build: move e2e dependencies into e2e/go.mod

Several packages are only used while running the e2e suite. These
packages are less important to update, as the they can not influence the
final executable that is part of the Ceph-CSI container-image.

By moving these dependencies out of the main Ceph-CSI go.mod, it is
easier to identify if a reported CVE affects Ceph-CSI, or only the
testing (like most of the Kubernetes CVEs).

Signed-off-by: Niels de Vos <ndevos@ibm.com>

e2e/vendor/k8s.io/kubernetes/pkg/util/filesystem/defaultfs.go

@@ -0,0 +1,172 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package filesystem
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+)
+
+// DefaultFs implements Filesystem using same-named functions from "os" and "io"
+type DefaultFs struct {
+	root string
+}
+
+var _ Filesystem = &DefaultFs{}
+
+// NewTempFs returns a fake Filesystem in temporary directory, useful for unit tests
+func NewTempFs() Filesystem {
+	path, _ := os.MkdirTemp("", "tmpfs")
+	return &DefaultFs{
+		root: path,
+	}
+}
+
+func (fs *DefaultFs) prefix(path string) string {
+	if len(fs.root) == 0 {
+		return path
+	}
+	return filepath.Join(fs.root, path)
+}
+
+// Stat via os.Stat
+func (fs *DefaultFs) Stat(name string) (os.FileInfo, error) {
+	return os.Stat(fs.prefix(name))
+}
+
+// Create via os.Create
+func (fs *DefaultFs) Create(name string) (File, error) {
+	file, err := os.Create(fs.prefix(name))
+	if err != nil {
+		return nil, err
+	}
+	return &defaultFile{file}, nil
+}
+
+// Rename via os.Rename
+func (fs *DefaultFs) Rename(oldpath, newpath string) error {
+	if !strings.HasPrefix(oldpath, fs.root) {
+		oldpath = fs.prefix(oldpath)
+	}
+	if !strings.HasPrefix(newpath, fs.root) {
+		newpath = fs.prefix(newpath)
+	}
+	return os.Rename(oldpath, newpath)
+}
+
+func (fs *DefaultFs) MkdirAll(path string, perm os.FileMode) error {
+	return MkdirAll(fs.prefix(path), perm)
+}
+
+// MkdirAllWithPathCheck checks if path exists already. If not, it creates a directory
+// named path, along with any necessary parents, and returns nil, or else returns an error.
+// Permission bits perm (before umask) are used for all directories that
+// MkdirAllWithPathCheck creates.
+// If path is already a directory, MkdirAllWithPathCheck does nothing and returns nil.
+// NOTE: In case of Windows NTFS, mount points are implemented as reparse-point
+// (similar to symlink) and do not represent actual directory. Hence Directory existence
+// check for windows NTFS will NOT check for dir, but for symlink presence.
+func MkdirAllWithPathCheck(path string, perm os.FileMode) error {
+	if dir, err := os.Lstat(path); err == nil {
+		// If the path exists already,
+		// 1. for Unix/Linux OS, check if the path is directory.
+		// 2. for windows NTFS, check if the path is symlink instead of directory.
+		if dir.IsDir() ||
+			(runtime.GOOS == "windows" && (dir.Mode()&os.ModeSymlink != 0)) {
+			return nil
+		}
+		return fmt.Errorf("path %v exists but is not a directory", path)
+	}
+	// If existence of path not known, attempt to create it.
+	if err := MkdirAll(path, perm); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Chtimes via os.Chtimes
+func (fs *DefaultFs) Chtimes(name string, atime time.Time, mtime time.Time) error {
+	return os.Chtimes(fs.prefix(name), atime, mtime)
+}
+
+// RemoveAll via os.RemoveAll
+func (fs *DefaultFs) RemoveAll(path string) error {
+	return os.RemoveAll(fs.prefix(path))
+}
+
+// Remove via os.Remove
+func (fs *DefaultFs) Remove(name string) error {
+	return os.Remove(fs.prefix(name))
+}
+
+// ReadFile via os.ReadFile
+func (fs *DefaultFs) ReadFile(filename string) ([]byte, error) {
+	return os.ReadFile(fs.prefix(filename))
+}
+
+// TempDir via os.MkdirTemp
+func (fs *DefaultFs) TempDir(dir, prefix string) (string, error) {
+	return os.MkdirTemp(fs.prefix(dir), prefix)
+}
+
+// TempFile via os.CreateTemp
+func (fs *DefaultFs) TempFile(dir, prefix string) (File, error) {
+	file, err := os.CreateTemp(fs.prefix(dir), prefix)
+	if err != nil {
+		return nil, err
+	}
+	return &defaultFile{file}, nil
+}
+
+// ReadDir via os.ReadDir
+func (fs *DefaultFs) ReadDir(dirname string) ([]os.DirEntry, error) {
+	return os.ReadDir(fs.prefix(dirname))
+}
+
+// Walk via filepath.Walk
+func (fs *DefaultFs) Walk(root string, walkFn filepath.WalkFunc) error {
+	return filepath.Walk(fs.prefix(root), walkFn)
+}
+
+// defaultFile implements File using same-named functions from "os"
+type defaultFile struct {
+	file *os.File
+}
+
+// Name via os.File.Name
+func (file *defaultFile) Name() string {
+	return file.file.Name()
+}
+
+// Write via os.File.Write
+func (file *defaultFile) Write(b []byte) (n int, err error) {
+	return file.file.Write(b)
+}
+
+// Sync via os.File.Sync
+func (file *defaultFile) Sync() error {
+	return file.file.Sync()
+}
+
+// Close via os.File.Close
+func (file *defaultFile) Close() error {
+	return file.file.Close()
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/filesystem/filesystem.go

@@ -0,0 +1,52 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package filesystem
+
+import (
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// Filesystem is an interface that we can use to mock various filesystem operations
+type Filesystem interface {
+	// from "os"
+	Stat(name string) (os.FileInfo, error)
+	Create(name string) (File, error)
+	Rename(oldpath, newpath string) error
+	MkdirAll(path string, perm os.FileMode) error
+	Chtimes(name string, atime time.Time, mtime time.Time) error
+	RemoveAll(path string) error
+	Remove(name string) error
+
+	// from "os"
+	ReadFile(filename string) ([]byte, error)
+	TempDir(dir, prefix string) (string, error)
+	TempFile(dir, prefix string) (File, error)
+	ReadDir(dirname string) ([]os.DirEntry, error)
+	Walk(root string, walkFn filepath.WalkFunc) error
+}
+
+// File is an interface that we can use to mock various filesystem operations typically
+// accessed through the File object from the "os" package
+type File interface {
+	// for now, the only os.File methods used are those below, add more as necessary
+	Name() string
+	Write(b []byte) (n int, err error)
+	Sync() error
+	Close() error
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/filesystem/util.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package filesystem
+
+import (
+	"path/filepath"
+)
+
+// IsPathClean will replace slashes to Separator (which is OS-specific).
+// This will make sure that all slashes are the same before comparing.
+func IsPathClean(path string) bool {
+	return filepath.ToSlash(filepath.Clean(path)) == filepath.ToSlash(path)
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/filesystem/util_unix.go

@@ -0,0 +1,53 @@
+//go:build freebsd || linux || darwin
+// +build freebsd linux darwin
+
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package filesystem
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// IsUnixDomainSocket returns whether a given file is a AF_UNIX socket file
+func IsUnixDomainSocket(filePath string) (bool, error) {
+	fi, err := os.Stat(filePath)
+	if err != nil {
+		return false, fmt.Errorf("stat file %s failed: %v", filePath, err)
+	}
+	if fi.Mode()&os.ModeSocket == 0 {
+		return false, nil
+	}
+	return true, nil
+}
+
+// Chmod is the same as os.Chmod on Unix.
+func Chmod(name string, mode os.FileMode) error {
+	return os.Chmod(name, mode)
+}
+
+// MkdirAll is same as os.MkdirAll on Unix.
+func MkdirAll(path string, perm os.FileMode) error {
+	return os.MkdirAll(path, perm)
+}
+
+// IsAbs is same as filepath.IsAbs on Unix.
+func IsAbs(path string) bool {
+	return filepath.IsAbs(path)
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/filesystem/util_windows.go

@@ -0,0 +1,255 @@
+//go:build windows
+// +build windows
+
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package filesystem
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/klog/v2"
+
+	"golang.org/x/sys/windows"
+)
+
+const (
+	// Amount of time to wait between attempting to use a Unix domain socket.
+	// As detailed in https://github.com/kubernetes/kubernetes/issues/104584
+	// the first attempt will most likely fail, hence the need to retry
+	socketDialRetryPeriod = 1 * time.Second
+	// Overall timeout value to dial a Unix domain socket, including retries
+	socketDialTimeout = 4 * time.Second
+)
+
+// IsUnixDomainSocket returns whether a given file is a AF_UNIX socket file
+// Note that due to the retry logic inside, it could take up to 4 seconds
+// to determine whether or not the file path supplied is a Unix domain socket
+func IsUnixDomainSocket(filePath string) (bool, error) {
+	// Due to the absence of golang support for os.ModeSocket in Windows (https://github.com/golang/go/issues/33357)
+	// we need to dial the file and check if we receive an error to determine if a file is Unix Domain Socket file.
+
+	// Note that querrying for the Reparse Points (https://docs.microsoft.com/en-us/windows/win32/fileio/reparse-points)
+	// for the file (using FSCTL_GET_REPARSE_POINT) and checking for reparse tag: reparseTagSocket
+	// does NOT work in 1809 if the socket file is created within a bind mounted directory by a container
+	// and the FSCTL is issued in the host by the kubelet.
+
+	// If the file does not exist, it cannot be a Unix domain socket.
+	if _, err := os.Stat(filePath); os.IsNotExist(err) {
+		return false, fmt.Errorf("File %s not found. Err: %v", filePath, err)
+	}
+
+	klog.V(6).InfoS("Function IsUnixDomainSocket starts", "filePath", filePath)
+	// As detailed in https://github.com/kubernetes/kubernetes/issues/104584 we cannot rely
+	// on the Unix Domain socket working on the very first try, hence the potential need to
+	// dial multiple times
+	var lastSocketErr error
+	err := wait.PollImmediate(socketDialRetryPeriod, socketDialTimeout,
+		func() (bool, error) {
+			klog.V(6).InfoS("Dialing the socket", "filePath", filePath)
+			var c net.Conn
+			c, lastSocketErr = net.Dial("unix", filePath)
+			if lastSocketErr == nil {
+				c.Close()
+				klog.V(6).InfoS("Socket dialed successfully", "filePath", filePath)
+				return true, nil
+			}
+			klog.V(6).InfoS("Failed the current attempt to dial the socket, so pausing before retry",
+				"filePath", filePath, "err", lastSocketErr, "socketDialRetryPeriod",
+				socketDialRetryPeriod)
+			return false, nil
+		})
+
+	// PollImmediate will return "timed out waiting for the condition" if the function it
+	// invokes never returns true
+	if err != nil {
+		klog.V(2).InfoS("Failed all attempts to dial the socket so marking it as a non-Unix Domain socket. Last socket error along with the error from PollImmediate follow",
+			"filePath", filePath, "lastSocketErr", lastSocketErr, "err", err)
+		return false, nil
+	}
+	return true, nil
+}
+
+// On Windows os.Mkdir all doesn't set any permissions so call the Chown function below to set
+// permissions once the directory is created.
+func MkdirAll(path string, perm os.FileMode) error {
+	klog.V(6).InfoS("Function MkdirAll starts", "path", path, "perm", perm)
+	err := os.MkdirAll(path, perm)
+	if err != nil {
+		return fmt.Errorf("Error creating directory %s: %v", path, err)
+	}
+
+	err = Chmod(path, perm)
+	if err != nil {
+		return fmt.Errorf("Error setting permissions for directory %s: %v", path, err)
+	}
+
+	return nil
+}
+
+const (
+	// These aren't defined in the syscall package for Windows :(
+	USER_READ      = 0x100
+	USER_WRITE     = 0x80
+	USER_EXECUTE   = 0x40
+	GROUP_READ     = 0x20
+	GROUP_WRITE    = 0x10
+	GROUP_EXECUTE  = 0x8
+	OTHERS_READ    = 0x4
+	OTHERS_WRITE   = 0x2
+	OTHERS_EXECUTE = 0x1
+	USER_ALL       = USER_READ | USER_WRITE | USER_EXECUTE
+	GROUP_ALL      = GROUP_READ | GROUP_WRITE | GROUP_EXECUTE
+	OTHERS_ALL     = OTHERS_READ | OTHERS_WRITE | OTHERS_EXECUTE
+)
+
+// On Windows os.Chmod only sets the read-only flag on files, so we need to use Windows APIs to set the desired access on files / directories.
+// The OWNER mode will set file permissions for the file owner SID, the GROUP mode will set file permissions for the file group SID,
+// and the OTHERS mode will set file permissions for BUILTIN\Users.
+// Please note that Windows containers can be run as one of two user accounts; ContainerUser or ContainerAdministrator.
+// Containers run as ContainerAdministrator will inherit permissions from BUILTIN\Administrators,
+// while containers run as ContainerUser will inherit permissions from BUILTIN\Users.
+// Windows containers do not have the ability to run as a custom user account that is known to the host so the OTHERS group mode
+// is used to grant / deny permissions of files on the hosts to the ContainerUser account.
+func Chmod(path string, filemode os.FileMode) error {
+	klog.V(6).InfoS("Function Chmod starts", "path", path, "filemode", filemode)
+	// Get security descriptor for the file
+	sd, err := windows.GetNamedSecurityInfo(
+		path,
+		windows.SE_FILE_OBJECT,
+		windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION|windows.OWNER_SECURITY_INFORMATION|windows.GROUP_SECURITY_INFORMATION)
+	if err != nil {
+		return fmt.Errorf("Error getting security descriptor for file %s: %v", path, err)
+	}
+
+	// Get owner SID from the security descriptor for assigning USER permissions
+	owner, _, err := sd.Owner()
+	if err != nil {
+		return fmt.Errorf("Error getting owner SID for file %s: %v", path, err)
+	}
+	ownerString := owner.String()
+
+	// Get the group SID from the security descriptor for assigning GROUP permissions
+	group, _, err := sd.Group()
+	if err != nil {
+		return fmt.Errorf("Error getting group SID for file %s: %v", path, err)
+	}
+	groupString := group.String()
+
+	mask := uint32(windows.ACCESS_MASK(filemode))
+
+	// Build a new Discretionary Access Control List (DACL) with the desired permissions using
+	//the Security Descriptor Definition Language (SDDL) format.
+	// https://learn.microsoft.com/windows/win32/secauthz/security-descriptor-definition-language
+	// the DACL is a list of Access Control Entries (ACEs) where each ACE represents the permissions (Allow or Deny) for a specific SID.
+	// Each ACE has the following format:
+	//  (AceType;AceFlags;Rights;ObjectGuid;InheritObjectGuid;AccountSid)
+	// We can leave ObjectGuid and InheritObjectGuid empty for our purposes.
+
+	dacl := "D:"
+
+	// build the owner ACE
+	dacl += "(A;OICI;"
+	if mask&USER_ALL == USER_ALL {
+		dacl += "FA"
+	} else {
+		if mask&USER_READ == USER_READ {
+			dacl += "FR"
+		}
+		if mask&USER_WRITE == USER_WRITE {
+			dacl += "FW"
+		}
+		if mask&USER_EXECUTE == USER_EXECUTE {
+			dacl += "FX"
+		}
+	}
+	dacl += ";;;" + ownerString + ")"
+
+	// Build the group ACE
+	dacl += "(A;OICI;"
+	if mask&GROUP_ALL == GROUP_ALL {
+		dacl += "FA"
+	} else {
+		if mask&GROUP_READ == GROUP_READ {
+			dacl += "FR"
+		}
+		if mask&GROUP_WRITE == GROUP_WRITE {
+			dacl += "FW"
+		}
+		if mask&GROUP_EXECUTE == GROUP_EXECUTE {
+			dacl += "FX"
+		}
+	}
+	dacl += ";;;" + groupString + ")"
+
+	// Build the others ACE
+	dacl += "(A;OICI;"
+	if mask&OTHERS_ALL == OTHERS_ALL {
+		dacl += "FA"
+	} else {
+		if mask&OTHERS_READ == OTHERS_READ {
+			dacl += "FR"
+		}
+		if mask&OTHERS_WRITE == OTHERS_WRITE {
+			dacl += "FW"
+		}
+		if mask&OTHERS_EXECUTE == OTHERS_EXECUTE {
+			dacl += "FX"
+		}
+	}
+	dacl += ";;;BU)"
+
+	klog.V(6).InfoS("Setting new DACL for path", "path", path, "dacl", dacl)
+
+	// create a new security descriptor from the DACL string
+	newSD, err := windows.SecurityDescriptorFromString(dacl)
+	if err != nil {
+		return fmt.Errorf("Error creating new security descriptor from DACL string: %v", err)
+	}
+
+	// get the DACL in binary format from the newly created security descriptor
+	newDACL, _, err := newSD.DACL()
+	if err != nil {
+		return fmt.Errorf("Error getting DACL from new security descriptor: %v", err)
+	}
+
+	// Write the new security descriptor to the file
+	return windows.SetNamedSecurityInfo(
+		path,
+		windows.SE_FILE_OBJECT,
+		windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION,
+		nil, // owner SID
+		nil, // group SID
+		newDACL,
+		nil) // SACL
+}
+
+// IsAbs returns whether the given path is absolute or not.
+// On Windows, filepath.IsAbs will not return True for paths prefixed with a slash, even
+// though they can be used as absolute paths (https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats).
+//
+// WARN: It isn't safe to use this for API values which will propagate across systems (e.g. REST API values
+// that get validated on Unix, persisted, then consumed by Windows, etc).
+func IsAbs(path string) bool {
+	return filepath.IsAbs(path) || strings.HasPrefix(path, `\`) || strings.HasPrefix(path, `/`)
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/filesystem/watcher.go

@@ -0,0 +1,216 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package filesystem
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/fsnotify/fsnotify"
+)
+
+// FSWatcher is a callback-based filesystem watcher abstraction for fsnotify.
+type FSWatcher interface {
+	// Initializes the watcher with the given watch handlers.
+	// Called before all other methods.
+	Init(FSEventHandler, FSErrorHandler) error
+
+	// Starts listening for events and errors.
+	// When an event or error occurs, the corresponding handler is called.
+	Run()
+
+	// Add a filesystem path to watch
+	AddWatch(path string) error
+}
+
+// FSEventHandler is called when a fsnotify event occurs.
+type FSEventHandler func(event fsnotify.Event)
+
+// FSErrorHandler is called when a fsnotify error occurs.
+type FSErrorHandler func(err error)
+
+type fsnotifyWatcher struct {
+	watcher      *fsnotify.Watcher
+	eventHandler FSEventHandler
+	errorHandler FSErrorHandler
+}
+
+var _ FSWatcher = &fsnotifyWatcher{}
+
+// NewFsnotifyWatcher returns an implementation of FSWatcher that continuously listens for
+// fsnotify events and calls the event handler as soon as an event is received.
+func NewFsnotifyWatcher() FSWatcher {
+	return &fsnotifyWatcher{}
+}
+
+func (w *fsnotifyWatcher) AddWatch(path string) error {
+	return w.watcher.Add(path)
+}
+
+func (w *fsnotifyWatcher) Init(eventHandler FSEventHandler, errorHandler FSErrorHandler) error {
+	var err error
+	w.watcher, err = fsnotify.NewWatcher()
+	if err != nil {
+		return err
+	}
+
+	w.eventHandler = eventHandler
+	w.errorHandler = errorHandler
+	return nil
+}
+
+func (w *fsnotifyWatcher) Run() {
+	go func() {
+		defer w.watcher.Close()
+		for {
+			select {
+			case event := <-w.watcher.Events:
+				if w.eventHandler != nil {
+					w.eventHandler(event)
+				}
+			case err := <-w.watcher.Errors:
+				if w.errorHandler != nil {
+					w.errorHandler(err)
+				}
+			}
+		}
+	}()
+}
+
+type watchAddRemover interface {
+	Add(path string) error
+	Remove(path string) error
+}
+type noopWatcher struct{}
+
+func (noopWatcher) Add(path string) error    { return nil }
+func (noopWatcher) Remove(path string) error { return nil }
+
+// WatchUntil watches the specified path for changes and blocks until ctx is canceled.
+// eventHandler() must be non-nil, and pollInterval must be greater than 0.
+// eventHandler() is invoked whenever a change event is observed or pollInterval elapses.
+// errorHandler() is invoked (if non-nil) whenever an error occurs initializing or watching the specified path.
+//
+// If path is a directory, only the directory and immediate children are watched.
+//
+// If path does not exist or cannot be watched, an error is passed to errorHandler() and eventHandler() is called at pollInterval.
+//
+// Multiple observed events may collapse to a single invocation of eventHandler().
+//
+// eventHandler() is invoked immediately after successful initialization of the filesystem watch,
+// in case the path changed concurrent with calling WatchUntil().
+func WatchUntil(ctx context.Context, pollInterval time.Duration, path string, eventHandler func(), errorHandler func(err error)) {
+	if pollInterval <= 0 {
+		panic(fmt.Errorf("pollInterval must be > 0"))
+	}
+	if eventHandler == nil {
+		panic(fmt.Errorf("eventHandler must be non-nil"))
+	}
+	if errorHandler == nil {
+		errorHandler = func(err error) {}
+	}
+
+	// Initialize watcher, fall back to no-op
+	var (
+		eventsCh chan fsnotify.Event
+		errorCh  chan error
+		watcher  watchAddRemover
+	)
+	if w, err := fsnotify.NewWatcher(); err != nil {
+		errorHandler(fmt.Errorf("error creating file watcher, falling back to poll at interval %s: %w", pollInterval, err))
+		watcher = noopWatcher{}
+	} else {
+		watcher = w
+		eventsCh = w.Events
+		errorCh = w.Errors
+		defer func() {
+			_ = w.Close()
+		}()
+	}
+
+	// Initialize background poll
+	t := time.NewTicker(pollInterval)
+	defer t.Stop()
+
+	attemptPeriodicRewatch := false
+
+	// Start watching the path
+	if err := watcher.Add(path); err != nil {
+		errorHandler(err)
+		attemptPeriodicRewatch = true
+	} else {
+		// Invoke handle() at least once after successfully registering the listener,
+		// in case the file changed concurrent with calling WatchUntil.
+		eventHandler()
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+
+		case <-t.C:
+			// Prioritize exiting if context is canceled
+			if ctx.Err() != nil {
+				return
+			}
+
+			// Try to re-establish the watcher if we previously got a watch error
+			if attemptPeriodicRewatch {
+				_ = watcher.Remove(path)
+				if err := watcher.Add(path); err != nil {
+					errorHandler(err)
+				} else {
+					attemptPeriodicRewatch = false
+				}
+			}
+
+			// Handle
+			eventHandler()
+
+		case e := <-eventsCh:
+			// Prioritize exiting if context is canceled
+			if ctx.Err() != nil {
+				return
+			}
+
+			// Try to re-establish the watcher for events which dropped the existing watch
+			if e.Name == path && (e.Has(fsnotify.Remove) || e.Has(fsnotify.Rename)) {
+				_ = watcher.Remove(path)
+				if err := watcher.Add(path); err != nil {
+					errorHandler(err)
+					attemptPeriodicRewatch = true
+				}
+			}
+
+			// Handle
+			eventHandler()
+
+		case err := <-errorCh:
+			// Prioritize exiting if context is canceled
+			if ctx.Err() != nil {
+				return
+			}
+
+			// If the error occurs in response to calling watcher.Add, re-adding here could hot-loop.
+			// The periodic poll will attempt to re-establish the watch.
+			errorHandler(err)
+			attemptPeriodicRewatch = true
+		}
+	}
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/hash/hash.go

@@ -0,0 +1,32 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package hash
+
+import (
+	"fmt"
+	"hash"
+
+	"k8s.io/apimachinery/pkg/util/dump"
+)
+
+// DeepHashObject writes specified object to hash using the spew library
+// which follows pointers and prints actual values of the nested objects
+// ensuring the hash does not change when a pointer changes.
+func DeepHashObject(hasher hash.Hash, objectToWrite interface{}) {
+	hasher.Reset()
+	fmt.Fprintf(hasher, "%v", dump.ForHash(objectToWrite))
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/kernel/OWNERS

@@ -0,0 +1,8 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+reviewers:
+  - sig-network-reviewers
+  - sig-node-reviewers
+approvers:
+  - sig-network-approvers
+  - sig-node-approvers

e2e/vendor/k8s.io/kubernetes/pkg/util/kernel/constants.go

@@ -0,0 +1,64 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kernel
+
+// IPLocalReservedPortsNamespacedKernelVersion is the kernel version in which net.ipv4.ip_local_reserved_ports was namespaced(netns).
+// (ref: https://github.com/torvalds/linux/commit/122ff243f5f104194750ecbc76d5946dd1eec934)
+const IPLocalReservedPortsNamespacedKernelVersion = "3.16"
+
+// IPVSConnReuseModeMinSupportedKernelVersion is the minium kernel version supporting net.ipv4.vs.conn_reuse_mode.
+// (ref: https://github.com/torvalds/linux/commit/d752c364571743d696c2a54a449ce77550c35ac5)
+const IPVSConnReuseModeMinSupportedKernelVersion = "4.1"
+
+// TCPKeepAliveTimeNamespacedKernelVersion is the kernel version in which net.ipv4.tcp_keepalive_time was namespaced(netns).
+// (ref: https://github.com/torvalds/linux/commit/13b287e8d1cad951634389f85b8c9b816bd3bb1e)
+const TCPKeepAliveTimeNamespacedKernelVersion = "4.5"
+
+// TCPKeepAliveIntervalNamespacedKernelVersion is the kernel version in which net.ipv4.tcp_keepalive_intvl was namespaced(netns).
+// (ref: https://github.com/torvalds/linux/commit/b840d15d39128d08ed4486085e5507d2617b9ae1)
+const TCPKeepAliveIntervalNamespacedKernelVersion = "4.5"
+
+// TCPKeepAliveProbesNamespacedKernelVersion is the kernel version in which net.ipv4.tcp_keepalive_probes was namespaced(netns).
+// (ref: https://github.com/torvalds/linux/commit/9bd6861bd4326e3afd3f14a9ec8a723771fb20bb)
+const TCPKeepAliveProbesNamespacedKernelVersion = "4.5"
+
+// TCPFinTimeoutNamespacedKernelVersion is the kernel version in which net.ipv4.tcp_fin_timeout was namespaced(netns).
+// (ref: https://github.com/torvalds/linux/commit/1e579caa18b96f9eb18f4f5416658cd15f37c062)
+const TCPFinTimeoutNamespacedKernelVersion = "4.6"
+
+// IPVSConnReuseModeFixedKernelVersion is the kernel version in which net.ipv4.vs.conn_reuse_mode was fixed.
+// (ref: https://github.com/torvalds/linux/commit/35dfb013149f74c2be1ff9c78f14e6a3cd1539d1)
+const IPVSConnReuseModeFixedKernelVersion = "5.9"
+
+// UserNamespacesSupportKernelVersion is the kernel version where idmap for tmpfs support was added
+// (ref: https://github.com/torvalds/linux/commit/05e6295f7b5e05f09e369a3eb2882ec5b40fff20)
+const UserNamespacesSupportKernelVersion = "6.3"
+
+const TmpfsNoswapSupportKernelVersion = "6.4"
+
+// NFTablesKubeProxyKernelVersion is the lowest kernel version kube-proxy supports using
+// nftables mode with by default. This is not directly related to any specific kernel
+// commit; see https://issues.k8s.io/122743#issuecomment-1893922424
+const NFTablesKubeProxyKernelVersion = "5.13"
+
+// TCPReceiveMemoryNamespacedKernelVersion is the kernel version in which net.ipv4.tcp_rmem was namespaced(netns).
+// (ref: https://github.com/torvalds/linux/commit/356d1833b638bd465672aefeb71def3ab93fc17d)
+const TCPReceiveMemoryNamespacedKernelVersion = "4.15"
+
+// TCPTransmitMemoryNamespacedKernelVersion is the kernel version in which net.ipv4.tcp_wmem was namespaced(netns).
+// (ref: https://github.com/torvalds/linux/commit/356d1833b638bd465672aefeb71def3ab93fc17d)
+const TCPTransmitMemoryNamespacedKernelVersion = "4.15"

e2e/vendor/k8s.io/kubernetes/pkg/util/kernel/version.go

@@ -0,0 +1,48 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package kernel
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/version"
+)
+
+type readFileFunc func(string) ([]byte, error)
+
+// GetVersion returns currently running kernel version.
+func GetVersion() (*version.Version, error) {
+	return getVersion(os.ReadFile)
+}
+
+// getVersion reads os release file from the give readFile function.
+func getVersion(readFile readFileFunc) (*version.Version, error) {
+	kernelVersionFile := "/proc/sys/kernel/osrelease"
+	fileContent, err := readFile(kernelVersionFile)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read os-release file: %s", err.Error())
+	}
+
+	kernelVersion, err := version.ParseGeneric(strings.TrimSpace(string(fileContent)))
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse kernel version: %s", err.Error())
+	}
+
+	return kernelVersion, nil
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/labels/doc.go

@@ -0,0 +1,18 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package labels provides utilities to work with Kubernetes labels.
+package labels // import "k8s.io/kubernetes/pkg/util/labels"

e2e/vendor/k8s.io/kubernetes/pkg/util/labels/labels.go

@@ -0,0 +1,124 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package labels
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// Clones the given map and returns a new map with the given key and value added.
+// Returns the given map, if labelKey is empty.
+func CloneAndAddLabel(labels map[string]string, labelKey, labelValue string) map[string]string {
+	if labelKey == "" {
+		// Don't need to add a label.
+		return labels
+	}
+	// Clone.
+	newLabels := map[string]string{}
+	for key, value := range labels {
+		newLabels[key] = value
+	}
+	newLabels[labelKey] = labelValue
+	return newLabels
+}
+
+// CloneAndRemoveLabel clones the given map and returns a new map with the given key removed.
+// Returns the given map, if labelKey is empty.
+func CloneAndRemoveLabel(labels map[string]string, labelKey string) map[string]string {
+	if labelKey == "" {
+		// Don't need to add a label.
+		return labels
+	}
+	// Clone.
+	newLabels := map[string]string{}
+	for key, value := range labels {
+		newLabels[key] = value
+	}
+	delete(newLabels, labelKey)
+	return newLabels
+}
+
+// AddLabel returns a map with the given key and value added to the given map.
+func AddLabel(labels map[string]string, labelKey, labelValue string) map[string]string {
+	if labelKey == "" {
+		// Don't need to add a label.
+		return labels
+	}
+	if labels == nil {
+		labels = make(map[string]string)
+	}
+	labels[labelKey] = labelValue
+	return labels
+}
+
+// Clones the given selector and returns a new selector with the given key and value added.
+// Returns the given selector, if labelKey is empty.
+func CloneSelectorAndAddLabel(selector *metav1.LabelSelector, labelKey, labelValue string) *metav1.LabelSelector {
+	if labelKey == "" {
+		// Don't need to add a label.
+		return selector
+	}
+
+	// Clone.
+	newSelector := new(metav1.LabelSelector)
+
+	// TODO(madhusudancs): Check if you can use deepCopy_extensions_LabelSelector here.
+	newSelector.MatchLabels = make(map[string]string)
+	if selector.MatchLabels != nil {
+		for key, val := range selector.MatchLabels {
+			newSelector.MatchLabels[key] = val
+		}
+	}
+	newSelector.MatchLabels[labelKey] = labelValue
+
+	if selector.MatchExpressions != nil {
+		newMExps := make([]metav1.LabelSelectorRequirement, len(selector.MatchExpressions))
+		for i, me := range selector.MatchExpressions {
+			newMExps[i].Key = me.Key
+			newMExps[i].Operator = me.Operator
+			if me.Values != nil {
+				newMExps[i].Values = make([]string, len(me.Values))
+				copy(newMExps[i].Values, me.Values)
+			} else {
+				newMExps[i].Values = nil
+			}
+		}
+		newSelector.MatchExpressions = newMExps
+	} else {
+		newSelector.MatchExpressions = nil
+	}
+
+	return newSelector
+}
+
+// AddLabelToSelector returns a selector with the given key and value added to the given selector's MatchLabels.
+func AddLabelToSelector(selector *metav1.LabelSelector, labelKey, labelValue string) *metav1.LabelSelector {
+	if labelKey == "" {
+		// Don't need to add a label.
+		return selector
+	}
+	if selector.MatchLabels == nil {
+		selector.MatchLabels = make(map[string]string)
+	}
+	selector.MatchLabels[labelKey] = labelValue
+	return selector
+}
+
+// SelectorHasLabel checks if the given selector contains the given label key in its MatchLabels
+func SelectorHasLabel(selector *metav1.LabelSelector, labelKey string) bool {
+	return len(selector.MatchLabels[labelKey]) > 0
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/oom/doc.go

@@ -0,0 +1,18 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package oom implements utility functions relating to out of memory management.
+package oom // import "k8s.io/kubernetes/pkg/util/oom"

e2e/vendor/k8s.io/kubernetes/pkg/util/oom/oom.go

@@ -0,0 +1,26 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oom
+
+// This is a struct instead of an interface to allow injection of process ID listers and
+// applying OOM score in tests.
+// TODO: make this an interface, and inject a mock ioutil struct for testing.
+type OOMAdjuster struct {
+	pidLister                 func(cgroupName string) ([]int, error)
+	ApplyOOMScoreAdj          func(pid int, oomScoreAdj int) error
+	ApplyOOMScoreAdjContainer func(cgroupName string, oomScoreAdj, maxTries int) error
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/oom/oom_fake.go

@@ -0,0 +1,35 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oom
+
+type FakeOOMAdjuster struct{}
+
+func NewFakeOOMAdjuster() *OOMAdjuster {
+	return &OOMAdjuster{
+		pidLister:                 func(cgroupName string) ([]int, error) { return make([]int, 0), nil },
+		ApplyOOMScoreAdj:          fakeApplyOOMScoreAdj,
+		ApplyOOMScoreAdjContainer: fakeApplyOOMScoreAdjContainer,
+	}
+}
+
+func fakeApplyOOMScoreAdj(pid int, oomScoreAdj int) error {
+	return nil
+}
+
+func fakeApplyOOMScoreAdjContainer(cgroupName string, oomScoreAdj, maxTries int) error {
+	return nil
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/oom/oom_linux.go

@@ -0,0 +1,130 @@
+//go:build linux
+// +build linux
+
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oom
+
+import (
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"strconv"
+	"time"
+
+	cmutil "k8s.io/kubernetes/pkg/kubelet/cm/util"
+
+	"k8s.io/klog/v2"
+)
+
+func NewOOMAdjuster() *OOMAdjuster {
+	oomAdjuster := &OOMAdjuster{
+		pidLister:        getPids,
+		ApplyOOMScoreAdj: applyOOMScoreAdj,
+	}
+	oomAdjuster.ApplyOOMScoreAdjContainer = oomAdjuster.applyOOMScoreAdjContainer
+	return oomAdjuster
+}
+
+func getPids(cgroupName string) ([]int, error) {
+	return cmutil.GetPids(filepath.Join("/", cgroupName))
+}
+
+// Writes 'value' to /proc/<pid>/oom_score_adj. PID = 0 means self
+// Returns os.ErrNotExist if the `pid` does not exist.
+func applyOOMScoreAdj(pid int, oomScoreAdj int) error {
+	if pid < 0 {
+		return fmt.Errorf("invalid PID %d specified for oom_score_adj", pid)
+	}
+
+	var pidStr string
+	if pid == 0 {
+		pidStr = "self"
+	} else {
+		pidStr = strconv.Itoa(pid)
+	}
+
+	maxTries := 2
+	oomScoreAdjPath := path.Join("/proc", pidStr, "oom_score_adj")
+	value := strconv.Itoa(oomScoreAdj)
+	klog.V(4).Infof("attempting to set %q to %q", oomScoreAdjPath, value)
+	var err error
+	for i := 0; i < maxTries; i++ {
+		err = os.WriteFile(oomScoreAdjPath, []byte(value), 0700)
+		if err != nil {
+			if os.IsNotExist(err) {
+				klog.V(2).Infof("%q does not exist", oomScoreAdjPath)
+				return os.ErrNotExist
+			}
+
+			klog.V(3).Info(err)
+			time.Sleep(100 * time.Millisecond)
+			continue
+		}
+		return nil
+	}
+	if err != nil {
+		klog.V(2).Infof("failed to set %q to %q: %v", oomScoreAdjPath, value, err)
+	}
+	return err
+}
+
+// Writes 'value' to /proc/<pid>/oom_score_adj for all processes in cgroup cgroupName.
+// Keeps trying to write until the process list of the cgroup stabilizes, or until maxTries tries.
+func (oomAdjuster *OOMAdjuster) applyOOMScoreAdjContainer(cgroupName string, oomScoreAdj, maxTries int) error {
+	adjustedProcessSet := make(map[int]bool)
+	for i := 0; i < maxTries; i++ {
+		continueAdjusting := false
+		pidList, err := oomAdjuster.pidLister(cgroupName)
+		if err != nil {
+			if os.IsNotExist(err) {
+				// Nothing to do since the container doesn't exist anymore.
+				return os.ErrNotExist
+			}
+			continueAdjusting = true
+			klog.V(10).Infof("Error getting process list for cgroup %s: %+v", cgroupName, err)
+		} else if len(pidList) == 0 {
+			klog.V(10).Infof("Pid list is empty")
+			continueAdjusting = true
+		} else {
+			for _, pid := range pidList {
+				if !adjustedProcessSet[pid] {
+					klog.V(10).Infof("pid %d needs to be set", pid)
+					if err = oomAdjuster.ApplyOOMScoreAdj(pid, oomScoreAdj); err == nil {
+						adjustedProcessSet[pid] = true
+					} else if err == os.ErrNotExist {
+						continue
+					} else {
+						klog.V(10).Infof("cannot adjust oom score for pid %d - %v", pid, err)
+						continueAdjusting = true
+					}
+					// Processes can come and go while we try to apply oom score adjust value. So ignore errors here.
+				}
+			}
+		}
+		if !continueAdjusting {
+			return nil
+		}
+		// There's a slight race. A process might have forked just before we write its OOM score adjust.
+		// The fork might copy the parent process's old OOM score, then this function might execute and
+		// update the parent's OOM score, but the forked process id might not be reflected in cgroup.procs
+		// for a short amount of time. So this function might return without changing the forked process's
+		// OOM score. Very unlikely race, so ignoring this for now.
+	}
+	return fmt.Errorf("exceeded maxTries, some processes might not have desired OOM score")
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/oom/oom_unsupported.go

@@ -0,0 +1,41 @@
+//go:build !linux
+// +build !linux
+
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oom
+
+import (
+	"errors"
+)
+
+var unsupportedErr = errors.New("setting OOM scores is unsupported in this build")
+
+func NewOOMAdjuster() *OOMAdjuster {
+	return &OOMAdjuster{
+		ApplyOOMScoreAdj:          unsupportedApplyOOMScoreAdj,
+		ApplyOOMScoreAdjContainer: unsupportedApplyOOMScoreAdjContainer,
+	}
+}
+
+func unsupportedApplyOOMScoreAdj(pid int, oomScoreAdj int) error {
+	return unsupportedErr
+}
+
+func unsupportedApplyOOMScoreAdjContainer(cgroupName string, oomScoreAdj, maxTries int) error {
+	return unsupportedErr
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/parsers/parsers.go

@@ -0,0 +1,54 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package parsers
+
+import (
+	"fmt"
+	//  Import the crypto sha256 algorithm for the docker image parser to work
+	_ "crypto/sha256"
+	//  Import the crypto/sha512 algorithm for the docker image parser to work with 384 and 512 sha hashes
+	_ "crypto/sha512"
+
+	dockerref "github.com/distribution/reference"
+)
+
+// ParseImageName parses a docker image string into three parts: repo, tag and digest.
+// If both tag and digest are empty, a default image tag will be returned.
+func ParseImageName(image string) (string, string, string, error) {
+	named, err := dockerref.ParseNormalizedNamed(image)
+	if err != nil {
+		return "", "", "", fmt.Errorf("couldn't parse image name %q: %v", image, err)
+	}
+
+	repoToPull := named.Name()
+	var tag, digest string
+
+	tagged, ok := named.(dockerref.Tagged)
+	if ok {
+		tag = tagged.Tag()
+	}
+
+	digested, ok := named.(dockerref.Digested)
+	if ok {
+		digest = digested.Digest().String()
+	}
+	// If no tag was specified, use the default "latest".
+	if len(tag) == 0 && len(digest) == 0 {
+		tag = "latest"
+	}
+	return repoToPull, tag, digest, nil
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/pod/pod.go

@@ -0,0 +1,81 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package pod
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/strategicpatch"
+	clientset "k8s.io/client-go/kubernetes"
+	podutil "k8s.io/kubernetes/pkg/api/v1/pod"
+)
+
+// PatchPodStatus patches pod status. It returns true and avoids an update if the patch contains no changes.
+func PatchPodStatus(ctx context.Context, c clientset.Interface, namespace, name string, uid types.UID, oldPodStatus, newPodStatus v1.PodStatus) (*v1.Pod, []byte, bool, error) {
+	patchBytes, unchanged, err := preparePatchBytesForPodStatus(namespace, name, uid, oldPodStatus, newPodStatus)
+	if err != nil {
+		return nil, nil, false, err
+	}
+	if unchanged {
+		return nil, patchBytes, true, nil
+	}
+
+	updatedPod, err := c.CoreV1().Pods(namespace).Patch(ctx, name, types.StrategicMergePatchType, patchBytes, metav1.PatchOptions{}, "status")
+	if err != nil {
+		return nil, nil, false, fmt.Errorf("failed to patch status %q for pod %q/%q: %v", patchBytes, namespace, name, err)
+	}
+	return updatedPod, patchBytes, false, nil
+}
+
+func preparePatchBytesForPodStatus(namespace, name string, uid types.UID, oldPodStatus, newPodStatus v1.PodStatus) ([]byte, bool, error) {
+	oldData, err := json.Marshal(v1.Pod{
+		Status: oldPodStatus,
+	})
+	if err != nil {
+		return nil, false, fmt.Errorf("failed to Marshal oldData for pod %q/%q: %v", namespace, name, err)
+	}
+
+	newData, err := json.Marshal(v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{UID: uid}, // only put the uid in the new object to ensure it appears in the patch as a precondition
+		Status:     newPodStatus,
+	})
+	if err != nil {
+		return nil, false, fmt.Errorf("failed to Marshal newData for pod %q/%q: %v", namespace, name, err)
+	}
+
+	patchBytes, err := strategicpatch.CreateTwoWayMergePatch(oldData, newData, v1.Pod{})
+	if err != nil {
+		return nil, false, fmt.Errorf("failed to CreateTwoWayMergePatch for pod %q/%q: %v", namespace, name, err)
+	}
+	return patchBytes, bytes.Equal(patchBytes, []byte(fmt.Sprintf(`{"metadata":{"uid":%q}}`, uid))), nil
+}
+
+// ReplaceOrAppendPodCondition replaces the first pod condition with equal type or appends if there is none
+func ReplaceOrAppendPodCondition(conditions []v1.PodCondition, condition *v1.PodCondition) []v1.PodCondition {
+	if i, _ := podutil.GetPodConditionFromList(conditions, condition.Type); i >= 0 {
+		conditions[i] = *condition
+	} else {
+		conditions = append(conditions, *condition)
+	}
+	return conditions
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/slice/slice.go

@@ -0,0 +1,75 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package slice provides utility methods for common operations on slices.
+package slice
+
+import (
+	"sort"
+)
+
+// CopyStrings copies the contents of the specified string slice
+// into a new slice.
+func CopyStrings(s []string) []string {
+	if s == nil {
+		return nil
+	}
+	c := make([]string, len(s))
+	copy(c, s)
+	return c
+}
+
+// SortStrings sorts the specified string slice in place. It returns the same
+// slice that was provided in order to facilitate method chaining.
+func SortStrings(s []string) []string {
+	sort.Strings(s)
+	return s
+}
+
+// ContainsString checks if a given slice of strings contains the provided string.
+// If a modifier func is provided, it is called with the slice item before the comparation.
+func ContainsString(slice []string, s string, modifier func(s string) string) bool {
+	for _, item := range slice {
+		if item == s {
+			return true
+		}
+		if modifier != nil && modifier(item) == s {
+			return true
+		}
+	}
+	return false
+}
+
+// RemoveString returns a newly created []string that contains all items from slice that
+// are not equal to s and modifier(s) in case modifier func is provided.
+func RemoveString(slice []string, s string, modifier func(s string) string) []string {
+	newSlice := make([]string, 0)
+	for _, item := range slice {
+		if item == s {
+			continue
+		}
+		if modifier != nil && modifier(item) == s {
+			continue
+		}
+		newSlice = append(newSlice, item)
+	}
+	if len(newSlice) == 0 {
+		// Sanitize for unit tests so we don't need to distinguish empty array
+		// and nil.
+		newSlice = nil
+	}
+	return newSlice
+}

e2e/vendor/k8s.io/kubernetes/pkg/util/taints/taints.go

@@ -0,0 +1,289 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// package taints implements utilities for working with taints
+package taints
+
+import (
+	"fmt"
+	"strings"
+
+	v1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/kubernetes/pkg/apis/core/helper"
+)
+
+const (
+	MODIFIED  = "modified"
+	TAINTED   = "tainted"
+	UNTAINTED = "untainted"
+)
+
+// parseTaint parses a taint from a string, whose form must be either
+// '<key>=<value>:<effect>', '<key>:<effect>', or '<key>'.
+func parseTaint(st string) (v1.Taint, error) {
+	var taint v1.Taint
+
+	var key string
+	var value string
+	var effect v1.TaintEffect
+
+	parts := strings.Split(st, ":")
+	switch len(parts) {
+	case 1:
+		key = parts[0]
+	case 2:
+		effect = v1.TaintEffect(parts[1])
+		if err := validateTaintEffect(effect); err != nil {
+			return taint, err
+		}
+
+		partsKV := strings.Split(parts[0], "=")
+		if len(partsKV) > 2 {
+			return taint, fmt.Errorf("invalid taint spec: %v", st)
+		}
+		key = partsKV[0]
+		if len(partsKV) == 2 {
+			value = partsKV[1]
+			if errs := validation.IsValidLabelValue(value); len(errs) > 0 {
+				return taint, fmt.Errorf("invalid taint spec: %v, %s", st, strings.Join(errs, "; "))
+			}
+		}
+	default:
+		return taint, fmt.Errorf("invalid taint spec: %v", st)
+	}
+
+	if errs := validation.IsQualifiedName(key); len(errs) > 0 {
+		return taint, fmt.Errorf("invalid taint spec: %v, %s", st, strings.Join(errs, "; "))
+	}
+
+	taint.Key = key
+	taint.Value = value
+	taint.Effect = effect
+
+	return taint, nil
+}
+
+func validateTaintEffect(effect v1.TaintEffect) error {
+	if effect != v1.TaintEffectNoSchedule && effect != v1.TaintEffectPreferNoSchedule && effect != v1.TaintEffectNoExecute {
+		return fmt.Errorf("invalid taint effect: %v, unsupported taint effect", effect)
+	}
+
+	return nil
+}
+
+// ParseTaints takes a spec which is an array and creates slices for new taints to be added, taints to be deleted.
+// It also validates the spec. For example, the form `<key>` may be used to remove a taint, but not to add one.
+func ParseTaints(spec []string) ([]v1.Taint, []v1.Taint, error) {
+	var taints, taintsToRemove []v1.Taint
+	uniqueTaints := map[v1.TaintEffect]sets.String{}
+
+	for _, taintSpec := range spec {
+		if strings.HasSuffix(taintSpec, "-") {
+			taintToRemove, err := parseTaint(strings.TrimSuffix(taintSpec, "-"))
+			if err != nil {
+				return nil, nil, err
+			}
+			taintsToRemove = append(taintsToRemove, v1.Taint{Key: taintToRemove.Key, Effect: taintToRemove.Effect})
+		} else {
+			newTaint, err := parseTaint(taintSpec)
+			if err != nil {
+				return nil, nil, err
+			}
+			// validate that the taint has an effect, which is required to add the taint
+			if len(newTaint.Effect) == 0 {
+				return nil, nil, fmt.Errorf("invalid taint spec: %v", taintSpec)
+			}
+			// validate if taint is unique by <key, effect>
+			if len(uniqueTaints[newTaint.Effect]) > 0 && uniqueTaints[newTaint.Effect].Has(newTaint.Key) {
+				return nil, nil, fmt.Errorf("duplicated taints with the same key and effect: %v", newTaint)
+			}
+			// add taint to existingTaints for uniqueness check
+			if len(uniqueTaints[newTaint.Effect]) == 0 {
+				uniqueTaints[newTaint.Effect] = sets.String{}
+			}
+			uniqueTaints[newTaint.Effect].Insert(newTaint.Key)
+
+			taints = append(taints, newTaint)
+		}
+	}
+	return taints, taintsToRemove, nil
+}
+
+// CheckIfTaintsAlreadyExists checks if the node already has taints that we want to add and returns a string with taint keys.
+func CheckIfTaintsAlreadyExists(oldTaints []v1.Taint, taints []v1.Taint) string {
+	var existingTaintList = make([]string, 0)
+	for _, taint := range taints {
+		for _, oldTaint := range oldTaints {
+			if taint.Key == oldTaint.Key && taint.Effect == oldTaint.Effect {
+				existingTaintList = append(existingTaintList, taint.Key)
+			}
+		}
+	}
+	return strings.Join(existingTaintList, ",")
+}
+
+// DeleteTaintsByKey removes all the taints that have the same key to given taintKey
+func DeleteTaintsByKey(taints []v1.Taint, taintKey string) ([]v1.Taint, bool) {
+	newTaints := []v1.Taint{}
+	deleted := false
+	for i := range taints {
+		if taintKey == taints[i].Key {
+			deleted = true
+			continue
+		}
+		newTaints = append(newTaints, taints[i])
+	}
+	return newTaints, deleted
+}
+
+// DeleteTaint removes all the taints that have the same key and effect to given taintToDelete.
+func DeleteTaint(taints []v1.Taint, taintToDelete *v1.Taint) ([]v1.Taint, bool) {
+	newTaints := []v1.Taint{}
+	deleted := false
+	for i := range taints {
+		if taintToDelete.MatchTaint(&taints[i]) {
+			deleted = true
+			continue
+		}
+		newTaints = append(newTaints, taints[i])
+	}
+	return newTaints, deleted
+}
+
+// RemoveTaint tries to remove a taint from annotations list. Returns a new copy of updated Node and true if something was updated
+// false otherwise.
+func RemoveTaint(node *v1.Node, taint *v1.Taint) (*v1.Node, bool, error) {
+	newNode := node.DeepCopy()
+	nodeTaints := newNode.Spec.Taints
+	if len(nodeTaints) == 0 {
+		return newNode, false, nil
+	}
+
+	if !TaintExists(nodeTaints, taint) {
+		return newNode, false, nil
+	}
+
+	newTaints, _ := DeleteTaint(nodeTaints, taint)
+	newNode.Spec.Taints = newTaints
+	return newNode, true, nil
+}
+
+// AddOrUpdateTaint tries to add a taint to annotations list. Returns a new copy of updated Node and true if something was updated
+// false otherwise.
+func AddOrUpdateTaint(node *v1.Node, taint *v1.Taint) (*v1.Node, bool, error) {
+	newNode := node.DeepCopy()
+	nodeTaints := newNode.Spec.Taints
+
+	var newTaints []v1.Taint
+	updated := false
+	for i := range nodeTaints {
+		if taint.MatchTaint(&nodeTaints[i]) {
+			if helper.Semantic.DeepEqual(*taint, nodeTaints[i]) {
+				return newNode, false, nil
+			}
+			newTaints = append(newTaints, *taint)
+			updated = true
+			continue
+		}
+
+		newTaints = append(newTaints, nodeTaints[i])
+	}
+
+	if !updated {
+		newTaints = append(newTaints, *taint)
+	}
+
+	newNode.Spec.Taints = newTaints
+	return newNode, true, nil
+}
+
+// TaintExists checks if the given taint exists in list of taints. Returns true if exists false otherwise.
+func TaintExists(taints []v1.Taint, taintToFind *v1.Taint) bool {
+	for _, taint := range taints {
+		if taint.MatchTaint(taintToFind) {
+			return true
+		}
+	}
+	return false
+}
+
+// TaintKeyExists checks if the given taint key exists in list of taints. Returns true if exists false otherwise.
+func TaintKeyExists(taints []v1.Taint, taintKeyToMatch string) bool {
+	for _, taint := range taints {
+		if taint.Key == taintKeyToMatch {
+			return true
+		}
+	}
+	return false
+}
+
+// TaintSetDiff finds the difference between two taint slices and
+// returns all new and removed elements of the new slice relative to the old slice.
+// for example:
+// input: taintsNew=[a b] taintsOld=[a c]
+// output: taintsToAdd=[b] taintsToRemove=[c]
+func TaintSetDiff(taintsNew, taintsOld []v1.Taint) (taintsToAdd []*v1.Taint, taintsToRemove []*v1.Taint) {
+	for _, taint := range taintsNew {
+		if !TaintExists(taintsOld, &taint) {
+			t := taint
+			taintsToAdd = append(taintsToAdd, &t)
+		}
+	}
+
+	for _, taint := range taintsOld {
+		if !TaintExists(taintsNew, &taint) {
+			t := taint
+			taintsToRemove = append(taintsToRemove, &t)
+		}
+	}
+
+	return
+}
+
+// TaintSetFilter filters from the taint slice according to the passed fn function to get the filtered taint slice.
+func TaintSetFilter(taints []v1.Taint, fn func(*v1.Taint) bool) []v1.Taint {
+	res := []v1.Taint{}
+
+	for _, taint := range taints {
+		if fn(&taint) {
+			res = append(res, taint)
+		}
+	}
+
+	return res
+}
+
+// CheckTaintValidation checks if the given taint is valid.
+// Returns error if the given taint is invalid.
+func CheckTaintValidation(taint v1.Taint) error {
+	if errs := validation.IsQualifiedName(taint.Key); len(errs) > 0 {
+		return fmt.Errorf("invalid taint key: %s", strings.Join(errs, "; "))
+	}
+	if taint.Value != "" {
+		if errs := validation.IsValidLabelValue(taint.Value); len(errs) > 0 {
+			return fmt.Errorf("invalid taint value: %s", strings.Join(errs, "; "))
+		}
+	}
+	if taint.Effect != "" {
+		if err := validateTaintEffect(taint.Effect); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}