Issue 1:
https://storage.googleapis.com/kubernetes-jenkins/logs/kubernetes-e2e-gke/8201/

Multiple broken tests:

Failed: [k8s.io] ServiceAccounts should ensure a single API token exists {Kubernetes e2e suite}

/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/service_accounts.go:153
Expected error:
<*errors.StatusError | 0xc820aafa80>: {
ErrStatus: {
TypeMeta: {Kind: "", APIVersion: ""},
ListMeta: {SelfLink: "", ResourceVersion: ""},
Status: "Failure",
Message: "the server does not allow access to the requested resource (put serviceAccounts default)",
Reason: "Forbidden",
Details: {
Name: "default",
Group: "",
Kind: "serviceAccounts",
Causes: [
{
Type: "UnexpectedServerResponse",
Message: "Forbidden: \"/api/v1/namespaces/e2e-tests-svcaccounts-c84sj/serviceaccounts/default\"",
Field: "",
},
],
RetryAfterSeconds: 0,
},
Code: 403,
},
}
the server does not allow access to the requested resource (put serviceAccounts default)
not to have occurred

Failed: [k8s.io] EmptyDir volumes should support (root,0644,default) [Conformance] {Kubernetes e2e suite}

/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:122
Expected error:
<*errors.StatusError | 0xc8200a2780>: {
ErrStatus: {
TypeMeta: {Kind: "", APIVersion: ""},
ListMeta: {SelfLink: "", ResourceVersion: ""},
Status: "Failure",
Message: "the server does not allow access to the requested resource (get serviceAccounts)",
Reason: "Forbidden",
Details: {
Name: "",
Group: "",
Kind: "serviceAccounts",
Causes: [
{
Type: "UnexpectedServerResponse",
Message: "Forbidden: \"/api/v1/watch/namespaces/e2e-tests-emptydir-z0q53/serviceaccounts?fieldSelector=metadata.name%3Ddefault\"",
Field: "",
},
],
RetryAfterSeconds: 0,
},
Code: 403,
},
}
the server does not allow access to the requested resource (get serviceAccounts)
not to have occurred

Failed: [k8s.io] Proxy version v1 should proxy to cadvisor using proxy subresource [Conformance] {Kubernetes e2e suite}

/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:122
Expected error:
<*errors.StatusError | 0xc820e80300>: {
ErrStatus: {
TypeMeta: {Kind: "", APIVersion: ""},
ListMeta: {SelfLink: "", ResourceVersion: ""},
Status: "Failure",
Message: "the server does not allow access to the requested resource (get serviceAccounts)",
Reason: "Forbidden",
Details: {
Name: "",
Group: "",
Kind: "serviceAccounts",
Causes: [
{
Type: "UnexpectedServerResponse",
Message: "Forbidden: \"/api/v1/watch/namespaces/e2e-tests-proxy-z4jp6/serviceaccounts?fieldSelector=metadata.name%3Ddefault\"",
Field: "",
},
],
RetryAfterSeconds: 0,
},
Code: 403,
},
}
the server does not allow access to the requested resource (get serviceAccounts)
not to have occurred

Failed: [k8s.io] Proxy version v1 should proxy through a service and a pod [Conformance] {Kubernetes e2e suite}

/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/proxy.go:260
Expected error:
<*errors.StatusError | 0xc820096380>: {
ErrStatus: {
TypeMeta: {Kind: "", APIVersion: ""},
ListMeta: {SelfLink: "", ResourceVersion: ""},
Status: "Failure",
Message: "the server does not allow access to the requested resource (post services)",
Reason: "Forbidden",
Details: {
Name: "",
Group: "",
Kind: "services",
Causes: [
{
Type: "UnexpectedServerResponse",
Message: "Forbidden: \"/api/v1/namespaces/e2e-tests-proxy-rchpk/services\"",
Field: "",
},
],
RetryAfterSeconds: 0,
},
Code: 403,
},
}
the server does not allow access to the requested resource (post services)
not to have occurred

Issues about this test specifically: #26164 #26210

Issue 2:
Right now we have for GCE config-default.sh and config-test.sh and they are (after a recent PR of mine merges) isomorphic i.e. one is a duplicate of the other with some settings flipped. I think this makes it hard to maintain these files since they have to remain in sync.

I propose that we require the significant env vars in config-default.sh to be over-ridable from the enclosing environment. Then the test driver scripts and programs (e.g. for e2e) could set things like INSTANCE_PREFIX and ENBALE_CLUSTER_LOGGING as env vars and just source config-default.h