfigOrDie(restclient.AddUserAgent(&config, "deployment-controller")),
+	)
+	rm := replicaset.NewReplicaSetController(
+		informers.Extensions().V1beta1().ReplicaSets(),
+		informers.Core().V1().Pods(),
+		clientset.NewForConfigOrDie(restclient.AddUserAgent(&config, "replicaset-controller")),
+		replicaset.BurstReplicas,
+	)
+	return s, closeFn, rm, dc, informers, clientSet
+}
+
+// dcSimpleSetup sets up necessities for Deployment integration test, including master, apiserver,
+// and clientset, but not controllers and informers
+func dcSimpleSetup(t *testing.T) (*httptest.Server, framework.CloseFunc, clientset.Interface) {
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	_, s, closeFn := framework.RunAMaster(masterConfig)
+
+	config := restclient.Config{Host: s.URL}
+	clientSet, err := clientset.NewForConfig(&config)
+	if err != nil {
+		t.Fatalf("error in create clientset: %v", err)
+	}
+	return s, closeFn, clientSet
+}
+
+// addPodConditionReady sets given pod status to ready at given time
+func addPodConditionReady(pod *v1.Pod, time metav1.Time) {
+	pod.Status = v1.PodStatus{
+		Phase: v1.PodRunning,
+		Conditions: []v1.PodCondition{
+			{
+				Type:               v1.PodReady,
+				Status:             v1.ConditionTrue,
+				LastTransitionTime: time,
+			},
+		},
+	}
+}
+
+func (d *deploymentTester) waitForDeploymentRevisionAndImage(revision, image string) error {
+	if err := testutil.WaitForDeploymentRevisionAndImage(d.c, d.deployment.Namespace, d.deployment.Name, revision, image, d.t.Logf, pollInterval, pollTimeout); err != nil {
+		return fmt.Errorf("failed to wait for Deployment revision %s: %v", d.deployment.Name, err)
+	}
+	return nil
+}
+
+// markAllPodsReady manually updates all Deployment pods status to ready
+func (d *deploymentTester) markAllPodsReady() {
+	ns := d.deployment.Namespace
+	selector, err := metav1.LabelSelectorAsSelector(d.deployment.Spec.Selector)
+	if err != nil {
+		d.t.Fatalf("failed to parse Deployment selector: %v", err)
+	}
+	var readyPods int32
+	err = wait.Poll(100*time.Millisecond, pollTimeout, func() (bool, error) {
+		readyPods = 0
+		pods, err := d.c.Core().Pods(ns).List(metav1.ListOptions{LabelSelector: selector.String()})
+		if err != nil {
+			d.t.Logf("failed to list Deployment pods, will retry later: %v", err)
+			return false, nil
+		}
+		for i := range pods.Items {
+			pod := pods.Items[i]
+			if podutil.IsPodReady(&pod) {
+				readyPods++
+				continue
+			}
+			addPodConditionReady(&pod, metav1.Now())
+			if _, err = d.c.Core().Pods(ns).UpdateStatus(&pod); err != nil {
+				d.t.Logf("failed to update Deployment pod %s, will retry later: %v", pod.Name, err)
+			} else {
+				readyPods++
+			}
+		}
+		if readyPods >= *d.deployment.Spec.Replicas {
+			return true, nil
+		}
+		return false, nil
+	})
+	if err != nil {
+		d.t.Fatalf("failed to mark all Deployment pods to ready: %v", err)
+	}
+}
+
+func (d *deploymentTester) waitForDeploymentStatusValid() error {
+	return testutil.WaitForDeploymentStatusValid(d.c, d.deployment, d.t.Logf, pollInterval, pollTimeout)
+}
+
+// waitForDeploymentStatusValidAndMarkPodsReady waits for the Deployment status to become valid
+// while marking all Deployment pods as ready at the same time.
+func (d *deploymentTester) waitForDeploymentStatusValidAndMarkPodsReady() error {
+	// Manually mark all Deployment pods as ready in a separate goroutine
+	go d.markAllPodsReady()
+
+	// Make sure the Deployment status is valid while Deployment pods are becoming ready
+	err := d.waitForDeploymentStatusValid()
+	if err != nil {
+		return fmt.Errorf("failed to wait for Deployment status %s: %v", d.deployment.Name, err)
+	}
+	return nil
+}
+
+func (d *deploymentTester) updateDeployment(applyUpdate testutil.UpdateDeploymentFunc) (*v1beta1.Deployment, error) {
+	return testutil.UpdateDeploymentWithRetries(d.c, d.deployment.Namespace, d.deployment.Name, applyUpdate, d.t.Logf)
+}
+
+func (d *deploymentTester) waitForObservedDeployment(desiredGeneration int64) error {
+	if err := testutil.WaitForObservedDeployment(d.c, d.deployment.Namespace, d.deployment.Name, desiredGeneration); err != nil {
+		return fmt.Errorf("failed waiting for ObservedGeneration of deployment %s to become %d: %v", d.deployment.Name, desiredGeneration, err)
+	}
+	return nil
+}
+
+func (d *deploymentTester) getNewReplicaSet() (*v1beta1.ReplicaSet, error) {
+	rs, err := deploymentutil.GetNewReplicaSet(d.deployment, d.c.ExtensionsV1beta1())
+	if err != nil {
+		return nil, fmt.Errorf("failed retrieving new replicaset of deployment %s: %v", d.deployment.Name, err)
+	}
+	return rs, nil
+}
+
+func (d *deploymentTester) expectNoNewReplicaSet() error {
+	rs, err := d.getNewReplicaSet()
+	if err != nil {
+		return err
+	}
+	if rs != nil {
+		return fmt.Errorf("expected deployment %s not to create a new replicaset, got %v", d.deployment.Name, rs)
+	}
+	return nil
+}
+
+func (d *deploymentTester) expectNewReplicaSet() (*v1beta1.ReplicaSet, error) {
+	rs, err := d.getNewReplicaSet()
+	if err != nil {
+		return nil, err
+	}
+	if rs == nil {
+		return nil, fmt.Errorf("expected deployment %s to create a new replicaset, got nil", d.deployment.Name)
+	}
+	return rs, nil
+}
+
+func pauseFn() func(update *v1beta1.Deployment) {
+	return func(update *v1beta1.Deployment) {
+		update.Spec.Paused = true
+	}
+}
+
+func resumeFn() func(update *v1beta1.Deployment) {
+	return func(update *v1beta1.Deployment) {
+		update.Spec.Paused = false
+	}
+}

vendor/k8s.io/kubernetes/test/integration/doc.go

@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package integration provides integration tests for Kubernetes.Some tests require a
+// running etcd or Docker installation on the system.
+package integration // import "k8s.io/kubernetes/test/integration"

vendor/k8s.io/kubernetes/test/integration/etcd/BUILD

@@ -0,0 +1,58 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "etcd_storage_path_test.go",
+        "main_test.go",
+    ],
+    tags = [
+        "etcd",
+        "integration",
+    ],
+    deps = [
+        "//cmd/kube-apiserver/app:go_default_library",
+        "//cmd/kube-apiserver/app/options:go_default_library",
+        "//pkg/api:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//pkg/master:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/github.com/coreos/etcd/clientv3:go_default_library",
+        "//vendor/github.com/coreos/etcd/pkg/transport:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/equality:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/diff:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/server:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/storage/storagebackend:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/tools/clientcmd:go_default_library",
+        "//vendor/k8s.io/client-go/tools/clientcmd/api:go_default_library",
+        "//vendor/k8s.io/client-go/util/flowcontrol:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/etcd/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package etcd
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/evictions/BUILD

@@ -0,0 +1,44 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "evictions_test.go",
+        "main_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//pkg/controller/disruption:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/api/policy/v1beta1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/intstr:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/tools/cache:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/evictions/evictions_test.go

@@ -0,0 +1,280 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package evictions
+
+import (
+	"fmt"
+	"net/http/httptest"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/api/policy/v1beta1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/informers"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/kubernetes/pkg/controller/disruption"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+const (
+	numOfEvictions = 10
+)
+
+// TestConcurrentEvictionRequests is to make sure pod disruption budgets (PDB) controller is able to
+// handle concurrent eviction requests. Original issue:#37605
+func TestConcurrentEvictionRequests(t *testing.T) {
+	podNameFormat := "test-pod-%d"
+
+	s, closeFn, rm, informers, clientSet := rmSetup(t)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("concurrent-eviction-requests", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	stopCh := make(chan struct{})
+	informers.Start(stopCh)
+	go rm.Run(stopCh)
+	defer close(stopCh)
+
+	config := restclient.Config{Host: s.URL}
+	clientSet, err := clientset.NewForConfig(&config)
+	if err != nil {
+		t.Fatalf("Failed to create clientset: %v", err)
+	}
+
+	var gracePeriodSeconds int64 = 30
+	deleteOption := &metav1.DeleteOptions{
+		GracePeriodSeconds: &gracePeriodSeconds,
+	}
+
+	// Generate numOfEvictions pods to evict
+	for i := 0; i < numOfEvictions; i++ {
+		podName := fmt.Sprintf(podNameFormat, i)
+		pod := newPod(podName)
+
+		if _, err := clientSet.Core().Pods(ns.Name).Create(pod); err != nil {
+			t.Errorf("Failed to create pod: %v", err)
+		}
+
+		addPodConditionReady(pod)
+		if _, err := clientSet.Core().Pods(ns.Name).UpdateStatus(pod); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	waitToObservePods(t, informers.Core().V1().Pods().Informer(), numOfEvictions)
+
+	pdb := newPDB()
+	if _, err := clientSet.Policy().PodDisruptionBudgets(ns.Name).Create(pdb); err != nil {
+		t.Errorf("Failed to create PodDisruptionBudget: %v", err)
+	}
+
+	waitPDBStable(t, clientSet, numOfEvictions, ns.Name, pdb.Name)
+
+	var numberPodsEvicted uint32 = 0
+	errCh := make(chan error, 3*numOfEvictions)
+	var wg sync.WaitGroup
+	// spawn numOfEvictions goroutines to concurrently evict the pods
+	for i := 0; i < numOfEvictions; i++ {
+		wg.Add(1)
+		go func(id int, errCh chan error) {
+			defer wg.Done()
+			podName := fmt.Sprintf(podNameFormat, id)
+			eviction := newEviction(ns.Name, podName, deleteOption)
+
+			err := wait.PollImmediate(5*time.Second, 60*time.Second, func() (bool, error) {
+				e := clientSet.Policy().Evictions(ns.Name).Evict(eviction)
+				switch {
+				case errors.IsTooManyRequests(e):
+					return false, nil
+				case errors.IsConflict(e):
+					return false, fmt.Errorf("Unexpected Conflict (409) error caused by failing to handle concurrent PDB updates: %v", e)
+				case e == nil:
+					return true, nil
+				default:
+					return false, e
+				}
+			})
+
+			if err != nil {
+				errCh <- err
+				// should not return here otherwise we would leak the pod
+			}
+
+			_, err = clientSet.Core().Pods(ns.Name).Get(podName, metav1.GetOptions{})
+			switch {
+			case errors.IsNotFound(err):
+				atomic.AddUint32(&numberPodsEvicted, 1)
+				// pod was evicted and deleted so return from goroutine immediately
+				return
+			case err == nil:
+				// this shouldn't happen if the pod was evicted successfully
+				errCh <- fmt.Errorf("Pod %q is expected to be evicted", podName)
+			default:
+				errCh <- err
+			}
+
+			// delete pod which still exists due to error
+			e := clientSet.Core().Pods(ns.Name).Delete(podName, deleteOption)
+			if e != nil {
+				errCh <- e
+			}
+
+		}(i, errCh)
+	}
+
+	wg.Wait()
+
+	close(errCh)
+	var errList []error
+	if err := clientSet.Policy().PodDisruptionBudgets(ns.Name).Delete(pdb.Name, deleteOption); err != nil {
+		errList = append(errList, fmt.Errorf("Failed to delete PodDisruptionBudget: %v", err))
+	}
+	for err := range errCh {
+		errList = append(errList, err)
+	}
+	if len(errList) > 0 {
+		t.Fatal(utilerrors.NewAggregate(errList))
+	}
+
+	if atomic.LoadUint32(&numberPodsEvicted) != numOfEvictions {
+		t.Fatalf("fewer number of successful evictions than expected : %d", numberPodsEvicted)
+	}
+}
+
+func newPod(podName string) *v1.Pod {
+	return &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:   podName,
+			Labels: map[string]string{"app": "test-evictions"},
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name:  "fake-name",
+					Image: "fakeimage",
+				},
+			},
+		},
+	}
+}
+
+func addPodConditionReady(pod *v1.Pod) {
+	pod.Status = v1.PodStatus{
+		Phase: v1.PodRunning,
+		Conditions: []v1.PodCondition{
+			{
+				Type:   v1.PodReady,
+				Status: v1.ConditionTrue,
+			},
+		},
+	}
+}
+
+func newPDB() *v1beta1.PodDisruptionBudget {
+	return &v1beta1.PodDisruptionBudget{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test-pdb",
+		},
+		Spec: v1beta1.PodDisruptionBudgetSpec{
+			MinAvailable: &intstr.IntOrString{
+				Type:   intstr.Int,
+				IntVal: 0,
+			},
+			Selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{"app": "test-evictions"},
+			},
+		},
+	}
+}
+
+func newEviction(ns, evictionName string, deleteOption *metav1.DeleteOptions) *v1beta1.Eviction {
+	return &v1beta1.Eviction{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "Policy/v1beta1",
+			Kind:       "Eviction",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      evictionName,
+			Namespace: ns,
+		},
+		DeleteOptions: deleteOption,
+	}
+}
+
+func rmSetup(t *testing.T) (*httptest.Server, framework.CloseFunc, *disruption.DisruptionController, informers.SharedInformerFactory, clientset.Interface) {
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	_, s, closeFn := framework.RunAMaster(masterConfig)
+
+	config := restclient.Config{Host: s.URL}
+	clientSet, err := clientset.NewForConfig(&config)
+	if err != nil {
+		t.Fatalf("Error in create clientset: %v", err)
+	}
+	resyncPeriod := 12 * time.Hour
+	informers := informers.NewSharedInformerFactory(clientset.NewForConfigOrDie(restclient.AddUserAgent(&config, "pdb-informers")), resyncPeriod)
+
+	rm := disruption.NewDisruptionController(
+		informers.Core().V1().Pods(),
+		informers.Policy().V1beta1().PodDisruptionBudgets(),
+		informers.Core().V1().ReplicationControllers(),
+		informers.Extensions().V1beta1().ReplicaSets(),
+		informers.Extensions().V1beta1().Deployments(),
+		informers.Apps().V1beta1().StatefulSets(),
+		clientset.NewForConfigOrDie(restclient.AddUserAgent(&config, "disruption-controller")),
+	)
+	return s, closeFn, rm, informers, clientSet
+}
+
+// wait for the podInformer to observe the pods. Call this function before
+// running the RS controller to prevent the rc manager from creating new pods
+// rather than adopting the existing ones.
+func waitToObservePods(t *testing.T, podInformer cache.SharedIndexInformer, podNum int) {
+	if err := wait.PollImmediate(2*time.Second, 60*time.Second, func() (bool, error) {
+		objects := podInformer.GetIndexer().List()
+		if len(objects) == podNum {
+			return true, nil
+		}
+		return false, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func waitPDBStable(t *testing.T, clientSet clientset.Interface, podNum int32, ns, pdbName string) {
+	if err := wait.PollImmediate(2*time.Second, 60*time.Second, func() (bool, error) {
+		pdb, err := clientSet.Policy().PodDisruptionBudgets(ns).Get(pdbName, metav1.GetOptions{})
+		if err != nil {
+			return false, err
+		}
+		if pdb.Status.CurrentHealthy != podNum {
+			return false, nil
+		}
+		return true, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+}

vendor/k8s.io/kubernetes/test/integration/evictions/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package evictions
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/examples/BUILD

@@ -0,0 +1,48 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "apiserver_test.go",
+        "main_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//cmd/kube-apiserver/app:go_default_library",
+        "//cmd/kube-apiserver/app/options:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/github.com/stretchr/testify/assert:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/server:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/tools/clientcmd:go_default_library",
+        "//vendor/k8s.io/client-go/tools/clientcmd/api:go_default_library",
+        "//vendor/k8s.io/client-go/util/cert:go_default_library",
+        "//vendor/k8s.io/kube-aggregator/pkg/apis/apiregistration/v1beta1:go_default_library",
+        "//vendor/k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset:go_default_library",
+        "//vendor/k8s.io/kube-aggregator/pkg/cmd/server:go_default_library",
+        "//vendor/k8s.io/sample-apiserver/pkg/apis/wardle/v1alpha1:go_default_library",
+        "//vendor/k8s.io/sample-apiserver/pkg/cmd/server:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/examples/apiserver_test.go

@@ -0,0 +1,462 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apiserver
+
+import (
+	"crypto/x509"
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"os"
+	"path"
+	"strconv"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/wait"
+	genericapiserver "k8s.io/apiserver/pkg/server"
+	client "k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+	"k8s.io/client-go/util/cert"
+	apiregistrationv1beta1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1beta1"
+	aggregatorclient "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset"
+	kubeaggregatorserver "k8s.io/kube-aggregator/pkg/cmd/server"
+	"k8s.io/kubernetes/cmd/kube-apiserver/app"
+	"k8s.io/kubernetes/cmd/kube-apiserver/app/options"
+	"k8s.io/kubernetes/test/integration/framework"
+	"k8s.io/sample-apiserver/pkg/apis/wardle/v1alpha1"
+	sampleserver "k8s.io/sample-apiserver/pkg/cmd/server"
+)
+
+var groupVersion = v1alpha1.SchemeGroupVersion
+
+var groupVersionForDiscovery = metav1.GroupVersionForDiscovery{
+	GroupVersion: groupVersion.String(),
+	Version:      groupVersion.Version,
+}
+
+func TestAggregatedAPIServer(t *testing.T) {
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+
+	certDir, _ := ioutil.TempDir("", "test-integration-apiserver")
+	defer os.RemoveAll(certDir)
+	_, defaultServiceClusterIPRange, _ := net.ParseCIDR("10.0.0.0/24")
+	proxySigningKey, err := cert.NewPrivateKey()
+	if err != nil {
+		t.Fatal(err)
+	}
+	proxySigningCert, err := cert.NewSelfSignedCACert(cert.Config{CommonName: "front-proxy-ca"}, proxySigningKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	proxyCACertFile, _ := ioutil.TempFile(certDir, "proxy-ca.crt")
+	if err := ioutil.WriteFile(proxyCACertFile.Name(), cert.EncodeCertPEM(proxySigningCert), 0644); err != nil {
+		t.Fatal(err)
+	}
+	clientSigningKey, err := cert.NewPrivateKey()
+	if err != nil {
+		t.Fatal(err)
+	}
+	clientSigningCert, err := cert.NewSelfSignedCACert(cert.Config{CommonName: "client-ca"}, clientSigningKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	clientCACertFile, _ := ioutil.TempFile(certDir, "client-ca.crt")
+	if err := ioutil.WriteFile(clientCACertFile.Name(), cert.EncodeCertPEM(clientSigningCert), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	kubeClientConfigValue := atomic.Value{}
+	go func() {
+		for {
+			// always get a fresh port in case something claimed the old one
+			kubePort, err := framework.FindFreeLocalPort()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			kubeAPIServerOptions := options.NewServerRunOptions()
+			kubeAPIServerOptions.SecureServing.BindAddress = net.ParseIP("127.0.0.1")
+			kubeAPIServerOptions.SecureServing.BindPort = kubePort
+			kubeAPIServerOptions.SecureServing.ServerCert.CertDirectory = certDir
+			kubeAPIServerOptions.InsecureServing.BindPort = 0
+			kubeAPIServerOptions.Etcd.StorageConfig.ServerList = []string{framework.GetEtcdURL()}
+			kubeAPIServerOptions.ServiceClusterIPRange = *defaultServiceClusterIPRange
+			kubeAPIServerOptions.Authentication.RequestHeader.UsernameHeaders = []string{"X-Remote-User"}
+			kubeAPIServerOptions.Authentication.RequestHeader.GroupHeaders = []string{"X-Remote-Group"}
+			kubeAPIServerOptions.Authentication.RequestHeader.ExtraHeaderPrefixes = []string{"X-Remote-Extra-"}
+			kubeAPIServerOptions.Authentication.RequestHeader.AllowedNames = []string{"kube-aggregator"}
+			kubeAPIServerOptions.Authentication.RequestHeader.ClientCAFile = proxyCACertFile.Name()
+			kubeAPIServerOptions.Authentication.ClientCert.ClientCA = clientCACertFile.Name()
+			kubeAPIServerOptions.Authorization.Mode = "RBAC"
+
+			tunneler, proxyTransport, err := app.CreateNodeDialer(kubeAPIServerOptions)
+			if err != nil {
+				t.Fatal(err)
+			}
+			kubeAPIServerConfig, sharedInformers, versionedInformers, _, _, err := app.CreateKubeAPIServerConfig(kubeAPIServerOptions, tunneler, proxyTransport)
+			if err != nil {
+				t.Fatal(err)
+			}
+			kubeClientConfigValue.Store(kubeAPIServerConfig.GenericConfig.LoopbackClientConfig)
+
+			kubeAPIServer, err := app.CreateKubeAPIServer(kubeAPIServerConfig, genericapiserver.EmptyDelegate, sharedInformers, versionedInformers)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if err := kubeAPIServer.GenericAPIServer.PrepareRun().Run(wait.NeverStop); err != nil {
+				t.Log(err)
+			}
+			time.Sleep(100 * time.Millisecond)
+		}
+	}()
+
+	// just use json because everyone speaks it
+	err = wait.PollImmediate(100*time.Millisecond, 10*time.Second, func() (done bool, err error) {
+		obj := kubeClientConfigValue.Load()
+		if obj == nil {
+			return false, nil
+		}
+		kubeClientConfig := kubeClientConfigValue.Load().(*rest.Config)
+		kubeClientConfig.ContentType = ""
+		kubeClientConfig.AcceptContentTypes = ""
+		kubeClient, err := client.NewForConfig(kubeClientConfig)
+		if err != nil {
+			// this happens because we race the API server start
+			t.Log(err)
+			return false, nil
+		}
+		if _, err := kubeClient.Discovery().ServerVersion(); err != nil {
+			return false, nil
+		}
+		return true, nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// after this point we won't be mutating, so the race detector will be fine
+	kubeClientConfig := kubeClientConfigValue.Load().(*rest.Config)
+
+	// write a kubeconfig out for starting other API servers with delegated auth.  remember, no in-cluster config
+	adminKubeConfig := createKubeConfig(kubeClientConfig)
+	kubeconfigFile, _ := ioutil.TempFile("", "")
+	defer os.Remove(kubeconfigFile.Name())
+	clientcmd.WriteToFile(*adminKubeConfig, kubeconfigFile.Name())
+	wardleCertDir, _ := ioutil.TempDir("", "test-integration-wardle-server")
+	defer os.RemoveAll(wardleCertDir)
+	wardlePort := new(int32)
+
+	// start the wardle server to prove we can aggregate it
+	go func() {
+		for {
+			// always get a fresh port in case something claimed the old one
+			wardlePortInt, err := framework.FindFreeLocalPort()
+			if err != nil {
+				t.Fatal(err)
+			}
+			atomic.StoreInt32(wardlePort, int32(wardlePortInt))
+			wardleCmd := sampleserver.NewCommandStartWardleServer(os.Stdout, os.Stderr, stopCh)
+			wardleCmd.SetArgs([]string{
+				"--bind-address", "127.0.0.1",
+				"--secure-port", strconv.Itoa(wardlePortInt),
+				"--requestheader-username-headers=X-Remote-User",
+				"--requestheader-group-headers=X-Remote-Group",
+				"--requestheader-extra-headers-prefix=X-Remote-Extra-",
+				"--requestheader-client-ca-file=" + proxyCACertFile.Name(),
+				"--requestheader-allowed-names=kube-aggregator",
+				"--authentication-kubeconfig", kubeconfigFile.Name(),
+				"--authorization-kubeconfig", kubeconfigFile.Name(),
+				"--etcd-servers", framework.GetEtcdURL(),
+				"--cert-dir", wardleCertDir,
+				"--kubeconfig", kubeconfigFile.Name(),
+			})
+			if err := wardleCmd.Execute(); err != nil {
+				t.Log(err)
+			}
+			time.Sleep(100 * time.Millisecond)
+		}
+	}()
+
+	wardleClientConfig := rest.AnonymousClientConfig(kubeClientConfig)
+	wardleClientConfig.CAFile = path.Join(wardleCertDir, "apiserver.crt")
+	wardleClientConfig.CAData = nil
+	wardleClientConfig.ServerName = ""
+	wardleClientConfig.BearerToken = kubeClientConfig.BearerToken
+	var wardleClient client.Interface
+	err = wait.PollImmediate(100*time.Millisecond, 10*time.Second, func() (done bool, err error) {
+		wardleClientConfig.Host = fmt.Sprintf("https://127.0.0.1:%d", atomic.LoadInt32(wardlePort))
+		wardleClient, err = client.NewForConfig(wardleClientConfig)
+		if err != nil {
+			// this happens because we race the API server start
+			t.Log(err)
+			return false, nil
+		}
+		if _, err := wardleClient.Discovery().ServerVersion(); err != nil {
+			t.Log(err)
+			return false, nil
+		}
+		return true, nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// start the aggregator
+	aggregatorCertDir, _ := ioutil.TempDir("", "test-integration-aggregator")
+	defer os.RemoveAll(aggregatorCertDir)
+	proxyClientKey, err := cert.NewPrivateKey()
+	if err != nil {
+		t.Fatal(err)
+	}
+	proxyClientCert, err := cert.NewSignedCert(
+		cert.Config{
+			CommonName: "kube-aggregator",
+			Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		},
+		proxyClientKey, proxySigningCert, proxySigningKey,
+	)
+	proxyClientCertFile, _ := ioutil.TempFile(aggregatorCertDir, "proxy-client.crt")
+	proxyClientKeyFile, _ := ioutil.TempFile(aggregatorCertDir, "proxy-client.key")
+	if err := ioutil.WriteFile(proxyClientCertFile.Name(), cert.EncodeCertPEM(proxyClientCert), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := ioutil.WriteFile(proxyClientKeyFile.Name(), cert.EncodePrivateKeyPEM(proxyClientKey), 0644); err != nil {
+		t.Fatal(err)
+	}
+	aggregatorPort := new(int32)
+
+	go func() {
+		for {
+			// always get a fresh port in case something claimed the old one
+			aggregatorPortInt, err := framework.FindFreeLocalPort()
+			if err != nil {
+				t.Fatal(err)
+			}
+			atomic.StoreInt32(aggregatorPort, int32(aggregatorPortInt))
+			aggregatorCmd := kubeaggregatorserver.NewCommandStartAggregator(os.Stdout, os.Stderr, stopCh)
+			aggregatorCmd.SetArgs([]string{
+				"--bind-address", "127.0.0.1",
+				"--secure-port", strconv.Itoa(aggregatorPortInt),
+				"--requestheader-username-headers", "",
+				"--proxy-client-cert-file", proxyClientCertFile.Name(),
+				"--proxy-client-key-file", proxyClientKeyFile.Name(),
+				"--kubeconfig", kubeconfigFile.Name(),
+				"--authentication-kubeconfig", kubeconfigFile.Name(),
+				"--authorization-kubeconfig", kubeconfigFile.Name(),
+				"--etcd-servers", framework.GetEtcdURL(),
+				"--cert-dir", aggregatorCertDir,
+			})
+			if err := aggregatorCmd.Execute(); err != nil {
+				t.Log(err)
+			}
+			time.Sleep(100 * time.Millisecond)
+		}
+	}()
+
+	aggregatorClientConfig := rest.AnonymousClientConfig(kubeClientConfig)
+	aggregatorClientConfig.CAFile = path.Join(aggregatorCertDir, "apiserver.crt")
+	aggregatorClientConfig.CAData = nil
+	aggregatorClientConfig.ServerName = ""
+	aggregatorClientConfig.BearerToken = kubeClientConfig.BearerToken
+	var aggregatorDiscoveryClient client.Interface
+	err = wait.PollImmediate(100*time.Millisecond, 10*time.Second, func() (done bool, err error) {
+		aggregatorClientConfig.Host = fmt.Sprintf("https://127.0.0.1:%d", atomic.LoadInt32(aggregatorPort))
+		aggregatorDiscoveryClient, err = client.NewForConfig(aggregatorClientConfig)
+		if err != nil {
+			// this happens if we race the API server for writing the cert
+			return false, nil
+		}
+		if _, err := aggregatorDiscoveryClient.Discovery().ServerVersion(); err != nil {
+			return false, nil
+		}
+		return true, nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// now we're finally ready to test. These are what's run by defautl now
+	testAPIGroupList(t, wardleClient.Discovery().RESTClient())
+	testAPIGroup(t, wardleClient.Discovery().RESTClient())
+	testAPIResourceList(t, wardleClient.Discovery().RESTClient())
+
+	wardleCA, err := ioutil.ReadFile(wardleClientConfig.CAFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	aggregatorClient := aggregatorclient.NewForConfigOrDie(aggregatorClientConfig)
+	_, err = aggregatorClient.ApiregistrationV1beta1().APIServices().Create(&apiregistrationv1beta1.APIService{
+		ObjectMeta: metav1.ObjectMeta{Name: "v1alpha1.wardle.k8s.io"},
+		Spec: apiregistrationv1beta1.APIServiceSpec{
+			Service: &apiregistrationv1beta1.ServiceReference{
+				Namespace: "kube-wardle",
+				Name:      "api",
+			},
+			Group:                "wardle.k8s.io",
+			Version:              "v1alpha1",
+			CABundle:             wardleCA,
+			GroupPriorityMinimum: 200,
+			VersionPriority:      200,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// this is ugly, but sleep just a little bit so that the watch is probably observed.  Since nothing will actually be added to discovery
+	// (the service is missing), we don't have an external signal.
+	time.Sleep(100 * time.Millisecond)
+	if _, err := aggregatorDiscoveryClient.Discovery().ServerResources(); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = aggregatorClient.ApiregistrationV1beta1().APIServices().Create(&apiregistrationv1beta1.APIService{
+		ObjectMeta: metav1.ObjectMeta{Name: "v1."},
+		Spec: apiregistrationv1beta1.APIServiceSpec{
+			// register this as a loca service so it doesn't try to lookup the default kubernetes service
+			// which will have an unroutable IP address since its fake.
+			Group:                "",
+			Version:              "v1",
+			GroupPriorityMinimum: 100,
+			VersionPriority:      100,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// this is ugly, but sleep just a little bit so that the watch is probably observed.  Since nothing will actually be added to discovery
+	// (the service is missing), we don't have an external signal.
+	time.Sleep(100 * time.Millisecond)
+	_, err = aggregatorDiscoveryClient.Discovery().ServerResources()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// TODO figure out how to turn on enough of services and dns to run more
+}
+
+func createKubeConfig(clientCfg *rest.Config) *clientcmdapi.Config {
+	clusterNick := "cluster"
+	userNick := "user"
+	contextNick := "context"
+
+	config := clientcmdapi.NewConfig()
+
+	credentials := clientcmdapi.NewAuthInfo()
+	credentials.Token = clientCfg.BearerToken
+	credentials.ClientCertificate = clientCfg.TLSClientConfig.CertFile
+	if len(credentials.ClientCertificate) == 0 {
+		credentials.ClientCertificateData = clientCfg.TLSClientConfig.CertData
+	}
+	credentials.ClientKey = clientCfg.TLSClientConfig.KeyFile
+	if len(credentials.ClientKey) == 0 {
+		credentials.ClientKeyData = clientCfg.TLSClientConfig.KeyData
+	}
+	config.AuthInfos[userNick] = credentials
+
+	cluster := clientcmdapi.NewCluster()
+	cluster.Server = clientCfg.Host
+	cluster.CertificateAuthority = clientCfg.CAFile
+	if len(cluster.CertificateAuthority) == 0 {
+		cluster.CertificateAuthorityData = clientCfg.CAData
+	}
+	cluster.InsecureSkipTLSVerify = clientCfg.Insecure
+	config.Clusters[clusterNick] = cluster
+
+	context := clientcmdapi.NewContext()
+	context.Cluster = clusterNick
+	context.AuthInfo = userNick
+	config.Contexts[contextNick] = context
+	config.CurrentContext = contextNick
+
+	return config
+}
+
+func readResponse(client rest.Interface, location string) ([]byte, error) {
+	return client.Get().AbsPath(location).DoRaw()
+}
+
+func testAPIGroupList(t *testing.T, client rest.Interface) {
+	contents, err := readResponse(client, "/apis")
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	t.Log(string(contents))
+	var apiGroupList metav1.APIGroupList
+	err = json.Unmarshal(contents, &apiGroupList)
+	if err != nil {
+		t.Fatalf("Error in unmarshalling response from server %s: %v", "/apis", err)
+	}
+	assert.Equal(t, 1, len(apiGroupList.Groups))
+	assert.Equal(t, groupVersion.Group, apiGroupList.Groups[0].Name)
+	assert.Equal(t, 1, len(apiGroupList.Groups[0].Versions))
+	assert.Equal(t, groupVersionForDiscovery, apiGroupList.Groups[0].Versions[0])
+	assert.Equal(t, groupVersionForDiscovery, apiGroupList.Groups[0].PreferredVersion)
+}
+
+func testAPIGroup(t *testing.T, client rest.Interface) {
+	contents, err := readResponse(client, "/apis/wardle.k8s.io")
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	t.Log(string(contents))
+	var apiGroup metav1.APIGroup
+	err = json.Unmarshal(contents, &apiGroup)
+	if err != nil {
+		t.Fatalf("Error in unmarshalling response from server %s: %v", "/apis/wardle.k8s.io", err)
+	}
+	assert.Equal(t, groupVersion.Group, apiGroup.Name)
+	assert.Equal(t, 1, len(apiGroup.Versions))
+	assert.Equal(t, groupVersion.String(), apiGroup.Versions[0].GroupVersion)
+	assert.Equal(t, groupVersion.Version, apiGroup.Versions[0].Version)
+	assert.Equal(t, apiGroup.PreferredVersion, apiGroup.Versions[0])
+}
+
+func testAPIResourceList(t *testing.T, client rest.Interface) {
+	contents, err := readResponse(client, "/apis/wardle.k8s.io/v1alpha1")
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	t.Log(string(contents))
+	var apiResourceList metav1.APIResourceList
+	err = json.Unmarshal(contents, &apiResourceList)
+	if err != nil {
+		t.Fatalf("Error in unmarshalling response from server %s: %v", "/apis/wardle.k8s.io/v1alpha1", err)
+	}
+	assert.Equal(t, groupVersion.String(), apiResourceList.GroupVersion)
+	assert.Equal(t, 2, len(apiResourceList.APIResources))
+	assert.Equal(t, "fischers", apiResourceList.APIResources[0].Name)
+	assert.False(t, apiResourceList.APIResources[0].Namespaced)
+	assert.Equal(t, "flunders", apiResourceList.APIResources[1].Name)
+	assert.True(t, apiResourceList.APIResources[1].Namespaced)
+}
+
+const (
+	policyCachePollInterval = 100 * time.Millisecond
+	policyCachePollTimeout  = 5 * time.Second
+)

vendor/k8s.io/kubernetes/test/integration/examples/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apiserver
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/federation/BUILD

@@ -0,0 +1,49 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "api_test.go",
+        "crud_test.go",
+        "main_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//federation/apis/federation/v1beta1:go_default_library",
+        "//federation/pkg/federatedtypes:go_default_library",
+        "//federation/pkg/federatedtypes/crudtester:go_default_library",
+        "//test/integration/federation/framework:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/github.com/pborman/uuid:go_default_library",
+        "//vendor/github.com/stretchr/testify/assert:go_default_library",
+        "//vendor/k8s.io/api/autoscaling/v1:go_default_library",
+        "//vendor/k8s.io/api/batch/v1:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/api/extensions/v1beta1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//test/integration/federation/framework:all-srcs",
+    ],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/federation/OWNERS

@@ -0,0 +1,16 @@
+reviewers:
+  - colhom
+  - csbell
+  - irfanurrehman
+  - madhusudancs
+  - marun
+  - mwielgus
+  - nikhiljindal
+  - quinton-hoole
+  - shashidharatd
+approvers:
+  - csbell
+  - madhusudancs
+  - mwielgus
+  - nikhiljindal
+  - quinton-hoole

vendor/k8s.io/kubernetes/test/integration/federation/api_test.go

@@ -0,0 +1,417 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package federation
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	autoscaling_v1 "k8s.io/api/autoscaling/v1"
+	batch_v1 "k8s.io/api/batch/v1"
+	"k8s.io/api/core/v1"
+	ext_v1b1 "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	fed_v1b1 "k8s.io/kubernetes/federation/apis/federation/v1beta1"
+	"k8s.io/kubernetes/test/integration/federation/framework"
+)
+
+// List of group versions that are enabled by default.
+var enabledGroupVersions = []schema.GroupVersion{
+	fed_v1b1.SchemeGroupVersion,
+	ext_v1b1.SchemeGroupVersion,
+}
+
+// List of group versions that are disabled by default.
+var disabledGroupVersions = []schema.GroupVersion{
+	batch_v1.SchemeGroupVersion,
+	autoscaling_v1.SchemeGroupVersion,
+}
+
+type apiTestFunc func(t *testing.T, host string, expectedGroupVersions []schema.GroupVersion)
+
+func testFederationAPI(t *testing.T, runtimeConfig string, expectedGroupVersions []schema.GroupVersion) {
+	f := &framework.FederationAPIFixture{}
+	if runtimeConfig == "" {
+		f.SetUp(t)
+	} else {
+		runOptions := framework.GetRunOptions()
+		runOptions.APIEnablement.RuntimeConfig.Set(runtimeConfig)
+		f.SetUpWithRunOptions(t, runOptions)
+	}
+	defer f.TearDown(t)
+
+	testCases := map[string]apiTestFunc{
+		"swaggerSpec":     testSwaggerSpec,
+		"support":         testSupport,
+		"apiGroupList":    testAPIGroupList,
+		"apiGroup":        testAPIGroup,
+		"apiResourceList": testAPIResourceList,
+	}
+	for testName, testFunc := range testCases {
+		t.Run(testName, func(t *testing.T) {
+			testFunc(t, f.Host, expectedGroupVersions)
+		})
+	}
+}
+
+// Verifies that only default APIs are enabled when no runtime config is set.
+func TestDefaultRun(t *testing.T) {
+	testFederationAPI(t, "", enabledGroupVersions)
+}
+
+// Verifies that all APIs are enabled when runtime config is set to all.
+func TestRunWithRuntimeConfigAll(t *testing.T) {
+	expectedGroupVersions := enabledGroupVersions
+	expectedGroupVersions = append(enabledGroupVersions, disabledGroupVersions...)
+	testFederationAPI(t, "api/all=true", expectedGroupVersions)
+}
+
+func readResponse(serverURL string) ([]byte, error) {
+	response, err := http.Get(serverURL)
+	if err != nil {
+		return nil, fmt.Errorf("Error in fetching %s: %v", serverURL, err)
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("unexpected status: %d for URL: %s, expected status: %d", response.StatusCode, serverURL, http.StatusOK)
+	}
+	contents, err := ioutil.ReadAll(response.Body)
+	if err != nil {
+		return nil, fmt.Errorf("Error reading response from %s: %v", serverURL, err)
+	}
+	return contents, nil
+}
+
+func testSwaggerSpec(t *testing.T, host string, expectedGroupVersions []schema.GroupVersion) {
+	serverURL := host + "/swaggerapi"
+	_, err := readResponse(serverURL)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+}
+
+func testSupport(t *testing.T, host string, expectedGroupVersions []schema.GroupVersion) {
+	serverURL := host + "/version"
+	_, err := readResponse(serverURL)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+}
+
+func findGroup(groups []metav1.APIGroup, groupName string) *metav1.APIGroup {
+	for _, group := range groups {
+		if group.Name == groupName {
+			return &group
+		}
+	}
+	return nil
+}
+
+func testAPIGroupList(t *testing.T, host string, expectedGroupVersions []schema.GroupVersion) {
+	groupVersionForDiscoveryMap := make(map[string]metav1.GroupVersionForDiscovery)
+	for _, groupVersion := range expectedGroupVersions {
+		groupVersionForDiscoveryMap[groupVersion.Group] = metav1.GroupVersionForDiscovery{
+			GroupVersion: groupVersion.String(),
+			Version:      groupVersion.Version,
+		}
+	}
+
+	serverURL := host + "/apis"
+	contents, err := readResponse(serverURL)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	var apiGroupList metav1.APIGroupList
+	err = json.Unmarshal(contents, &apiGroupList)
+	if err != nil {
+		t.Fatalf("Error in unmarshalling response from server %s: %v", serverURL, err)
+	}
+
+	assert.Equal(t, len(apiGroupList.Groups), len(expectedGroupVersions), "expected: %v, actual: %v", expectedGroupVersions, apiGroupList.Groups)
+	for _, groupVersion := range expectedGroupVersions {
+		found := findGroup(apiGroupList.Groups, groupVersion.Group)
+		assert.NotNil(t, found)
+		assert.Equal(t, groupVersion.Group, found.Name)
+		assert.Equal(t, 1, len(found.Versions))
+		groupVersionForDiscovery := groupVersionForDiscoveryMap[groupVersion.Group]
+		assert.Equal(t, groupVersionForDiscovery, found.Versions[0])
+		assert.Equal(t, groupVersionForDiscovery, found.PreferredVersion)
+	}
+}
+
+func testAPIGroup(t *testing.T, host string, expectedGroupVersions []schema.GroupVersion) {
+	for _, groupVersion := range expectedGroupVersions {
+		serverURL := host + "/apis/" + groupVersion.Group
+		contents, err := readResponse(serverURL)
+		if err != nil {
+			t.Fatalf("%v", err)
+		}
+		var apiGroup metav1.APIGroup
+		err = json.Unmarshal(contents, &apiGroup)
+		if err != nil {
+			t.Fatalf("Error in unmarshalling response from server %s: %v", serverURL, err)
+		}
+		// empty APIVersion for extensions group
+		if groupVersion.Group == "extensions" {
+			assert.Equal(t, "", apiGroup.APIVersion)
+		} else {
+			assert.Equal(t, "v1", apiGroup.APIVersion)
+		}
+		assert.Equal(t, apiGroup.Name, groupVersion.Group)
+		assert.Equal(t, 1, len(apiGroup.Versions))
+		assert.Equal(t, groupVersion.String(), apiGroup.Versions[0].GroupVersion)
+		assert.Equal(t, groupVersion.Version, apiGroup.Versions[0].Version)
+		assert.Equal(t, apiGroup.PreferredVersion, apiGroup.Versions[0])
+	}
+
+	testCoreAPIGroup(t, host)
+}
+
+func testCoreAPIGroup(t *testing.T, host string) {
+	serverURL := host + "/api"
+	contents, err := readResponse(serverURL)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	var apiVersions metav1.APIVersions
+	err = json.Unmarshal(contents, &apiVersions)
+	if err != nil {
+		t.Fatalf("Error in unmarshalling response from server %s: %v", serverURL, err)
+	}
+	assert.Equal(t, 1, len(apiVersions.Versions))
+	assert.Equal(t, "v1", apiVersions.Versions[0])
+	assert.NotEmpty(t, apiVersions.ServerAddressByClientCIDRs)
+}
+
+func findResource(resources []metav1.APIResource, resourceName string) *metav1.APIResource {
+	for _, resource := range resources {
+		if resource.Name == resourceName {
+			return &resource
+		}
+	}
+	return nil
+}
+
+func testAPIResourceList(t *testing.T, host string, expectedGroupVersions []schema.GroupVersion) {
+	testFederationResourceList(t, host)
+	testCoreResourceList(t, host)
+	testExtensionsResourceList(t, host)
+	if contains(expectedGroupVersions, batch_v1.SchemeGroupVersion) {
+		testBatchResourceList(t, host)
+	}
+	if contains(expectedGroupVersions, autoscaling_v1.SchemeGroupVersion) {
+		testAutoscalingResourceList(t, host)
+	}
+}
+
+func contains(gvs []schema.GroupVersion, requiredGV schema.GroupVersion) bool {
+	for _, gv := range gvs {
+		if gv.String() == requiredGV.String() {
+			return true
+		}
+	}
+	return false
+}
+
+func testFederationResourceList(t *testing.T, host string) {
+	serverURL := host + "/apis/" + fed_v1b1.SchemeGroupVersion.String()
+	contents, err := readResponse(serverURL)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	var apiResourceList metav1.APIResourceList
+	err = json.Unmarshal(contents, &apiResourceList)
+	if err != nil {
+		t.Fatalf("Error in unmarshalling response from server %s: %v", serverURL, err)
+	}
+	assert.Equal(t, "v1", apiResourceList.APIVersion)
+	assert.Equal(t, fed_v1b1.SchemeGroupVersion.String(), apiResourceList.GroupVersion)
+	// Assert that there are exactly 2 resources.
+	assert.Equal(t, 2, len(apiResourceList.APIResources))
+
+	found := findResource(apiResourceList.APIResources, "clusters")
+	assert.NotNil(t, found)
+	assert.False(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "clusters/status")
+	assert.NotNil(t, found)
+	assert.False(t, found.Namespaced)
+}
+
+func testCoreResourceList(t *testing.T, host string) {
+	serverURL := host + "/api/" + v1.SchemeGroupVersion.String()
+	contents, err := readResponse(serverURL)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	var apiResourceList metav1.APIResourceList
+	err = json.Unmarshal(contents, &apiResourceList)
+	if err != nil {
+		t.Fatalf("Error in unmarshalling response from server %s: %v", serverURL, err)
+	}
+	assert.Equal(t, "", apiResourceList.APIVersion)
+	assert.Equal(t, v1.SchemeGroupVersion.String(), apiResourceList.GroupVersion)
+	assert.Equal(t, 8, len(apiResourceList.APIResources), "ResourceList: %v", apiResourceList.APIResources)
+
+	// Verify services.
+	found := findResource(apiResourceList.APIResources, "services")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "services/status")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+
+	// Verify namespaces.
+	found = findResource(apiResourceList.APIResources, "namespaces")
+	assert.NotNil(t, found)
+	assert.False(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "namespaces/status")
+	assert.NotNil(t, found)
+	assert.False(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "namespaces/finalize")
+	assert.NotNil(t, found)
+	assert.False(t, found.Namespaced)
+
+	// Verify events.
+	found = findResource(apiResourceList.APIResources, "events")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+
+	// Verify secrets.
+	found = findResource(apiResourceList.APIResources, "secrets")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+
+	// Verify config maps.
+	found = findResource(apiResourceList.APIResources, "configmaps")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+}
+
+func testExtensionsResourceList(t *testing.T, host string) {
+	serverURL := host + "/apis/" + ext_v1b1.SchemeGroupVersion.String()
+	contents, err := readResponse(serverURL)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	var apiResourceList metav1.APIResourceList
+	err = json.Unmarshal(contents, &apiResourceList)
+	if err != nil {
+		t.Fatalf("Error in unmarshalling response from server %s: %v", serverURL, err)
+	}
+	// empty APIVersion for extensions group
+	assert.Equal(t, "", apiResourceList.APIVersion)
+	assert.Equal(t, ext_v1b1.SchemeGroupVersion.String(), apiResourceList.GroupVersion)
+	// Assert that there are exactly 11 resources.
+	assert.Equal(t, 11, len(apiResourceList.APIResources))
+
+	// Verify replicasets.
+	found := findResource(apiResourceList.APIResources, "replicasets")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "replicasets/status")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "replicasets/scale")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+
+	// Verify ingress.
+	found = findResource(apiResourceList.APIResources, "ingresses")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "ingresses/status")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+
+	// Verify daemonsets.
+	found = findResource(apiResourceList.APIResources, "daemonsets")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "daemonsets/status")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+
+	// Verify deployments.
+	found = findResource(apiResourceList.APIResources, "deployments")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "deployments/status")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "deployments/scale")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "deployments/rollback")
+}
+
+func testBatchResourceList(t *testing.T, host string) {
+	serverURL := host + "/apis/" + batch_v1.SchemeGroupVersion.String()
+	contents, err := readResponse(serverURL)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	var apiResourceList metav1.APIResourceList
+	err = json.Unmarshal(contents, &apiResourceList)
+	if err != nil {
+		t.Fatalf("Error in unmarshalling response from server %s: %v", serverURL, err)
+	}
+	// empty APIVersion for extensions group
+	assert.Equal(t, "v1", apiResourceList.APIVersion)
+	assert.Equal(t, batch_v1.SchemeGroupVersion.String(), apiResourceList.GroupVersion)
+	// Assert that there are exactly this number of resources.
+	assert.Equal(t, 2, len(apiResourceList.APIResources))
+
+	// Verify jobs
+	found := findResource(apiResourceList.APIResources, "jobs")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "jobs/status")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+}
+
+func testAutoscalingResourceList(t *testing.T, host string) {
+	serverURL := host + "/apis/" + autoscaling_v1.SchemeGroupVersion.String()
+	contents, err := readResponse(serverURL)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	var apiResourceList metav1.APIResourceList
+	err = json.Unmarshal(contents, &apiResourceList)
+	if err != nil {
+		t.Fatalf("Error in unmarshalling response from server %s: %v", serverURL, err)
+	}
+	// empty APIVersion for extensions group
+	assert.Equal(t, "v1", apiResourceList.APIVersion)
+	assert.Equal(t, autoscaling_v1.SchemeGroupVersion.String(), apiResourceList.GroupVersion)
+	// Assert that there are exactly this number of resources.
+	assert.Equal(t, 2, len(apiResourceList.APIResources))
+
+	// Verify hpa
+	found := findResource(apiResourceList.APIResources, "horizontalpodautoscalers")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+	found = findResource(apiResourceList.APIResources, "horizontalpodautoscalers/status")
+	assert.NotNil(t, found)
+	assert.True(t, found.Namespaced)
+}

vendor/k8s.io/kubernetes/test/integration/federation/crud_test.go

@@ -0,0 +1,114 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package federation
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/pborman/uuid"
+
+	pkgruntime "k8s.io/apimachinery/pkg/runtime"
+	federationapi "k8s.io/kubernetes/federation/apis/federation/v1beta1"
+	"k8s.io/kubernetes/federation/pkg/federatedtypes"
+	"k8s.io/kubernetes/federation/pkg/federatedtypes/crudtester"
+	"k8s.io/kubernetes/test/integration/federation/framework"
+)
+
+// TestFederationCRUD validates create/read/update/delete operations for federated resource types.
+func TestFederationCRUD(t *testing.T) {
+	fedFixture := framework.FederationFixture{DesiredClusterCount: 2}
+	fedFixture.SetUp(t)
+	defer fedFixture.TearDown(t)
+
+	federatedTypes := federatedtypes.FederatedTypes()
+	for kind, fedType := range federatedTypes {
+		t.Run(kind, func(t *testing.T) {
+			fixture, crudTester, obj, _ := initCRUDTest(t, &fedFixture, fedType.AdapterFactory, kind)
+			defer fixture.TearDown(t)
+
+			crudTester.CheckLifecycle(obj)
+		})
+	}
+
+	// The following tests target a single type since the underlying logic is common across all types.
+	kind := federatedtypes.SecretKind
+	adapterFactory := federatedtypes.NewSecretAdapter
+
+	// Validate deletion handling where orphanDependents is true or nil
+	orphanedDependents := true
+	testCases := map[string]*bool{
+		"Resource should not be deleted from underlying clusters when OrphanDependents is true": &orphanedDependents,
+		"Resource should not be deleted from underlying clusters when OrphanDependents is nil":  nil,
+	}
+	for testName, orphanDependents := range testCases {
+		t.Run(testName, func(t *testing.T) {
+			fixture, crudTester, obj, _ := initCRUDTest(t, &fedFixture, adapterFactory, kind)
+			defer fixture.TearDown(t)
+
+			updatedObj := crudTester.CheckCreate(obj)
+			crudTester.CheckDelete(updatedObj, orphanDependents)
+		})
+	}
+
+	t.Run("Resource should be propagated to a newly added cluster", func(t *testing.T) {
+		fixture, crudTester, obj, _ := initCRUDTest(t, &fedFixture, adapterFactory, kind)
+		defer fixture.TearDown(t)
+
+		updatedObj := crudTester.CheckCreate(obj)
+		// Start a new cluster and validate that the resource is propagated to it.
+		fedFixture.StartCluster(t)
+		// Check propagation to the new cluster by providing the updated set of clients
+		objectExpected := true
+		crudTester.CheckPropagationForClients(updatedObj, fedFixture.ClusterClients, objectExpected)
+	})
+
+	t.Run("Resource should only be propagated to the cluster with a matching selector", func(t *testing.T) {
+		fixture, crudTester, obj, adapter := initCRUDTest(t, &fedFixture, adapterFactory, kind)
+		defer fixture.TearDown(t)
+
+		// Set an annotation to specify that the object is isolated to cluster 1.
+		federatedtypes.SetAnnotation(adapter, obj, federationapi.FederationClusterSelectorAnnotation, `[{"key": "cluster", "operator": "==", "values": ["1"]}]`)
+
+		updatedObj := crudTester.Create(obj)
+
+		// Check propagation to the first cluster
+		objectExpected := true
+		crudTester.CheckPropagationForClients(updatedObj, fedFixture.ClusterClients[0:1], objectExpected)
+
+		// Verify the object is not sent to the second cluster
+		objectExpected = false
+		crudTester.CheckPropagationForClients(updatedObj, fedFixture.ClusterClients[1:2], objectExpected)
+
+	})
+}
+
+// initCRUDTest initializes common elements of a crud test
+func initCRUDTest(t *testing.T, fedFixture *framework.FederationFixture, adapterFactory federatedtypes.AdapterFactory, kind string) (
+	*framework.ControllerFixture, *crudtester.FederatedTypeCRUDTester, pkgruntime.Object, federatedtypes.FederatedTypeAdapter) {
+	config := fedFixture.APIFixture.NewConfig()
+	fixture := framework.NewControllerFixture(t, kind, adapterFactory, config)
+
+	client := fedFixture.APIFixture.NewClient(fmt.Sprintf("crud-test-%s", kind))
+	adapter := adapterFactory(client, config, nil)
+
+	crudTester := framework.NewFederatedTypeCRUDTester(t, adapter, fedFixture.ClusterClients)
+
+	obj := adapter.NewTestObject(uuid.New())
+
+	return fixture, crudTester, obj, adapter
+}

vendor/k8s.io/kubernetes/test/integration/federation/framework/BUILD

@@ -0,0 +1,48 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "api.go",
+        "controller.go",
+        "crudtester.go",
+        "federation.go",
+        "util.go",
+    ],
+    deps = [
+        "//federation/apis/federation/v1beta1:go_default_library",
+        "//federation/client/clientset_generated/federation_clientset:go_default_library",
+        "//federation/cmd/federation-apiserver/app:go_default_library",
+        "//federation/cmd/federation-apiserver/app/options:go_default_library",
+        "//federation/pkg/federatedtypes:go_default_library",
+        "//federation/pkg/federatedtypes/crudtester:go_default_library",
+        "//federation/pkg/federation-controller/cluster:go_default_library",
+        "//federation/pkg/federation-controller/sync:go_default_library",
+        "//pkg/master:go_default_library",
+        "//test/e2e_node/services:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/github.com/pborman/uuid:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/federation/framework/api.go

@@ -0,0 +1,133 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package framework
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/pborman/uuid"
+
+	"k8s.io/apimachinery/pkg/util/wait"
+	restclient "k8s.io/client-go/rest"
+	federationclientset "k8s.io/kubernetes/federation/client/clientset_generated/federation_clientset"
+	"k8s.io/kubernetes/federation/cmd/federation-apiserver/app"
+	"k8s.io/kubernetes/federation/cmd/federation-apiserver/app/options"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+const apiNoun = "federation apiserver"
+
+// GetRunOptions returns the default run options that can be used to run a test federation apiserver.
+func GetRunOptions() *options.ServerRunOptions {
+	r := options.NewServerRunOptions()
+	r.Etcd.StorageConfig.ServerList = []string{framework.GetEtcdURL()}
+	// Use a unique prefix to ensure isolation from other tests using the same etcd instance
+	r.Etcd.StorageConfig.Prefix = uuid.New()
+	// Disable secure serving
+	r.SecureServing.BindPort = 0
+	return r
+}
+
+// FederationAPIFixture manages a federation api server
+type FederationAPIFixture struct {
+	Host     string
+	stopChan chan struct{}
+}
+
+// SetUp runs federation apiserver with default run options.
+func (f *FederationAPIFixture) SetUp(t *testing.T) {
+	f.SetUpWithRunOptions(t, GetRunOptions())
+}
+
+// SetUpWithRunOptions runs federation apiserver with the given run options.
+// Uses default run options if runOptions is nil.
+func (f *FederationAPIFixture) SetUpWithRunOptions(t *testing.T, runOptions *options.ServerRunOptions) {
+	if f.stopChan != nil {
+		t.Fatal("SetUp() already called")
+	}
+	defer TearDownOnPanic(t, f)
+
+	f.stopChan = make(chan struct{})
+
+	err := startServer(t, runOptions, f.stopChan)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f.Host = fmt.Sprintf("http://%s:%d", runOptions.InsecureServing.BindAddress, runOptions.InsecureServing.BindPort)
+
+	err = waitForServer(t, f.Host)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func (f *FederationAPIFixture) TearDown(t *testing.T) {
+	if f.stopChan != nil {
+		close(f.stopChan)
+		f.stopChan = nil
+	}
+}
+
+func (f *FederationAPIFixture) NewConfig() *restclient.Config {
+	return &restclient.Config{Host: f.Host}
+}
+
+func (f *FederationAPIFixture) NewClient(userAgent string) federationclientset.Interface {
+	config := f.NewConfig()
+	restclient.AddUserAgent(config, userAgent)
+	return federationclientset.NewForConfigOrDie(config)
+}
+
+func startServer(t *testing.T, runOptions *options.ServerRunOptions, stopChan <-chan struct{}) error {
+	err := wait.PollImmediate(DefaultWaitInterval, wait.ForeverTestTimeout, func() (bool, error) {
+		port, err := framework.FindFreeLocalPort()
+		if err != nil {
+			t.Logf("Error allocating an ephemeral port: %v", err)
+			return false, nil
+		}
+
+		runOptions.InsecureServing.BindPort = port
+		err = app.NonBlockingRun(runOptions, stopChan)
+		if err != nil {
+			t.Logf("Error starting the %s: %v", apiNoun, err)
+			return false, nil
+		}
+		return true, nil
+	})
+	if err != nil {
+		return fmt.Errorf("Timed out waiting for the %s: %v", apiNoun, err)
+	}
+	return nil
+}
+
+func waitForServer(t *testing.T, host string) error {
+	err := wait.PollImmediate(DefaultWaitInterval, wait.ForeverTestTimeout, func() (bool, error) {
+		_, err := http.Get(host)
+		if err != nil {
+			t.Logf("Error when trying to contact the API: %v", err)
+			return false, nil
+		}
+		return true, nil
+	})
+	if err != nil {
+		return fmt.Errorf("Timed out waiting for the %s: %v", apiNoun, err)
+	}
+	return nil
+}

vendor/k8s.io/kubernetes/test/integration/federation/framework/controller.go

@@ -0,0 +1,43 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package framework
+
+import (
+	"testing"
+
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/kubernetes/federation/pkg/federatedtypes"
+	synccontroller "k8s.io/kubernetes/federation/pkg/federation-controller/sync"
+)
+
+// ControllerFixture manages a federation controller for testing.
+type ControllerFixture struct {
+	stopChan chan struct{}
+}
+
+// NewControllerFixture initializes a new controller fixture
+func NewControllerFixture(t *testing.T, kind string, adapterFactory federatedtypes.AdapterFactory, config *restclient.Config) *ControllerFixture {
+	f := &ControllerFixture{
+		stopChan: make(chan struct{}),
+	}
+	synccontroller.StartFederationSyncController(kind, adapterFactory, config, f.stopChan, true, nil)
+	return f
+}
+
+func (f *ControllerFixture) TearDown(t *testing.T) {
+	close(f.stopChan)
+}

vendor/k8s.io/kubernetes/test/integration/federation/framework/crudtester.go

@@ -0,0 +1,47 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package framework
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/wait"
+	clientset "k8s.io/client-go/kubernetes"
+	"k8s.io/kubernetes/federation/pkg/federatedtypes"
+	"k8s.io/kubernetes/federation/pkg/federatedtypes/crudtester"
+)
+
+type IntegrationLogger struct {
+	t *testing.T
+}
+
+func (l *IntegrationLogger) Logf(format string, args ...interface{}) {
+	l.t.Logf(format, args...)
+}
+
+func (l *IntegrationLogger) Fatalf(format string, args ...interface{}) {
+	l.t.Fatalf(format, args...)
+}
+
+func (l *IntegrationLogger) Fatal(msg string) {
+	l.t.Fatal(msg)
+}
+
+func NewFederatedTypeCRUDTester(t *testing.T, adapter federatedtypes.FederatedTypeAdapter, clusterClients []clientset.Interface) *crudtester.FederatedTypeCRUDTester {
+	logger := &IntegrationLogger{t}
+	return crudtester.NewFederatedTypeCRUDTester(logger, adapter, clusterClients, DefaultWaitInterval, wait.ForeverTestTimeout)
+}

vendor/k8s.io/kubernetes/test/integration/federation/framework/federation.go

@@ -0,0 +1,141 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package framework
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientset "k8s.io/client-go/kubernetes"
+	federationapi "k8s.io/kubernetes/federation/apis/federation/v1beta1"
+	federationclientset "k8s.io/kubernetes/federation/client/clientset_generated/federation_clientset"
+	clustercontroller "k8s.io/kubernetes/federation/pkg/federation-controller/cluster"
+	"k8s.io/kubernetes/pkg/master"
+	"k8s.io/kubernetes/test/e2e_node/services"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+type MemberCluster struct {
+	CloseFn             framework.CloseFunc
+	Config              *master.Config
+	Client              clientset.Interface
+	Host                string
+	namespaceController *services.NamespaceController
+}
+
+// FederationFixture manages a federation api server and a set of member clusters
+type FederationFixture struct {
+	APIFixture          *FederationAPIFixture
+	DesiredClusterCount int
+	Clusters            []*MemberCluster
+
+	ClusterClients    []clientset.Interface
+	ClusterController *clustercontroller.ClusterController
+	fedClient         federationclientset.Interface
+	stopChan          chan struct{}
+}
+
+func (f *FederationFixture) SetUp(t *testing.T) {
+	if f.APIFixture != nil {
+		t.Fatal("Fixture already started")
+	}
+	if f.DesiredClusterCount < 1 {
+		f.DesiredClusterCount = 1
+	}
+	defer TearDownOnPanic(t, f)
+
+	t.Logf("Starting a federation of %d clusters", f.DesiredClusterCount)
+
+	f.APIFixture = &FederationAPIFixture{}
+	runOptions := GetRunOptions()
+	// Enable all apis features for test.
+	runOptions.APIEnablement.RuntimeConfig.Set("api/all=true")
+	f.APIFixture.SetUpWithRunOptions(t, runOptions)
+
+	f.stopChan = make(chan struct{})
+	monitorPeriod := 1 * time.Second
+	clustercontroller.StartClusterController(f.APIFixture.NewConfig(), f.stopChan, monitorPeriod)
+
+	f.fedClient = f.APIFixture.NewClient("federation-fixture")
+	for i := 0; i < f.DesiredClusterCount; i++ {
+		f.StartCluster(t)
+	}
+}
+
+func (f *FederationFixture) StartCluster(t *testing.T) {
+	config := framework.NewMasterConfig()
+	_, _, closeFn := framework.RunAMaster(config)
+	host := config.GenericConfig.LoopbackClientConfig.Host
+
+	clusterClient := clientset.NewForConfigOrDie(config.GenericConfig.LoopbackClientConfig)
+	f.ClusterClients = append(f.ClusterClients, clusterClient)
+	memberCluster := &MemberCluster{
+		CloseFn:             closeFn,
+		Config:              config,
+		Client:              clusterClient,
+		Host:                host,
+		namespaceController: services.NewNamespaceController(host),
+	}
+	f.Clusters = append(f.Clusters, memberCluster)
+	err := memberCluster.namespaceController.Start()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	clusterId := len(f.ClusterClients)
+
+	t.Logf("Federated cluster %d serving on %s", clusterId, host)
+
+	cluster := &federationapi.Cluster{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:   fmt.Sprintf("cluster-%d", clusterId),
+			Labels: map[string]string{"cluster": fmt.Sprintf("%d", clusterId)},
+		},
+		Spec: federationapi.ClusterSpec{
+			ServerAddressByClientCIDRs: []federationapi.ServerAddressByClientCIDR{
+				{
+					ClientCIDR:    "0.0.0.0/0",
+					ServerAddress: host,
+				},
+			},
+			// Use insecure access
+			SecretRef: nil,
+		},
+	}
+	f.fedClient.FederationV1beta1().Clusters().Create(cluster)
+}
+
+func (f *FederationFixture) TearDown(t *testing.T) {
+	if f.stopChan != nil {
+		close(f.stopChan)
+		f.stopChan = nil
+	}
+	for _, cluster := range f.Clusters {
+		// Need to close controllers with active connections to the
+		// cluster api before stopping the api or the connections will
+		// hang until tcp timeout.
+		cluster.namespaceController.Stop()
+		cluster.CloseFn()
+	}
+	f.Clusters = nil
+	if f.APIFixture != nil {
+		f.APIFixture.TearDown(t)
+		f.APIFixture = nil
+	}
+}

vendor/k8s.io/kubernetes/test/integration/federation/framework/util.go

@@ -0,0 +1,40 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package framework
+
+import (
+	"testing"
+	"time"
+)
+
+const (
+	DefaultWaitInterval = 50 * time.Millisecond
+)
+
+// SetUp is likely to be fixture-specific, but TearDown needs to be
+// consistent to enable TearDownOnPanic.
+type TestFixture interface {
+	TearDown(t *testing.T)
+}
+
+// TearDownOnPanic can be used to ensure cleanup on setup failure.
+func TearDownOnPanic(t *testing.T, f TestFixture) {
+	if r := recover(); r != nil {
+		f.TearDown(t)
+		panic(r)
+	}
+}

vendor/k8s.io/kubernetes/test/integration/federation/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package federation
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/framework/BUILD

@@ -0,0 +1,82 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "etcd.go",
+        "master_utils.go",
+        "perf_utils.go",
+        "serializer.go",
+        "util.go",
+    ],
+    data = [
+        "@com_coreos_etcd//:etcd",
+    ],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//pkg/apis/batch:go_default_library",
+        "//pkg/apis/policy/v1alpha1:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/replication:go_default_library",
+        "//pkg/generated/openapi:go_default_library",
+        "//pkg/kubectl:go_default_library",
+        "//pkg/kubelet/client:go_default_library",
+        "//pkg/master:go_default_library",
+        "//pkg/util/env:go_default_library",
+        "//pkg/version:go_default_library",
+        "//plugin/pkg/admission/admit:go_default_library",
+        "//test/e2e/framework:go_default_library",
+        "//test/utils:go_default_library",
+        "//vendor/github.com/go-openapi/spec:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/github.com/pborman/uuid:go_default_library",
+        "//vendor/k8s.io/api/apps/v1beta1:go_default_library",
+        "//vendor/k8s.io/api/autoscaling/v1:go_default_library",
+        "//vendor/k8s.io/api/certificates/v1beta1:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/api/extensions/v1beta1:go_default_library",
+        "//vendor/k8s.io/api/rbac/v1alpha1:go_default_library",
+        "//vendor/k8s.io/api/storage/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/authenticator:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/authenticatorfactory:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/request/union:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authorization/authorizerfactory:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authorization/union:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/server:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/server/options:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/server/storage:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/storage/storagebackend:go_default_library",
+        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/tools/record:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/framework/etcd.go

@@ -0,0 +1,109 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package framework
+
+import (
+	"fmt"
+	"hash/adler32"
+	"io"
+	"io/ioutil"
+	"math/rand"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sync"
+
+	"k8s.io/kubernetes/pkg/util/env"
+
+	"github.com/golang/glog"
+)
+
+var (
+	etcdSetup sync.Once
+	etcdURL   = ""
+)
+
+func setupETCD() {
+	etcdSetup.Do(func() {
+		if os.Getenv("RUNFILES_DIR") == "" {
+			etcdURL = env.GetEnvAsStringOrFallback("KUBE_INTEGRATION_ETCD_URL", "http://127.0.0.1:2379")
+			return
+		}
+		etcdPath := filepath.Join(os.Getenv("RUNFILES_DIR"), "com_coreos_etcd/etcd")
+		// give every test the same random port each run
+		etcdPort := 20000 + rand.New(rand.NewSource(int64(adler32.Checksum([]byte(os.Args[0]))))).Intn(5000)
+		etcdURL = fmt.Sprintf("http://127.0.0.1:%d", etcdPort)
+
+		info, err := os.Stat(etcdPath)
+		if err != nil {
+			glog.Fatalf("Unable to stat etcd: %v", err)
+		}
+		if info.IsDir() {
+			glog.Fatalf("Did not expect %q to be a directory", etcdPath)
+		}
+
+		etcdDataDir, err := ioutil.TempDir(os.TempDir(), "integration_test_etcd_data")
+		if err != nil {
+			glog.Fatalf("Unable to make temp etcd data dir: %v", err)
+		}
+		glog.Infof("storing etcd data in: %v", etcdDataDir)
+
+		etcdCmd := exec.Command(
+			etcdPath,
+			"--data-dir",
+			etcdDataDir,
+			"--listen-client-urls",
+			GetEtcdURL(),
+			"--advertise-client-urls",
+			GetEtcdURL(),
+			"--listen-peer-urls",
+			"http://127.0.0.1:0",
+		)
+
+		stdout, err := etcdCmd.StdoutPipe()
+		if err != nil {
+			glog.Fatalf("Failed to run etcd: %v", err)
+		}
+		stderr, err := etcdCmd.StderrPipe()
+		if err != nil {
+			glog.Fatalf("Failed to run etcd: %v", err)
+		}
+		if err := etcdCmd.Start(); err != nil {
+			glog.Fatalf("Failed to run etcd: %v", err)
+		}
+
+		go io.Copy(os.Stdout, stdout)
+		go io.Copy(os.Stderr, stderr)
+
+		go func() {
+			if err := etcdCmd.Wait(); err != nil {
+				glog.Fatalf("Failed to run etcd: %v", err)
+			}
+			glog.Fatalf("etcd should not have succeeded")
+		}()
+	})
+}
+
+func EtcdMain(tests func() int) {
+	setupETCD()
+	os.Exit(tests())
+}
+
+// return the EtcdURL
+func GetEtcdURL() string {
+	return etcdURL
+}

vendor/k8s.io/kubernetes/test/integration/framework/master_utils.go

@@ -0,0 +1,525 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package framework
+
+import (
+	"io/ioutil"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	goruntime "runtime"
+	"strconv"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/go-openapi/spec"
+	"github.com/golang/glog"
+	"github.com/pborman/uuid"
+
+	apps "k8s.io/api/apps/v1beta1"
+	autoscaling "k8s.io/api/autoscaling/v1"
+	certificates "k8s.io/api/certificates/v1beta1"
+	"k8s.io/api/core/v1"
+	extensions "k8s.io/api/extensions/v1beta1"
+	rbac "k8s.io/api/rbac/v1alpha1"
+	storage "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/wait"
+	authauthenticator "k8s.io/apiserver/pkg/authentication/authenticator"
+	"k8s.io/apiserver/pkg/authentication/authenticatorfactory"
+	authenticatorunion "k8s.io/apiserver/pkg/authentication/request/union"
+	"k8s.io/apiserver/pkg/authentication/user"
+	authauthorizer "k8s.io/apiserver/pkg/authorization/authorizer"
+	"k8s.io/apiserver/pkg/authorization/authorizerfactory"
+	authorizerunion "k8s.io/apiserver/pkg/authorization/union"
+	genericapiserver "k8s.io/apiserver/pkg/server"
+	"k8s.io/apiserver/pkg/server/options"
+	serverstorage "k8s.io/apiserver/pkg/server/storage"
+	"k8s.io/apiserver/pkg/storage/storagebackend"
+	"k8s.io/client-go/informers"
+	extinformers "k8s.io/client-go/informers"
+	clientset "k8s.io/client-go/kubernetes"
+	extclient "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/pkg/apis/batch"
+	policy "k8s.io/kubernetes/pkg/apis/policy/v1alpha1"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
+	"k8s.io/kubernetes/pkg/controller"
+	replicationcontroller "k8s.io/kubernetes/pkg/controller/replication"
+	"k8s.io/kubernetes/pkg/generated/openapi"
+	"k8s.io/kubernetes/pkg/kubectl"
+	kubeletclient "k8s.io/kubernetes/pkg/kubelet/client"
+	"k8s.io/kubernetes/pkg/master"
+	"k8s.io/kubernetes/pkg/version"
+	"k8s.io/kubernetes/plugin/pkg/admission/admit"
+)
+
+const (
+	// Timeout used in benchmarks, to eg: scale an rc
+	DefaultTimeout = 30 * time.Minute
+
+	// Rc manifest used to create pods for benchmarks.
+	// TODO: Convert this to a full path?
+	TestRCManifest = "benchmark-controller.json"
+)
+
+// MasterComponents is a control struct for all master components started via NewMasterComponents.
+// TODO: Include all master components (scheduler, nodecontroller).
+// TODO: Reconcile with integration.go, currently the master used there doesn't understand
+// how to restart cleanly, which is required for each iteration of a benchmark. The integration
+// tests also don't make it easy to isolate and turn off components at will.
+type MasterComponents struct {
+	// Raw http server in front of the master
+	ApiServer *httptest.Server
+	// Kubernetes master, contains an embedded etcd storage
+	KubeMaster *master.Master
+	// Restclient used to talk to the kubernetes master
+	ClientSet clientset.Interface
+	// Replication controller manager
+	ControllerManager *replicationcontroller.ReplicationManager
+	// CloseFn shuts down the server
+	CloseFn CloseFunc
+	// Channel for stop signals to rc manager
+	rcStopCh chan struct{}
+	// Used to stop master components individually, and via MasterComponents.Stop
+	once sync.Once
+}
+
+// Config is a struct of configuration directives for NewMasterComponents.
+type Config struct {
+	// If nil, a default is used, partially filled configs will not get populated.
+	MasterConfig            *master.Config
+	StartReplicationManager bool
+	// Client throttling qps
+	QPS float32
+	// Client burst qps, also burst replicas allowed in rc manager
+	Burst int
+	// TODO: Add configs for endpoints controller, scheduler etc
+}
+
+// NewMasterComponents creates, initializes and starts master components based on the given config.
+func NewMasterComponents(c *Config) *MasterComponents {
+	m, s, closeFn := startMasterOrDie(c.MasterConfig, nil, nil)
+	// TODO: Allow callers to pipe through a different master url and create a client/start components using it.
+	glog.Infof("Master %+v", s.URL)
+	// TODO: caesarxuchao: remove this client when the refactoring of client libraray is done.
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}, QPS: c.QPS, Burst: c.Burst})
+	rcStopCh := make(chan struct{})
+	informerFactory := informers.NewSharedInformerFactory(clientset, controller.NoResyncPeriodFunc())
+	controllerManager := replicationcontroller.NewReplicationManager(informerFactory.Core().V1().Pods(), informerFactory.Core().V1().ReplicationControllers(), clientset, c.Burst)
+
+	// TODO: Support events once we can cleanly shutdown an event recorder.
+	controllerManager.SetEventRecorder(&record.FakeRecorder{})
+	if c.StartReplicationManager {
+		informerFactory.Start(rcStopCh)
+		go controllerManager.Run(goruntime.NumCPU(), rcStopCh)
+	}
+	return &MasterComponents{
+		ApiServer:         s,
+		KubeMaster:        m,
+		ClientSet:         clientset,
+		ControllerManager: controllerManager,
+		CloseFn:           closeFn,
+		rcStopCh:          rcStopCh,
+	}
+}
+
+// alwaysAllow always allows an action
+type alwaysAllow struct{}
+
+func (alwaysAllow) Authorize(requestAttributes authauthorizer.Attributes) (bool, string, error) {
+	return true, "always allow", nil
+}
+
+// alwaysEmpty simulates "no authentication" for old tests
+func alwaysEmpty(req *http.Request) (user.Info, bool, error) {
+	return &user.DefaultInfo{
+		Name: "",
+	}, true, nil
+}
+
+// MasterReceiver can be used to provide the master to a custom incoming server function
+type MasterReceiver interface {
+	SetMaster(m *master.Master)
+}
+
+// MasterHolder implements
+type MasterHolder struct {
+	Initialized chan struct{}
+	M           *master.Master
+}
+
+func (h *MasterHolder) SetMaster(m *master.Master) {
+	h.M = m
+	close(h.Initialized)
+}
+
+// startMasterOrDie starts a kubernetes master and an httpserver to handle api requests
+func startMasterOrDie(masterConfig *master.Config, incomingServer *httptest.Server, masterReceiver MasterReceiver) (*master.Master, *httptest.Server, CloseFunc) {
+	var m *master.Master
+	var s *httptest.Server
+
+	if incomingServer != nil {
+		s = incomingServer
+	} else {
+		s = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			m.GenericAPIServer.Handler.ServeHTTP(w, req)
+		}))
+	}
+
+	stopCh := make(chan struct{})
+	closeFn := func() {
+		close(stopCh)
+		s.Close()
+	}
+
+	if masterConfig == nil {
+		masterConfig = NewMasterConfig()
+		masterConfig.GenericConfig.EnableProfiling = true
+		masterConfig.GenericConfig.EnableMetrics = true
+		masterConfig.GenericConfig.OpenAPIConfig = genericapiserver.DefaultOpenAPIConfig(openapi.GetOpenAPIDefinitions, api.Scheme)
+		masterConfig.GenericConfig.OpenAPIConfig.Info = &spec.Info{
+			InfoProps: spec.InfoProps{
+				Title:   "Kubernetes",
+				Version: "unversioned",
+			},
+		}
+		masterConfig.GenericConfig.OpenAPIConfig.DefaultResponse = &spec.Response{
+			ResponseProps: spec.ResponseProps{
+				Description: "Default Response.",
+			},
+		}
+		masterConfig.GenericConfig.OpenAPIConfig.GetDefinitions = openapi.GetOpenAPIDefinitions
+		masterConfig.GenericConfig.SwaggerConfig = genericapiserver.DefaultSwaggerConfig()
+	}
+
+	// set the loopback client config
+	if masterConfig.GenericConfig.LoopbackClientConfig == nil {
+		masterConfig.GenericConfig.LoopbackClientConfig = &restclient.Config{QPS: 50, Burst: 100, ContentConfig: restclient.ContentConfig{NegotiatedSerializer: api.Codecs}}
+	}
+	masterConfig.GenericConfig.LoopbackClientConfig.Host = s.URL
+
+	privilegedLoopbackToken := uuid.NewRandom().String()
+	// wrap any available authorizer
+	tokens := make(map[string]*user.DefaultInfo)
+	tokens[privilegedLoopbackToken] = &user.DefaultInfo{
+		Name:   user.APIServerUser,
+		UID:    uuid.NewRandom().String(),
+		Groups: []string{user.SystemPrivilegedGroup},
+	}
+
+	tokenAuthenticator := authenticatorfactory.NewFromTokens(tokens)
+	if masterConfig.GenericConfig.Authenticator == nil {
+		masterConfig.GenericConfig.Authenticator = authenticatorunion.New(tokenAuthenticator, authauthenticator.RequestFunc(alwaysEmpty))
+	} else {
+		masterConfig.GenericConfig.Authenticator = authenticatorunion.New(tokenAuthenticator, masterConfig.GenericConfig.Authenticator)
+	}
+
+	if masterConfig.GenericConfig.Authorizer != nil {
+		tokenAuthorizer := authorizerfactory.NewPrivilegedGroups(user.SystemPrivilegedGroup)
+		masterConfig.GenericConfig.Authorizer = authorizerunion.New(tokenAuthorizer, masterConfig.GenericConfig.Authorizer)
+	} else {
+		masterConfig.GenericConfig.Authorizer = alwaysAllow{}
+	}
+
+	masterConfig.GenericConfig.LoopbackClientConfig.BearerToken = privilegedLoopbackToken
+
+	clientset, err := extclient.NewForConfig(masterConfig.GenericConfig.LoopbackClientConfig)
+	if err != nil {
+		glog.Fatal(err)
+	}
+
+	sharedInformers := extinformers.NewSharedInformerFactory(clientset, masterConfig.GenericConfig.LoopbackClientConfig.Timeout)
+	m, err = masterConfig.Complete(sharedInformers).New(genericapiserver.EmptyDelegate)
+	if err != nil {
+		closeFn()
+		glog.Fatalf("error in bringing up the master: %v", err)
+	}
+	if masterReceiver != nil {
+		masterReceiver.SetMaster(m)
+	}
+
+	// TODO have this start method actually use the normal start sequence for the API server
+	// this method never actually calls the `Run` method for the API server
+	// fire the post hooks ourselves
+	m.GenericAPIServer.PrepareRun()
+	m.GenericAPIServer.RunPostStartHooks(stopCh)
+
+	cfg := *masterConfig.GenericConfig.LoopbackClientConfig
+	cfg.ContentConfig.GroupVersion = &schema.GroupVersion{}
+	privilegedClient, err := restclient.RESTClientFor(&cfg)
+	if err != nil {
+		closeFn()
+		glog.Fatal(err)
+	}
+	err = wait.PollImmediate(100*time.Millisecond, 30*time.Second, func() (bool, error) {
+		result := privilegedClient.Get().AbsPath("/healthz").Do()
+		status := 0
+		result.StatusCode(&status)
+		if status == 200 {
+			return true, nil
+		}
+		return false, nil
+	})
+	if err != nil {
+		closeFn()
+		glog.Fatal(err)
+	}
+
+	return m, s, closeFn
+}
+
+// Returns a basic master config.
+func NewMasterConfig() *master.Config {
+	// This causes the integration tests to exercise the etcd
+	// prefix code, so please don't change without ensuring
+	// sufficient coverage in other ways.
+	etcdOptions := options.NewEtcdOptions(storagebackend.NewDefaultConfig(uuid.New(), api.Scheme, nil))
+	etcdOptions.StorageConfig.ServerList = []string{GetEtcdURL()}
+
+	info, _ := runtime.SerializerInfoForMediaType(api.Codecs.SupportedMediaTypes(), runtime.ContentTypeJSON)
+	ns := NewSingleContentTypeSerializer(api.Scheme, info)
+
+	resourceEncoding := serverstorage.NewDefaultResourceEncodingConfig(api.Registry)
+	// FIXME (soltysh): this GroupVersionResource override should be configurable
+	// we need to set both for the whole group and for cronjobs, separately
+	resourceEncoding.SetVersionEncoding(batch.GroupName, *testapi.Batch.GroupVersion(), schema.GroupVersion{Group: batch.GroupName, Version: runtime.APIVersionInternal})
+	resourceEncoding.SetResourceEncoding(schema.GroupResource{Group: "batch", Resource: "cronjobs"}, schema.GroupVersion{Group: batch.GroupName, Version: "v1beta1"}, schema.GroupVersion{Group: batch.GroupName, Version: runtime.APIVersionInternal})
+
+	storageFactory := serverstorage.NewDefaultStorageFactory(etcdOptions.StorageConfig, runtime.ContentTypeJSON, ns, resourceEncoding, master.DefaultAPIResourceConfigSource())
+	storageFactory.SetSerializer(
+		schema.GroupResource{Group: v1.GroupName, Resource: serverstorage.AllResources},
+		"",
+		ns)
+	storageFactory.SetSerializer(
+		schema.GroupResource{Group: autoscaling.GroupName, Resource: serverstorage.AllResources},
+		"",
+		ns)
+	storageFactory.SetSerializer(
+		schema.GroupResource{Group: batch.GroupName, Resource: serverstorage.AllResources},
+		"",
+		ns)
+	storageFactory.SetSerializer(
+		schema.GroupResource{Group: apps.GroupName, Resource: serverstorage.AllResources},
+		"",
+		ns)
+	storageFactory.SetSerializer(
+		schema.GroupResource{Group: extensions.GroupName, Resource: serverstorage.AllResources},
+		"",
+		ns)
+	storageFactory.SetSerializer(
+		schema.GroupResource{Group: policy.GroupName, Resource: serverstorage.AllResources},
+		"",
+		ns)
+	storageFactory.SetSerializer(
+		schema.GroupResource{Group: rbac.GroupName, Resource: serverstorage.AllResources},
+		"",
+		ns)
+	storageFactory.SetSerializer(
+		schema.GroupResource{Group: certificates.GroupName, Resource: serverstorage.AllResources},
+		"",
+		ns)
+	storageFactory.SetSerializer(
+		schema.GroupResource{Group: storage.GroupName, Resource: serverstorage.AllResources},
+		"",
+		ns)
+
+	genericConfig := genericapiserver.NewConfig(api.Codecs)
+	kubeVersion := version.Get()
+	genericConfig.Version = &kubeVersion
+	genericConfig.Authorizer = authorizerfactory.NewAlwaysAllowAuthorizer()
+	genericConfig.AdmissionControl = admit.NewAlwaysAdmit()
+	genericConfig.EnableMetrics = true
+
+	err := etcdOptions.ApplyWithStorageFactoryTo(storageFactory, genericConfig)
+	if err != nil {
+		panic(err)
+	}
+
+	return &master.Config{
+		GenericConfig: genericConfig,
+		ExtraConfig: master.ExtraConfig{
+			APIResourceConfigSource: master.DefaultAPIResourceConfigSource(),
+			StorageFactory:          storageFactory,
+			EnableCoreControllers:   true,
+			KubeletClientConfig:     kubeletclient.KubeletClientConfig{Port: 10250},
+			APIServerServicePort:    443,
+			MasterCount:             1,
+		},
+	}
+}
+
+// Returns the master config appropriate for most integration tests.
+func NewIntegrationTestMasterConfig() *master.Config {
+	masterConfig := NewMasterConfig()
+	masterConfig.ExtraConfig.EnableCoreControllers = true
+	masterConfig.GenericConfig.PublicAddress = net.ParseIP("192.168.10.4")
+	masterConfig.ExtraConfig.APIResourceConfigSource = master.DefaultAPIResourceConfigSource()
+	return masterConfig
+}
+
+func (m *MasterComponents) stopRCManager() {
+	close(m.rcStopCh)
+}
+
+func (m *MasterComponents) Stop(apiServer, rcManager bool) {
+	glog.Infof("Stopping master components")
+	if rcManager {
+		// Ordering matters because the apiServer will only shutdown when pending
+		// requests are done
+		m.once.Do(m.stopRCManager)
+	}
+	if apiServer {
+		m.CloseFn()
+	}
+}
+
+func CreateTestingNamespace(baseName string, apiserver *httptest.Server, t *testing.T) *v1.Namespace {
+	// TODO: Create a namespace with a given basename.
+	// Currently we neither create the namespace nor delete all its contents at the end.
+	// But as long as tests are not using the same namespaces, this should work fine.
+	return &v1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			// TODO: Once we start creating namespaces, switch to GenerateName.
+			Name: baseName,
+		},
+	}
+}
+
+func DeleteTestingNamespace(ns *v1.Namespace, apiserver *httptest.Server, t *testing.T) {
+	// TODO: Remove all resources from a given namespace once we implement CreateTestingNamespace.
+}
+
+// RCFromManifest reads a .json file and returns the rc in it.
+func RCFromManifest(fileName string) *v1.ReplicationController {
+	data, err := ioutil.ReadFile(fileName)
+	if err != nil {
+		glog.Fatalf("Unexpected error reading rc manifest %v", err)
+	}
+	var controller v1.ReplicationController
+	if err := runtime.DecodeInto(testapi.Default.Codec(), data, &controller); err != nil {
+		glog.Fatalf("Unexpected error reading rc manifest %v", err)
+	}
+	return &controller
+}
+
+// StopRC stops the rc via kubectl's stop library
+func StopRC(rc *v1.ReplicationController, clientset internalclientset.Interface) error {
+	reaper, err := kubectl.ReaperFor(api.Kind("ReplicationController"), clientset)
+	if err != nil || reaper == nil {
+		return err
+	}
+	err = reaper.Stop(rc.Namespace, rc.Name, 0, nil)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// ScaleRC scales the given rc to the given replicas.
+func ScaleRC(name, ns string, replicas int32, clientset internalclientset.Interface) (*api.ReplicationController, error) {
+	scaler, err := kubectl.ScalerFor(api.Kind("ReplicationController"), clientset)
+	if err != nil {
+		return nil, err
+	}
+	retry := &kubectl.RetryParams{Interval: 50 * time.Millisecond, Timeout: DefaultTimeout}
+	waitForReplicas := &kubectl.RetryParams{Interval: 50 * time.Millisecond, Timeout: DefaultTimeout}
+	err = scaler.Scale(ns, name, uint(replicas), nil, retry, waitForReplicas)
+	if err != nil {
+		return nil, err
+	}
+	scaled, err := clientset.Core().ReplicationControllers(ns).Get(name, metav1.GetOptions{})
+	if err != nil {
+		return nil, err
+	}
+	return scaled, nil
+}
+
+// CloseFunc can be called to cleanup the master
+type CloseFunc func()
+
+func RunAMaster(masterConfig *master.Config) (*master.Master, *httptest.Server, CloseFunc) {
+	if masterConfig == nil {
+		masterConfig = NewMasterConfig()
+		masterConfig.GenericConfig.EnableProfiling = true
+		masterConfig.GenericConfig.EnableMetrics = true
+	}
+	return startMasterOrDie(masterConfig, nil, nil)
+}
+
+func RunAMasterUsingServer(masterConfig *master.Config, s *httptest.Server, masterReceiver MasterReceiver) (*master.Master, *httptest.Server, CloseFunc) {
+	return startMasterOrDie(masterConfig, s, masterReceiver)
+}
+
+// Task is a function passed to worker goroutines by RunParallel.
+// The function needs to implement its own thread safety.
+type Task func(id int) error
+
+// RunParallel spawns a goroutine per task in the given queue
+func RunParallel(task Task, numTasks, numWorkers int) {
+	start := time.Now()
+	if numWorkers <= 0 {
+		numWorkers = numTasks
+	}
+	defer func() {
+		glog.Infof("RunParallel took %v for %d tasks and %d workers", time.Since(start), numTasks, numWorkers)
+	}()
+	var wg sync.WaitGroup
+	semCh := make(chan struct{}, numWorkers)
+	wg.Add(numTasks)
+	for id := 0; id < numTasks; id++ {
+		go func(id int) {
+			semCh <- struct{}{}
+			err := task(id)
+			if err != nil {
+				glog.Fatalf("Worker failed with %v", err)
+			}
+			<-semCh
+			wg.Done()
+		}(id)
+	}
+	wg.Wait()
+	close(semCh)
+}
+
+// FindFreeLocalPort returns the number of an available port number on
+// the loopback interface.  Useful for determining the port to launch
+// a server on.  Error handling required - there is a non-zero chance
+// that the returned port number will be bound by another process
+// after this function returns.
+func FindFreeLocalPort() (int, error) {
+	l, err := net.Listen("tcp", ":0")
+	if err != nil {
+		return 0, err
+	}
+	defer l.Close()
+	_, portStr, err := net.SplitHostPort(l.Addr().String())
+	if err != nil {
+		return 0, err
+	}
+	port, err := strconv.Atoi(portStr)
+	if err != nil {
+		return 0, err
+	}
+	return port, nil
+}

vendor/k8s.io/kubernetes/test/integration/framework/perf_utils.go

@@ -0,0 +1,104 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package framework
+
+import (
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientset "k8s.io/client-go/kubernetes"
+	e2eframework "k8s.io/kubernetes/test/e2e/framework"
+	testutils "k8s.io/kubernetes/test/utils"
+
+	"github.com/golang/glog"
+)
+
+const (
+	retries = 5
+)
+
+type IntegrationTestNodePreparer struct {
+	client          clientset.Interface
+	countToStrategy []testutils.CountToStrategy
+	nodeNamePrefix  string
+}
+
+func NewIntegrationTestNodePreparer(client clientset.Interface, countToStrategy []testutils.CountToStrategy, nodeNamePrefix string) testutils.TestNodePreparer {
+	return &IntegrationTestNodePreparer{
+		client:          client,
+		countToStrategy: countToStrategy,
+		nodeNamePrefix:  nodeNamePrefix,
+	}
+}
+
+func (p *IntegrationTestNodePreparer) PrepareNodes() error {
+	numNodes := 0
+	for _, v := range p.countToStrategy {
+		numNodes += v.Count
+	}
+
+	glog.Infof("Making %d nodes", numNodes)
+	baseNode := &v1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			GenerateName: p.nodeNamePrefix,
+		},
+		Spec: v1.NodeSpec{
+			// TODO: investigate why this is needed.
+			ExternalID: "foo",
+		},
+		Status: v1.NodeStatus{
+			Capacity: v1.ResourceList{
+				v1.ResourcePods:   *resource.NewQuantity(110, resource.DecimalSI),
+				v1.ResourceCPU:    resource.MustParse("4"),
+				v1.ResourceMemory: resource.MustParse("32Gi"),
+			},
+			Phase: v1.NodeRunning,
+			Conditions: []v1.NodeCondition{
+				{Type: v1.NodeReady, Status: v1.ConditionTrue},
+			},
+		},
+	}
+	for i := 0; i < numNodes; i++ {
+		if _, err := p.client.Core().Nodes().Create(baseNode); err != nil {
+			glog.Fatalf("Error creating node: %v", err)
+		}
+	}
+
+	nodes := e2eframework.GetReadySchedulableNodesOrDie(p.client)
+	index := 0
+	sum := 0
+	for _, v := range p.countToStrategy {
+		sum += v.Count
+		for ; index < sum; index++ {
+			if err := testutils.DoPrepareNode(p.client, &nodes.Items[index], v.Strategy); err != nil {
+				glog.Errorf("Aborting node preparation: %v", err)
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (p *IntegrationTestNodePreparer) CleanupNodes() error {
+	nodes := e2eframework.GetReadySchedulableNodesOrDie(p.client)
+	for i := range nodes.Items {
+		if err := p.client.Core().Nodes().Delete(nodes.Items[i].Name, &metav1.DeleteOptions{}); err != nil {
+			glog.Errorf("Error while deleting Node: %v", err)
+		}
+	}
+	return nil
+}

vendor/k8s.io/kubernetes/test/integration/framework/serializer.go

@@ -0,0 +1,53 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package framework
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer/versioning"
+)
+
+// NewSingleContentTypeSerializer wraps a serializer in a NegotiatedSerializer that handles one content type
+func NewSingleContentTypeSerializer(scheme *runtime.Scheme, info runtime.SerializerInfo) runtime.StorageSerializer {
+	return &wrappedSerializer{
+		scheme: scheme,
+		info:   info,
+	}
+}
+
+type wrappedSerializer struct {
+	scheme *runtime.Scheme
+	info   runtime.SerializerInfo
+}
+
+var _ runtime.StorageSerializer = &wrappedSerializer{}
+
+func (s *wrappedSerializer) SupportedMediaTypes() []runtime.SerializerInfo {
+	return []runtime.SerializerInfo{s.info}
+}
+
+func (s *wrappedSerializer) UniversalDeserializer() runtime.Decoder {
+	return s.info.Serializer
+}
+
+func (s *wrappedSerializer) EncoderForVersion(encoder runtime.Encoder, gv runtime.GroupVersioner) runtime.Encoder {
+	return versioning.NewCodec(encoder, nil, s.scheme, s.scheme, s.scheme, s.scheme, s.scheme, gv, nil)
+}
+
+func (s *wrappedSerializer) DecoderToVersion(decoder runtime.Decoder, gv runtime.GroupVersioner) runtime.Decoder {
+	return versioning.NewCodec(nil, decoder, s.scheme, s.scheme, s.scheme, s.scheme, s.scheme, nil, gv)
+}

vendor/k8s.io/kubernetes/test/integration/framework/util.go

@@ -0,0 +1,53 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// TODO: This file can potentially be moved to a common place used by both e2e and integration tests.
+
+package framework
+
+import (
+	"strings"
+
+	clientset "k8s.io/client-go/kubernetes"
+)
+
+const (
+	// When these values are updated, also update cmd/kubelet/app/options/options.go
+	// A copy of these values exist in e2e/framework/util.go.
+	currentPodInfraContainerImageName    = "gcr.io/google_containers/pause"
+	currentPodInfraContainerImageVersion = "3.0"
+)
+
+// GetServerArchitecture fetches the architecture of the cluster's apiserver.
+func GetServerArchitecture(c clientset.Interface) string {
+	arch := ""
+	sVer, err := c.Discovery().ServerVersion()
+	if err != nil || sVer.Platform == "" {
+		// If we failed to get the server version for some reason, default to amd64.
+		arch = "amd64"
+	} else {
+		// Split the platform string into OS and Arch separately.
+		// The platform string may for example be "linux/amd64", "linux/arm" or "windows/amd64".
+		osArchArray := strings.Split(sVer.Platform, "/")
+		arch = osArchArray[1]
+	}
+	return arch
+}
+
+// GetPauseImageName fetches the pause image name for the same architecture as the apiserver.
+func GetPauseImageName(c clientset.Interface) string {
+	return currentPodInfraContainerImageName + "-" + GetServerArchitecture(c) + ":" + currentPodInfraContainerImageVersion
+}

vendor/k8s.io/kubernetes/test/integration/garbagecollector/BUILD

@@ -0,0 +1,49 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = ["garbage_collector_test.go"],
+    tags = ["integration"],
+    deps = [
+        "//cmd/kube-apiserver/app/testing:go_default_library",
+        "//pkg/controller/garbagecollector:go_default_library",
+        "//test/integration:go_default_library",
+        "//vendor/github.com/coreos/pkg/capnslog:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1:go_default_library",
+        "//vendor/k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset:go_default_library",
+        "//vendor/k8s.io/apiextensions-apiserver/test/integration/testserver:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/storage/names:go_default_library",
+        "//vendor/k8s.io/client-go/discovery:go_default_library",
+        "//vendor/k8s.io/client-go/discovery/cached:go_default_library",
+        "//vendor/k8s.io/client-go/dynamic:go_default_library",
+        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/tools/cache:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/kubectl/BUILD

@@ -0,0 +1,35 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "kubectl_test.go",
+        "main_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/k8s.io/client-go/tools/clientcmd:go_default_library",
+        "//vendor/k8s.io/client-go/tools/clientcmd/api:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/kubectl/kubectl_test.go

@@ -0,0 +1,76 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kubectl
+
+import (
+	"testing"
+
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestKubectlValidation(t *testing.T) {
+	testCases := []struct {
+		data string
+		// Validation should not fail on missing type information.
+		err bool
+	}{
+		{`{"apiVersion": "v1", "kind": "thisObjectShouldNotExistInAnyGroup"}`, true},
+		{`{"apiVersion": "invalidVersion", "kind": "Pod"}`, false},
+		{`{"apiVersion": "v1", "kind": "Pod"}`, false},
+
+		// The following test the experimental api.
+		// TODO: Replace with something more robust. These may move.
+		{`{"apiVersion": "extensions/v1beta1", "kind": "Ingress"}`, false},
+		{`{"apiVersion": "extensions/v1beta1", "kind": "DaemonSet"}`, false},
+		{`{"apiVersion": "vNotAVersion", "kind": "DaemonSet"}`, false},
+	}
+	components := framework.NewMasterComponents(&framework.Config{})
+	defer components.Stop(true, true)
+	ctx := clientcmdapi.NewContext()
+	cfg := clientcmdapi.NewConfig()
+	cluster := clientcmdapi.NewCluster()
+
+	cluster.Server = components.ApiServer.URL
+	cluster.InsecureSkipTLSVerify = true
+	cfg.Contexts = map[string]*clientcmdapi.Context{"test": ctx}
+	cfg.CurrentContext = "test"
+	overrides := clientcmd.ConfigOverrides{
+		ClusterInfo: *cluster,
+	}
+	cmdConfig := clientcmd.NewNonInteractiveClientConfig(*cfg, "test", &overrides, nil)
+	factory := util.NewFactory(cmdConfig)
+	schema, err := factory.Validator(true, true, "")
+	if err != nil {
+		t.Errorf("failed to get validator: %v", err)
+		return
+	}
+	for i, test := range testCases {
+		err := schema.ValidateBytes([]byte(test.data))
+		if err == nil {
+			if test.err {
+				t.Errorf("case %d: expected error", i)
+			}
+		} else {
+			if !test.err {
+				t.Errorf("case %d: unexpected error: %v", i, err)
+			}
+		}
+	}
+}

vendor/k8s.io/kubernetes/test/integration/kubectl/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kubectl
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/master/BUILD

@@ -0,0 +1,50 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "main_test.go",
+        "master_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset:go_default_library",
+        "//pkg/master:go_default_library",
+        "//test/integration:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/github.com/ghodss/yaml:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/group:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/request/bearertoken:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authorization/authorizerfactory:go_default_library",
+        "//vendor/k8s.io/apiserver/plugin/pkg/authenticator/token/tokentest:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes/typed/core/v1:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/master/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package master
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/master/master_test.go

@@ -0,0 +1,768 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package master
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/ghodss/yaml"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/apiserver/pkg/authentication/group"
+	"k8s.io/apiserver/pkg/authentication/request/bearertoken"
+	"k8s.io/apiserver/pkg/authentication/user"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+	"k8s.io/apiserver/pkg/authorization/authorizerfactory"
+	"k8s.io/apiserver/plugin/pkg/authenticator/token/tokentest"
+	clienttypedv1 "k8s.io/client-go/kubernetes/typed/core/v1"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	clientset "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
+	"k8s.io/kubernetes/pkg/master"
+	"k8s.io/kubernetes/test/integration"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+const (
+	AliceToken string = "abc123" // username: alice.  Present in token file.
+	BobToken   string = "xyz987" // username: bob.  Present in token file.
+)
+
+type allowAliceAuthorizer struct{}
+
+func (allowAliceAuthorizer) Authorize(a authorizer.Attributes) (bool, string, error) {
+	if a.GetUser() != nil && a.GetUser().GetName() == "alice" {
+		return true, "", nil
+	}
+	return false, "I can't allow that.  Go ask alice.", nil
+}
+
+func testPrefix(t *testing.T, prefix string) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	resp, err := http.Get(s.URL + prefix)
+	if err != nil {
+		t.Fatalf("unexpected error getting %s prefix: %v", prefix, err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("got status %v instead of 200 OK", resp.StatusCode)
+	}
+}
+
+func TestAutoscalingPrefix(t *testing.T) {
+	testPrefix(t, "/apis/autoscaling/")
+}
+
+func TestBatchPrefix(t *testing.T) {
+	testPrefix(t, "/apis/batch/")
+}
+
+func TestAppsPrefix(t *testing.T) {
+	testPrefix(t, "/apis/apps/")
+}
+
+func TestExtensionsPrefix(t *testing.T) {
+	testPrefix(t, "/apis/extensions/")
+}
+
+func TestKubernetesService(t *testing.T) {
+	config := framework.NewMasterConfig()
+	_, _, closeFn := framework.RunAMaster(config)
+	defer closeFn()
+	coreClient := clientset.NewForConfigOrDie(config.GenericConfig.LoopbackClientConfig)
+	if _, err := coreClient.Core().Services(metav1.NamespaceDefault).Get("kubernetes", metav1.GetOptions{}); err != nil {
+		t.Fatalf("Expected kubernetes service to exists, got: %v", err)
+	}
+}
+
+func TestEmptyList(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	u := s.URL + "/api/v1/namespaces/default/pods"
+	resp, err := http.Get(u)
+	if err != nil {
+		t.Fatalf("unexpected error getting %s: %v", u, err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("got status %v instead of 200 OK", resp.StatusCode)
+	}
+	defer resp.Body.Close()
+	data, _ := ioutil.ReadAll(resp.Body)
+	decodedData := map[string]interface{}{}
+	if err := json.Unmarshal(data, &decodedData); err != nil {
+		t.Logf("body: %s", string(data))
+		t.Fatalf("got error decoding data: %v", err)
+	}
+	if items, ok := decodedData["items"]; !ok {
+		t.Logf("body: %s", string(data))
+		t.Fatalf("missing items field in empty list (all lists should return an items field)")
+	} else if items == nil {
+		t.Logf("body: %s", string(data))
+		t.Fatalf("nil items field from empty list (all lists should return non-nil empty items lists)")
+	}
+}
+
+func initStatusForbiddenMasterCongfig() *master.Config {
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	masterConfig.GenericConfig.Authorizer = authorizerfactory.NewAlwaysDenyAuthorizer()
+	return masterConfig
+}
+
+func initUnauthorizedMasterCongfig() *master.Config {
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	tokenAuthenticator := tokentest.New()
+	tokenAuthenticator.Tokens[AliceToken] = &user.DefaultInfo{Name: "alice", UID: "1"}
+	tokenAuthenticator.Tokens[BobToken] = &user.DefaultInfo{Name: "bob", UID: "2"}
+	masterConfig.GenericConfig.Authenticator = group.NewGroupAdder(bearertoken.New(tokenAuthenticator), []string{user.AllAuthenticated})
+	masterConfig.GenericConfig.Authorizer = allowAliceAuthorizer{}
+	return masterConfig
+}
+
+func TestStatus(t *testing.T) {
+	testCases := []struct {
+		name         string
+		masterConfig *master.Config
+		statusCode   int
+		reqPath      string
+		reason       string
+		message      string
+	}{
+		{
+			name:         "404",
+			masterConfig: nil,
+			statusCode:   http.StatusNotFound,
+			reqPath:      "/apis/batch/v1/namespaces/default/jobs/foo",
+			reason:       "NotFound",
+			message:      `jobs.batch "foo" not found`,
+		},
+		{
+			name:         "403",
+			masterConfig: initStatusForbiddenMasterCongfig(),
+			statusCode:   http.StatusForbidden,
+			reqPath:      "/apis",
+			reason:       "Forbidden",
+			message:      `forbidden: User "" cannot get path "/apis": Everything is forbidden.`,
+		},
+		{
+			name:         "401",
+			masterConfig: initUnauthorizedMasterCongfig(),
+			statusCode:   http.StatusUnauthorized,
+			reqPath:      "/apis",
+			reason:       "Unauthorized",
+			message:      `Unauthorized`,
+		},
+	}
+
+	for _, tc := range testCases {
+		_, s, closeFn := framework.RunAMaster(tc.masterConfig)
+		defer closeFn()
+
+		u := s.URL + tc.reqPath
+		resp, err := http.Get(u)
+		if err != nil {
+			t.Fatalf("unexpected error getting %s: %v", u, err)
+		}
+		if resp.StatusCode != tc.statusCode {
+			t.Fatalf("got status %v instead of %s", resp.StatusCode, tc.name)
+		}
+		defer resp.Body.Close()
+		data, _ := ioutil.ReadAll(resp.Body)
+		decodedData := map[string]interface{}{}
+		if err := json.Unmarshal(data, &decodedData); err != nil {
+			t.Logf("body: %s", string(data))
+			t.Fatalf("got error decoding data: %v", err)
+		}
+		t.Logf("body: %s", string(data))
+
+		if got, expected := decodedData["apiVersion"], "v1"; got != expected {
+			t.Errorf("unexpected apiVersion %q, expected %q", got, expected)
+		}
+		if got, expected := decodedData["kind"], "Status"; got != expected {
+			t.Errorf("unexpected kind %q, expected %q", got, expected)
+		}
+		if got, expected := decodedData["status"], "Failure"; got != expected {
+			t.Errorf("unexpected status %q, expected %q", got, expected)
+		}
+		if got, expected := decodedData["code"], float64(tc.statusCode); got != expected {
+			t.Errorf("unexpected code %v, expected %v", got, expected)
+		}
+		if got, expected := decodedData["reason"], tc.reason; got != expected {
+			t.Errorf("unexpected reason %v, expected %v", got, expected)
+		}
+		if got, expected := decodedData["message"], tc.message; got != expected {
+			t.Errorf("unexpected message %v, expected %v", got, expected)
+		}
+	}
+}
+
+func TestWatchSucceedsWithoutArgs(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	resp, err := http.Get(s.URL + "/api/v1/namespaces?watch=1")
+	if err != nil {
+		t.Fatalf("unexpected error getting experimental prefix: %v", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("got status %v instead of 200 OK", resp.StatusCode)
+	}
+	resp.Body.Close()
+}
+
+var hpaV1 string = `
+{
+  "apiVersion": "autoscaling/v1",
+  "kind": "HorizontalPodAutoscaler",
+  "metadata": {
+    "name": "test-hpa",
+    "namespace": "default"
+  },
+  "spec": {
+    "scaleTargetRef": {
+      "kind": "ReplicationController",
+      "name": "test-hpa",
+      "namespace": "default"
+    },
+    "minReplicas": 1,
+    "maxReplicas": 10,
+    "targetCPUUtilizationPercentage": 50
+  }
+}
+`
+
+var deploymentExtensions string = `
+{
+  "apiVersion": "extensions/v1beta1",
+  "kind": "Deployment",
+  "metadata": {
+     "name": "test-deployment1",
+     "namespace": "default"
+  },
+  "spec": {
+    "replicas": 1,
+    "template": {
+      "metadata": {
+        "labels": {
+          "app": "nginx0"
+        }
+      },
+      "spec": {
+        "containers": [{
+          "name": "nginx",
+          "image": "gcr.io/google-containers/nginx:1.7.9"
+        }]
+      }
+    }
+  }
+}
+`
+
+var deploymentApps string = `
+{
+  "apiVersion": "apps/v1beta1",
+  "kind": "Deployment",
+  "metadata": {
+     "name": "test-deployment2",
+     "namespace": "default"
+  },
+  "spec": {
+    "replicas": 1,
+    "template": {
+      "metadata": {
+        "labels": {
+          "app": "nginx0"
+        }
+      },
+      "spec": {
+        "containers": [{
+          "name": "nginx",
+          "image": "gcr.io/google-containers/nginx:1.7.9"
+        }]
+      }
+    }
+  }
+}
+`
+
+func autoscalingPath(resource, namespace, name string) string {
+	return testapi.Autoscaling.ResourcePath(resource, namespace, name)
+}
+
+func batchPath(resource, namespace, name string) string {
+	return testapi.Batch.ResourcePath(resource, namespace, name)
+}
+
+func extensionsPath(resource, namespace, name string) string {
+	return testapi.Extensions.ResourcePath(resource, namespace, name)
+}
+
+func appsPath(resource, namespace, name string) string {
+	return testapi.Apps.ResourcePath(resource, namespace, name)
+}
+
+func TestAutoscalingGroupBackwardCompatibility(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+	transport := http.DefaultTransport
+
+	requests := []struct {
+		verb                string
+		URL                 string
+		body                string
+		expectedStatusCodes map[int]bool
+		expectedVersion     string
+	}{
+		{"POST", autoscalingPath("horizontalpodautoscalers", metav1.NamespaceDefault, ""), hpaV1, integration.Code201, ""},
+		{"GET", autoscalingPath("horizontalpodautoscalers", metav1.NamespaceDefault, ""), "", integration.Code200, testapi.Autoscaling.GroupVersion().String()},
+	}
+
+	for _, r := range requests {
+		bodyBytes := bytes.NewReader([]byte(r.body))
+		req, err := http.NewRequest(r.verb, s.URL+r.URL, bodyBytes)
+		if err != nil {
+			t.Logf("case %v", r)
+			t.Fatalf("unexpected error: %v", err)
+		}
+		func() {
+			resp, err := transport.RoundTrip(req)
+			defer resp.Body.Close()
+			if err != nil {
+				t.Logf("case %v", r)
+				t.Fatalf("unexpected error: %v", err)
+			}
+			b, _ := ioutil.ReadAll(resp.Body)
+			body := string(b)
+			if _, ok := r.expectedStatusCodes[resp.StatusCode]; !ok {
+				t.Logf("case %v", r)
+				t.Errorf("Expected status one of %v, but got %v", r.expectedStatusCodes, resp.StatusCode)
+				t.Errorf("Body: %v", body)
+			}
+			if !strings.Contains(body, "\"apiVersion\":\""+r.expectedVersion) {
+				t.Logf("case %v", r)
+				t.Errorf("Expected version %v, got body %v", r.expectedVersion, body)
+			}
+		}()
+	}
+}
+
+func TestAppsGroupBackwardCompatibility(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+	transport := http.DefaultTransport
+
+	requests := []struct {
+		verb                string
+		URL                 string
+		body                string
+		expectedStatusCodes map[int]bool
+		expectedVersion     string
+	}{
+		// Post to extensions endpoint and get back from both: extensions and apps
+		{"POST", extensionsPath("deployments", metav1.NamespaceDefault, ""), deploymentExtensions, integration.Code201, ""},
+		{"GET", extensionsPath("deployments", metav1.NamespaceDefault, "test-deployment1"), "", integration.Code200, testapi.Extensions.GroupVersion().String()},
+		{"GET", appsPath("deployments", metav1.NamespaceDefault, "test-deployment1"), "", integration.Code200, testapi.Apps.GroupVersion().String()},
+		{"DELETE", extensionsPath("deployments", metav1.NamespaceDefault, "test-deployment1"), "", integration.Code200, testapi.Extensions.GroupVersion().String()},
+		// Post to apps endpoint and get back from both: apps and extensions
+		{"POST", appsPath("deployments", metav1.NamespaceDefault, ""), deploymentApps, integration.Code201, ""},
+		{"GET", appsPath("deployments", metav1.NamespaceDefault, "test-deployment2"), "", integration.Code200, testapi.Apps.GroupVersion().String()},
+		{"GET", extensionsPath("deployments", metav1.NamespaceDefault, "test-deployment2"), "", integration.Code200, testapi.Extensions.GroupVersion().String()},
+		{"DELETE", appsPath("deployments", metav1.NamespaceDefault, "test-deployment2"), "", integration.Code200, testapi.Apps.GroupVersion().String()},
+	}
+
+	for _, r := range requests {
+		bodyBytes := bytes.NewReader([]byte(r.body))
+		req, err := http.NewRequest(r.verb, s.URL+r.URL, bodyBytes)
+		if err != nil {
+			t.Logf("case %v", r)
+			t.Fatalf("unexpected error: %v", err)
+		}
+		func() {
+			resp, err := transport.RoundTrip(req)
+			defer resp.Body.Close()
+			if err != nil {
+				t.Logf("case %v", r)
+				t.Fatalf("unexpected error: %v", err)
+			}
+			b, _ := ioutil.ReadAll(resp.Body)
+			body := string(b)
+			if _, ok := r.expectedStatusCodes[resp.StatusCode]; !ok {
+				t.Logf("case %v", r)
+				t.Errorf("Expected status one of %v, but got %v", r.expectedStatusCodes, resp.StatusCode)
+				t.Errorf("Body: %v", body)
+			}
+			if !strings.Contains(body, "\"apiVersion\":\""+r.expectedVersion) {
+				t.Logf("case %v", r)
+				t.Errorf("Expected version %v, got body %v", r.expectedVersion, body)
+			}
+		}()
+	}
+}
+
+func TestAccept(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	resp, err := http.Get(s.URL + "/api/")
+	if err != nil {
+		t.Fatalf("unexpected error getting api: %v", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("got status %v instead of 200 OK", resp.StatusCode)
+	}
+
+	body, _ := ioutil.ReadAll(resp.Body)
+	if resp.Header.Get("Content-Type") != "application/json" {
+		t.Errorf("unexpected content: %s", body)
+	}
+	if err := json.Unmarshal(body, &map[string]interface{}{}); err != nil {
+		t.Fatal(err)
+	}
+
+	req, err := http.NewRequest("GET", s.URL+"/api/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Accept", "application/yaml")
+	resp, err = http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _ = ioutil.ReadAll(resp.Body)
+	if resp.Header.Get("Content-Type") != "application/yaml" {
+		t.Errorf("unexpected content: %s", body)
+	}
+	t.Logf("body: %s", body)
+	if err := yaml.Unmarshal(body, &map[string]interface{}{}); err != nil {
+		t.Fatal(err)
+	}
+
+	req, err = http.NewRequest("GET", s.URL+"/api/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Accept", "application/json, application/yaml")
+	resp, err = http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _ = ioutil.ReadAll(resp.Body)
+	if resp.Header.Get("Content-Type") != "application/json" {
+		t.Errorf("unexpected content: %s", body)
+	}
+	t.Logf("body: %s", body)
+	if err := yaml.Unmarshal(body, &map[string]interface{}{}); err != nil {
+		t.Fatal(err)
+	}
+
+	req, err = http.NewRequest("GET", s.URL+"/api/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Accept", "application") // not a valid media type
+	resp, err = http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp.StatusCode != http.StatusNotAcceptable {
+		t.Errorf("unexpected error from the server")
+	}
+}
+
+func countEndpoints(eps *api.Endpoints) int {
+	count := 0
+	for i := range eps.Subsets {
+		count += len(eps.Subsets[i].Addresses) * len(eps.Subsets[i].Ports)
+	}
+	return count
+}
+
+func TestMasterService(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(framework.NewIntegrationTestMasterConfig())
+	defer closeFn()
+
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[api.GroupName].GroupVersion()}})
+
+	err := wait.Poll(time.Second, time.Minute, func() (bool, error) {
+		svcList, err := client.Core().Services(metav1.NamespaceDefault).List(metav1.ListOptions{})
+		if err != nil {
+			t.Errorf("unexpected error: %v", err)
+			return false, nil
+		}
+		found := false
+		for i := range svcList.Items {
+			if svcList.Items[i].Name == "kubernetes" {
+				found = true
+				break
+			}
+		}
+		if found {
+			ep, err := client.Core().Endpoints(metav1.NamespaceDefault).Get("kubernetes", metav1.GetOptions{})
+			if err != nil {
+				return false, nil
+			}
+			if countEndpoints(ep) == 0 {
+				return false, fmt.Errorf("no endpoints for kubernetes service: %v", ep)
+			}
+			return true, nil
+		}
+		return false, nil
+	})
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
+func TestServiceAlloc(t *testing.T) {
+	cfg := framework.NewIntegrationTestMasterConfig()
+	_, cidr, err := net.ParseCIDR("192.168.0.0/29")
+	if err != nil {
+		t.Fatalf("bad cidr: %v", err)
+	}
+	cfg.ExtraConfig.ServiceIPRange = *cidr
+	_, s, closeFn := framework.RunAMaster(cfg)
+	defer closeFn()
+
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[api.GroupName].GroupVersion()}})
+
+	svc := func(i int) *api.Service {
+		return &api.Service{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: fmt.Sprintf("svc-%v", i),
+			},
+			Spec: api.ServiceSpec{
+				Type: api.ServiceTypeClusterIP,
+				Ports: []api.ServicePort{
+					{Port: 80},
+				},
+			},
+		}
+	}
+
+	// Wait until the default "kubernetes" service is created.
+	if err = wait.Poll(250*time.Millisecond, time.Minute, func() (bool, error) {
+		_, err := client.Core().Services(metav1.NamespaceDefault).Get("kubernetes", metav1.GetOptions{})
+		if err != nil && !errors.IsNotFound(err) {
+			return false, err
+		}
+		return !errors.IsNotFound(err), nil
+	}); err != nil {
+		t.Fatalf("creating kubernetes service timed out")
+	}
+
+	// make 5 more services to take up all IPs
+	for i := 0; i < 5; i++ {
+		if _, err := client.Core().Services(metav1.NamespaceDefault).Create(svc(i)); err != nil {
+			t.Error(err)
+		}
+	}
+
+	// Make another service. It will fail because we're out of cluster IPs
+	if _, err := client.Core().Services(metav1.NamespaceDefault).Create(svc(8)); err != nil {
+		if !strings.Contains(err.Error(), "range is full") {
+			t.Errorf("unexpected error text: %v", err)
+		}
+	} else {
+		svcs, err := client.Core().Services(metav1.NamespaceAll).List(metav1.ListOptions{})
+		if err != nil {
+			t.Fatalf("unexpected success, and error getting the services: %v", err)
+		}
+		allIPs := []string{}
+		for _, s := range svcs.Items {
+			allIPs = append(allIPs, s.Spec.ClusterIP)
+		}
+		t.Fatalf("unexpected creation success. The following IPs exist: %#v. It should only be possible to allocate 2 IP addresses in this cluster.\n\n%#v", allIPs, svcs)
+	}
+
+	// Delete the first service.
+	if err := client.Core().Services(metav1.NamespaceDefault).Delete(svc(1).ObjectMeta.Name, nil); err != nil {
+		t.Fatalf("got unexpected error: %v", err)
+	}
+
+	// This time creating the second service should work.
+	if _, err := client.Core().Services(metav1.NamespaceDefault).Create(svc(8)); err != nil {
+		t.Fatalf("got unexpected error: %v", err)
+	}
+}
+
+// TestUpdateNodeObjects represents a simple version of the behavior of node checkins at steady
+// state. This test allows for easy profiling of a realistic master scenario for baseline CPU
+// in very large clusters. It is disabled by default - start a kube-apiserver and pass
+// UPDATE_NODE_APISERVER as the host value.
+func TestUpdateNodeObjects(t *testing.T) {
+	server := os.Getenv("UPDATE_NODE_APISERVER")
+	if len(server) == 0 {
+		t.Skip("UPDATE_NODE_APISERVER is not set")
+	}
+	c := clienttypedv1.NewForConfigOrDie(&restclient.Config{
+		QPS:  10000,
+		Host: server,
+		ContentConfig: restclient.ContentConfig{
+			AcceptContentTypes: "application/vnd.kubernetes.protobuf",
+			ContentType:        "application/vnd.kubernetes.protobuf",
+		},
+	})
+
+	nodes := 400
+	listers := 5
+	watchers := 50
+	iterations := 10000
+
+	for i := 0; i < nodes*6; i++ {
+		c.Nodes().Delete(fmt.Sprintf("node-%d", i), nil)
+		_, err := c.Nodes().Create(&v1.Node{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: fmt.Sprintf("node-%d", i),
+			},
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	for k := 0; k < listers; k++ {
+		go func(lister int) {
+			for i := 0; i < iterations; i++ {
+				_, err := c.Nodes().List(metav1.ListOptions{})
+				if err != nil {
+					fmt.Printf("[list:%d] error after %d: %v\n", lister, i, err)
+					break
+				}
+				time.Sleep(time.Duration(lister)*10*time.Millisecond + 1500*time.Millisecond)
+			}
+		}(k)
+	}
+
+	for k := 0; k < watchers; k++ {
+		go func(lister int) {
+			w, err := c.Nodes().Watch(metav1.ListOptions{})
+			if err != nil {
+				fmt.Printf("[watch:%d] error: %v", k, err)
+				return
+			}
+			i := 0
+			for r := range w.ResultChan() {
+				i++
+				if _, ok := r.Object.(*v1.Node); !ok {
+					fmt.Printf("[watch:%d] unexpected object after %d: %#v\n", lister, i, r)
+				}
+				if i%100 == 0 {
+					fmt.Printf("[watch:%d] iteration %d ...\n", lister, i)
+				}
+			}
+			fmt.Printf("[watch:%d] done\n", lister)
+		}(k)
+	}
+
+	var wg sync.WaitGroup
+	wg.Add(nodes - listers)
+
+	for j := 0; j < nodes; j++ {
+		go func(node int) {
+			var lastCount int
+			for i := 0; i < iterations; i++ {
+				if i%100 == 0 {
+					fmt.Printf("[%d] iteration %d ...\n", node, i)
+				}
+				if i%20 == 0 {
+					_, err := c.Nodes().List(metav1.ListOptions{})
+					if err != nil {
+						fmt.Printf("[%d] error after %d: %v\n", node, i, err)
+						break
+					}
+				}
+
+				r, err := c.Nodes().List(metav1.ListOptions{
+					FieldSelector:   fmt.Sprintf("metadata.name=node-%d", node),
+					ResourceVersion: "0",
+				})
+				if err != nil {
+					fmt.Printf("[%d] error after %d: %v\n", node, i, err)
+					break
+				}
+				if len(r.Items) != 1 {
+					fmt.Printf("[%d] error after %d: unexpected list count\n", node, i)
+					break
+				}
+
+				n, err := c.Nodes().Get(fmt.Sprintf("node-%d", node), metav1.GetOptions{})
+				if err != nil {
+					fmt.Printf("[%d] error after %d: %v\n", node, i, err)
+					break
+				}
+				if len(n.Status.Conditions) != lastCount {
+					fmt.Printf("[%d] worker set %d, read %d conditions\n", node, lastCount, len(n.Status.Conditions))
+					break
+				}
+				previousCount := lastCount
+				switch {
+				case i%4 == 0:
+					lastCount = 1
+					n.Status.Conditions = []v1.NodeCondition{
+						{
+							Type:   v1.NodeReady,
+							Status: v1.ConditionTrue,
+							Reason: "foo",
+						},
+					}
+				case i%4 == 1:
+					lastCount = 2
+					n.Status.Conditions = []v1.NodeCondition{
+						{
+							Type:   v1.NodeReady,
+							Status: v1.ConditionFalse,
+							Reason: "foo",
+						},
+						{
+							Type:   v1.NodeDiskPressure,
+							Status: v1.ConditionTrue,
+							Reason: "bar",
+						},
+					}
+				case i%4 == 1:
+					lastCount = 0
+					n.Status.Conditions = nil
+				}
+				if _, err := c.Nodes().UpdateStatus(n); err != nil {
+					if !errors.IsConflict(err) {
+						fmt.Printf("[%d] error after %d: %v\n", node, i, err)
+						break
+					}
+					lastCount = previousCount
+				}
+			}
+			wg.Done()
+			fmt.Printf("[%d] done\n", node)
+		}(j)
+	}
+	wg.Wait()
+}

vendor/k8s.io/kubernetes/test/integration/metrics/BUILD

@@ -0,0 +1,47 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["doc.go"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "main_test.go",
+        "metrics_test.go",
+    ],
+    library = ":go_default_library",
+    tags = ["integration"],
+    deps = [
+        "//pkg/api/testapi:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/github.com/golang/protobuf/proto:go_default_library",
+        "//vendor/github.com/prometheus/client_model/go:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+    ],
+)

vendor/k8s.io/kubernetes/test/integration/metrics/doc.go

@@ -0,0 +1,17 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package metrics

vendor/k8s.io/kubernetes/test/integration/metrics/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package metrics
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/metrics/metrics_test.go

@@ -0,0 +1,127 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package metrics
+
+import (
+	"bufio"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"runtime"
+	"testing"
+
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/test/integration/framework"
+
+	"github.com/golang/glog"
+	"github.com/golang/protobuf/proto"
+	prometheuspb "github.com/prometheus/client_model/go"
+)
+
+const scrapeRequestHeader = "application/vnd.google.protobuf;proto=io.prometheus.client.MetricFamily;encoding=compact-text"
+
+func scrapeMetrics(s *httptest.Server) ([]*prometheuspb.MetricFamily, error) {
+	req, err := http.NewRequest("GET", s.URL+"/metrics", nil)
+	if err != nil {
+		return nil, fmt.Errorf("Unable to create http request: %v", err)
+	}
+	// Ask the prometheus exporter for its text protocol buffer format, since it's
+	// much easier to parse than its plain-text format. Don't use the serialized
+	// proto representation since it uses a non-standard varint delimiter between
+	// metric families.
+	req.Header.Add("Accept", scrapeRequestHeader)
+
+	client := &http.Client{}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("Unable to contact metrics endpoint of master: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != 200 {
+		return nil, fmt.Errorf("Non-200 response trying to scrape metrics from master: %v", resp)
+	}
+
+	// Each line in the response body should contain all the data for a single metric.
+	var metrics []*prometheuspb.MetricFamily
+	scanner := bufio.NewScanner(resp.Body)
+	for scanner.Scan() {
+		var metric prometheuspb.MetricFamily
+		if err := proto.UnmarshalText(scanner.Text(), &metric); err != nil {
+			return nil, fmt.Errorf("Failed to unmarshal line of metrics response: %v", err)
+		}
+		glog.V(4).Infof("Got metric %q", metric.GetName())
+		metrics = append(metrics, &metric)
+	}
+	return metrics, nil
+}
+
+func checkForExpectedMetrics(t *testing.T, metrics []*prometheuspb.MetricFamily, expectedMetrics []string) {
+	foundMetrics := make(map[string]bool)
+	for _, metric := range metrics {
+		foundMetrics[metric.GetName()] = true
+	}
+	for _, expected := range expectedMetrics {
+		if _, found := foundMetrics[expected]; !found {
+			t.Errorf("Master metrics did not include expected metric %q", expected)
+		}
+	}
+}
+
+func TestMasterProcessMetrics(t *testing.T) {
+	if runtime.GOOS == "darwin" || runtime.GOOS == "windows" {
+		t.Skipf("not supported on GOOS=%s", runtime.GOOS)
+	}
+
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	metrics, err := scrapeMetrics(s)
+	if err != nil {
+		t.Fatal(err)
+	}
+	checkForExpectedMetrics(t, metrics, []string{
+		"process_start_time_seconds",
+		"process_cpu_seconds_total",
+		"process_open_fds",
+		"process_resident_memory_bytes",
+	})
+}
+
+func TestApiserverMetrics(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	// Make a request to the apiserver to ensure there's at least one data point
+	// for the metrics we're expecting -- otherwise, they won't be exported.
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+	if _, err := client.Core().Pods(metav1.NamespaceDefault).List(metav1.ListOptions{}); err != nil {
+		t.Fatalf("unexpected error getting pods: %v", err)
+	}
+
+	metrics, err := scrapeMetrics(s)
+	if err != nil {
+		t.Fatal(err)
+	}
+	checkForExpectedMetrics(t, metrics, []string{
+		"apiserver_request_count",
+		"apiserver_request_latencies",
+	})
+}

vendor/k8s.io/kubernetes/test/integration/objectmeta/BUILD

@@ -0,0 +1,38 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "main_test.go",
+        "objectmeta_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//pkg/api/testapi:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/github.com/stretchr/testify/assert:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/objectmeta/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package objectmeta
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/objectmeta/objectmeta_test.go

@@ -0,0 +1,53 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package objectmeta
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestIgnoreClusterName(t *testing.T) {
+	config := framework.NewMasterConfig()
+	_, s, closeFn := framework.RunAMaster(config)
+	defer closeFn()
+
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+	ns := v1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        "test-namespace",
+			ClusterName: "cluster-name-to-ignore",
+		},
+	}
+	nsNew, err := client.Core().Namespaces().Create(&ns)
+	assert.Nil(t, err)
+	assert.Equal(t, ns.Name, nsNew.Name)
+	assert.Empty(t, nsNew.ClusterName)
+
+	nsNew, err = client.Core().Namespaces().Update(&ns)
+	assert.Nil(t, err)
+	assert.Equal(t, ns.Name, nsNew.Name)
+	assert.Empty(t, nsNew.ClusterName)
+}

vendor/k8s.io/kubernetes/test/integration/openshift/BUILD

@@ -0,0 +1,34 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "main_test.go",
+        "openshift_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//pkg/master:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/server:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/openshift/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package openshift
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/openshift/openshift_test.go

@@ -0,0 +1,42 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package openshift
+
+import (
+	"testing"
+
+	genericapiserver "k8s.io/apiserver/pkg/server"
+	"k8s.io/kubernetes/pkg/master"
+)
+
+// This test references methods that OpenShift uses to customize the master on startup, that
+// are not referenced directly by a master.
+func TestMasterExportsSymbols(t *testing.T) {
+	_ = &master.Config{
+		GenericConfig: &genericapiserver.Config{
+			EnableMetrics: true,
+		},
+		ExtraConfig: master.ExtraConfig{
+			EnableCoreControllers: false,
+			EnableUISupport:       false,
+			EnableLogsSupport:     false,
+		},
+	}
+	_ = &master.Master{
+		GenericAPIServer: &genericapiserver.GenericAPIServer{},
+	}
+}

vendor/k8s.io/kubernetes/test/integration/pods/BUILD

@@ -0,0 +1,38 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "main_test.go",
+        "pods_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//pkg/api/testapi:go_default_library",
+        "//test/integration:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/pods/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package pods
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/pods/pods_test.go

@@ -0,0 +1,181 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package pods
+
+import (
+	"fmt"
+	"testing"
+
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/test/integration"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestPodUpdateActiveDeadlineSeconds(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("pod-activedeadline-update", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	var (
+		iZero = int64(0)
+		i30   = int64(30)
+		i60   = int64(60)
+		iNeg  = int64(-1)
+	)
+
+	prototypePod := func() *v1.Pod {
+		return &v1.Pod{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "xxx",
+			},
+			Spec: v1.PodSpec{
+				Containers: []v1.Container{
+					{
+						Name:  "fake-name",
+						Image: "fakeimage",
+					},
+				},
+			},
+		}
+	}
+
+	cases := []struct {
+		name     string
+		original *int64
+		update   *int64
+		valid    bool
+	}{
+		{
+			name:     "no change, nil",
+			original: nil,
+			update:   nil,
+			valid:    true,
+		},
+		{
+			name:     "no change, set",
+			original: &i30,
+			update:   &i30,
+			valid:    true,
+		},
+		{
+			name:     "change to positive from nil",
+			original: nil,
+			update:   &i60,
+			valid:    true,
+		},
+		{
+			name:     "change to smaller positive",
+			original: &i60,
+			update:   &i30,
+			valid:    true,
+		},
+		{
+			name:     "change to larger positive",
+			original: &i30,
+			update:   &i60,
+			valid:    false,
+		},
+		{
+			name:     "change to negative from positive",
+			original: &i30,
+			update:   &iNeg,
+			valid:    false,
+		},
+		{
+			name:     "change to negative from nil",
+			original: nil,
+			update:   &iNeg,
+			valid:    false,
+		},
+		// zero is not allowed, must be a positive integer
+		{
+			name:     "change to zero from positive",
+			original: &i30,
+			update:   &iZero,
+			valid:    false,
+		},
+		{
+			name:     "change to nil from positive",
+			original: &i30,
+			update:   nil,
+			valid:    false,
+		},
+	}
+
+	for i, tc := range cases {
+		pod := prototypePod()
+		pod.Spec.ActiveDeadlineSeconds = tc.original
+		pod.ObjectMeta.Name = fmt.Sprintf("activedeadlineseconds-test-%v", i)
+
+		if _, err := client.Core().Pods(ns.Name).Create(pod); err != nil {
+			t.Errorf("Failed to create pod: %v", err)
+		}
+
+		pod.Spec.ActiveDeadlineSeconds = tc.update
+
+		_, err := client.Core().Pods(ns.Name).Update(pod)
+		if tc.valid && err != nil {
+			t.Errorf("%v: failed to update pod: %v", tc.name, err)
+		} else if !tc.valid && err == nil {
+			t.Errorf("%v: unexpected allowed update to pod", tc.name)
+		}
+
+		integration.DeletePodOrErrorf(t, client, ns.Name, pod.Name)
+	}
+}
+
+func TestPodReadOnlyFilesystem(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	isReadOnly := true
+	ns := framework.CreateTestingNamespace("pod-readonly-root", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	client := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	pod := &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "xxx",
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name:  "fake-name",
+					Image: "fakeimage",
+					SecurityContext: &v1.SecurityContext{
+						ReadOnlyRootFilesystem: &isReadOnly,
+					},
+				},
+			},
+		},
+	}
+
+	if _, err := client.Core().Pods(ns.Name).Create(pod); err != nil {
+		t.Errorf("Failed to create pod: %v", err)
+	}
+
+	integration.DeletePodOrErrorf(t, client, ns.Name, pod.Name)
+}

vendor/k8s.io/kubernetes/test/integration/quota/BUILD

@@ -0,0 +1,55 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "main_test.go",
+        "quota_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset:go_default_library",
+        "//pkg/client/informers/informers_generated/internalversion:go_default_library",
+        "//pkg/controller:go_default_library",
+        "//pkg/controller/replication:go_default_library",
+        "//pkg/controller/resourcequota:go_default_library",
+        "//pkg/kubeapiserver/admission:go_default_library",
+        "//pkg/quota/install:go_default_library",
+        "//plugin/pkg/admission/resourcequota:go_default_library",
+        "//plugin/pkg/admission/resourcequota/apis/resourcequota:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/fields:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/watch:go_default_library",
+        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/tools/record:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/quota/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package quota
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/quota/quota_test.go

@@ -0,0 +1,350 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package quota
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/informers"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
+	internalinformers "k8s.io/kubernetes/pkg/client/informers/informers_generated/internalversion"
+	"k8s.io/kubernetes/pkg/controller"
+	replicationcontroller "k8s.io/kubernetes/pkg/controller/replication"
+	resourcequotacontroller "k8s.io/kubernetes/pkg/controller/resourcequota"
+	kubeadmission "k8s.io/kubernetes/pkg/kubeapiserver/admission"
+	quotainstall "k8s.io/kubernetes/pkg/quota/install"
+	"k8s.io/kubernetes/plugin/pkg/admission/resourcequota"
+	resourcequotaapi "k8s.io/kubernetes/plugin/pkg/admission/resourcequota/apis/resourcequota"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+// 1.2 code gets:
+// 	quota_test.go:95: Took 4.218619579s to scale up without quota
+// 	quota_test.go:199: unexpected error: timed out waiting for the condition, ended with 342 pods (1 minute)
+// 1.3+ code gets:
+// 	quota_test.go:100: Took 4.196205966s to scale up without quota
+// 	quota_test.go:115: Took 12.021640372s to scale up with quota
+func TestQuota(t *testing.T) {
+	// Set up a master
+	h := &framework.MasterHolder{Initialized: make(chan struct{})}
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		<-h.Initialized
+		h.M.GenericAPIServer.Handler.ServeHTTP(w, req)
+	}))
+
+	admissionCh := make(chan struct{})
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{QPS: -1, Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+	internalClientset := internalclientset.NewForConfigOrDie(&restclient.Config{QPS: -1, Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+	config := &resourcequotaapi.Configuration{}
+	admission, err := resourcequota.NewResourceQuota(config, 5, admissionCh)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	admission.(kubeadmission.WantsInternalKubeClientSet).SetInternalKubeClientSet(internalClientset)
+	internalInformers := internalinformers.NewSharedInformerFactory(internalClientset, controller.NoResyncPeriodFunc())
+	admission.(kubeadmission.WantsInternalKubeInformerFactory).SetInternalKubeInformerFactory(internalInformers)
+	quotaRegistry := quotainstall.NewRegistry(nil, nil)
+	admission.(kubeadmission.WantsQuotaRegistry).SetQuotaRegistry(quotaRegistry)
+	defer close(admissionCh)
+
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	masterConfig.GenericConfig.AdmissionControl = admission
+	_, _, closeFn := framework.RunAMasterUsingServer(masterConfig, s, h)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("quotaed", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+	ns2 := framework.CreateTestingNamespace("non-quotaed", s, t)
+	defer framework.DeleteTestingNamespace(ns2, s, t)
+
+	controllerCh := make(chan struct{})
+	defer close(controllerCh)
+
+	informers := informers.NewSharedInformerFactory(clientset, controller.NoResyncPeriodFunc())
+	rm := replicationcontroller.NewReplicationManager(
+		informers.Core().V1().Pods(),
+		informers.Core().V1().ReplicationControllers(),
+		clientset,
+		replicationcontroller.BurstReplicas,
+	)
+	rm.SetEventRecorder(&record.FakeRecorder{})
+	go rm.Run(3, controllerCh)
+
+	resourceQuotaRegistry := quotainstall.NewRegistry(clientset, nil)
+	groupKindsToReplenish := []schema.GroupKind{
+		api.Kind("Pod"),
+	}
+	resourceQuotaControllerOptions := &resourcequotacontroller.ResourceQuotaControllerOptions{
+		QuotaClient:               clientset.Core(),
+		ResourceQuotaInformer:     informers.Core().V1().ResourceQuotas(),
+		ResyncPeriod:              controller.NoResyncPeriodFunc,
+		Registry:                  resourceQuotaRegistry,
+		GroupKindsToReplenish:     groupKindsToReplenish,
+		ReplenishmentResyncPeriod: controller.NoResyncPeriodFunc,
+		ControllerFactory:         resourcequotacontroller.NewReplenishmentControllerFactory(informers),
+	}
+	go resourcequotacontroller.NewResourceQuotaController(resourceQuotaControllerOptions).Run(2, controllerCh)
+	internalInformers.Start(controllerCh)
+	informers.Start(controllerCh)
+
+	startTime := time.Now()
+	scale(t, ns2.Name, clientset)
+	endTime := time.Now()
+	t.Logf("Took %v to scale up without quota", endTime.Sub(startTime))
+
+	quota := &v1.ResourceQuota{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "quota",
+			Namespace: ns.Name,
+		},
+		Spec: v1.ResourceQuotaSpec{
+			Hard: v1.ResourceList{
+				v1.ResourcePods: resource.MustParse("1000"),
+			},
+		},
+	}
+	waitForQuota(t, quota, clientset)
+
+	startTime = time.Now()
+	scale(t, "quotaed", clientset)
+	endTime = time.Now()
+	t.Logf("Took %v to scale up with quota", endTime.Sub(startTime))
+}
+
+func waitForQuota(t *testing.T, quota *v1.ResourceQuota, clientset *clientset.Clientset) {
+	w, err := clientset.Core().ResourceQuotas(quota.Namespace).Watch(metav1.SingleObject(metav1.ObjectMeta{Name: quota.Name}))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if _, err := clientset.Core().ResourceQuotas(quota.Namespace).Create(quota); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	_, err = watch.Until(1*time.Minute, w, func(event watch.Event) (bool, error) {
+		switch event.Type {
+		case watch.Modified:
+		default:
+			return false, nil
+		}
+
+		switch cast := event.Object.(type) {
+		case *v1.ResourceQuota:
+			if len(cast.Status.Hard) > 0 {
+				return true, nil
+			}
+		}
+
+		return false, nil
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func scale(t *testing.T, namespace string, clientset *clientset.Clientset) {
+	target := int32(100)
+	rc := &v1.ReplicationController{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "foo",
+			Namespace: namespace,
+		},
+		Spec: v1.ReplicationControllerSpec{
+			Replicas: &target,
+			Selector: map[string]string{"foo": "bar"},
+			Template: &v1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						"foo": "bar",
+					},
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{
+							Name:  "container",
+							Image: "busybox",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	w, err := clientset.Core().ReplicationControllers(namespace).Watch(metav1.SingleObject(metav1.ObjectMeta{Name: rc.Name}))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if _, err := clientset.Core().ReplicationControllers(namespace).Create(rc); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	_, err = watch.Until(3*time.Minute, w, func(event watch.Event) (bool, error) {
+		switch event.Type {
+		case watch.Modified:
+		default:
+			return false, nil
+		}
+
+		switch cast := event.Object.(type) {
+		case *v1.ReplicationController:
+			fmt.Printf("Found %v of %v replicas\n", int(cast.Status.Replicas), target)
+			if cast.Status.Replicas == target {
+				return true, nil
+			}
+		}
+
+		return false, nil
+	})
+	if err != nil {
+		pods, _ := clientset.Core().Pods(namespace).List(metav1.ListOptions{LabelSelector: labels.Everything().String(), FieldSelector: fields.Everything().String()})
+		t.Fatalf("unexpected error: %v, ended with %v pods", err, len(pods.Items))
+	}
+}
+
+func TestQuotaLimitedResourceDenial(t *testing.T) {
+	// Set up a master
+	h := &framework.MasterHolder{Initialized: make(chan struct{})}
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		<-h.Initialized
+		h.M.GenericAPIServer.Handler.ServeHTTP(w, req)
+	}))
+
+	admissionCh := make(chan struct{})
+	clientset := clientset.NewForConfigOrDie(&restclient.Config{QPS: -1, Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+	internalClientset := internalclientset.NewForConfigOrDie(&restclient.Config{QPS: -1, Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	// stop creation of a pod resource unless there is a quota
+	config := &resourcequotaapi.Configuration{
+		LimitedResources: []resourcequotaapi.LimitedResource{
+			{
+				Resource:      "pods",
+				MatchContains: []string{"pods"},
+			},
+		},
+	}
+	quotaRegistry := quotainstall.NewRegistry(nil, nil)
+	admission, err := resourcequota.NewResourceQuota(config, 5, admissionCh)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	admission.(kubeadmission.WantsInternalKubeClientSet).SetInternalKubeClientSet(internalClientset)
+	internalInformers := internalinformers.NewSharedInformerFactory(internalClientset, controller.NoResyncPeriodFunc())
+	admission.(kubeadmission.WantsInternalKubeInformerFactory).SetInternalKubeInformerFactory(internalInformers)
+	admission.(kubeadmission.WantsQuotaRegistry).SetQuotaRegistry(quotaRegistry)
+	defer close(admissionCh)
+
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	masterConfig.GenericConfig.AdmissionControl = admission
+	_, _, closeFn := framework.RunAMasterUsingServer(masterConfig, s, h)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("quota", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	controllerCh := make(chan struct{})
+	defer close(controllerCh)
+
+	informers := informers.NewSharedInformerFactory(clientset, controller.NoResyncPeriodFunc())
+	rm := replicationcontroller.NewReplicationManager(
+		informers.Core().V1().Pods(),
+		informers.Core().V1().ReplicationControllers(),
+		clientset,
+		replicationcontroller.BurstReplicas,
+	)
+	rm.SetEventRecorder(&record.FakeRecorder{})
+	go rm.Run(3, controllerCh)
+
+	resourceQuotaRegistry := quotainstall.NewRegistry(clientset, nil)
+	groupKindsToReplenish := []schema.GroupKind{
+		api.Kind("Pod"),
+	}
+	resourceQuotaControllerOptions := &resourcequotacontroller.ResourceQuotaControllerOptions{
+		QuotaClient:               clientset.Core(),
+		ResourceQuotaInformer:     informers.Core().V1().ResourceQuotas(),
+		ResyncPeriod:              controller.NoResyncPeriodFunc,
+		Registry:                  resourceQuotaRegistry,
+		GroupKindsToReplenish:     groupKindsToReplenish,
+		ReplenishmentResyncPeriod: controller.NoResyncPeriodFunc,
+		ControllerFactory:         resourcequotacontroller.NewReplenishmentControllerFactory(informers),
+	}
+	go resourcequotacontroller.NewResourceQuotaController(resourceQuotaControllerOptions).Run(2, controllerCh)
+	internalInformers.Start(controllerCh)
+	informers.Start(controllerCh)
+
+	// try to create a pod
+	pod := &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "foo",
+			Namespace: ns.Name,
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name:  "container",
+					Image: "busybox",
+				},
+			},
+		},
+	}
+	if _, err := clientset.Core().Pods(ns.Name).Create(pod); err == nil {
+		t.Fatalf("expected error for insufficient quota")
+	}
+
+	// now create a covering quota
+	quota := &v1.ResourceQuota{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "quota",
+			Namespace: ns.Name,
+		},
+		Spec: v1.ResourceQuotaSpec{
+			Hard: v1.ResourceList{
+				v1.ResourcePods: resource.MustParse("1000"),
+			},
+		},
+	}
+	waitForQuota(t, quota, clientset)
+
+	// attempt to create a new pod once the quota is propagated
+	err = wait.PollImmediate(5*time.Second, time.Minute, func() (bool, error) {
+		// retry until we succeed (to allow time for all changes to propagate)
+		if _, err := clientset.Core().Pods(ns.Name).Create(pod); err == nil {
+			return true, nil
+		}
+		return false, nil
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}

vendor/k8s.io/kubernetes/test/integration/replicaset/BUILD

@@ -0,0 +1,42 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "main_test.go",
+        "replicaset_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//pkg/controller/replicaset:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/api/extensions/v1beta1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/tools/cache:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/replicaset/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package replicaset
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/replicaset/replicaset_test.go

@@ -0,0 +1,517 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package replicaset
+
+import (
+	"fmt"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/informers"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/kubernetes/pkg/controller/replicaset"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func testLabels() map[string]string {
+	return map[string]string{"name": "test"}
+}
+
+func newRS(name, namespace string, replicas int) *v1beta1.ReplicaSet {
+	replicasCopy := int32(replicas)
+	return &v1beta1.ReplicaSet{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "ReplicaSet",
+			APIVersion: "extensions/v1beta1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: namespace,
+			Name:      name,
+		},
+		Spec: v1beta1.ReplicaSetSpec{
+			Selector: &metav1.LabelSelector{
+				MatchLabels: testLabels(),
+			},
+			Replicas: &replicasCopy,
+			Template: v1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: testLabels(),
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{
+							Name:  "fake-name",
+							Image: "fakeimage",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func newMatchingPod(podName, namespace string) *v1.Pod {
+	return &v1.Pod{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Pod",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      podName,
+			Namespace: namespace,
+			Labels:    testLabels(),
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name:  "fake-name",
+					Image: "fakeimage",
+				},
+			},
+		},
+		Status: v1.PodStatus{
+			Phase: v1.PodRunning,
+		},
+	}
+}
+
+// verifyRemainingObjects verifies if the number of the remaining replica
+// sets and pods are rsNum and podNum. It returns error if the
+// communication with the API server fails.
+func verifyRemainingObjects(t *testing.T, clientSet clientset.Interface, namespace string, rsNum, podNum int) (bool, error) {
+	rsClient := clientSet.Extensions().ReplicaSets(namespace)
+	podClient := clientSet.Core().Pods(namespace)
+	pods, err := podClient.List(metav1.ListOptions{})
+	if err != nil {
+		return false, fmt.Errorf("Failed to list pods: %v", err)
+	}
+	var ret = true
+	if len(pods.Items) != podNum {
+		ret = false
+		t.Logf("expect %d pods, got %d pods", podNum, len(pods.Items))
+	}
+	rss, err := rsClient.List(metav1.ListOptions{})
+	if err != nil {
+		return false, fmt.Errorf("Failed to list replica sets: %v", err)
+	}
+	if len(rss.Items) != rsNum {
+		ret = false
+		t.Logf("expect %d RSs, got %d RSs", rsNum, len(rss.Items))
+	}
+	return ret, nil
+}
+
+func rmSetup(t *testing.T) (*httptest.Server, framework.CloseFunc, *replicaset.ReplicaSetController, informers.SharedInformerFactory, clientset.Interface) {
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	_, s, closeFn := framework.RunAMaster(masterConfig)
+
+	config := restclient.Config{Host: s.URL}
+	clientSet, err := clientset.NewForConfig(&config)
+	if err != nil {
+		t.Fatalf("Error in create clientset: %v", err)
+	}
+	resyncPeriod := 12 * time.Hour
+	informers := informers.NewSharedInformerFactory(clientset.NewForConfigOrDie(restclient.AddUserAgent(&config, "rs-informers")), resyncPeriod)
+
+	rm := replicaset.NewReplicaSetController(
+		informers.Extensions().V1beta1().ReplicaSets(),
+		informers.Core().V1().Pods(),
+		clientset.NewForConfigOrDie(restclient.AddUserAgent(&config, "replicaset-controller")),
+		replicaset.BurstReplicas,
+	)
+
+	if err != nil {
+		t.Fatalf("Failed to create replicaset controller")
+	}
+	return s, closeFn, rm, informers, clientSet
+}
+
+func rmSimpleSetup(t *testing.T) (*httptest.Server, framework.CloseFunc, clientset.Interface) {
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	_, s, closeFn := framework.RunAMaster(masterConfig)
+
+	config := restclient.Config{Host: s.URL}
+	clientSet, err := clientset.NewForConfig(&config)
+	if err != nil {
+		t.Fatalf("Error in create clientset: %v", err)
+	}
+	return s, closeFn, clientSet
+}
+
+// wait for the podInformer to observe the pods. Call this function before
+// running the RS controller to prevent the rc manager from creating new pods
+// rather than adopting the existing ones.
+func waitToObservePods(t *testing.T, podInformer cache.SharedIndexInformer, podNum int) {
+	if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+		objects := podInformer.GetIndexer().List()
+		if len(objects) == podNum {
+			return true, nil
+		} else {
+			return false, nil
+		}
+	}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestAdoption(t *testing.T) {
+	boolPtr := func(b bool) *bool { return &b }
+	testCases := []struct {
+		name                    string
+		existingOwnerReferences func(rs *v1beta1.ReplicaSet) []metav1.OwnerReference
+		expectedOwnerReferences func(rs *v1beta1.ReplicaSet) []metav1.OwnerReference
+	}{
+		{
+			"pod refers rs as an owner, not a controller",
+			func(rs *v1beta1.ReplicaSet) []metav1.OwnerReference {
+				return []metav1.OwnerReference{{UID: rs.UID, Name: rs.Name, APIVersion: "extensions/v1beta1", Kind: "ReplicaSet"}}
+			},
+			func(rs *v1beta1.ReplicaSet) []metav1.OwnerReference {
+				return []metav1.OwnerReference{{UID: rs.UID, Name: rs.Name, APIVersion: "extensions/v1beta1", Kind: "ReplicaSet", Controller: boolPtr(true), BlockOwnerDeletion: boolPtr(true)}}
+			},
+		},
+		{
+			"pod doesn't have owner references",
+			func(rs *v1beta1.ReplicaSet) []metav1.OwnerReference {
+				return []metav1.OwnerReference{}
+			},
+			func(rs *v1beta1.ReplicaSet) []metav1.OwnerReference {
+				return []metav1.OwnerReference{{UID: rs.UID, Name: rs.Name, APIVersion: "extensions/v1beta1", Kind: "ReplicaSet", Controller: boolPtr(true), BlockOwnerDeletion: boolPtr(true)}}
+			},
+		},
+		{
+			"pod refers rs as a controller",
+			func(rs *v1beta1.ReplicaSet) []metav1.OwnerReference {
+				return []metav1.OwnerReference{{UID: rs.UID, Name: rs.Name, APIVersion: "extensions/v1beta1", Kind: "ReplicaSet", Controller: boolPtr(true)}}
+			},
+			func(rs *v1beta1.ReplicaSet) []metav1.OwnerReference {
+				return []metav1.OwnerReference{{UID: rs.UID, Name: rs.Name, APIVersion: "extensions/v1beta1", Kind: "ReplicaSet", Controller: boolPtr(true)}}
+			},
+		},
+		{
+			"pod refers other rs as the controller, refers the rs as an owner",
+			func(rs *v1beta1.ReplicaSet) []metav1.OwnerReference {
+				return []metav1.OwnerReference{
+					{UID: "1", Name: "anotherRS", APIVersion: "extensions/v1beta1", Kind: "ReplicaSet", Controller: boolPtr(true)},
+					{UID: rs.UID, Name: rs.Name, APIVersion: "extensions/v1beta1", Kind: "ReplicaSet"},
+				}
+			},
+			func(rs *v1beta1.ReplicaSet) []metav1.OwnerReference {
+				return []metav1.OwnerReference{
+					{UID: "1", Name: "anotherRS", APIVersion: "extensions/v1beta1", Kind: "ReplicaSet", Controller: boolPtr(true)},
+					{UID: rs.UID, Name: rs.Name, APIVersion: "extensions/v1beta1", Kind: "ReplicaSet"},
+				}
+			},
+		},
+	}
+	for i, tc := range testCases {
+		s, closeFn, rm, informers, clientSet := rmSetup(t)
+		defer closeFn()
+		podInformer := informers.Core().V1().Pods().Informer()
+		ns := framework.CreateTestingNamespace(fmt.Sprintf("rs-adoption-%d", i), s, t)
+		defer framework.DeleteTestingNamespace(ns, s, t)
+
+		rsClient := clientSet.Extensions().ReplicaSets(ns.Name)
+		podClient := clientSet.Core().Pods(ns.Name)
+		const rsName = "rs"
+		rs, err := rsClient.Create(newRS(rsName, ns.Name, 1))
+		if err != nil {
+			t.Fatalf("Failed to create replica set: %v", err)
+		}
+		podName := fmt.Sprintf("pod%d", i)
+		pod := newMatchingPod(podName, ns.Name)
+		pod.OwnerReferences = tc.existingOwnerReferences(rs)
+		_, err = podClient.Create(pod)
+		if err != nil {
+			t.Fatalf("Failed to create Pod: %v", err)
+		}
+
+		stopCh := make(chan struct{})
+		informers.Start(stopCh)
+		waitToObservePods(t, podInformer, 1)
+		go rm.Run(5, stopCh)
+		if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+			updatedPod, err := podClient.Get(pod.Name, metav1.GetOptions{})
+			if err != nil {
+				return false, err
+			}
+			if e, a := tc.expectedOwnerReferences(rs), updatedPod.OwnerReferences; reflect.DeepEqual(e, a) {
+				return true, nil
+			} else {
+				t.Logf("ownerReferences don't match, expect %v, got %v", e, a)
+				return false, nil
+			}
+		}); err != nil {
+			t.Fatalf("test %q failed: %v", tc.name, err)
+		}
+		close(stopCh)
+	}
+}
+
+func createRSsPods(t *testing.T, clientSet clientset.Interface, rss []*v1beta1.ReplicaSet, pods []*v1.Pod, ns string) {
+	rsClient := clientSet.Extensions().ReplicaSets(ns)
+	podClient := clientSet.Core().Pods(ns)
+	for _, rs := range rss {
+		if _, err := rsClient.Create(rs); err != nil {
+			t.Fatalf("Failed to create replica set %s: %v", rs.Name, err)
+		}
+	}
+	for _, pod := range pods {
+		if _, err := podClient.Create(pod); err != nil {
+			t.Fatalf("Failed to create pod %s: %v", pod.Name, err)
+		}
+	}
+}
+
+func waitRSStable(t *testing.T, clientSet clientset.Interface, rs *v1beta1.ReplicaSet, ns string) {
+	rsClient := clientSet.Extensions().ReplicaSets(ns)
+	if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+		updatedRS, err := rsClient.Get(rs.Name, metav1.GetOptions{})
+		if err != nil {
+			return false, err
+		}
+		if updatedRS.Status.Replicas != *rs.Spec.Replicas {
+			return false, nil
+		} else {
+			return true, nil
+		}
+	}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestUpdateSelectorToAdopt(t *testing.T) {
+	// We have pod1, pod2 and rs. rs.spec.replicas=1. At first rs.Selector
+	// matches pod1 only; change the selector to match pod2 as well. Verify
+	// there is only one pod left.
+	s, closeFn, rm, informers, clientSet := rmSetup(t)
+	defer closeFn()
+	ns := framework.CreateTestingNamespace("rs-update-selector-to-adopt", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+	rs := newRS("rs", ns.Name, 1)
+	// let rs's selector only match pod1
+	rs.Spec.Selector.MatchLabels["uniqueKey"] = "1"
+	rs.Spec.Template.Labels["uniqueKey"] = "1"
+	pod1 := newMatchingPod("pod1", ns.Name)
+	pod1.Labels["uniqueKey"] = "1"
+	pod2 := newMatchingPod("pod2", ns.Name)
+	pod2.Labels["uniqueKey"] = "2"
+	createRSsPods(t, clientSet, []*v1beta1.ReplicaSet{rs}, []*v1.Pod{pod1, pod2}, ns.Name)
+
+	stopCh := make(chan struct{})
+	informers.Start(stopCh)
+	go rm.Run(5, stopCh)
+	waitRSStable(t, clientSet, rs, ns.Name)
+
+	// change the rs's selector to match both pods
+	patch := `{"spec":{"selector":{"matchLabels": {"uniqueKey":null}}}}`
+	rsClient := clientSet.Extensions().ReplicaSets(ns.Name)
+	rs, err := rsClient.Patch(rs.Name, types.StrategicMergePatchType, []byte(patch))
+	if err != nil {
+		t.Fatalf("Failed to patch replica set: %v", err)
+	}
+	t.Logf("patched rs = %#v", rs)
+	// wait for the rs select both pods and delete one of them
+	if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+		return verifyRemainingObjects(t, clientSet, ns.Name, 1, 1)
+	}); err != nil {
+		t.Fatal(err)
+	}
+	close(stopCh)
+}
+
+func TestUpdateSelectorToRemoveControllerRef(t *testing.T) {
+	// We have pod1, pod2 and rs. rs.spec.replicas=2. At first rs.Selector
+	// matches pod1 and pod2; change the selector to match only pod1. Verify
+	// that rs creates one more pod, so there are 3 pods. Also verify that
+	// pod2's controllerRef is cleared.
+	s, closeFn, rm, informers, clientSet := rmSetup(t)
+	defer closeFn()
+	podInformer := informers.Core().V1().Pods().Informer()
+	ns := framework.CreateTestingNamespace("rs-update-selector-to-remove-controllerref", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+	rs := newRS("rs", ns.Name, 2)
+	pod1 := newMatchingPod("pod1", ns.Name)
+	pod1.Labels["uniqueKey"] = "1"
+	pod2 := newMatchingPod("pod2", ns.Name)
+	pod2.Labels["uniqueKey"] = "2"
+	createRSsPods(t, clientSet, []*v1beta1.ReplicaSet{rs}, []*v1.Pod{pod1, pod2}, ns.Name)
+
+	stopCh := make(chan struct{})
+	informers.Start(stopCh)
+	waitToObservePods(t, podInformer, 2)
+	go rm.Run(5, stopCh)
+	waitRSStable(t, clientSet, rs, ns.Name)
+
+	// change the rs's selector to match both pods
+	patch := `{"spec":{"selector":{"matchLabels": {"uniqueKey":"1"}},"template":{"metadata":{"labels":{"uniqueKey":"1"}}}}}`
+	rsClient := clientSet.Extensions().ReplicaSets(ns.Name)
+	rs, err := rsClient.Patch(rs.Name, types.StrategicMergePatchType, []byte(patch))
+	if err != nil {
+		t.Fatalf("Failed to patch replica set: %v", err)
+	}
+	t.Logf("patched rs = %#v", rs)
+	// wait for the rs to create one more pod
+	if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+		return verifyRemainingObjects(t, clientSet, ns.Name, 1, 3)
+	}); err != nil {
+		t.Fatal(err)
+	}
+	podClient := clientSet.Core().Pods(ns.Name)
+	pod2, err = podClient.Get(pod2.Name, metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("Failed to get pod2: %v", err)
+	}
+	if len(pod2.OwnerReferences) != 0 {
+		t.Fatalf("ownerReferences of pod2 is not cleared, got %#v", pod2.OwnerReferences)
+	}
+	close(stopCh)
+}
+
+func TestUpdateLabelToRemoveControllerRef(t *testing.T) {
+	// We have pod1, pod2 and rs. rs.spec.replicas=2. At first rs.Selector
+	// matches pod1 and pod2; change pod2's labels to non-matching. Verify
+	// that rs creates one more pod, so there are 3 pods. Also verify that
+	// pod2's controllerRef is cleared.
+	s, closeFn, rm, informers, clientSet := rmSetup(t)
+	defer closeFn()
+	ns := framework.CreateTestingNamespace("rs-update-label-to-remove-controllerref", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+	rs := newRS("rs", ns.Name, 2)
+	pod1 := newMatchingPod("pod1", ns.Name)
+	pod2 := newMatchingPod("pod2", ns.Name)
+	createRSsPods(t, clientSet, []*v1beta1.ReplicaSet{rs}, []*v1.Pod{pod1, pod2}, ns.Name)
+
+	stopCh := make(chan struct{})
+	informers.Start(stopCh)
+	go rm.Run(5, stopCh)
+	waitRSStable(t, clientSet, rs, ns.Name)
+
+	// change the rs's selector to match both pods
+	patch := `{"metadata":{"labels":{"name":null}}}`
+	podClient := clientSet.Core().Pods(ns.Name)
+	pod2, err := podClient.Patch(pod2.Name, types.StrategicMergePatchType, []byte(patch))
+	if err != nil {
+		t.Fatalf("Failed to patch pod2: %v", err)
+	}
+	t.Logf("patched pod2 = %#v", pod2)
+	// wait for the rs to create one more pod
+	if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+		return verifyRemainingObjects(t, clientSet, ns.Name, 1, 3)
+	}); err != nil {
+		t.Fatal(err)
+	}
+	pod2, err = podClient.Get(pod2.Name, metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("Failed to get pod2: %v", err)
+	}
+	if len(pod2.OwnerReferences) != 0 {
+		t.Fatalf("ownerReferences of pod2 is not cleared, got %#v", pod2.OwnerReferences)
+	}
+	close(stopCh)
+}
+
+func TestUpdateLabelToBeAdopted(t *testing.T) {
+	// We have pod1, pod2 and rs. rs.spec.replicas=1. At first rs.Selector
+	// matches pod1 only; change pod2's labels to be matching. Verify the RS
+	// controller adopts pod2 and delete one of them, so there is only 1 pod
+	// left.
+	s, closeFn, rm, informers, clientSet := rmSetup(t)
+	defer closeFn()
+	ns := framework.CreateTestingNamespace("rs-update-label-to-be-adopted", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+	rs := newRS("rs", ns.Name, 1)
+	// let rs's selector only matches pod1
+	rs.Spec.Selector.MatchLabels["uniqueKey"] = "1"
+	rs.Spec.Template.Labels["uniqueKey"] = "1"
+	pod1 := newMatchingPod("pod1", ns.Name)
+	pod1.Labels["uniqueKey"] = "1"
+	pod2 := newMatchingPod("pod2", ns.Name)
+	pod2.Labels["uniqueKey"] = "2"
+	createRSsPods(t, clientSet, []*v1beta1.ReplicaSet{rs}, []*v1.Pod{pod1, pod2}, ns.Name)
+
+	stopCh := make(chan struct{})
+	informers.Start(stopCh)
+	go rm.Run(5, stopCh)
+	waitRSStable(t, clientSet, rs, ns.Name)
+
+	// change the rs's selector to match both pods
+	patch := `{"metadata":{"labels":{"uniqueKey":"1"}}}`
+	podClient := clientSet.Core().Pods(ns.Name)
+	pod2, err := podClient.Patch(pod2.Name, types.StrategicMergePatchType, []byte(patch))
+	if err != nil {
+		t.Fatalf("Failed to patch pod2: %v", err)
+	}
+	t.Logf("patched pod2 = %#v", pod2)
+	// wait for the rs to select both pods and delete one of them
+	if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+		return verifyRemainingObjects(t, clientSet, ns.Name, 1, 1)
+	}); err != nil {
+		t.Fatal(err)
+	}
+	close(stopCh)
+}
+
+// selectors are IMMUTABLE for all API versions except extensions/v1beta1
+func TestRSSelectorImmutability(t *testing.T) {
+	s, closeFn, clientSet := rmSimpleSetup(t)
+	defer closeFn()
+	ns := framework.CreateTestingNamespace("rs-selector-immutability", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+	rs := newRS("rs", ns.Name, 0)
+	createRSsPods(t, clientSet, []*v1beta1.ReplicaSet{rs}, []*v1.Pod{}, ns.Name)
+
+	// test to ensure extensions/v1beta1 selector is mutable
+	newSelectorLabels := map[string]string{"changed_name_extensions_v1beta1": "changed_test_extensions_v1beta1"}
+	rs.Spec.Selector.MatchLabels = newSelectorLabels
+	rs.Spec.Template.Labels = newSelectorLabels
+	replicaset, err := clientSet.ExtensionsV1beta1().ReplicaSets(ns.Name).Update(rs)
+	if err != nil {
+		t.Fatalf("failed to update extensions/v1beta1 replicaset %s: %v", replicaset.Name, err)
+	}
+	if !reflect.DeepEqual(replicaset.Spec.Selector.MatchLabels, newSelectorLabels) {
+		t.Errorf("selector should be changed for extensions/v1beta1, expected: %v, got: %v", newSelectorLabels, replicaset.Spec.Selector.MatchLabels)
+	}
+
+	// test to ensure apps/v1beta2 selector is immutable
+	rsV1beta2, err := clientSet.AppsV1beta2().ReplicaSets(ns.Name).Get(replicaset.Name, metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("failed to get apps/v1beta2 replicaset %s: %v", replicaset.Name, err)
+	}
+	newSelectorLabels = map[string]string{"changed_name_apps_v1beta2": "changed_test_apps_v1beta2"}
+	rsV1beta2.Spec.Selector.MatchLabels = newSelectorLabels
+	rsV1beta2.Spec.Template.Labels = newSelectorLabels
+	_, err = clientSet.AppsV1beta2().ReplicaSets(ns.Name).Update(rsV1beta2)
+	if err == nil {
+		t.Fatalf("failed to provide validation error when changing immutable selector when updating apps/v1beta2 replicaset %s", rsV1beta2.Name)
+	}
+	expectedErrType := "Invalid value"
+	expectedErrDetail := "field is immutable"
+	if !strings.Contains(err.Error(), expectedErrType) || !strings.Contains(err.Error(), expectedErrDetail) {
+		t.Errorf("error message does not match, expected type: %s, expected detail: %s, got: %s", expectedErrType, expectedErrDetail, err.Error())
+	}
+}

vendor/k8s.io/kubernetes/test/integration/replicationcontroller/BUILD

@@ -0,0 +1,41 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "main_test.go",
+        "replicationcontroller_test.go",
+    ],
+    tags = ["integration"],
+    deps = [
+        "//pkg/controller/replication:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/tools/cache:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/replicationcontroller/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package replicationcontroller
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/replicationcontroller/replicationcontroller_test.go

@@ -0,0 +1,448 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package replicationcontroller
+
+import (
+	"fmt"
+	"net/http/httptest"
+	"reflect"
+	"testing"
+	"time"
+
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/informers"
+	clientset "k8s.io/client-go/kubernetes"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/kubernetes/pkg/controller/replication"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func testLabels() map[string]string {
+	return map[string]string{"name": "test"}
+}
+
+func newRC(name, namespace string, replicas int) *v1.ReplicationController {
+	replicasCopy := int32(replicas)
+	return &v1.ReplicationController{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "ReplicationController",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: namespace,
+			Name:      name,
+		},
+		Spec: v1.ReplicationControllerSpec{
+			Selector: testLabels(),
+			Replicas: &replicasCopy,
+			Template: &v1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: testLabels(),
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{
+						{
+							Name:  "fake-name",
+							Image: "fakeimage",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func newMatchingPod(podName, namespace string) *v1.Pod {
+	return &v1.Pod{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Pod",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      podName,
+			Namespace: namespace,
+			Labels:    testLabels(),
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name:  "fake-name",
+					Image: "fakeimage",
+				},
+			},
+		},
+		Status: v1.PodStatus{
+			Phase: v1.PodRunning,
+		},
+	}
+}
+
+// verifyRemainingObjects verifies if the number of the remaining replication
+// controllers and pods are rcNum and podNum. It returns error if the
+// communication with the API server fails.
+func verifyRemainingObjects(t *testing.T, clientSet clientset.Interface, namespace string, rcNum, podNum int) (bool, error) {
+	rcClient := clientSet.Core().ReplicationControllers(namespace)
+	podClient := clientSet.Core().Pods(namespace)
+	pods, err := podClient.List(metav1.ListOptions{})
+	if err != nil {
+		return false, fmt.Errorf("Failed to list pods: %v", err)
+	}
+	var ret = true
+	if len(pods.Items) != podNum {
+		ret = false
+		t.Logf("expect %d pods, got %d pods", podNum, len(pods.Items))
+	}
+	rcs, err := rcClient.List(metav1.ListOptions{})
+	if err != nil {
+		return false, fmt.Errorf("Failed to list replication controllers: %v", err)
+	}
+	if len(rcs.Items) != rcNum {
+		ret = false
+		t.Logf("expect %d RCs, got %d RCs", rcNum, len(rcs.Items))
+	}
+	return ret, nil
+}
+
+func rmSetup(t *testing.T, stopCh chan struct{}) (*httptest.Server, framework.CloseFunc, *replication.ReplicationManager, informers.SharedInformerFactory, clientset.Interface) {
+	masterConfig := framework.NewIntegrationTestMasterConfig()
+	_, s, closeFn := framework.RunAMaster(masterConfig)
+
+	config := restclient.Config{Host: s.URL}
+	clientSet, err := clientset.NewForConfig(&config)
+	if err != nil {
+		t.Fatalf("Error in create clientset: %v", err)
+	}
+	resyncPeriod := 12 * time.Hour
+
+	informers := informers.NewSharedInformerFactory(clientSet, resyncPeriod)
+	rm := replication.NewReplicationManager(informers.Core().V1().Pods(), informers.Core().V1().ReplicationControllers(), clientSet, replication.BurstReplicas)
+	informers.Start(stopCh)
+
+	return s, closeFn, rm, informers, clientSet
+}
+
+// wait for the podInformer to observe the pods. Call this function before
+// running the RC manager to prevent the rc manager from creating new pods
+// rather than adopting the existing ones.
+func waitToObservePods(t *testing.T, podInformer cache.SharedIndexInformer, podNum int) {
+	if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+		objects := podInformer.GetIndexer().List()
+		if len(objects) == podNum {
+			return true, nil
+		} else {
+			return false, nil
+		}
+	}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestAdoption(t *testing.T) {
+	boolPtr := func(b bool) *bool { return &b }
+	testCases := []struct {
+		name                    string
+		existingOwnerReferences func(rc *v1.ReplicationController) []metav1.OwnerReference
+		expectedOwnerReferences func(rc *v1.ReplicationController) []metav1.OwnerReference
+	}{
+		{
+			"pod refers rc as an owner, not a controller",
+			func(rc *v1.ReplicationController) []metav1.OwnerReference {
+				return []metav1.OwnerReference{{UID: rc.UID, Name: rc.Name, APIVersion: "v1", Kind: "ReplicationController"}}
+			},
+			func(rc *v1.ReplicationController) []metav1.OwnerReference {
+				return []metav1.OwnerReference{{UID: rc.UID, Name: rc.Name, APIVersion: "v1", Kind: "ReplicationController", Controller: boolPtr(true), BlockOwnerDeletion: boolPtr(true)}}
+			},
+		},
+		{
+			"pod doesn't have owner references",
+			func(rc *v1.ReplicationController) []metav1.OwnerReference {
+				return []metav1.OwnerReference{}
+			},
+			func(rc *v1.ReplicationController) []metav1.OwnerReference {
+				return []metav1.OwnerReference{{UID: rc.UID, Name: rc.Name, APIVersion: "v1", Kind: "ReplicationController", Controller: boolPtr(true), BlockOwnerDeletion: boolPtr(true)}}
+			},
+		},
+		{
+			"pod refers rc as a controller",
+			func(rc *v1.ReplicationController) []metav1.OwnerReference {
+				return []metav1.OwnerReference{{UID: rc.UID, Name: rc.Name, APIVersion: "v1", Kind: "ReplicationController", Controller: boolPtr(true)}}
+			},
+			func(rc *v1.ReplicationController) []metav1.OwnerReference {
+				return []metav1.OwnerReference{{UID: rc.UID, Name: rc.Name, APIVersion: "v1", Kind: "ReplicationController", Controller: boolPtr(true)}}
+			},
+		},
+		{
+			"pod refers other rc as the controller, refers the rc as an owner",
+			func(rc *v1.ReplicationController) []metav1.OwnerReference {
+				return []metav1.OwnerReference{
+					{UID: "1", Name: "anotherRC", APIVersion: "v1", Kind: "ReplicationController", Controller: boolPtr(true)},
+					{UID: rc.UID, Name: rc.Name, APIVersion: "v1", Kind: "ReplicationController"},
+				}
+			},
+			func(rc *v1.ReplicationController) []metav1.OwnerReference {
+				return []metav1.OwnerReference{
+					{UID: "1", Name: "anotherRC", APIVersion: "v1", Kind: "ReplicationController", Controller: boolPtr(true)},
+					{UID: rc.UID, Name: rc.Name, APIVersion: "v1", Kind: "ReplicationController"},
+				}
+			},
+		},
+	}
+	for i, tc := range testCases {
+		stopCh := make(chan struct{})
+		s, closeFn, rm, informers, clientSet := rmSetup(t, stopCh)
+		defer closeFn()
+		ns := framework.CreateTestingNamespace(fmt.Sprintf("adoption-%d", i), s, t)
+		defer framework.DeleteTestingNamespace(ns, s, t)
+
+		rcClient := clientSet.Core().ReplicationControllers(ns.Name)
+		podClient := clientSet.Core().Pods(ns.Name)
+		const rcName = "rc"
+		rc, err := rcClient.Create(newRC(rcName, ns.Name, 1))
+		if err != nil {
+			t.Fatalf("Failed to create replication controller: %v", err)
+		}
+		podName := fmt.Sprintf("pod%d", i)
+		pod := newMatchingPod(podName, ns.Name)
+		pod.OwnerReferences = tc.existingOwnerReferences(rc)
+		_, err = podClient.Create(pod)
+		if err != nil {
+			t.Fatalf("Failed to create Pod: %v", err)
+		}
+
+		informers.Start(stopCh)
+		waitToObservePods(t, informers.Core().V1().Pods().Informer(), 1)
+		go rm.Run(5, stopCh)
+		if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+			updatedPod, err := podClient.Get(pod.Name, metav1.GetOptions{})
+			if err != nil {
+				return false, err
+			}
+			if e, a := tc.expectedOwnerReferences(rc), updatedPod.OwnerReferences; reflect.DeepEqual(e, a) {
+				return true, nil
+			} else {
+				t.Logf("ownerReferences don't match, expect %v, got %v", e, a)
+				return false, nil
+			}
+		}); err != nil {
+			t.Fatalf("test %q failed: %v", tc.name, err)
+		}
+		close(stopCh)
+	}
+}
+
+func createRCsPods(t *testing.T, clientSet clientset.Interface, rcs []*v1.ReplicationController, pods []*v1.Pod, ns string) {
+	rcClient := clientSet.Core().ReplicationControllers(ns)
+	podClient := clientSet.Core().Pods(ns)
+	for _, rc := range rcs {
+		if _, err := rcClient.Create(rc); err != nil {
+			t.Fatalf("Failed to create replication controller %s: %v", rc.Name, err)
+		}
+	}
+	for _, pod := range pods {
+		if _, err := podClient.Create(pod); err != nil {
+			t.Fatalf("Failed to create pod %s: %v", pod.Name, err)
+		}
+	}
+}
+
+func waitRCStable(t *testing.T, clientSet clientset.Interface, rc *v1.ReplicationController, ns string) {
+	rcClient := clientSet.Core().ReplicationControllers(ns)
+	if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+		updatedRC, err := rcClient.Get(rc.Name, metav1.GetOptions{})
+		if err != nil {
+			return false, err
+		}
+		if updatedRC.Status.Replicas != *rc.Spec.Replicas {
+			return false, nil
+		} else {
+			return true, nil
+		}
+	}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestUpdateSelectorToAdopt(t *testing.T) {
+	// We have pod1, pod2 and rc. rc.spec.replicas=1. At first rc.Selector
+	// matches pod1 only; change the selector to match pod2 as well. Verify
+	// there is only one pod left.
+	stopCh := make(chan struct{})
+	s, closeFn, rm, _, clientSet := rmSetup(t, stopCh)
+	defer closeFn()
+	ns := framework.CreateTestingNamespace("update-selector-to-adopt", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+	rc := newRC("rc", ns.Name, 1)
+	// let rc's selector only match pod1
+	rc.Spec.Selector["uniqueKey"] = "1"
+	rc.Spec.Template.Labels["uniqueKey"] = "1"
+	pod1 := newMatchingPod("pod1", ns.Name)
+	pod1.Labels["uniqueKey"] = "1"
+	pod2 := newMatchingPod("pod2", ns.Name)
+	pod2.Labels["uniqueKey"] = "2"
+	createRCsPods(t, clientSet, []*v1.ReplicationController{rc}, []*v1.Pod{pod1, pod2}, ns.Name)
+
+	go rm.Run(5, stopCh)
+	waitRCStable(t, clientSet, rc, ns.Name)
+
+	// change the rc's selector to match both pods
+	patch := `{"spec":{"selector":{"uniqueKey":null}}}`
+	rcClient := clientSet.Core().ReplicationControllers(ns.Name)
+	rc, err := rcClient.Patch(rc.Name, types.StrategicMergePatchType, []byte(patch))
+	if err != nil {
+		t.Fatalf("Failed to patch replication controller: %v", err)
+	}
+	t.Logf("patched rc = %#v", rc)
+	// wait for the rc select both pods and delete one of them
+	if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+		return verifyRemainingObjects(t, clientSet, ns.Name, 1, 1)
+	}); err != nil {
+		t.Fatal(err)
+	}
+	close(stopCh)
+}
+
+func TestUpdateSelectorToRemoveControllerRef(t *testing.T) {
+	// We have pod1, pod2 and rc. rc.spec.replicas=2. At first rc.Selector
+	// matches pod1 and pod2; change the selector to match only pod1. Verify
+	// that rc creates one more pod, so there are 3 pods. Also verify that
+	// pod2's controllerRef is cleared.
+	stopCh := make(chan struct{})
+	s, closeFn, rm, informers, clientSet := rmSetup(t, stopCh)
+	defer closeFn()
+	ns := framework.CreateTestingNamespace("update-selector-to-remove-controllerref", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+	rc := newRC("rc", ns.Name, 2)
+	pod1 := newMatchingPod("pod1", ns.Name)
+	pod1.Labels["uniqueKey"] = "1"
+	pod2 := newMatchingPod("pod2", ns.Name)
+	pod2.Labels["uniqueKey"] = "2"
+	createRCsPods(t, clientSet, []*v1.ReplicationController{rc}, []*v1.Pod{pod1, pod2}, ns.Name)
+
+	waitToObservePods(t, informers.Core().V1().Pods().Informer(), 2)
+	go rm.Run(5, stopCh)
+	waitRCStable(t, clientSet, rc, ns.Name)
+
+	// change the rc's selector to match both pods
+	patch := `{"spec":{"selector":{"uniqueKey":"1"},"template":{"metadata":{"labels":{"uniqueKey":"1"}}}}}`
+	rcClient := clientSet.Core().ReplicationControllers(ns.Name)
+	rc, err := rcClient.Patch(rc.Name, types.StrategicMergePatchType, []byte(patch))
+	if err != nil {
+		t.Fatalf("Failed to patch replication controller: %v", err)
+	}
+	t.Logf("patched rc = %#v", rc)
+	// wait for the rc to create one more pod
+	if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+		return verifyRemainingObjects(t, clientSet, ns.Name, 1, 3)
+	}); err != nil {
+		t.Fatal(err)
+	}
+	podClient := clientSet.Core().Pods(ns.Name)
+	pod2, err = podClient.Get(pod2.Name, metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("Failed to get pod2: %v", err)
+	}
+	if len(pod2.OwnerReferences) != 0 {
+		t.Fatalf("ownerReferences of pod2 is not cleared, got %#v", pod2.OwnerReferences)
+	}
+	close(stopCh)
+}
+
+func TestUpdateLabelToRemoveControllerRef(t *testing.T) {
+	// We have pod1, pod2 and rc. rc.spec.replicas=2. At first rc.Selector
+	// matches pod1 and pod2; change pod2's labels to non-matching. Verify
+	// that rc creates one more pod, so there are 3 pods. Also verify that
+	// pod2's controllerRef is cleared.
+	stopCh := make(chan struct{})
+	s, closeFn, rm, _, clientSet := rmSetup(t, stopCh)
+	defer closeFn()
+	ns := framework.CreateTestingNamespace("update-label-to-remove-controllerref", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+	rc := newRC("rc", ns.Name, 2)
+	pod1 := newMatchingPod("pod1", ns.Name)
+	pod2 := newMatchingPod("pod2", ns.Name)
+	createRCsPods(t, clientSet, []*v1.ReplicationController{rc}, []*v1.Pod{pod1, pod2}, ns.Name)
+
+	go rm.Run(5, stopCh)
+	waitRCStable(t, clientSet, rc, ns.Name)
+
+	// change the rc's selector to match both pods
+	patch := `{"metadata":{"labels":{"name":null}}}`
+	podClient := clientSet.Core().Pods(ns.Name)
+	pod2, err := podClient.Patch(pod2.Name, types.StrategicMergePatchType, []byte(patch))
+	if err != nil {
+		t.Fatalf("Failed to patch pod2: %v", err)
+	}
+	t.Logf("patched pod2 = %#v", pod2)
+	// wait for the rc to create one more pod
+	if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+		return verifyRemainingObjects(t, clientSet, ns.Name, 1, 3)
+	}); err != nil {
+		t.Fatal(err)
+	}
+	pod2, err = podClient.Get(pod2.Name, metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("Failed to get pod2: %v", err)
+	}
+	if len(pod2.OwnerReferences) != 0 {
+		t.Fatalf("ownerReferences of pod2 is not cleared, got %#v", pod2.OwnerReferences)
+	}
+	close(stopCh)
+}
+
+func TestUpdateLabelToBeAdopted(t *testing.T) {
+	// We have pod1, pod2 and rc. rc.spec.replicas=1. At first rc.Selector
+	// matches pod1 only; change pod2's labels to be matching. Verify the RC
+	// controller adopts pod2 and delete one of them, so there is only 1 pod
+	// left.
+	stopCh := make(chan struct{})
+	s, closeFn, rm, _, clientSet := rmSetup(t, stopCh)
+	defer closeFn()
+	ns := framework.CreateTestingNamespace("update-label-to-be-adopted", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+	rc := newRC("rc", ns.Name, 1)
+	// let rc's selector only matches pod1
+	rc.Spec.Selector["uniqueKey"] = "1"
+	rc.Spec.Template.Labels["uniqueKey"] = "1"
+	pod1 := newMatchingPod("pod1", ns.Name)
+	pod1.Labels["uniqueKey"] = "1"
+	pod2 := newMatchingPod("pod2", ns.Name)
+	pod2.Labels["uniqueKey"] = "2"
+	createRCsPods(t, clientSet, []*v1.ReplicationController{rc}, []*v1.Pod{pod1, pod2}, ns.Name)
+
+	go rm.Run(5, stopCh)
+	waitRCStable(t, clientSet, rc, ns.Name)
+
+	// change the rc's selector to match both pods
+	patch := `{"metadata":{"labels":{"uniqueKey":"1"}}}`
+	podClient := clientSet.Core().Pods(ns.Name)
+	pod2, err := podClient.Patch(pod2.Name, types.StrategicMergePatchType, []byte(patch))
+	if err != nil {
+		t.Fatalf("Failed to patch pod2: %v", err)
+	}
+	t.Logf("patched pod2 = %#v", pod2)
+	// wait for the rc to select both pods and delete one of them
+	if err := wait.Poll(10*time.Second, 60*time.Second, func() (bool, error) {
+		return verifyRemainingObjects(t, clientSet, ns.Name, 1, 1)
+	}); err != nil {
+		t.Fatal(err)
+	}
+	close(stopCh)
+}

vendor/k8s.io/kubernetes/test/integration/scheduler/BUILD

@@ -0,0 +1,89 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "extender_test.go",
+        "main_test.go",
+        "predicates_test.go",
+        "priorities_test.go",
+        "scheduler_test.go",
+    ],
+    library = ":go_default_library",
+    tags = ["integration"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//pkg/features:go_default_library",
+        "//plugin/cmd/kube-scheduler/app:go_default_library",
+        "//plugin/cmd/kube-scheduler/app/options:go_default_library",
+        "//plugin/pkg/scheduler:go_default_library",
+        "//plugin/pkg/scheduler/algorithm:go_default_library",
+        "//plugin/pkg/scheduler/algorithmprovider:go_default_library",
+        "//plugin/pkg/scheduler/api:go_default_library",
+        "//plugin/pkg/scheduler/core:go_default_library",
+        "//plugin/pkg/scheduler/factory:go_default_library",
+        "//plugin/pkg/scheduler/schedulercache:go_default_library",
+        "//test/e2e/framework:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//test/utils:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/util/feature:go_default_library",
+        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes/typed/core/v1:go_default_library",
+        "//vendor/k8s.io/client-go/listers/core/v1:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/tools/cache:go_default_library",
+        "//vendor/k8s.io/client-go/tools/record:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["util.go"],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//plugin/pkg/scheduler:go_default_library",
+        "//plugin/pkg/scheduler/algorithmprovider:go_default_library",
+        "//plugin/pkg/scheduler/factory:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/uuid:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
+        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes/typed/core/v1:go_default_library",
+        "//vendor/k8s.io/client-go/listers/core/v1:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/tools/record:go_default_library",
+    ],
+)

vendor/k8s.io/kubernetes/test/integration/scheduler/OWNERS

@@ -0,0 +1,4 @@
+approvers:
+- sig-scheduling-maintainers
+reviewers:
+- sig-scheduling

vendor/k8s.io/kubernetes/test/integration/scheduler/extender_test.go

@@ -0,0 +1,450 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheduler
+
+// This file tests scheduler extender.
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/informers"
+	clientset "k8s.io/client-go/kubernetes"
+	v1core "k8s.io/client-go/kubernetes/typed/core/v1"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/plugin/pkg/scheduler"
+	_ "k8s.io/kubernetes/plugin/pkg/scheduler/algorithmprovider"
+	schedulerapi "k8s.io/kubernetes/plugin/pkg/scheduler/api"
+	"k8s.io/kubernetes/plugin/pkg/scheduler/factory"
+	e2e "k8s.io/kubernetes/test/e2e/framework"
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+const (
+	filter     = "filter"
+	prioritize = "prioritize"
+	bind       = "bind"
+)
+
+type fitPredicate func(pod *v1.Pod, node *v1.Node) (bool, error)
+type priorityFunc func(pod *v1.Pod, nodes *v1.NodeList) (*schedulerapi.HostPriorityList, error)
+
+type priorityConfig struct {
+	function priorityFunc
+	weight   int
+}
+
+type Extender struct {
+	name             string
+	predicates       []fitPredicate
+	prioritizers     []priorityConfig
+	nodeCacheCapable bool
+	Client           clientset.Interface
+}
+
+func (e *Extender) serveHTTP(t *testing.T, w http.ResponseWriter, req *http.Request) {
+	decoder := json.NewDecoder(req.Body)
+	defer req.Body.Close()
+
+	encoder := json.NewEncoder(w)
+
+	if strings.Contains(req.URL.Path, filter) || strings.Contains(req.URL.Path, prioritize) {
+		var args schedulerapi.ExtenderArgs
+
+		if err := decoder.Decode(&args); err != nil {
+			http.Error(w, "Decode error", http.StatusBadRequest)
+			return
+		}
+
+		if strings.Contains(req.URL.Path, filter) {
+			resp := &schedulerapi.ExtenderFilterResult{}
+			resp, err := e.Filter(&args)
+			if err != nil {
+				resp.Error = err.Error()
+			}
+
+			if err := encoder.Encode(resp); err != nil {
+				t.Fatalf("Failed to encode %v", resp)
+			}
+		} else if strings.Contains(req.URL.Path, prioritize) {
+			// Prioritize errors are ignored. Default k8s priorities or another extender's
+			// priorities may be applied.
+			priorities, _ := e.Prioritize(&args)
+
+			if err := encoder.Encode(priorities); err != nil {
+				t.Fatalf("Failed to encode %+v", priorities)
+			}
+		}
+	} else if strings.Contains(req.URL.Path, bind) {
+		var args schedulerapi.ExtenderBindingArgs
+
+		if err := decoder.Decode(&args); err != nil {
+			http.Error(w, "Decode error", http.StatusBadRequest)
+			return
+		}
+
+		resp := &schedulerapi.ExtenderBindingResult{}
+
+		if err := e.Bind(&args); err != nil {
+			resp.Error = err.Error()
+		}
+
+		if err := encoder.Encode(resp); err != nil {
+			t.Fatalf("Failed to encode %+v", resp)
+		}
+	} else {
+		http.Error(w, "Unknown method", http.StatusNotFound)
+	}
+}
+
+func (e *Extender) filterUsingNodeCache(args *schedulerapi.ExtenderArgs) (*schedulerapi.ExtenderFilterResult, error) {
+	nodeSlice := make([]string, 0)
+	failedNodesMap := schedulerapi.FailedNodesMap{}
+	for _, nodeName := range *args.NodeNames {
+		fits := true
+		for _, predicate := range e.predicates {
+			fit, err := predicate(&args.Pod,
+				&v1.Node{ObjectMeta: metav1.ObjectMeta{Name: nodeName}})
+			if err != nil {
+				return &schedulerapi.ExtenderFilterResult{
+					Nodes:       nil,
+					NodeNames:   nil,
+					FailedNodes: schedulerapi.FailedNodesMap{},
+					Error:       err.Error(),
+				}, err
+			}
+			if !fit {
+				fits = false
+				break
+			}
+		}
+		if fits {
+			nodeSlice = append(nodeSlice, nodeName)
+		} else {
+			failedNodesMap[nodeName] = fmt.Sprintf("extender failed: %s", e.name)
+		}
+	}
+
+	return &schedulerapi.ExtenderFilterResult{
+		Nodes:       nil,
+		NodeNames:   &nodeSlice,
+		FailedNodes: failedNodesMap,
+	}, nil
+}
+
+func (e *Extender) Filter(args *schedulerapi.ExtenderArgs) (*schedulerapi.ExtenderFilterResult, error) {
+	filtered := []v1.Node{}
+	failedNodesMap := schedulerapi.FailedNodesMap{}
+
+	if e.nodeCacheCapable {
+		return e.filterUsingNodeCache(args)
+	} else {
+		for _, node := range args.Nodes.Items {
+			fits := true
+			for _, predicate := range e.predicates {
+				fit, err := predicate(&args.Pod, &node)
+				if err != nil {
+					return &schedulerapi.ExtenderFilterResult{
+						Nodes:       &v1.NodeList{},
+						NodeNames:   nil,
+						FailedNodes: schedulerapi.FailedNodesMap{},
+						Error:       err.Error(),
+					}, err
+				}
+				if !fit {
+					fits = false
+					break
+				}
+			}
+			if fits {
+				filtered = append(filtered, node)
+			} else {
+				failedNodesMap[node.Name] = fmt.Sprintf("extender failed: %s", e.name)
+			}
+		}
+
+		return &schedulerapi.ExtenderFilterResult{
+			Nodes:       &v1.NodeList{Items: filtered},
+			NodeNames:   nil,
+			FailedNodes: failedNodesMap,
+		}, nil
+	}
+}
+
+func (e *Extender) Prioritize(args *schedulerapi.ExtenderArgs) (*schedulerapi.HostPriorityList, error) {
+	result := schedulerapi.HostPriorityList{}
+	combinedScores := map[string]int{}
+	var nodes = &v1.NodeList{Items: []v1.Node{}}
+
+	if e.nodeCacheCapable {
+		for _, nodeName := range *args.NodeNames {
+			nodes.Items = append(nodes.Items, v1.Node{ObjectMeta: metav1.ObjectMeta{Name: nodeName}})
+		}
+	} else {
+		nodes = args.Nodes
+	}
+
+	for _, prioritizer := range e.prioritizers {
+		weight := prioritizer.weight
+		if weight == 0 {
+			continue
+		}
+		priorityFunc := prioritizer.function
+		prioritizedList, err := priorityFunc(&args.Pod, nodes)
+		if err != nil {
+			return &schedulerapi.HostPriorityList{}, err
+		}
+		for _, hostEntry := range *prioritizedList {
+			combinedScores[hostEntry.Host] += hostEntry.Score * weight
+		}
+	}
+	for host, score := range combinedScores {
+		result = append(result, schedulerapi.HostPriority{Host: host, Score: score})
+	}
+	return &result, nil
+}
+
+func (e *Extender) Bind(binding *schedulerapi.ExtenderBindingArgs) error {
+	b := &v1.Binding{
+		ObjectMeta: metav1.ObjectMeta{Namespace: binding.PodNamespace, Name: binding.PodName, UID: binding.PodUID},
+		Target: v1.ObjectReference{
+			Kind: "Node",
+			Name: binding.Node,
+		},
+	}
+
+	return e.Client.CoreV1().Pods(b.Namespace).Bind(b)
+}
+
+func machine_1_2_3_Predicate(pod *v1.Pod, node *v1.Node) (bool, error) {
+	if node.Name == "machine1" || node.Name == "machine2" || node.Name == "machine3" {
+		return true, nil
+	}
+	return false, nil
+}
+
+func machine_2_3_5_Predicate(pod *v1.Pod, node *v1.Node) (bool, error) {
+	if node.Name == "machine2" || node.Name == "machine3" || node.Name == "machine5" {
+		return true, nil
+	}
+	return false, nil
+}
+
+func machine_2_Prioritizer(pod *v1.Pod, nodes *v1.NodeList) (*schedulerapi.HostPriorityList, error) {
+	result := schedulerapi.HostPriorityList{}
+	for _, node := range nodes.Items {
+		score := 1
+		if node.Name == "machine2" {
+			score = 10
+		}
+		result = append(result, schedulerapi.HostPriority{
+			Host:  node.Name,
+			Score: score,
+		})
+	}
+	return &result, nil
+}
+
+func machine_3_Prioritizer(pod *v1.Pod, nodes *v1.NodeList) (*schedulerapi.HostPriorityList, error) {
+	result := schedulerapi.HostPriorityList{}
+	for _, node := range nodes.Items {
+		score := 1
+		if node.Name == "machine3" {
+			score = 10
+		}
+		result = append(result, schedulerapi.HostPriority{
+			Host:  node.Name,
+			Score: score,
+		})
+	}
+	return &result, nil
+}
+
+func TestSchedulerExtender(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("scheduler-extender", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	clientSet := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+
+	extender1 := &Extender{
+		name:         "extender1",
+		predicates:   []fitPredicate{machine_1_2_3_Predicate},
+		prioritizers: []priorityConfig{{machine_2_Prioritizer, 1}},
+	}
+	es1 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		extender1.serveHTTP(t, w, req)
+	}))
+	defer es1.Close()
+
+	extender2 := &Extender{
+		name:         "extender2",
+		predicates:   []fitPredicate{machine_2_3_5_Predicate},
+		prioritizers: []priorityConfig{{machine_3_Prioritizer, 1}},
+		Client:       clientSet,
+	}
+	es2 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		extender2.serveHTTP(t, w, req)
+	}))
+	defer es2.Close()
+
+	extender3 := &Extender{
+		name:             "extender3",
+		predicates:       []fitPredicate{machine_1_2_3_Predicate},
+		prioritizers:     []priorityConfig{{machine_2_Prioritizer, 5}},
+		nodeCacheCapable: true,
+	}
+	es3 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		extender3.serveHTTP(t, w, req)
+	}))
+	defer es3.Close()
+
+	policy := schedulerapi.Policy{
+		ExtenderConfigs: []schedulerapi.ExtenderConfig{
+			{
+				URLPrefix:      es1.URL,
+				FilterVerb:     filter,
+				PrioritizeVerb: prioritize,
+				Weight:         3,
+				EnableHttps:    false,
+			},
+			{
+				URLPrefix:      es2.URL,
+				FilterVerb:     filter,
+				PrioritizeVerb: prioritize,
+				BindVerb:       bind,
+				Weight:         4,
+				EnableHttps:    false,
+			},
+			{
+				URLPrefix:        es3.URL,
+				FilterVerb:       filter,
+				PrioritizeVerb:   prioritize,
+				Weight:           10,
+				EnableHttps:      false,
+				NodeCacheCapable: true,
+			},
+		},
+	}
+	policy.APIVersion = testapi.Groups[v1.GroupName].GroupVersion().String()
+
+	informerFactory := informers.NewSharedInformerFactory(clientSet, 0)
+	schedulerConfigFactory := factory.NewConfigFactory(
+		v1.DefaultSchedulerName,
+		clientSet,
+		informerFactory.Core().V1().Nodes(),
+		informerFactory.Core().V1().Pods(),
+		informerFactory.Core().V1().PersistentVolumes(),
+		informerFactory.Core().V1().PersistentVolumeClaims(),
+		informerFactory.Core().V1().ReplicationControllers(),
+		informerFactory.Extensions().V1beta1().ReplicaSets(),
+		informerFactory.Apps().V1beta1().StatefulSets(),
+		informerFactory.Core().V1().Services(),
+		v1.DefaultHardPodAffinitySymmetricWeight,
+		enableEquivalenceCache,
+	)
+	schedulerConfig, err := schedulerConfigFactory.CreateFromConfig(policy)
+	if err != nil {
+		t.Fatalf("Couldn't create scheduler config: %v", err)
+	}
+	eventBroadcaster := record.NewBroadcaster()
+	schedulerConfig.Recorder = eventBroadcaster.NewRecorder(api.Scheme, v1.EventSource{Component: v1.DefaultSchedulerName})
+	eventBroadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: v1core.New(clientSet.CoreV1().RESTClient()).Events("")})
+	scheduler, _ := scheduler.NewFromConfigurator(&scheduler.FakeConfigurator{Config: schedulerConfig}, nil...)
+	informerFactory.Start(schedulerConfig.StopEverything)
+	scheduler.Run()
+
+	defer close(schedulerConfig.StopEverything)
+
+	DoTestPodScheduling(ns, t, clientSet)
+}
+
+func DoTestPodScheduling(ns *v1.Namespace, t *testing.T, cs clientset.Interface) {
+	// NOTE: This test cannot run in parallel, because it is creating and deleting
+	// non-namespaced objects (Nodes).
+	defer cs.CoreV1().Nodes().DeleteCollection(nil, metav1.ListOptions{})
+
+	goodCondition := v1.NodeCondition{
+		Type:              v1.NodeReady,
+		Status:            v1.ConditionTrue,
+		Reason:            fmt.Sprintf("schedulable condition"),
+		LastHeartbeatTime: metav1.Time{Time: time.Now()},
+	}
+	node := &v1.Node{
+		Spec: v1.NodeSpec{Unschedulable: false},
+		Status: v1.NodeStatus{
+			Capacity: v1.ResourceList{
+				v1.ResourcePods: *resource.NewQuantity(32, resource.DecimalSI),
+			},
+			Conditions: []v1.NodeCondition{goodCondition},
+		},
+	}
+
+	for ii := 0; ii < 5; ii++ {
+		node.Name = fmt.Sprintf("machine%d", ii+1)
+		if _, err := cs.CoreV1().Nodes().Create(node); err != nil {
+			t.Fatalf("Failed to create nodes: %v", err)
+		}
+	}
+
+	pod := &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{Name: "extender-test-pod"},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{{Name: "container", Image: e2e.GetPauseImageName(cs)}},
+		},
+	}
+
+	myPod, err := cs.CoreV1().Pods(ns.Name).Create(pod)
+	if err != nil {
+		t.Fatalf("Failed to create pod: %v", err)
+	}
+
+	err = wait.Poll(time.Second, wait.ForeverTestTimeout, podScheduled(cs, myPod.Namespace, myPod.Name))
+	if err != nil {
+		t.Fatalf("Failed to schedule pod: %v", err)
+	}
+
+	myPod, err = cs.CoreV1().Pods(ns.Name).Get(myPod.Name, metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("Failed to get pod: %v", err)
+	} else if myPod.Spec.NodeName != "machine2" {
+		t.Fatalf("Failed to schedule using extender, expected machine2, got %v", myPod.Spec.NodeName)
+	}
+	var gracePeriod int64
+	if err := cs.CoreV1().Pods(ns.Name).Delete(myPod.Name, &metav1.DeleteOptions{GracePeriodSeconds: &gracePeriod}); err != nil {
+		t.Fatalf("Failed to delete pod: %v", err)
+	}
+	_, err = cs.CoreV1().Pods(ns.Name).Get(myPod.Name, metav1.GetOptions{})
+	if err == nil {
+		t.Fatalf("Failed to delete pod: %v", err)
+	}
+	t.Logf("Scheduled pod using extenders")
+}

vendor/k8s.io/kubernetes/test/integration/scheduler/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheduler
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/scheduler/predicates_test.go

@@ -0,0 +1,868 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheduler
+
+import (
+	"testing"
+	"time"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/kubernetes/test/integration/framework"
+	testutils "k8s.io/kubernetes/test/utils"
+)
+
+// This file tests the scheduler predicates functionality.
+
+// TestInterPodAffinity verifies that scheduler's inter pod affinity and
+// anti-affinity predicate functions works correctly.
+func TestInterPodAffinity(t *testing.T) {
+	context := initTest(t, "inter-pod-affinity")
+	defer cleanupTest(t, context)
+	// Add a few nodes.
+	nodes, err := createNodes(context.clientSet, "testnode", nil, 2)
+	if err != nil {
+		t.Fatalf("Cannot create nodes: %v", err)
+	}
+	// Add labels to the nodes.
+	labels1 := map[string]string{
+		"region": "r1",
+		"zone":   "z11",
+	}
+	for _, node := range nodes {
+		if err = testutils.AddLabelsToNode(context.clientSet, node.Name, labels1); err != nil {
+			t.Fatalf("Cannot add labels to node: %v", err)
+		}
+		if err = waitForNodeLabels(context.clientSet, node.Name, labels1); err != nil {
+			t.Fatalf("Adding labels to node didn't succeed: %v", err)
+		}
+	}
+
+	cs := context.clientSet
+	podLabel := map[string]string{"service": "securityscan"}
+	podLabel2 := map[string]string{"security": "S1"}
+
+	tests := []struct {
+		pod       *v1.Pod
+		pods      []*v1.Pod
+		node      *v1.Node
+		fits      bool
+		errorType string
+		test      string
+	}{
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel2,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "security",
+												Operator: metav1.LabelSelectorOpDoesNotExist,
+												Values:   []string{"securityscan"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+					},
+				},
+			},
+			node:      nodes[0],
+			fits:      false,
+			errorType: "invalidPod",
+			test:      "validates that a pod with an invalid podAffinity is rejected because of the LabelSelectorRequirement is invalid",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel2,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "security",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"securityscan"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+					},
+				},
+			},
+			node: nodes[0],
+			fits: false,
+			test: "validates that Inter-pod-Affinity is respected if not matching",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel2,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"securityscan", "value2"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+					},
+				},
+			},
+			pods: []*v1.Pod{{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename2",
+					Labels: podLabel,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					NodeName:   nodes[0].Name,
+				},
+			},
+			},
+			node: nodes[0],
+			fits: true,
+			test: "validates that InterPodAffinity is respected if matching. requiredDuringSchedulingIgnoredDuringExecution in PodAffinity using In operator that matches the existing pod",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel2,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpNotIn,
+												Values:   []string{"securityscan3", "value3"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+					},
+				},
+			},
+			pods: []*v1.Pod{{Spec: v1.PodSpec{
+				Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+				NodeName:   nodes[0].Name},
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename2",
+					Labels: podLabel}}},
+			node: nodes[0],
+			fits: true,
+			test: "validates that InterPodAffinity is respected if matching. requiredDuringSchedulingIgnoredDuringExecution in PodAffinity using not in operator in labelSelector that matches the existing pod",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel2,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"securityscan", "value2"},
+											},
+										},
+									},
+									TopologyKey: "region",
+									Namespaces:  []string{"diff-namespace"},
+								},
+							},
+						},
+					},
+				},
+			},
+			pods: []*v1.Pod{{Spec: v1.PodSpec{
+				Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+				NodeName:   nodes[0].Name},
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename2",
+					Labels: podLabel, Namespace: "ns"}}},
+			node: nodes[0],
+			fits: false,
+			test: "validates that inter-pod-affinity is respected when pods have different Namespaces",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"antivirusscan", "value2"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+					},
+				},
+			},
+			pods: []*v1.Pod{{Spec: v1.PodSpec{
+				Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+				NodeName:   nodes[0].Name}, ObjectMeta: metav1.ObjectMeta{
+				Name:   "fakename2",
+				Labels: podLabel}}},
+			node: nodes[0],
+			fits: false,
+			test: "Doesn't satisfy the PodAffinity because of unmatching labelSelector with the existing pod",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel2,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpExists,
+											}, {
+												Key:      "wrongkey",
+												Operator: metav1.LabelSelectorOpDoesNotExist,
+											},
+										},
+									},
+									TopologyKey: "region",
+								}, {
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"securityscan"},
+											}, {
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpNotIn,
+												Values:   []string{"WrongValue"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+					},
+				},
+			},
+			pods: []*v1.Pod{{Spec: v1.PodSpec{
+				Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+				NodeName:   nodes[0].Name}, ObjectMeta: metav1.ObjectMeta{
+				Name:   "fakename2",
+				Labels: podLabel}}},
+			node: nodes[0],
+			fits: true,
+			test: "validates that InterPodAffinity is respected if matching with multiple affinities in multiple RequiredDuringSchedulingIgnoredDuringExecution ",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: podLabel2,
+					Name:   "fakename",
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpExists,
+											}, {
+												Key:      "wrongkey",
+												Operator: metav1.LabelSelectorOpDoesNotExist,
+											},
+										},
+									},
+									TopologyKey: "region",
+								}, {
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"securityscan2"},
+											}, {
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpNotIn,
+												Values:   []string{"WrongValue"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+					},
+				},
+			},
+			pods: []*v1.Pod{{Spec: v1.PodSpec{
+				Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+				NodeName:   nodes[0].Name}, ObjectMeta: metav1.ObjectMeta{
+				Name:   "fakename2",
+				Labels: podLabel}}},
+			node: nodes[0],
+			fits: false,
+			test: "The labelSelector requirements(items of matchExpressions) are ANDed, the pod cannot schedule onto the node because one of the matchExpression items doesn't match.",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel2,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"securityscan", "value2"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+						PodAntiAffinity: &v1.PodAntiAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"antivirusscan", "value2"},
+											},
+										},
+									},
+									TopologyKey: "node",
+								},
+							},
+						},
+					},
+				},
+			},
+			pods: []*v1.Pod{{Spec: v1.PodSpec{
+				Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+				NodeName:   nodes[0].Name}, ObjectMeta: metav1.ObjectMeta{
+				Name:   "fakename2",
+				Labels: podLabel}}},
+			node: nodes[0],
+			fits: true,
+			test: "validates that InterPod Affinity and AntiAffinity is respected if matching",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel2,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"securityscan", "value2"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+						PodAntiAffinity: &v1.PodAntiAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"antivirusscan", "value2"},
+											},
+										},
+									},
+									TopologyKey: "node",
+								},
+							},
+						},
+					},
+				},
+			},
+			pods: []*v1.Pod{
+				{
+					Spec: v1.PodSpec{
+						Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+						NodeName:   nodes[0].Name,
+						Affinity: &v1.Affinity{
+							PodAntiAffinity: &v1.PodAntiAffinity{
+								RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+									{
+										LabelSelector: &metav1.LabelSelector{
+											MatchExpressions: []metav1.LabelSelectorRequirement{
+												{
+													Key:      "service",
+													Operator: metav1.LabelSelectorOpIn,
+													Values:   []string{"antivirusscan", "value2"},
+												},
+											},
+										},
+										TopologyKey: "node",
+									},
+								},
+							},
+						},
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name:   "fakename2",
+						Labels: podLabel},
+				},
+			},
+			node: nodes[0],
+			fits: true,
+			test: "satisfies the PodAffinity and PodAntiAffinity and PodAntiAffinity symmetry with the existing pod",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel2,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"securityscan", "value2"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+						PodAntiAffinity: &v1.PodAntiAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"securityscan", "value2"},
+											},
+										},
+									},
+									TopologyKey: "zone",
+								},
+							},
+						},
+					},
+				},
+			},
+			pods: []*v1.Pod{{Spec: v1.PodSpec{
+				Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+				NodeName:   nodes[0].Name}, ObjectMeta: metav1.ObjectMeta{
+				Name:   "fakename2",
+				Labels: podLabel}}},
+			node: nodes[0],
+			fits: false,
+			test: "satisfies the PodAffinity but doesn't satisfies the PodAntiAffinity with the existing pod",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"securityscan", "value2"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+						PodAntiAffinity: &v1.PodAntiAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"antivirusscan", "value2"},
+											},
+										},
+									},
+									TopologyKey: "node",
+								},
+							},
+						},
+					},
+				},
+			},
+			pods: []*v1.Pod{
+				{
+					Spec: v1.PodSpec{
+						NodeName:   nodes[0].Name,
+						Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+						Affinity: &v1.Affinity{
+							PodAntiAffinity: &v1.PodAntiAffinity{
+								RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+									{
+										LabelSelector: &metav1.LabelSelector{
+											MatchExpressions: []metav1.LabelSelectorRequirement{
+												{
+													Key:      "service",
+													Operator: metav1.LabelSelectorOpIn,
+													Values:   []string{"securityscan", "value3"},
+												},
+											},
+										},
+										TopologyKey: "zone",
+									},
+								},
+							},
+						},
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name:   "fakename2",
+						Labels: podLabel},
+				},
+			},
+			node: nodes[0],
+			fits: false,
+			test: "satisfies the PodAffinity and PodAntiAffinity but doesn't satisfies PodAntiAffinity symmetry with the existing pod",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel,
+				},
+				Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					Affinity: &v1.Affinity{
+						PodAffinity: &v1.PodAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "service",
+												Operator: metav1.LabelSelectorOpNotIn,
+												Values:   []string{"securityscan", "value2"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+					},
+				},
+			},
+			pods: []*v1.Pod{{Spec: v1.PodSpec{
+				Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+				NodeName:   "machine2"}, ObjectMeta: metav1.ObjectMeta{
+				Name:   "fakename2",
+				Labels: podLabel}}},
+			node: nodes[0],
+			fits: false,
+			test: "pod matches its own Label in PodAffinity and that matches the existing pod Labels",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fakename",
+					Labels: podLabel,
+				},
+				Spec: v1.PodSpec{Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}}},
+			},
+			pods: []*v1.Pod{
+				{
+					Spec: v1.PodSpec{NodeName: nodes[0].Name,
+						Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+						Affinity: &v1.Affinity{
+							PodAntiAffinity: &v1.PodAntiAffinity{
+								RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+									{
+										LabelSelector: &metav1.LabelSelector{
+											MatchExpressions: []metav1.LabelSelectorRequirement{
+												{
+													Key:      "service",
+													Operator: metav1.LabelSelectorOpIn,
+													Values:   []string{"securityscan", "value2"},
+												},
+											},
+										},
+										TopologyKey: "zone",
+									},
+								},
+							},
+						},
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name:   "fakename2",
+						Labels: podLabel},
+				},
+			},
+			node: nodes[0],
+			fits: false,
+			test: "Verify that PodAntiAffinity of an existing pod is respected when PodAntiAffinity symmetry is not satisfied with the existing pod",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "fake-name",
+					Labels: podLabel,
+				},
+				Spec: v1.PodSpec{Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}}},
+			},
+			pods: []*v1.Pod{
+				{
+					Spec: v1.PodSpec{NodeName: nodes[0].Name,
+						Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+						Affinity: &v1.Affinity{
+							PodAntiAffinity: &v1.PodAntiAffinity{
+								RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+									{
+										LabelSelector: &metav1.LabelSelector{
+											MatchExpressions: []metav1.LabelSelectorRequirement{
+												{
+													Key:      "service",
+													Operator: metav1.LabelSelectorOpNotIn,
+													Values:   []string{"securityscan", "value2"},
+												},
+											},
+										},
+										TopologyKey: "zone",
+									},
+								},
+							},
+						},
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name:   "fake-name2",
+						Labels: podLabel},
+				},
+			},
+			node: nodes[0],
+			fits: true,
+			test: "Verify that PodAntiAffinity from existing pod is respected when pod statisfies PodAntiAffinity symmetry with the existing pod",
+		},
+		{
+			pod: &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{Name: "fake-name2"},
+				Spec: v1.PodSpec{
+					Containers:   []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					NodeSelector: map[string]string{"region": "r1"},
+					Affinity: &v1.Affinity{
+						PodAntiAffinity: &v1.PodAntiAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "foo",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"abc"},
+											},
+										},
+									},
+									TopologyKey: "region",
+								},
+							},
+						},
+					},
+				},
+			},
+			pods: []*v1.Pod{
+				{Spec: v1.PodSpec{
+					Containers: []v1.Container{{Name: "container", Image: framework.GetPauseImageName(cs)}},
+					NodeName:   nodes[0].Name}, ObjectMeta: metav1.ObjectMeta{Name: "fakename", Labels: map[string]string{"foo": "abc"}}},
+			},
+			fits: false,
+			test: "nodes[0] and nodes[1] have same topologyKey and label value. nodes[0] has an existing pod that matches the inter pod affinity rule. The new pod can not be scheduled onto either of the two nodes.",
+		},
+	}
+	for _, test := range tests {
+		for _, pod := range test.pods {
+			var nsName string
+			if pod.Namespace != "" {
+				nsName = pod.Namespace
+			} else {
+				nsName = context.ns.Name
+			}
+			createdPod, err := cs.CoreV1().Pods(nsName).Create(pod)
+			if err != nil {
+				t.Fatalf("Test Failed: error, %v, while creating pod during test: %v", err, test.test)
+			}
+			err = wait.Poll(time.Second, wait.ForeverTestTimeout, podScheduled(cs, createdPod.Namespace, createdPod.Name))
+			if err != nil {
+				t.Errorf("Test Failed: error, %v, while waiting for pod during test, %v", err, test)
+			}
+		}
+		testPod, err := cs.CoreV1().Pods(context.ns.Name).Create(test.pod)
+		if err != nil {
+			if !(test.errorType == "invalidPod" && errors.IsInvalid(err)) {
+				t.Fatalf("Test Failed: error, %v, while creating pod during test: %v", err, test.test)
+			}
+		} else {
+			err = wait.Poll(time.Second, wait.ForeverTestTimeout, podScheduled(cs, testPod.Namespace, testPod.Name))
+			if err != nil && err != wait.ErrWaitTimeout {
+				t.Errorf("Test Failed: error, %v, while waiting for pod to get scheduled, %v", err, test.test)
+			}
+			if (err == nil) != test.fits {
+				t.Errorf("Test Failed: %v, err %v, test.fits %v", test.test, err, test.fits)
+			}
+
+			for _, pod := range test.pods {
+				var nsName string
+				if pod.Namespace != "" {
+					nsName = pod.Namespace
+				} else {
+					nsName = context.ns.Name
+				}
+				err = cs.CoreV1().Pods(nsName).Delete(pod.Name, metav1.NewDeleteOptions(0))
+				if err != nil {
+					t.Errorf("Test Failed: error, %v, while deleting pod during test: %v", err, test.test)
+				}
+				err = wait.Poll(time.Second, wait.ForeverTestTimeout, podDeleted(cs, nsName, pod.Name))
+				if err != nil {
+					t.Errorf("Test Failed: error, %v, while waiting for pod to get deleted, %v", err, test.test)
+				}
+			}
+			err = cs.CoreV1().Pods(context.ns.Name).Delete(test.pod.Name, metav1.NewDeleteOptions(0))
+			if err != nil {
+				t.Errorf("Test Failed: error, %v, while deleting pod during test: %v", err, test.test)
+			}
+			err = wait.Poll(time.Second, wait.ForeverTestTimeout, podDeleted(cs, context.ns.Name, test.pod.Name))
+			if err != nil {
+				t.Errorf("Test Failed: error, %v, while waiting for pod to get deleted, %v", err, test.test)
+			}
+		}
+	}
+}

vendor/k8s.io/kubernetes/test/integration/scheduler/priorities_test.go

@@ -0,0 +1,174 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheduler
+
+import (
+	"testing"
+
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	testutils "k8s.io/kubernetes/test/utils"
+)
+
+// This file tests the scheduler priority functions.
+
+// TestNodeAffinity verifies that scheduler's node affinity priority function
+// works correctly.
+func TestNodeAffinity(t *testing.T) {
+	context := initTest(t, "node-affinity")
+	defer cleanupTest(t, context)
+	// Add a few nodes.
+	nodes, err := createNodes(context.clientSet, "testnode", nil, 5)
+	if err != nil {
+		t.Fatalf("Cannot create nodes: %v", err)
+	}
+	// Add a label to one of the nodes.
+	labeledNode := nodes[1]
+	labelKey := "kubernetes.io/node-topologyKey"
+	labelValue := "topologyvalue"
+	labels := map[string]string{
+		labelKey: labelValue,
+	}
+	if err = testutils.AddLabelsToNode(context.clientSet, labeledNode.Name, labels); err != nil {
+		t.Fatalf("Cannot add labels to node: %v", err)
+	}
+	if err = waitForNodeLabels(context.clientSet, labeledNode.Name, labels); err != nil {
+		t.Fatalf("Adding labels to node didn't succeed: %v", err)
+	}
+	// Create a pod with node affinity.
+	podName := "pod-with-node-affinity"
+	pod, err := runPausePod(context.clientSet, initPausePod(context.clientSet, &pausePodConfig{
+		Name:      podName,
+		Namespace: context.ns.Name,
+		Affinity: &v1.Affinity{
+			NodeAffinity: &v1.NodeAffinity{
+				PreferredDuringSchedulingIgnoredDuringExecution: []v1.PreferredSchedulingTerm{
+					{
+						Preference: v1.NodeSelectorTerm{
+							MatchExpressions: []v1.NodeSelectorRequirement{
+								{
+									Key:      labelKey,
+									Operator: v1.NodeSelectorOpIn,
+									Values:   []string{labelValue},
+								},
+							},
+						},
+						Weight: 20,
+					},
+				},
+			},
+		},
+	}))
+	if err != nil {
+		t.Fatalf("Error running pause pod: %v", err)
+	}
+	if pod.Spec.NodeName != labeledNode.Name {
+		t.Errorf("Pod %v got scheduled on an unexpected node: %v. Expected node: %v.", podName, pod.Spec.NodeName, labeledNode.Name)
+	} else {
+		t.Logf("Pod %v got successfully scheduled on node %v.", podName, pod.Spec.NodeName)
+	}
+}
+
+// TestPodAffinity verifies that scheduler's pod affinity priority function
+// works correctly.
+func TestPodAffinity(t *testing.T) {
+	context := initTest(t, "pod-affinity")
+	defer cleanupTest(t, context)
+	// Add a few nodes.
+	nodesInTopology, err := createNodes(context.clientSet, "in-topology", nil, 5)
+	if err != nil {
+		t.Fatalf("Cannot create nodes: %v", err)
+	}
+	topologyKey := "node-topologykey"
+	topologyValue := "topologyvalue"
+	nodeLabels := map[string]string{
+		topologyKey: topologyValue,
+	}
+	for _, node := range nodesInTopology {
+		// Add topology key to all the nodes.
+		if err = testutils.AddLabelsToNode(context.clientSet, node.Name, nodeLabels); err != nil {
+			t.Fatalf("Cannot add labels to node %v: %v", node.Name, err)
+		}
+		if err = waitForNodeLabels(context.clientSet, node.Name, nodeLabels); err != nil {
+			t.Fatalf("Adding labels to node %v didn't succeed: %v", node.Name, err)
+		}
+	}
+	// Add a pod with a label and wait for it to schedule.
+	labelKey := "service"
+	labelValue := "S1"
+	_, err = runPausePod(context.clientSet, initPausePod(context.clientSet, &pausePodConfig{
+		Name:      "attractor-pod",
+		Namespace: context.ns.Name,
+		Labels:    map[string]string{labelKey: labelValue},
+	}))
+	if err != nil {
+		t.Fatalf("Error running the attractor pod: %v", err)
+	}
+	// Add a few more nodes without the topology label.
+	_, err = createNodes(context.clientSet, "other-node", nil, 5)
+	if err != nil {
+		t.Fatalf("Cannot create the second set of nodes: %v", err)
+	}
+	// Add a new pod with affinity to the attractor pod.
+	podName := "pod-with-podaffinity"
+	pod, err := runPausePod(context.clientSet, initPausePod(context.clientSet, &pausePodConfig{
+		Name:      podName,
+		Namespace: context.ns.Name,
+		Affinity: &v1.Affinity{
+			PodAffinity: &v1.PodAffinity{
+				PreferredDuringSchedulingIgnoredDuringExecution: []v1.WeightedPodAffinityTerm{
+					{
+						PodAffinityTerm: v1.PodAffinityTerm{
+							LabelSelector: &metav1.LabelSelector{
+								MatchExpressions: []metav1.LabelSelectorRequirement{
+									{
+										Key:      labelKey,
+										Operator: metav1.LabelSelectorOpIn,
+										Values:   []string{labelValue, "S3"},
+									},
+									{
+										Key:      labelKey,
+										Operator: metav1.LabelSelectorOpNotIn,
+										Values:   []string{"S2"},
+									}, {
+										Key:      labelKey,
+										Operator: metav1.LabelSelectorOpExists,
+									},
+								},
+							},
+							TopologyKey: topologyKey,
+							Namespaces:  []string{context.ns.Name},
+						},
+						Weight: 50,
+					},
+				},
+			},
+		},
+	}))
+	if err != nil {
+		t.Fatalf("Error running pause pod: %v", err)
+	}
+	// The new pod must be scheduled on one of the nodes with the same topology
+	// key-value as the attractor pod.
+	for _, node := range nodesInTopology {
+		if node.Name == pod.Spec.NodeName {
+			t.Logf("Pod %v got successfully scheduled on node %v.", podName, pod.Spec.NodeName)
+			return
+		}
+	}
+	t.Errorf("Pod %v got scheduled on an unexpected node: %v.", podName, pod.Spec.NodeName)
+}

vendor/k8s.io/kubernetes/test/integration/scheduler/scheduler_test.go

@@ -0,0 +1,902 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheduler
+
+// This file tests the scheduler.
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/wait"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
+	"k8s.io/client-go/informers"
+	clientset "k8s.io/client-go/kubernetes"
+	clientv1core "k8s.io/client-go/kubernetes/typed/core/v1"
+	corelisters "k8s.io/client-go/listers/core/v1"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/pkg/features"
+	"k8s.io/kubernetes/plugin/cmd/kube-scheduler/app"
+	"k8s.io/kubernetes/plugin/cmd/kube-scheduler/app/options"
+	"k8s.io/kubernetes/plugin/pkg/scheduler"
+	"k8s.io/kubernetes/plugin/pkg/scheduler/algorithm"
+	_ "k8s.io/kubernetes/plugin/pkg/scheduler/algorithmprovider"
+	schedulerapi "k8s.io/kubernetes/plugin/pkg/scheduler/api"
+	"k8s.io/kubernetes/plugin/pkg/scheduler/core"
+	"k8s.io/kubernetes/plugin/pkg/scheduler/factory"
+	"k8s.io/kubernetes/plugin/pkg/scheduler/schedulercache"
+	"k8s.io/kubernetes/test/integration/framework"
+	testutils "k8s.io/kubernetes/test/utils"
+)
+
+const enableEquivalenceCache = true
+
+type nodeMutationFunc func(t *testing.T, n *v1.Node, nodeLister corelisters.NodeLister, c clientset.Interface)
+
+type nodeStateManager struct {
+	makeSchedulable   nodeMutationFunc
+	makeUnSchedulable nodeMutationFunc
+}
+
+func PredicateOne(pod *v1.Pod, meta algorithm.PredicateMetadata, nodeInfo *schedulercache.NodeInfo) (bool, []algorithm.PredicateFailureReason, error) {
+	return true, nil, nil
+}
+
+func PredicateTwo(pod *v1.Pod, meta algorithm.PredicateMetadata, nodeInfo *schedulercache.NodeInfo) (bool, []algorithm.PredicateFailureReason, error) {
+	return true, nil, nil
+}
+
+func PriorityOne(pod *v1.Pod, nodeNameToInfo map[string]*schedulercache.NodeInfo, nodes []*v1.Node) (schedulerapi.HostPriorityList, error) {
+	return []schedulerapi.HostPriority{}, nil
+}
+
+func PriorityTwo(pod *v1.Pod, nodeNameToInfo map[string]*schedulercache.NodeInfo, nodes []*v1.Node) (schedulerapi.HostPriorityList, error) {
+	return []schedulerapi.HostPriority{}, nil
+}
+
+// TestSchedulerCreationFromConfigMap verifies that scheduler can be created
+// from configurations provided by a ConfigMap object and then verifies that the
+// configuration is applied correctly.
+func TestSchedulerCreationFromConfigMap(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("configmap", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	clientSet := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+	defer clientSet.CoreV1().Nodes().DeleteCollection(nil, metav1.ListOptions{})
+	informerFactory := informers.NewSharedInformerFactory(clientSet, 0)
+
+	// Pre-register some predicate and priority functions
+	factory.RegisterFitPredicate("PredicateOne", PredicateOne)
+	factory.RegisterFitPredicate("PredicateTwo", PredicateTwo)
+	factory.RegisterPriorityFunction("PriorityOne", PriorityOne, 1)
+	factory.RegisterPriorityFunction("PriorityTwo", PriorityTwo, 1)
+
+	// Add a ConfigMap object.
+	configPolicyName := "scheduler-custom-policy-config"
+	policyConfigMap := v1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{Namespace: metav1.NamespaceSystem, Name: configPolicyName},
+		Data: map[string]string{
+			options.SchedulerPolicyConfigMapKey: `{
+			"kind" : "Policy",
+			"apiVersion" : "v1",
+			"predicates" : [
+				{"name" : "PredicateOne"},
+				{"name" : "PredicateTwo"}
+			],
+			"priorities" : [
+				{"name" : "PriorityOne", "weight" : 1},
+				{"name" : "PriorityTwo", "weight" : 5}
+			]
+			}`,
+		},
+	}
+
+	policyConfigMap.APIVersion = testapi.Groups[v1.GroupName].GroupVersion().String()
+	clientSet.CoreV1().ConfigMaps(metav1.NamespaceSystem).Create(&policyConfigMap)
+
+	eventBroadcaster := record.NewBroadcaster()
+	eventBroadcaster.StartRecordingToSink(&clientv1core.EventSinkImpl{Interface: clientv1core.New(clientSet.CoreV1().RESTClient()).Events("")})
+	ss := options.NewSchedulerServer()
+	ss.HardPodAffinitySymmetricWeight = v1.DefaultHardPodAffinitySymmetricWeight
+	ss.PolicyConfigMapName = configPolicyName
+	sched, err := app.CreateScheduler(ss, clientSet,
+		informerFactory.Core().V1().Nodes(),
+		informerFactory.Core().V1().Pods(),
+		informerFactory.Core().V1().PersistentVolumes(),
+		informerFactory.Core().V1().PersistentVolumeClaims(),
+		informerFactory.Core().V1().ReplicationControllers(),
+		informerFactory.Extensions().V1beta1().ReplicaSets(),
+		informerFactory.Apps().V1beta1().StatefulSets(),
+		informerFactory.Core().V1().Services(),
+		eventBroadcaster.NewRecorder(api.Scheme, v1.EventSource{Component: v1.DefaultSchedulerName}),
+	)
+	if err != nil {
+		t.Fatalf("Error creating scheduler: %v", err)
+	}
+	defer close(sched.Config().StopEverything)
+
+	// Verify that the config is applied correctly.
+	schedPredicates := sched.Config().Algorithm.Predicates()
+	schedPrioritizers := sched.Config().Algorithm.Prioritizers()
+	// Includes one mandatory predicates.
+	if len(schedPredicates) != 3 || len(schedPrioritizers) != 2 {
+		t.Errorf("Unexpected number of predicates or priority functions. Number of predicates: %v, number of prioritizers: %v", len(schedPredicates), len(schedPrioritizers))
+	}
+	// Check a predicate and a priority function.
+	if schedPredicates["PredicateTwo"] == nil {
+		t.Errorf("Expected to have a PodFitsHostPorts predicate.")
+	}
+	if schedPrioritizers[1].Function == nil || schedPrioritizers[1].Weight != 5 {
+		t.Errorf("Unexpected prioritizer: func: %v, weight: %v", schedPrioritizers[1].Function, schedPrioritizers[1].Weight)
+	}
+}
+
+// TestSchedulerCreationFromNonExistentConfigMap ensures that creation of the
+// scheduler from a non-existent ConfigMap fails.
+func TestSchedulerCreationFromNonExistentConfigMap(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("configmap", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	clientSet := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+	defer clientSet.CoreV1().Nodes().DeleteCollection(nil, metav1.ListOptions{})
+
+	informerFactory := informers.NewSharedInformerFactory(clientSet, 0)
+
+	eventBroadcaster := record.NewBroadcaster()
+	eventBroadcaster.StartRecordingToSink(&clientv1core.EventSinkImpl{Interface: clientv1core.New(clientSet.CoreV1().RESTClient()).Events("")})
+
+	ss := options.NewSchedulerServer()
+	ss.PolicyConfigMapName = "non-existent-config"
+
+	_, err := app.CreateScheduler(ss, clientSet,
+		informerFactory.Core().V1().Nodes(),
+		informerFactory.Core().V1().Pods(),
+		informerFactory.Core().V1().PersistentVolumes(),
+		informerFactory.Core().V1().PersistentVolumeClaims(),
+		informerFactory.Core().V1().ReplicationControllers(),
+		informerFactory.Extensions().V1beta1().ReplicaSets(),
+		informerFactory.Apps().V1beta1().StatefulSets(),
+		informerFactory.Core().V1().Services(),
+		eventBroadcaster.NewRecorder(api.Scheme, v1.EventSource{Component: v1.DefaultSchedulerName}),
+	)
+
+	if err == nil {
+		t.Fatalf("Creation of scheduler didn't fail while the policy ConfigMap didn't exist.")
+	}
+}
+
+// TestSchedulerCreationInLegacyMode ensures that creation of the scheduler
+// works fine when legacy mode is enabled.
+func TestSchedulerCreationInLegacyMode(t *testing.T) {
+	_, s, closeFn := framework.RunAMaster(nil)
+	defer closeFn()
+
+	ns := framework.CreateTestingNamespace("configmap", s, t)
+	defer framework.DeleteTestingNamespace(ns, s, t)
+
+	clientSet := clientset.NewForConfigOrDie(&restclient.Config{Host: s.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+	defer clientSet.CoreV1().Nodes().DeleteCollection(nil, metav1.ListOptions{})
+	informerFactory := informers.NewSharedInformerFactory(clientSet, 0)
+
+	eventBroadcaster := record.NewBroadcaster()
+	eventBroadcaster.StartRecordingToSink(&clientv1core.EventSinkImpl{Interface: clientv1core.New(clientSet.CoreV1().RESTClient()).Events("")})
+
+	ss := options.NewSchedulerServer()
+	ss.HardPodAffinitySymmetricWeight = v1.DefaultHardPodAffinitySymmetricWeight
+	ss.PolicyConfigMapName = "non-existent-configmap"
+	ss.UseLegacyPolicyConfig = true
+
+	sched, err := app.CreateScheduler(ss, clientSet,
+		informerFactory.Core().V1().Nodes(),
+		informerFactory.Core().V1().Pods(),
+		informerFactory.Core().V1().PersistentVolumes(),
+		informerFactory.Core().V1().PersistentVolumeClaims(),
+		informerFactory.Core().V1().ReplicationControllers(),
+		informerFactory.Extensions().V1beta1().ReplicaSets(),
+		informerFactory.Apps().V1beta1().StatefulSets(),
+		informerFactory.Core().V1().Services(),
+		eventBroadcaster.NewRecorder(api.Scheme, v1.EventSource{Component: v1.DefaultSchedulerName}),
+	)
+	if err != nil {
+		t.Fatalf("Creation of scheduler in legacy mode failed: %v", err)
+	}
+	informerFactory.Start(sched.Config().StopEverything)
+	defer close(sched.Config().StopEverything)
+	sched.Run()
+
+	_, err = createNode(clientSet, "test-node", nil)
+	if err != nil {
+		t.Fatalf("Failed to create node: %v", err)
+	}
+	pod, err := createPausePodWithResource(clientSet, "test-pod", "configmap", nil)
+	if err != nil {
+		t.Fatalf("Failed to create pod: %v", err)
+	}
+	err = waitForPodToSchedule(clientSet, pod)
+	if err != nil {
+		t.Errorf("Failed to schedule a pod: %v", err)
+	} else {
+		t.Logf("Pod got scheduled on a node.")
+	}
+}
+
+func TestUnschedulableNodes(t *testing.T) {
+	context := initTest(t, "unschedulable-nodes")
+	defer cleanupTest(t, context)
+
+	nodeLister := context.schedulerConfigFactory.GetNodeLister()
+	// NOTE: This test cannot run in parallel, because it is creating and deleting
+	// non-namespaced objects (Nodes).
+	defer context.clientSet.CoreV1().Nodes().DeleteCollection(nil, metav1.ListOptions{})
+
+	goodCondition := v1.NodeCondition{
+		Type:              v1.NodeReady,
+		Status:            v1.ConditionTrue,
+		Reason:            fmt.Sprintf("schedulable condition"),
+		LastHeartbeatTime: metav1.Time{Time: time.Now()},
+	}
+	badCondition := v1.NodeCondition{
+		Type:              v1.NodeReady,
+		Status:            v1.ConditionUnknown,
+		Reason:            fmt.Sprintf("unschedulable condition"),
+		LastHeartbeatTime: metav1.Time{Time: time.Now()},
+	}
+	// Create a new schedulable node, since we're first going to apply
+	// the unschedulable condition and verify that pods aren't scheduled.
+	node := &v1.Node{
+		ObjectMeta: metav1.ObjectMeta{Name: "node-scheduling-test-node"},
+		Spec:       v1.NodeSpec{Unschedulable: false},
+		Status: v1.NodeStatus{
+			Capacity: v1.ResourceList{
+				v1.ResourcePods: *resource.NewQuantity(32, resource.DecimalSI),
+			},
+			Conditions: []v1.NodeCondition{goodCondition},
+		},
+	}
+	nodeKey, err := cache.MetaNamespaceKeyFunc(node)
+	if err != nil {
+		t.Fatalf("Couldn't retrieve key for node %v", node.Name)
+	}
+
+	// The test does the following for each nodeStateManager in this list:
+	//	1. Create a new node
+	//	2. Apply the makeUnSchedulable function
+	//	3. Create a new pod
+	//  4. Check that the pod doesn't get assigned to the node
+	//  5. Apply the schedulable function
+	//  6. Check that the pod *does* get assigned to the node
+	//  7. Delete the pod and node.
+
+	nodeModifications := []nodeStateManager{
+		// Test node.Spec.Unschedulable=true/false
+		{
+			makeUnSchedulable: func(t *testing.T, n *v1.Node, nodeLister corelisters.NodeLister, c clientset.Interface) {
+				n.Spec.Unschedulable = true
+				if _, err := c.CoreV1().Nodes().Update(n); err != nil {
+					t.Fatalf("Failed to update node with unschedulable=true: %v", err)
+				}
+				err = waitForReflection(t, nodeLister, nodeKey, func(node interface{}) bool {
+					// An unschedulable node should still be present in the store
+					// Nodes that are unschedulable or that are not ready or
+					// have their disk full (Node.Spec.Conditions) are excluded
+					// based on NodeConditionPredicate, a separate check
+					return node != nil && node.(*v1.Node).Spec.Unschedulable == true
+				})
+				if err != nil {
+					t.Fatalf("Failed to observe reflected update for setting unschedulable=true: %v", err)
+				}
+			},
+			makeSchedulable: func(t *testing.T, n *v1.Node, nodeLister corelisters.NodeLister, c clientset.Interface) {
+				n.Spec.Unschedulable = false
+				if _, err := c.CoreV1().Nodes().Update(n); err != nil {
+					t.Fatalf("Failed to update node with unschedulable=false: %v", err)
+				}
+				err = waitForReflection(t, nodeLister, nodeKey, func(node interface{}) bool {
+					return node != nil && node.(*v1.Node).Spec.Unschedulable == false
+				})
+				if err != nil {
+					t.Fatalf("Failed to observe reflected update for setting unschedulable=false: %v", err)
+				}
+			},
+		},
+		// Test node.Status.Conditions=ConditionTrue/Unknown
+		{
+			makeUnSchedulable: func(t *testing.T, n *v1.Node, nodeLister corelisters.NodeLister, c clientset.Interface) {
+				n.Status = v1.NodeStatus{
+					Capacity: v1.ResourceList{
+						v1.ResourcePods: *resource.NewQuantity(32, resource.DecimalSI),
+					},
+					Conditions: []v1.NodeCondition{badCondition},
+				}
+				if _, err = c.CoreV1().Nodes().UpdateStatus(n); err != nil {
+					t.Fatalf("Failed to update node with bad status condition: %v", err)
+				}
+				err = waitForReflection(t, nodeLister, nodeKey, func(node interface{}) bool {
+					return node != nil && node.(*v1.Node).Status.Conditions[0].Status == v1.ConditionUnknown
+				})
+				if err != nil {
+					t.Fatalf("Failed to observe reflected update for status condition update: %v", err)
+				}
+			},
+			makeSchedulable: func(t *testing.T, n *v1.Node, nodeLister corelisters.NodeLister, c clientset.Interface) {
+				n.Status = v1.NodeStatus{
+					Capacity: v1.ResourceList{
+						v1.ResourcePods: *resource.NewQuantity(32, resource.DecimalSI),
+					},
+					Conditions: []v1.NodeCondition{goodCondition},
+				}
+				if _, err = c.CoreV1().Nodes().UpdateStatus(n); err != nil {
+					t.Fatalf("Failed to update node with healthy status condition: %v", err)
+				}
+				err = waitForReflection(t, nodeLister, nodeKey, func(node interface{}) bool {
+					return node != nil && node.(*v1.Node).Status.Conditions[0].Status == v1.ConditionTrue
+				})
+				if err != nil {
+					t.Fatalf("Failed to observe reflected update for status condition update: %v", err)
+				}
+			},
+		},
+	}
+
+	for i, mod := range nodeModifications {
+		unSchedNode, err := context.clientSet.CoreV1().Nodes().Create(node)
+		if err != nil {
+			t.Fatalf("Failed to create node: %v", err)
+		}
+
+		// Apply the unschedulable modification to the node, and wait for the reflection
+		mod.makeUnSchedulable(t, unSchedNode, nodeLister, context.clientSet)
+
+		// Create the new pod, note that this needs to happen post unschedulable
+		// modification or we have a race in the test.
+		myPod, err := createPausePodWithResource(context.clientSet, "node-scheduling-test-pod", context.ns.Name, nil)
+		if err != nil {
+			t.Fatalf("Failed to create pod: %v", err)
+		}
+
+		// There are no schedulable nodes - the pod shouldn't be scheduled.
+		err = waitForPodToSchedule(context.clientSet, myPod)
+		if err == nil {
+			t.Errorf("Pod scheduled successfully on unschedulable nodes")
+		}
+		if err != wait.ErrWaitTimeout {
+			t.Errorf("Test %d: failed while trying to confirm the pod does not get scheduled on the node: %v", i, err)
+		} else {
+			t.Logf("Test %d: Pod did not get scheduled on an unschedulable node", i)
+		}
+
+		// Apply the schedulable modification to the node, and wait for the reflection
+		schedNode, err := context.clientSet.CoreV1().Nodes().Get(unSchedNode.Name, metav1.GetOptions{})
+		if err != nil {
+			t.Fatalf("Failed to get node: %v", err)
+		}
+		mod.makeSchedulable(t, schedNode, nodeLister, context.clientSet)
+
+		// Wait until the pod is scheduled.
+		if err := waitForPodToSchedule(context.clientSet, myPod); err != nil {
+			t.Errorf("Test %d: failed to schedule a pod: %v", i, err)
+		} else {
+			t.Logf("Test %d: Pod got scheduled on a schedulable node", i)
+		}
+		// Clean up.
+		if err := deletePod(context.clientSet, myPod.Name, myPod.Namespace); err != nil {
+			t.Errorf("Failed to delete pod: %v", err)
+		}
+		err = context.clientSet.CoreV1().Nodes().Delete(schedNode.Name, nil)
+		if err != nil {
+			t.Errorf("Failed to delete node: %v", err)
+		}
+	}
+}
+
+func TestMultiScheduler(t *testing.T) {
+	/*
+		This integration tests the multi-scheduler feature in the following way:
+		1. create a default scheduler
+		2. create a node
+		3. create 3 pods: testPodNoAnnotation, testPodWithAnnotationFitsDefault and testPodWithAnnotationFitsFoo
+			- note: the first two should be picked and scheduled by default scheduler while the last one should be
+			        picked by scheduler of name "foo-scheduler" which does not exist yet.
+		4. **check point-1**:
+			- testPodNoAnnotation, testPodWithAnnotationFitsDefault should be scheduled
+			- testPodWithAnnotationFitsFoo should NOT be scheduled
+		5. create a scheduler with name "foo-scheduler"
+		6. **check point-2**:
+			- testPodWithAnnotationFitsFoo should be scheduled
+		7. stop default scheduler
+		8. create 2 pods: testPodNoAnnotation2 and testPodWithAnnotationFitsDefault2
+			- note: these two pods belong to default scheduler which no longer exists
+		9. **check point-3**:
+			- testPodNoAnnotation2 and testPodWithAnnotationFitsDefault2 should NOT be scheduled
+	*/
+
+	// 1. create and start default-scheduler
+	context := initTest(t, "multi-scheduler")
+	defer cleanupTest(t, context)
+
+	// 2. create a node
+	node := &v1.Node{
+		ObjectMeta: metav1.ObjectMeta{Name: "node-multi-scheduler-test-node"},
+		Spec:       v1.NodeSpec{Unschedulable: false},
+		Status: v1.NodeStatus{
+			Capacity: v1.ResourceList{
+				v1.ResourcePods: *resource.NewQuantity(32, resource.DecimalSI),
+			},
+		},
+	}
+	context.clientSet.CoreV1().Nodes().Create(node)
+
+	// 3. create 3 pods for testing
+	testPod, err := createPausePodWithResource(context.clientSet, "pod-without-scheduler-name", context.ns.Name, nil)
+	if err != nil {
+		t.Fatalf("Failed to create pod: %v", err)
+	}
+
+	defaultScheduler := "default-scheduler"
+	testPodFitsDefault, err := createPausePod(context.clientSet, initPausePod(context.clientSet, &pausePodConfig{Name: "pod-fits-default", Namespace: context.ns.Name, SchedulerName: defaultScheduler}))
+	if err != nil {
+		t.Fatalf("Failed to create pod: %v", err)
+	}
+
+	fooScheduler := "foo-scheduler"
+	testPodFitsFoo, err := createPausePod(context.clientSet, initPausePod(context.clientSet, &pausePodConfig{Name: "pod-fits-foo", Namespace: context.ns.Name, SchedulerName: fooScheduler}))
+	if err != nil {
+		t.Fatalf("Failed to create pod: %v", err)
+	}
+
+	// 4. **check point-1**:
+	//		- testPod, testPodFitsDefault should be scheduled
+	//		- testPodFitsFoo should NOT be scheduled
+	if err := waitForPodToSchedule(context.clientSet, testPod); err != nil {
+		t.Errorf("Test MultiScheduler: %s Pod not scheduled: %v", testPod.Name, err)
+	} else {
+		t.Logf("Test MultiScheduler: %s Pod scheduled", testPod.Name)
+	}
+
+	if err := waitForPodToSchedule(context.clientSet, testPodFitsDefault); err != nil {
+		t.Errorf("Test MultiScheduler: %s Pod not scheduled: %v", testPodFitsDefault.Name, err)
+	} else {
+		t.Logf("Test MultiScheduler: %s Pod scheduled", testPodFitsDefault.Name)
+	}
+
+	if err := waitForPodToScheduleWithTimeout(context.clientSet, testPodFitsFoo, time.Second*5); err == nil {
+		t.Errorf("Test MultiScheduler: %s Pod got scheduled, %v", testPodFitsFoo.Name, err)
+	} else {
+		t.Logf("Test MultiScheduler: %s Pod not scheduled", testPodFitsFoo.Name)
+	}
+
+	// 5. create and start a scheduler with name "foo-scheduler"
+	clientSet2 := clientset.NewForConfigOrDie(&restclient.Config{Host: context.httpServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+	informerFactory2 := informers.NewSharedInformerFactory(context.clientSet, 0)
+
+	schedulerConfigFactory2 := factory.NewConfigFactory(
+		fooScheduler,
+		clientSet2,
+		informerFactory2.Core().V1().Nodes(),
+		informerFactory2.Core().V1().Pods(),
+		informerFactory2.Core().V1().PersistentVolumes(),
+		informerFactory2.Core().V1().PersistentVolumeClaims(),
+		informerFactory2.Core().V1().ReplicationControllers(),
+		informerFactory2.Extensions().V1beta1().ReplicaSets(),
+		informerFactory2.Apps().V1beta1().StatefulSets(),
+		informerFactory2.Core().V1().Services(),
+		v1.DefaultHardPodAffinitySymmetricWeight,
+		enableEquivalenceCache,
+	)
+	schedulerConfig2, err := schedulerConfigFactory2.Create()
+	if err != nil {
+		t.Errorf("Couldn't create scheduler config: %v", err)
+	}
+	eventBroadcaster2 := record.NewBroadcaster()
+	schedulerConfig2.Recorder = eventBroadcaster2.NewRecorder(api.Scheme, v1.EventSource{Component: fooScheduler})
+	eventBroadcaster2.StartRecordingToSink(&clientv1core.EventSinkImpl{Interface: clientv1core.New(clientSet2.CoreV1().RESTClient()).Events("")})
+	informerFactory2.Start(schedulerConfig2.StopEverything)
+
+	sched2, _ := scheduler.NewFromConfigurator(&scheduler.FakeConfigurator{Config: schedulerConfig2}, nil...)
+	sched2.Run()
+	defer close(schedulerConfig2.StopEverything)
+
+	//	6. **check point-2**:
+	//		- testPodWithAnnotationFitsFoo should be scheduled
+	err = waitForPodToSchedule(context.clientSet, testPodFitsFoo)
+	if err != nil {
+		t.Errorf("Test MultiScheduler: %s Pod not scheduled, %v", testPodFitsFoo.Name, err)
+	} else {
+		t.Logf("Test MultiScheduler: %s Pod scheduled", testPodFitsFoo.Name)
+	}
+
+	//	7. delete the pods that were scheduled by the default scheduler, and stop the default scheduler
+	if err := deletePod(context.clientSet, testPod.Name, context.ns.Name); err != nil {
+		t.Errorf("Failed to delete pod: %v", err)
+	}
+	if err := deletePod(context.clientSet, testPodFitsDefault.Name, context.ns.Name); err != nil {
+		t.Errorf("Failed to delete pod: %v", err)
+	}
+
+	// The rest of this test assumes that closing StopEverything will cause the
+	// scheduler thread to stop immediately.  It won't, and in fact it will often
+	// schedule 1 more pod before finally exiting.  Comment out until we fix that.
+	//
+	// See https://github.com/kubernetes/kubernetes/issues/23715 for more details.
+
+	/*
+		close(schedulerConfig.StopEverything)
+
+		//	8. create 2 pods: testPodNoAnnotation2 and testPodWithAnnotationFitsDefault2
+		//		- note: these two pods belong to default scheduler which no longer exists
+		podWithNoAnnotation2 := createPod("pod-with-no-annotation2", nil)
+		podWithAnnotationFitsDefault2 := createPod("pod-with-annotation-fits-default2", schedulerAnnotationFitsDefault)
+		testPodNoAnnotation2, err := clientSet.Core().Pods(ns.Name).Create(podWithNoAnnotation2)
+		if err != nil {
+			t.Fatalf("Failed to create pod: %v", err)
+		}
+		testPodWithAnnotationFitsDefault2, err := clientSet.Core().Pods(ns.Name).Create(podWithAnnotationFitsDefault2)
+		if err != nil {
+			t.Fatalf("Failed to create pod: %v", err)
+		}
+
+		//	9. **check point-3**:
+		//		- testPodNoAnnotation2 and testPodWithAnnotationFitsDefault2 should NOT be scheduled
+		err = wait.Poll(time.Second, time.Second*5, podScheduled(clientSet, testPodNoAnnotation2.Namespace, testPodNoAnnotation2.Name))
+		if err == nil {
+			t.Errorf("Test MultiScheduler: %s Pod got scheduled, %v", testPodNoAnnotation2.Name, err)
+		} else {
+			t.Logf("Test MultiScheduler: %s Pod not scheduled", testPodNoAnnotation2.Name)
+		}
+		err = wait.Poll(time.Second, time.Second*5, podScheduled(clientSet, testPodWithAnnotationFitsDefault2.Namespace, testPodWithAnnotationFitsDefault2.Name))
+		if err == nil {
+			t.Errorf("Test MultiScheduler: %s Pod got scheduled, %v", testPodWithAnnotationFitsDefault2.Name, err)
+		} else {
+			t.Logf("Test MultiScheduler: %s Pod scheduled", testPodWithAnnotationFitsDefault2.Name)
+		}
+	*/
+}
+
+// This test will verify scheduler can work well regardless of whether kubelet is allocatable aware or not.
+func TestAllocatable(t *testing.T) {
+	context := initTest(t, "allocatable")
+	defer cleanupTest(t, context)
+
+	// 2. create a node without allocatable awareness
+	nodeRes := &v1.ResourceList{
+		v1.ResourcePods:   *resource.NewQuantity(32, resource.DecimalSI),
+		v1.ResourceCPU:    *resource.NewMilliQuantity(30, resource.DecimalSI),
+		v1.ResourceMemory: *resource.NewQuantity(30, resource.BinarySI),
+	}
+	allocNode, err := createNode(context.clientSet, "node-allocatable-scheduler-test-node", nodeRes)
+	if err != nil {
+		t.Fatalf("Failed to create node: %v", err)
+	}
+
+	// 3. create resource pod which requires less than Capacity
+	podName := "pod-test-allocatable"
+	podRes := &v1.ResourceList{
+		v1.ResourceCPU:    *resource.NewMilliQuantity(20, resource.DecimalSI),
+		v1.ResourceMemory: *resource.NewQuantity(20, resource.BinarySI),
+	}
+	testAllocPod, err := createPausePodWithResource(context.clientSet, podName, context.ns.Name, podRes)
+	if err != nil {
+		t.Fatalf("Test allocatable unawareness failed to create pod: %v", err)
+	}
+
+	// 4. Test: this test pod should be scheduled since api-server will use Capacity as Allocatable
+	err = waitForPodToScheduleWithTimeout(context.clientSet, testAllocPod, time.Second*5)
+	if err != nil {
+		t.Errorf("Test allocatable unawareness: %s Pod not scheduled: %v", testAllocPod.Name, err)
+	} else {
+		t.Logf("Test allocatable unawareness: %s Pod scheduled", testAllocPod.Name)
+	}
+
+	// 5. Change the node status to allocatable aware, note that Allocatable is less than Pod's requirement
+	allocNode.Status = v1.NodeStatus{
+		Capacity: v1.ResourceList{
+			v1.ResourcePods:   *resource.NewQuantity(32, resource.DecimalSI),
+			v1.ResourceCPU:    *resource.NewMilliQuantity(30, resource.DecimalSI),
+			v1.ResourceMemory: *resource.NewQuantity(30, resource.BinarySI),
+		},
+		Allocatable: v1.ResourceList{
+			v1.ResourcePods:   *resource.NewQuantity(32, resource.DecimalSI),
+			v1.ResourceCPU:    *resource.NewMilliQuantity(10, resource.DecimalSI),
+			v1.ResourceMemory: *resource.NewQuantity(10, resource.BinarySI),
+		},
+	}
+
+	if _, err := context.clientSet.CoreV1().Nodes().UpdateStatus(allocNode); err != nil {
+		t.Fatalf("Failed to update node with Status.Allocatable: %v", err)
+	}
+
+	if err := deletePod(context.clientSet, testAllocPod.Name, context.ns.Name); err != nil {
+		t.Fatalf("Failed to remove the first pod: %v", err)
+	}
+
+	// 6. Make another pod with different name, same resource request
+	podName2 := "pod-test-allocatable2"
+	testAllocPod2, err := createPausePodWithResource(context.clientSet, podName2, context.ns.Name, podRes)
+	if err != nil {
+		t.Fatalf("Test allocatable awareness failed to create pod: %v", err)
+	}
+
+	// 7. Test: this test pod should not be scheduled since it request more than Allocatable
+	if err := waitForPodToScheduleWithTimeout(context.clientSet, testAllocPod2, time.Second*5); err == nil {
+		t.Errorf("Test allocatable awareness: %s Pod got scheduled unexpectedly, %v", testAllocPod2.Name, err)
+	} else {
+		t.Logf("Test allocatable awareness: %s Pod not scheduled as expected", testAllocPod2.Name)
+	}
+}
+
+// TestPreemption tests a few preemption scenarios.
+func TestPreemption(t *testing.T) {
+	// Enable PodPriority feature gate.
+	utilfeature.DefaultFeatureGate.Set(fmt.Sprintf("%s=true", features.PodPriority))
+	// Initialize scheduler.
+	context := initTest(t, "preemption")
+	defer cleanupTest(t, context)
+	cs := context.clientSet
+
+	lowPriority, mediumPriority, highPriority := int32(100), int32(200), int32(300)
+	defaultPodRes := &v1.ResourceRequirements{Requests: v1.ResourceList{
+		v1.ResourceCPU:    *resource.NewMilliQuantity(100, resource.DecimalSI),
+		v1.ResourceMemory: *resource.NewQuantity(100, resource.BinarySI)},
+	}
+
+	tests := []struct {
+		description         string
+		existingPods        []*v1.Pod
+		pod                 *v1.Pod
+		preemptedPodIndexes map[int]struct{}
+	}{
+		{
+			description: "basic pod preemption",
+			existingPods: []*v1.Pod{
+				initPausePod(context.clientSet, &pausePodConfig{
+					Name:      "victim-pod",
+					Namespace: context.ns.Name,
+					Priority:  &lowPriority,
+					Resources: &v1.ResourceRequirements{Requests: v1.ResourceList{
+						v1.ResourceCPU:    *resource.NewMilliQuantity(400, resource.DecimalSI),
+						v1.ResourceMemory: *resource.NewQuantity(200, resource.BinarySI)},
+					},
+				}),
+			},
+			pod: initPausePod(cs, &pausePodConfig{
+				Name:      "preemptor-pod",
+				Namespace: context.ns.Name,
+				Priority:  &highPriority,
+				Resources: &v1.ResourceRequirements{Requests: v1.ResourceList{
+					v1.ResourceCPU:    *resource.NewMilliQuantity(300, resource.DecimalSI),
+					v1.ResourceMemory: *resource.NewQuantity(200, resource.BinarySI)},
+				},
+			}),
+			preemptedPodIndexes: map[int]struct{}{0: {}},
+		},
+		{
+			description: "preemption is performed to satisfy anti-affinity",
+			existingPods: []*v1.Pod{
+				initPausePod(cs, &pausePodConfig{
+					Name: "pod-0", Namespace: context.ns.Name,
+					Priority:  &mediumPriority,
+					Labels:    map[string]string{"pod": "p0"},
+					Resources: defaultPodRes,
+				}),
+				initPausePod(cs, &pausePodConfig{
+					Name: "pod-1", Namespace: context.ns.Name,
+					Priority:  &lowPriority,
+					Labels:    map[string]string{"pod": "p1"},
+					Resources: defaultPodRes,
+					Affinity: &v1.Affinity{
+						PodAntiAffinity: &v1.PodAntiAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "pod",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"preemptor"},
+											},
+										},
+									},
+									TopologyKey: "node",
+								},
+							},
+						},
+					},
+				}),
+			},
+			// A higher priority pod with anti-affinity.
+			pod: initPausePod(cs, &pausePodConfig{
+				Name:      "preemptor-pod",
+				Namespace: context.ns.Name,
+				Priority:  &highPriority,
+				Labels:    map[string]string{"pod": "preemptor"},
+				Resources: defaultPodRes,
+				Affinity: &v1.Affinity{
+					PodAntiAffinity: &v1.PodAntiAffinity{
+						RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+							{
+								LabelSelector: &metav1.LabelSelector{
+									MatchExpressions: []metav1.LabelSelectorRequirement{
+										{
+											Key:      "pod",
+											Operator: metav1.LabelSelectorOpIn,
+											Values:   []string{"p0"},
+										},
+									},
+								},
+								TopologyKey: "node",
+							},
+						},
+					},
+				},
+			}),
+			preemptedPodIndexes: map[int]struct{}{0: {}, 1: {}},
+		},
+		{
+			// This is similar to the previous case only pod-1 is high priority.
+			description: "preemption is not performed when anti-affinity is not satisfied",
+			existingPods: []*v1.Pod{
+				initPausePod(cs, &pausePodConfig{
+					Name: "pod-0", Namespace: context.ns.Name,
+					Priority:  &mediumPriority,
+					Labels:    map[string]string{"pod": "p0"},
+					Resources: defaultPodRes,
+				}),
+				initPausePod(cs, &pausePodConfig{
+					Name: "pod-1", Namespace: context.ns.Name,
+					Priority:  &highPriority,
+					Labels:    map[string]string{"pod": "p1"},
+					Resources: defaultPodRes,
+					Affinity: &v1.Affinity{
+						PodAntiAffinity: &v1.PodAntiAffinity{
+							RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+								{
+									LabelSelector: &metav1.LabelSelector{
+										MatchExpressions: []metav1.LabelSelectorRequirement{
+											{
+												Key:      "pod",
+												Operator: metav1.LabelSelectorOpIn,
+												Values:   []string{"preemptor"},
+											},
+										},
+									},
+									TopologyKey: "node",
+								},
+							},
+						},
+					},
+				}),
+			},
+			// A higher priority pod with anti-affinity.
+			pod: initPausePod(cs, &pausePodConfig{
+				Name:      "preemptor-pod",
+				Namespace: context.ns.Name,
+				Priority:  &highPriority,
+				Labels:    map[string]string{"pod": "preemptor"},
+				Resources: defaultPodRes,
+				Affinity: &v1.Affinity{
+					PodAntiAffinity: &v1.PodAntiAffinity{
+						RequiredDuringSchedulingIgnoredDuringExecution: []v1.PodAffinityTerm{
+							{
+								LabelSelector: &metav1.LabelSelector{
+									MatchExpressions: []metav1.LabelSelectorRequirement{
+										{
+											Key:      "pod",
+											Operator: metav1.LabelSelectorOpIn,
+											Values:   []string{"p0"},
+										},
+									},
+								},
+								TopologyKey: "node",
+							},
+						},
+					},
+				},
+			}),
+			preemptedPodIndexes: map[int]struct{}{},
+		},
+	}
+
+	// Create a node with some resources and a label.
+	nodeRes := &v1.ResourceList{
+		v1.ResourcePods:   *resource.NewQuantity(32, resource.DecimalSI),
+		v1.ResourceCPU:    *resource.NewMilliQuantity(500, resource.DecimalSI),
+		v1.ResourceMemory: *resource.NewQuantity(500, resource.BinarySI),
+	}
+	node, err := createNode(context.clientSet, "node1", nodeRes)
+	if err != nil {
+		t.Fatalf("Error creating nodes: %v", err)
+	}
+	nodeLabels := map[string]string{"node": node.Name}
+	if err = testutils.AddLabelsToNode(context.clientSet, node.Name, nodeLabels); err != nil {
+		t.Fatalf("Cannot add labels to node: %v", err)
+	}
+	if err = waitForNodeLabels(context.clientSet, node.Name, nodeLabels); err != nil {
+		t.Fatalf("Adding labels to node didn't succeed: %v", err)
+	}
+
+	for _, test := range tests {
+		pods := make([]*v1.Pod, len(test.existingPods))
+		// Create and run existingPods.
+		for i, p := range test.existingPods {
+			pods[i], err = runPausePod(cs, p)
+			if err != nil {
+				t.Fatalf("Test [%v]: Error running pause pod: %v", test.description, err)
+			}
+		}
+		// Create the "pod".
+		preemptor, err := createPausePod(cs, test.pod)
+		if err != nil {
+			t.Errorf("Error while creating high priority pod: %v", err)
+		}
+		// Wait for preemption of pods and make sure the other ones are not preempted.
+		for i, p := range pods {
+			if _, found := test.preemptedPodIndexes[i]; found {
+				if err = wait.Poll(time.Second, wait.ForeverTestTimeout, podIsGettingEvicted(cs, p.Namespace, p.Name)); err != nil {
+					t.Errorf("Test [%v]: Pod %v is not getting evicted.", test.description, p.Name)
+				}
+			} else {
+				if p.DeletionTimestamp != nil {
+					t.Errorf("Test [%v]: Didn't expect pod %v to get preempted.", test.description, p.Name)
+				}
+			}
+		}
+		// Also check that the preemptor pod gets the annotation for nominated node name.
+		if len(test.preemptedPodIndexes) > 0 {
+			if err = wait.Poll(time.Second, wait.ForeverTestTimeout, func() (bool, error) {
+				pod, err := context.clientSet.CoreV1().Pods(context.ns.Name).Get("preemptor-pod", metav1.GetOptions{})
+				if err != nil {
+					t.Errorf("Test [%v]: error getting pod: %v", test.description, err)
+				}
+				annot, found := pod.Annotations[core.NominatedNodeAnnotationKey]
+				if found && len(annot) > 0 {
+					return true, nil
+				}
+				return false, err
+			}); err != nil {
+				t.Errorf("Test [%v]: Pod annotation did not get set.", test.description)
+			}
+		}
+
+		// Cleanup
+		pods = append(pods, preemptor)
+		for _, p := range pods {
+			err = cs.CoreV1().Pods(p.Namespace).Delete(p.Name, metav1.NewDeleteOptions(0))
+			if err != nil && !errors.IsNotFound(err) {
+				t.Errorf("Test [%v]: error, %v, while deleting pod during test.", test.description, err)
+			}
+			err = wait.Poll(time.Second, wait.ForeverTestTimeout, podDeleted(cs, p.Namespace, p.Name))
+			if err != nil {
+				t.Errorf("Test [%v]: error, %v, while waiting for pod to get deleted.", test.description, err)
+			}
+		}
+	}
+}

vendor/k8s.io/kubernetes/test/integration/scheduler/util.go

@@ -0,0 +1,359 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheduler
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/uuid"
+	"k8s.io/apimachinery/pkg/util/wait"
+	informers "k8s.io/client-go/informers"
+	clientset "k8s.io/client-go/kubernetes"
+	clientv1core "k8s.io/client-go/kubernetes/typed/core/v1"
+	corelisters "k8s.io/client-go/listers/core/v1"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/plugin/pkg/scheduler"
+	_ "k8s.io/kubernetes/plugin/pkg/scheduler/algorithmprovider"
+	"k8s.io/kubernetes/plugin/pkg/scheduler/factory"
+	"k8s.io/kubernetes/test/integration/framework"
+
+	"net/http/httptest"
+)
+
+type TestContext struct {
+	closeFn                framework.CloseFunc
+	httpServer             *httptest.Server
+	ns                     *v1.Namespace
+	clientSet              *clientset.Clientset
+	informerFactory        informers.SharedInformerFactory
+	schedulerConfigFactory scheduler.Configurator
+	schedulerConfig        *scheduler.Config
+	scheduler              *scheduler.Scheduler
+}
+
+// initTest initializes a test environment and creates a scheduler with default
+// configuration.
+func initTest(t *testing.T, nsPrefix string) *TestContext {
+	var context TestContext
+	_, context.httpServer, context.closeFn = framework.RunAMaster(nil)
+
+	context.ns = framework.CreateTestingNamespace(nsPrefix+string(uuid.NewUUID()), context.httpServer, t)
+
+	context.clientSet = clientset.NewForConfigOrDie(&restclient.Config{Host: context.httpServer.URL, ContentConfig: restclient.ContentConfig{GroupVersion: testapi.Groups[v1.GroupName].GroupVersion()}})
+	context.informerFactory = informers.NewSharedInformerFactory(context.clientSet, 0)
+
+	context.schedulerConfigFactory = factory.NewConfigFactory(
+		v1.DefaultSchedulerName,
+		context.clientSet,
+		context.informerFactory.Core().V1().Nodes(),
+		context.informerFactory.Core().V1().Pods(),
+		context.informerFactory.Core().V1().PersistentVolumes(),
+		context.informerFactory.Core().V1().PersistentVolumeClaims(),
+		context.informerFactory.Core().V1().ReplicationControllers(),
+		context.informerFactory.Extensions().V1beta1().ReplicaSets(),
+		context.informerFactory.Apps().V1beta1().StatefulSets(),
+		context.informerFactory.Core().V1().Services(),
+		v1.DefaultHardPodAffinitySymmetricWeight,
+		true,
+	)
+	var err error
+	context.schedulerConfig, err = context.schedulerConfigFactory.Create()
+	if err != nil {
+		t.Fatalf("Couldn't create scheduler config: %v", err)
+	}
+	eventBroadcaster := record.NewBroadcaster()
+	context.schedulerConfig.Recorder = eventBroadcaster.NewRecorder(api.Scheme, v1.EventSource{Component: v1.DefaultSchedulerName})
+	eventBroadcaster.StartRecordingToSink(&clientv1core.EventSinkImpl{Interface: clientv1core.New(context.clientSet.CoreV1().RESTClient()).Events("")})
+	context.informerFactory.Start(context.schedulerConfig.StopEverything)
+	context.scheduler, err = scheduler.NewFromConfigurator(&scheduler.FakeConfigurator{Config: context.schedulerConfig}, nil...)
+	if err != nil {
+		t.Fatalf("Couldn't create scheduler: %v", err)
+	}
+	context.scheduler.Run()
+	return &context
+}
+
+// cleanupTest deletes the scheduler and the test namespace. It should be called
+// at the end of a test.
+func cleanupTest(t *testing.T, context *TestContext) {
+	// Kill the scheduler.
+	close(context.schedulerConfig.StopEverything)
+	// Cleanup nodes.
+	context.clientSet.CoreV1().Nodes().DeleteCollection(nil, metav1.ListOptions{})
+	framework.DeleteTestingNamespace(context.ns, context.httpServer, t)
+	context.closeFn()
+}
+
+// waitForReflection waits till the passFunc confirms that the object it expects
+// to see is in the store. Used to observe reflected events.
+func waitForReflection(t *testing.T, nodeLister corelisters.NodeLister, key string, passFunc func(n interface{}) bool) error {
+	nodes := []*v1.Node{}
+	err := wait.Poll(time.Millisecond*100, wait.ForeverTestTimeout, func() (bool, error) {
+		n, err := nodeLister.Get(key)
+
+		switch {
+		case err == nil && passFunc(n):
+			return true, nil
+		case errors.IsNotFound(err):
+			nodes = append(nodes, nil)
+		case err != nil:
+			t.Errorf("Unexpected error: %v", err)
+		default:
+			nodes = append(nodes, n)
+		}
+
+		return false, nil
+	})
+	if err != nil {
+		t.Logf("Logging consecutive node versions received from store:")
+		for i, n := range nodes {
+			t.Logf("%d: %#v", i, n)
+		}
+	}
+	return err
+}
+
+// nodeHasLabels returns a function that checks if a node has all the given labels.
+func nodeHasLabels(cs clientset.Interface, nodeName string, labels map[string]string) wait.ConditionFunc {
+	return func() (bool, error) {
+		node, err := cs.CoreV1().Nodes().Get(nodeName, metav1.GetOptions{})
+		if errors.IsNotFound(err) {
+			return false, nil
+		}
+		if err != nil {
+			// This could be a connection error so we want to retry.
+			return false, nil
+		}
+		for k, v := range labels {
+			if node.Labels == nil || node.Labels[k] != v {
+				return false, nil
+			}
+		}
+		return true, nil
+	}
+}
+
+// waitForNodeLabels waits for the given node to have all the given labels.
+func waitForNodeLabels(cs clientset.Interface, nodeName string, labels map[string]string) error {
+	return wait.Poll(time.Millisecond*100, wait.ForeverTestTimeout, nodeHasLabels(cs, nodeName, labels))
+}
+
+// createNode creates a node with the given resource list and
+// returns a pointer and error status. If 'res' is nil, a predefined amount of
+// resource will be used.
+func createNode(cs clientset.Interface, name string, res *v1.ResourceList) (*v1.Node, error) {
+	// if resource is nil, we use a default amount of resources for the node.
+	if res == nil {
+		res = &v1.ResourceList{
+			v1.ResourcePods: *resource.NewQuantity(32, resource.DecimalSI),
+		}
+	}
+	n := &v1.Node{
+		ObjectMeta: metav1.ObjectMeta{Name: name},
+		Spec:       v1.NodeSpec{Unschedulable: false},
+		Status: v1.NodeStatus{
+			Capacity: *res,
+		},
+	}
+	return cs.CoreV1().Nodes().Create(n)
+}
+
+// createNodes creates `numNodes` nodes. The created node names will be in the
+// form of "`prefix`-X" where X is an ordinal.
+func createNodes(cs clientset.Interface, prefix string, res *v1.ResourceList, numNodes int) ([]*v1.Node, error) {
+	nodes := make([]*v1.Node, numNodes)
+	for i := 0; i < numNodes; i++ {
+		nodeName := fmt.Sprintf("%v-%d", prefix, i)
+		node, err := createNode(cs, nodeName, res)
+		if err != nil {
+			return nodes[:], err
+		}
+		nodes[i] = node
+	}
+	return nodes[:], nil
+}
+
+type pausePodConfig struct {
+	Name                              string
+	Namespace                         string
+	Affinity                          *v1.Affinity
+	Annotations, Labels, NodeSelector map[string]string
+	Resources                         *v1.ResourceRequirements
+	Tolerations                       []v1.Toleration
+	NodeName                          string
+	SchedulerName                     string
+	Priority                          *int32
+}
+
+// initPausePod initializes a pod API object from the given config. It is used
+// mainly in pod creation process.
+func initPausePod(cs clientset.Interface, conf *pausePodConfig) *v1.Pod {
+	pod := &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        conf.Name,
+			Namespace:   conf.Namespace,
+			Labels:      conf.Labels,
+			Annotations: conf.Annotations,
+		},
+		Spec: v1.PodSpec{
+			NodeSelector: conf.NodeSelector,
+			Affinity:     conf.Affinity,
+			Containers: []v1.Container{
+				{
+					Name:  conf.Name,
+					Image: framework.GetPauseImageName(cs),
+				},
+			},
+			Tolerations:   conf.Tolerations,
+			NodeName:      conf.NodeName,
+			SchedulerName: conf.SchedulerName,
+			Priority:      conf.Priority,
+		},
+	}
+	if conf.Resources != nil {
+		pod.Spec.Containers[0].Resources = *conf.Resources
+	}
+	return pod
+}
+
+// createPausePod creates a pod with "Pause" image and the given config and
+// return its pointer and error status.
+func createPausePod(cs clientset.Interface, p *v1.Pod) (*v1.Pod, error) {
+	return cs.CoreV1().Pods(p.Namespace).Create(p)
+}
+
+// createPausePodWithResource creates a pod with "Pause" image and the given
+// resources and returns its pointer and error status. The resource list can be
+// nil.
+func createPausePodWithResource(cs clientset.Interface, podName string, nsName string, res *v1.ResourceList) (*v1.Pod, error) {
+	var conf pausePodConfig
+	if res == nil {
+		conf = pausePodConfig{
+			Name:      podName,
+			Namespace: nsName,
+		}
+	} else {
+		conf = pausePodConfig{
+			Name:      podName,
+			Namespace: nsName,
+			Resources: &v1.ResourceRequirements{
+				Requests: *res,
+			},
+		}
+	}
+	return createPausePod(cs, initPausePod(cs, &conf))
+}
+
+// runPausePod creates a pod with "Pause" image and the given config and waits
+// until it is scheduled. It returns its pointer and error status.
+func runPausePod(cs clientset.Interface, pod *v1.Pod) (*v1.Pod, error) {
+	pod, err := cs.CoreV1().Pods(pod.Namespace).Create(pod)
+	if err != nil {
+		return nil, fmt.Errorf("Error creating pause pod: %v", err)
+	}
+	if err = waitForPodToSchedule(cs, pod); err != nil {
+		return pod, fmt.Errorf("Pod %v didn't schedule successfully. Error: %v", pod.Name, err)
+	}
+	if pod, err = cs.CoreV1().Pods(pod.Namespace).Get(pod.Name, metav1.GetOptions{}); err != nil {
+		return pod, fmt.Errorf("Error getting pod %v info: %v", pod.Name, err)
+	}
+	return pod, nil
+}
+
+// podDeleted returns true if a pod is not found in the given namespace.
+func podDeleted(c clientset.Interface, podNamespace, podName string) wait.ConditionFunc {
+	return func() (bool, error) {
+		pod, err := c.CoreV1().Pods(podNamespace).Get(podName, metav1.GetOptions{})
+		if pod.DeletionTimestamp != nil {
+			return true, nil
+		}
+		if errors.IsNotFound(err) {
+			return true, nil
+		}
+		return false, nil
+	}
+}
+
+// podIsGettingEvicted returns true if the pod's deletion timestamp is set.
+func podIsGettingEvicted(c clientset.Interface, podNamespace, podName string) wait.ConditionFunc {
+	return func() (bool, error) {
+		pod, err := c.CoreV1().Pods(podNamespace).Get(podName, metav1.GetOptions{})
+		if err != nil {
+			return false, err
+		}
+		if pod.DeletionTimestamp != nil {
+			return true, nil
+		}
+		return false, nil
+	}
+}
+
+// podScheduled returns true if a node is assigned to the given pod.
+func podScheduled(c clientset.Interface, podNamespace, podName string) wait.ConditionFunc {
+	return func() (bool, error) {
+		pod, err := c.CoreV1().Pods(podNamespace).Get(podName, metav1.GetOptions{})
+		if errors.IsNotFound(err) {
+			return false, nil
+		}
+		if err != nil {
+			// This could be a connection error so we want to retry.
+			return false, nil
+		}
+		if pod.Spec.NodeName == "" {
+			return false, nil
+		}
+		return true, nil
+	}
+}
+
+// waitForPodToScheduleWithTimeout waits for a pod to get scheduled and returns
+// an error if it does not scheduled within the given timeout.
+func waitForPodToScheduleWithTimeout(cs clientset.Interface, pod *v1.Pod, timeout time.Duration) error {
+	return wait.Poll(time.Second, timeout, podScheduled(cs, pod.Namespace, pod.Name))
+}
+
+// waitForPodToSchedule waits for a pod to get scheduled and returns an error if
+// it does not scheduled within the timeout duration (30 seconds).
+func waitForPodToSchedule(cs clientset.Interface, pod *v1.Pod) error {
+	return waitForPodToScheduleWithTimeout(cs, pod, wait.ForeverTestTimeout)
+}
+
+// deletePod deletes the given pod in the given namespace.
+func deletePod(cs clientset.Interface, podName string, nsName string) error {
+	return cs.CoreV1().Pods(nsName).Delete(podName, metav1.NewDeleteOptions(0))
+}
+
+// printAllPods prints a list of all the pods and their node names. This is used
+// for debugging.
+func printAllPods(t *testing.T, cs clientset.Interface, nsName string) {
+	podList, err := cs.CoreV1().Pods(nsName).List(metav1.ListOptions{})
+	if err != nil {
+		t.Logf("Error getting pods: %v", err)
+	}
+	for _, pod := range podList.Items {
+		t.Logf("Pod:\n\tName:%v\n\tNamespace:%v\n\tNode Name:%v\n", pod.Name, pod.Namespace, pod.Spec.NodeName)
+	}
+}

vendor/k8s.io/kubernetes/test/integration/scheduler_perf/BUILD

@@ -0,0 +1,65 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "scheduler_perf_types.go",
+        "util.go",
+    ],
+    deps = [
+        "//pkg/api:go_default_library",
+        "//pkg/api/testapi:go_default_library",
+        "//plugin/pkg/scheduler:go_default_library",
+        "//plugin/pkg/scheduler/algorithmprovider:go_default_library",
+        "//plugin/pkg/scheduler/factory:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/client-go/informers:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes/typed/core/v1:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/tools/record:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    size = "large",
+    srcs = [
+        "main_test.go",
+        "scheduler_bench_test.go",
+        "scheduler_test.go",
+    ],
+    library = ":go_default_library",
+    tags = ["integration"],
+    deps = [
+        "//plugin/pkg/scheduler:go_default_library",
+        "//test/integration/framework:go_default_library",
+        "//test/utils:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/test/integration/scheduler_perf/OWNERS

@@ -0,0 +1,16 @@
+approvers:
+- bsalamat
+- davidopp
+- gmarek
+- jayunit100
+- timothysc
+- wojtek-t
+reviewers:
+- bsalamat
+- davidopp
+- jayunit100
+- k82cn
+- ravisantoshgudimetla
+- sjug
+- timothysc
+- wojtek-t

vendor/k8s.io/kubernetes/test/integration/scheduler_perf/README.md

@@ -0,0 +1,48 @@
+Scheduler Performance Test
+======
+
+Motivation
+------
+We already have a performance testing system -- Kubemark. However, Kubemark requires setting up and bootstrapping a whole cluster, which takes a lot of time.
+
+We want to have a standard way to reproduce scheduling latency metrics result and benchmark scheduler as simple and fast as possible. We have the following goals:
+
+- Save time on testing
+  - The test and benchmark can be run in a single box.
+    We only set up components necessary to scheduling without booting up a cluster.
+- Profiling runtime metrics to find out bottleneck
+  - Write scheduler integration test but focus on performance measurement.
+    Take advantage of go profiling tools and collect fine-grained metrics,
+    like cpu-profiling, memory-profiling and block-profiling.
+- Reproduce test result easily
+  - We want to have a known place to do the performance related test for scheduler.
+    Developers should just run one script to collect all the information they need.
+
+Currently the test suite has the following:
+
+- density test (by adding a new Go test)
+  - schedule 30k pods on 1000 (fake) nodes and 3k pods on 100 (fake) nodes
+  - print out scheduling rate every second
+  - let you learn the rate changes vs number of scheduled pods
+- benchmark
+  - make use of `go test -bench` and report nanosecond/op.
+  - schedule b.N pods when the cluster has N nodes and P scheduled pods. Since it takes relatively long time to finish one round, b.N is small: 10 - 100.
+
+
+How To Run
+------
+```shell
+# In Kubernetes root path
+make generated_files
+
+cd test/integration/scheduler_perf
+./test-performance.sh
+```
+
+
+<!-- BEGIN MUNGE: GENERATED_ANALYTICS -->
+[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/test/component/scheduler/perf/README.md?pixel)]()
+<!-- END MUNGE: GENERATED_ANALYTICS -->
+
+
+[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/test/integration/scheduler_perf/README.md?pixel)]()

vendor/k8s.io/kubernetes/test/integration/scheduler_perf/main_test.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package benchmark
+
+import (
+	"testing"
+
+	"k8s.io/kubernetes/test/integration/framework"
+)
+
+func TestMain(m *testing.M) {
+	framework.EtcdMain(m.Run)
+}

vendor/k8s.io/kubernetes/test/integration/scheduler_perf/scheduler_bench_test.go

@@ -0,0 +1,107 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package benchmark
+
+import (
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/kubernetes/test/integration/framework"
+	testutils "k8s.io/kubernetes/test/utils"
+
+	"github.com/golang/glog"
+)
+
+// BenchmarkScheduling100Nodes0Pods benchmarks the scheduling rate
+// when the cluster has 100 nodes and 0 scheduled pods
+func BenchmarkScheduling100Nodes0Pods(b *testing.B) {
+	benchmarkScheduling(100, 0, b)
+}
+
+// BenchmarkScheduling100Nodes1000Pods benchmarks the scheduling rate
+// when the cluster has 100 nodes and 1000 scheduled pods
+func BenchmarkScheduling100Nodes1000Pods(b *testing.B) {
+	benchmarkScheduling(100, 1000, b)
+}
+
+// BenchmarkScheduling1000Nodes0Pods benchmarks the scheduling rate
+// when the cluster has 1000 nodes and 0 scheduled pods
+func BenchmarkScheduling1000Nodes0Pods(b *testing.B) {
+	benchmarkScheduling(1000, 0, b)
+}
+
+// BenchmarkScheduling1000Nodes1000Pods benchmarks the scheduling rate
+// when the cluster has 1000 nodes and 1000 scheduled pods
+func BenchmarkScheduling1000Nodes1000Pods(b *testing.B) {
+	benchmarkScheduling(1000, 1000, b)
+}
+
+// benchmarkScheduling benchmarks scheduling rate with specific number of nodes
+// and specific number of pods already scheduled. Since an operation takes relatively
+// long time, b.N should be small: 10 - 100.
+func benchmarkScheduling(numNodes, numScheduledPods int, b *testing.B) {
+	schedulerConfigFactory, finalFunc := mustSetupScheduler()
+	defer finalFunc()
+	c := schedulerConfigFactory.GetClient()
+
+	nodePreparer := framework.NewIntegrationTestNodePreparer(
+		c,
+		[]testutils.CountToStrategy{{Count: numNodes, Strategy: &testutils.TrivialNodePrepareStrategy{}}},
+		"scheduler-perf-",
+	)
+	if err := nodePreparer.PrepareNodes(); err != nil {
+		glog.Fatalf("%v", err)
+	}
+	defer nodePreparer.CleanupNodes()
+
+	config := testutils.NewTestPodCreatorConfig()
+	config.AddStrategy("sched-test", numScheduledPods, testutils.NewSimpleWithControllerCreatePodStrategy("rc1"))
+	podCreator := testutils.NewTestPodCreator(c, config)
+	podCreator.CreatePods()
+
+	for {
+		scheduled, err := schedulerConfigFactory.GetScheduledPodLister().List(labels.Everything())
+		if err != nil {
+			glog.Fatalf("%v", err)
+		}
+		if len(scheduled) >= numScheduledPods {
+			break
+		}
+		time.Sleep(1 * time.Second)
+	}
+	// start benchmark
+	b.ResetTimer()
+	config = testutils.NewTestPodCreatorConfig()
+	config.AddStrategy("sched-test", b.N, testutils.NewSimpleWithControllerCreatePodStrategy("rc2"))
+	podCreator = testutils.NewTestPodCreator(c, config)
+	podCreator.CreatePods()
+	for {
+		// This can potentially affect performance of scheduler, since List() is done under mutex.
+		// TODO: Setup watch on apiserver and wait until all pods scheduled.
+		scheduled, err := schedulerConfigFactory.GetScheduledPodLister().List(labels.Everything())
+		if err != nil {
+			glog.Fatalf("%v", err)
+		}
+		if len(scheduled) >= numScheduledPods+b.N {
+			break
+		}
+		// Note: This might introduce slight deviation in accuracy of benchmark results.
+		// Since the total amount of time is relatively large, it might not be a concern.
+		time.Sleep(100 * time.Millisecond)
+	}
+}

vendor/k8s.io/kubernetes/test/integration/scheduler_perf/scheduler_perf_types.go

@@ -0,0 +1,31 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package benchmark
+
+// High Level Configuration for all predicates and priorities.
+type schedulerPerfConfig struct {
+	NodeCount    int // The number of nodes which will be seeded with metadata to match predicates and have non-trivial priority rankings.
+	PodCount     int // The number of pods which will be seeded with metadata to match predicates and have non-trivial priority rankings.
+	NodeAffinity *nodeAffinity
+	// TODO: Other predicates and priorities to be added here.
+}
+
+// nodeAffinity priority configuration details.
+type nodeAffinity struct {
+	nodeAffinityKey string // Node Selection Key.
+	LabelCount      int    // number of labels to be added to each node or pod.
+}

vendor/k8s.io/kubernetes/test/integration/scheduler_perf/scheduler_test.go

@@ -0,0 +1,277 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package benchmark
+
+import (
+	"fmt"
+	"github.com/golang/glog"
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/kubernetes/plugin/pkg/scheduler"
+	testutils "k8s.io/kubernetes/test/utils"
+	"math"
+	"strconv"
+	"testing"
+	"time"
+)
+
+const (
+	warning3K    = 100
+	threshold3K  = 30
+	threshold30K = 30
+	threshold60K = 30
+)
+
+var (
+	basePodTemplate = &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			GenerateName: "sched-perf-pod-",
+		},
+		// TODO: this needs to be configurable.
+		Spec: testutils.MakePodSpec(),
+	}
+	baseNodeTemplate = &v1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			GenerateName: "sample-node-",
+		},
+		Spec: v1.NodeSpec{
+			// TODO: investigate why this is needed.
+			ExternalID: "foo",
+		},
+		Status: v1.NodeStatus{
+			Capacity: v1.ResourceList{
+				v1.ResourcePods:   *resource.NewQuantity(110, resource.DecimalSI),
+				v1.ResourceCPU:    resource.MustParse("4"),
+				v1.ResourceMemory: resource.MustParse("32Gi"),
+			},
+			Phase: v1.NodeRunning,
+			Conditions: []v1.NodeCondition{
+				{Type: v1.NodeReady, Status: v1.ConditionTrue},
+			},
+		},
+	}
+)
+
+// TestSchedule100Node3KPods schedules 3k pods on 100 nodes.
+func TestSchedule100Node3KPods(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping because we want to run short tests")
+	}
+
+	config := getBaseConfig(100, 3000)
+	err := writePodAndNodeTopologyToConfig(config)
+	if err != nil {
+		t.Errorf("Misconfiguration happened for nodes/pods chosen to have predicates and priorities")
+	}
+	min := schedulePods(config)
+	if min < threshold3K {
+		t.Errorf("Failing: Scheduling rate was too low for an interval, we saw rate of %v, which is the allowed minimum of %v ! ", min, threshold3K)
+	} else if min < warning3K {
+		fmt.Printf("Warning: pod scheduling throughput for 3k pods was slow for an interval... Saw a interval with very low (%v) scheduling rate!", min)
+	} else {
+		fmt.Printf("Minimal observed throughput for 3k pod test: %v\n", min)
+	}
+}
+
+// TestSchedule2000Node60KPods schedules 60k pods on 2000 nodes.
+// This test won't fit in normal 10 minutes time window.
+// func TestSchedule2000Node60KPods(t *testing.T) {
+// 	if testing.Short() {
+// 		t.Skip("Skipping because we want to run short tests")
+// 	}
+// 	config := defaultSchedulerBenchmarkConfig(2000, 60000)
+// 	if min := schedulePods(config); min < threshold60K {
+// 		t.Errorf("To small pod scheduling throughput for 60k pods. Expected %v got %v", threshold60K, min)
+// 	} else {
+// 		fmt.Printf("Minimal observed throughput for 60k pod test: %v\n", min)
+// 	}
+// }
+
+// testConfig contains the some input parameters needed for running test-suite
+type testConfig struct {
+	numPods                   int
+	numNodes                  int
+	mutatedNodeTemplate       *v1.Node
+	mutatedPodTemplate        *v1.Pod
+	schedulerSupportFunctions scheduler.Configurator
+	destroyFunc               func()
+}
+
+// getBaseConfig returns baseConfig after initializing number of nodes and pods.
+func getBaseConfig(nodes int, pods int) *testConfig {
+	schedulerConfigFactory, destroyFunc := mustSetupScheduler()
+	return &testConfig{
+		schedulerSupportFunctions: schedulerConfigFactory,
+		destroyFunc:               destroyFunc,
+		numNodes:                  nodes,
+		numPods:                   pods,
+	}
+}
+
+// schedulePods schedules specific number of pods on specific number of nodes.
+// This is used to learn the scheduling throughput on various
+// sizes of cluster and changes as more and more pods are scheduled.
+// It won't stop until all pods are scheduled.
+// It returns the minimum of throughput over whole run.
+func schedulePods(config *testConfig) int32 {
+	defer config.destroyFunc()
+	prev := 0
+	// On startup there may be a latent period where NO scheduling occurs (qps = 0).
+	// We are interested in low scheduling rates (i.e. qps=2),
+	minQps := int32(math.MaxInt32)
+	start := time.Now()
+	// Bake in time for the first pod scheduling event.
+	for {
+		time.Sleep(50 * time.Millisecond)
+		scheduled, err := config.schedulerSupportFunctions.GetScheduledPodLister().List(labels.Everything())
+		if err != nil {
+			glog.Fatalf("%v", err)
+		}
+		// 30,000 pods -> wait till @ least 300 are scheduled to start measuring.
+		// TODO Find out why sometimes there may be scheduling blips in the beggining.
+		if len(scheduled) > config.numPods/100 {
+			break
+		}
+	}
+	// map minimum QPS entries in a counter, useful for debugging tests.
+	qpsStats := map[int]int{}
+
+	// Now that scheduling has started, lets start taking the pulse on how many pods are happening per second.
+	for {
+		// This can potentially affect performance of scheduler, since List() is done under mutex.
+		// Listing 10000 pods is an expensive operation, so running it frequently may impact scheduler.
+		// TODO: Setup watch on apiserver and wait until all pods scheduled.
+		scheduled, err := config.schedulerSupportFunctions.GetScheduledPodLister().List(labels.Everything())
+		if err != nil {
+			glog.Fatalf("%v", err)
+		}
+
+		// We will be completed when all pods are done being scheduled.
+		// return the worst-case-scenario interval that was seen during this time.
+		// Note this should never be low due to cold-start, so allow bake in sched time if necessary.
+		if len(scheduled) >= config.numPods {
+			fmt.Printf("Scheduled %v Pods in %v seconds (%v per second on average). min QPS was %v\n",
+				config.numPods, int(time.Since(start)/time.Second), config.numPods/int(time.Since(start)/time.Second), minQps)
+			return minQps
+		}
+
+		// There's no point in printing it for the last iteration, as the value is random
+		qps := len(scheduled) - prev
+		qpsStats[qps] += 1
+		if int32(qps) < minQps {
+			minQps = int32(qps)
+		}
+		fmt.Printf("%ds\trate: %d\ttotal: %d (qps frequency: %v)\n", time.Since(start)/time.Second, qps, len(scheduled), qpsStats)
+		prev = len(scheduled)
+		time.Sleep(1 * time.Second)
+	}
+}
+
+// mutateNodeTemplate returns the modified node needed for creation of nodes.
+func (na nodeAffinity) mutateNodeTemplate(node *v1.Node) {
+	labels := make(map[string]string)
+	for i := 0; i < na.LabelCount; i++ {
+		value := strconv.Itoa(i)
+		key := na.nodeAffinityKey + value
+		labels[key] = value
+	}
+	node.ObjectMeta.Labels = labels
+	return
+}
+
+// mutatePodTemplate returns the modified pod template after applying mutations.
+func (na nodeAffinity) mutatePodTemplate(pod *v1.Pod) {
+	var nodeSelectorRequirements []v1.NodeSelectorRequirement
+	for i := 0; i < na.LabelCount; i++ {
+		value := strconv.Itoa(i)
+		key := na.nodeAffinityKey + value
+		nodeSelector := v1.NodeSelectorRequirement{Key: key, Values: []string{value}, Operator: v1.NodeSelectorOpIn}
+		nodeSelectorRequirements = append(nodeSelectorRequirements, nodeSelector)
+	}
+	pod.Spec.Affinity = &v1.Affinity{
+		NodeAffinity: &v1.NodeAffinity{
+			RequiredDuringSchedulingIgnoredDuringExecution: &v1.NodeSelector{
+				NodeSelectorTerms: []v1.NodeSelectorTerm{
+					{
+						MatchExpressions: nodeSelectorRequirements,
+					},
+				},
+			},
+		},
+	}
+}
+
+// generateNodes generates nodes to be used for scheduling.
+func (inputConfig *schedulerPerfConfig) generateNodes(config *testConfig) {
+	for i := 0; i < inputConfig.NodeCount; i++ {
+		config.schedulerSupportFunctions.GetClient().Core().Nodes().Create(config.mutatedNodeTemplate)
+
+	}
+	for i := 0; i < config.numNodes-inputConfig.NodeCount; i++ {
+		config.schedulerSupportFunctions.GetClient().Core().Nodes().Create(baseNodeTemplate)
+
+	}
+}
+
+// generatePods generates pods to be used for scheduling.
+func (inputConfig *schedulerPerfConfig) generatePods(config *testConfig) {
+	testutils.CreatePod(config.schedulerSupportFunctions.GetClient(), "sample", inputConfig.PodCount, config.mutatedPodTemplate)
+	testutils.CreatePod(config.schedulerSupportFunctions.GetClient(), "sample", config.numPods-inputConfig.PodCount, basePodTemplate)
+}
+
+// generatePodAndNodeTopology is the wrapper function for modifying both pods and node objects.
+func (inputConfig *schedulerPerfConfig) generatePodAndNodeTopology(config *testConfig) error {
+	if config.numNodes < inputConfig.NodeCount || config.numPods < inputConfig.PodCount {
+		return fmt.Errorf("NodeCount cannot be greater than numNodes")
+	}
+	nodeAffinity := inputConfig.NodeAffinity
+	// Node template that needs to be mutated.
+	mutatedNodeTemplate := baseNodeTemplate
+	// Pod template that needs to be mutated.
+	mutatedPodTemplate := basePodTemplate
+	if nodeAffinity != nil {
+		nodeAffinity.mutateNodeTemplate(mutatedNodeTemplate)
+		nodeAffinity.mutatePodTemplate(mutatedPodTemplate)
+
+	} // TODO: other predicates/priorities will be processed in subsequent if statements or a switch:).
+	config.mutatedPodTemplate = mutatedPodTemplate
+	config.mutatedNodeTemplate = mutatedNodeTemplate
+	inputConfig.generateNodes(config)
+	inputConfig.generatePods(config)
+	return nil
+}
+
+// writePodAndNodeTopologyToConfig reads a configuration and then applies it to a test configuration.
+//TODO: As of now, this function is not doing anything expect for reading input values to priority structs.
+func writePodAndNodeTopologyToConfig(config *testConfig) error {
+	// High Level structure that should be filled for every predicate or priority.
+	inputConfig := &schedulerPerfConfig{
+		NodeCount: 100,
+		PodCount:  3000,
+		NodeAffinity: &nodeAffinity{
+			nodeAffinityKey: "kubernetes.io/sched-perf-node-affinity-",
+			LabelCount:      10,
+		},
+	}
+	err := inputConfig.generatePodAndNodeTopology(config)
+	if err != nil {
+		return err
+	}
+	return nil
+}