Issue 1:
I actually see two problems here. The state here is that the tests have run successfully to completion.

% krun -q kubectl --context=federation-cluster get svc --all-namespaces
% krun -q kubectl --context=federation-e2e-gce-us-central1-c get svc --all-namespaces | grep federated-service
zsh: done krun -q kubectl --context=federation-e2e-gce-us-central1-c get svc |
zsh: exit 1 grep federated-service
% ^1-c^1-b
krun -q kubectl --context=federation-e2e-gce-us-central1-b get svc --all-namespaces | grep federated-service
e2e-tests-federated-service-51tvg federated-service 10.0.247.207 104.197.14.220 80/TCP 35m
e2e-tests-federated-service-qfx5a federated-service 10.0.48.177 104.198.194.87 80/TCP 36m
% krun -q kubectl --context=federation-e2e-gce-us-central1-c get ns
NAME STATUS AGE
default Active 2d
federation Active 1d
kube-system Active 2d
% ^1-c^1-b
krun -q kubectl --context=federation-e2e-gce-us-central1-b get ns
NAME STATUS AGE
default Active 2d
e2e-tests-federated-service-51tvg Active 36m
e2e-tests-federated-service-a4pmu Active 37m
e2e-tests-federated-service-dvrzj Active 38m
e2e-tests-federated-service-qfx5a Active 37m
kube-system Active 2d

We're not deleting the namespace from the second cluster.

It seems sometimes the services aren't deleted when the parent service goes away. That's hidden in 1-c. We should add a test.

@kubernetes/sig-cluster-federation

Issue 2:
What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.): secret permission mode

Kubernetes version (use kubectl version):

version.Info{Major:"1", Minor:"6+", GitVersion:"v1.6.0-alpha.0.551+8fefda3bc3c134", GitCommit:"8fefda3bc3c134fbd29ec18c7b6b9bddb0add86d", GitTreeState:"clean", BuildDate:"2016-11-16T01:56:56Z", GoVersion:"go1.6.3", Compiler:"gc", Platform:"linux/amd64"}

Environment:

OS (e.g. from /etc/os-release): Red Hat Enterprise Linux Server 7.2

Kernel (e.g. uname -a): 3.10.0-327.22.2.el7.x86_64

What happened:

In upstream doesn't set S_ISGID on the directory in volumes. But, set S_ISGID on the directory in volumes in OCP.

How to reproduce it (as minimally and precisely as possible):

1. Create a secret: kubectl create -f secret.yaml

apiVersion: v1
kind: Secret
metadata:
name: test-secret
data:
data-1: dmFsdWUtMQ0K
data-2: dmFsdWUtMg0KDQo=

2. Create a pod with default permission mode: kubectl create -f secret-permission-pod.yaml

apiVersion: v1
kind: Pod
metadata:
name: secret-permission-pod
spec:
containers:
- name: secret-permission-pod
image: redis
volumeMounts:
- name: foo-volume
mountPath: "/etc/foo"
volumes:
- name: foo-volume
secret:
secretName: test-secret
defaultMode: 0400

3. Check /etc/foo directory and files permission

Actual results:

Doesn't set S_ISGID on the directory /etc/foo.

# ls -ld /etc/foo
drwxrwxrwt. 3 root root 120 Nov 16 02:23 /etc/foo <-- Doesn't set S_ISGID
# ls -l /etc/foo/..data/*
-r--------. 1 root root 9 Nov 16 02:23 /etc/foo/..data/data-1
-r--------. 1 root root 11 Nov 16 02:23 /etc/foo/..data/data-2

Expected results:

Should set S_ISGID on the directory /etc/foo.

# ls -ld /etc/foo
drwxrwsrwt. 3 root root 120 Nov 16 02:23 /etc/foo <-- Set S_ISGID
# ls -l /etc/foo/..data/*
-r--------. 1 root root 9 Nov 16 02:23 /etc/foo/..data/data-1
-r--------. 1 root root 11 Nov 16 02:23 /etc/foo/..data/data-2

Anything else do we need to know:

You can refer to OCP bug: https://bugzilla.redhat.com/show_bug.cgi?id=1387306

Relate Kube PR: #36386

Relate Origin cherry-pick PR: openshift/origin#11816