<p dir="auto">I actually see two problems here.  The state here is that the tests have run successfully to completion.</p>
<div class="highlight highlight-text-shell-session notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="% krun -q kubectl --context=federation-cluster get svc --all-namespaces                                       
% krun -q kubectl --context=federation-e2e-gce-us-central1-c get svc --all-namespaces | grep federated-service
zsh: done       krun -q kubectl --context=federation-e2e-gce-us-central1-c get svc  | 
zsh: exit 1     grep federated-service
% ^1-c^1-b
krun -q kubectl --context=federation-e2e-gce-us-central1-b get svc --all-namespaces | grep federated-service
e2e-tests-federated-service-51tvg   federated-service       10.0.247.207   104.197.14.220   80/TCP              35m
e2e-tests-federated-service-qfx5a   federated-service       10.0.48.177    104.198.194.87   80/TCP              36m
% krun -q kubectl --context=federation-e2e-gce-us-central1-c get ns
NAME          STATUS    AGE
default       Active    2d
federation    Active    1d
kube-system   Active    2d
% ^1-c^1-b
krun -q kubectl --context=federation-e2e-gce-us-central1-b get ns
NAME                                STATUS    AGE
default                             Active    2d
e2e-tests-federated-service-51tvg   Active    36m
e2e-tests-federated-service-a4pmu   Active    37m
e2e-tests-federated-service-dvrzj   Active    38m
e2e-tests-federated-service-qfx5a   Active    37m
kube-system                         Active    2d"><pre class="notranslate">% <span class="pl-s1">krun -q kubectl --context=federation-cluster get svc --all-namespaces                                       </span>
% <span class="pl-s1">krun -q kubectl --context=federation-e2e-gce-us-central1-c get svc --all-namespaces <span class="pl-k">|</span> grep federated-service</span>
<span class="pl-c1">zsh: done       krun -q kubectl --context=federation-e2e-gce-us-central1-c get svc  | </span>
<span class="pl-c1">zsh: exit 1     grep federated-service</span>
% <span class="pl-s1">^1-c^1-b</span>
<span class="pl-c1">krun -q kubectl --context=federation-e2e-gce-us-central1-b get svc --all-namespaces | grep federated-service</span>
<span class="pl-c1">e2e-tests-federated-service-51tvg   federated-service       10.0.247.207   104.197.14.220   80/TCP              35m</span>
<span class="pl-c1">e2e-tests-federated-service-qfx5a   federated-service       10.0.48.177    104.198.194.87   80/TCP              36m</span>
% <span class="pl-s1">krun -q kubectl --context=federation-e2e-gce-us-central1-c get ns</span>
<span class="pl-c1">NAME          STATUS    AGE</span>
<span class="pl-c1">default       Active    2d</span>
<span class="pl-c1">federation    Active    1d</span>
<span class="pl-c1">kube-system   Active    2d</span>
% <span class="pl-s1">^1-c^1-b</span>
<span class="pl-c1">krun -q kubectl --context=federation-e2e-gce-us-central1-b get ns</span>
<span class="pl-c1">NAME                                STATUS    AGE</span>
<span class="pl-c1">default                             Active    2d</span>
<span class="pl-c1">e2e-tests-federated-service-51tvg   Active    36m</span>
<span class="pl-c1">e2e-tests-federated-service-a4pmu   Active    37m</span>
<span class="pl-c1">e2e-tests-federated-service-dvrzj   Active    38m</span>
<span class="pl-c1">e2e-tests-federated-service-qfx5a   Active    37m</span>
<span class="pl-c1">kube-system                         Active    2d</span></pre></div>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox"> We're not deleting the namespace from the second cluster.</li>
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> It seems sometimes the services aren't deleted when the parent service goes away.  That's hidden in <code class="notranslate">1-c</code>.  We should add a test.</li>
</ul>
<p dir="auto">@kubernetes/sig-cluster-federation</p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.): secret permission mode</p>
<p dir="auto"><strong>Kubernetes version</strong> (use <code class="notranslate">kubectl version</code>):<br>
version.Info{Major:"1", Minor:"6+", GitVersion:"v1.6.0-alpha.0.551+8fefda3bc3c134", GitCommit:"8fefda3bc3c134fbd29ec18c7b6b9bddb0add86d", GitTreeState:"clean", BuildDate:"2016-11-16T01:56:56Z", GoVersion:"go1.6.3", Compiler:"gc", Platform:"linux/amd64"}</p>
<p dir="auto"><strong>Environment</strong>:</p>
<ul dir="auto">
<li><strong>OS</strong> (e.g. from /etc/os-release): Red Hat Enterprise Linux Server 7.2</li>
<li><strong>Kernel</strong> (e.g. <code class="notranslate">uname -a</code>): 3.10.0-327.22.2.el7.x86_64</li>
</ul>
<p dir="auto"><strong>What happened</strong>:<br>
In upstream doesn't set S_ISGID on the directory in volumes. But, set S_ISGID on the directory in volumes in OCP.</p>
<p dir="auto"><strong>How to reproduce it</strong> (as minimally and precisely as possible):<br>
<strong>1. Create a secret: <code class="notranslate">kubectl create -f secret.yaml</code></strong></p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="apiVersion: v1
kind: Secret
metadata:
  name: test-secret
data:
  data-1: dmFsdWUtMQ0K
  data-2: dmFsdWUtMg0KDQo="><pre class="notranslate"><code class="notranslate">apiVersion: v1
kind: Secret
metadata:
  name: test-secret
data:
  data-1: dmFsdWUtMQ0K
  data-2: dmFsdWUtMg0KDQo=
</code></pre></div>
<p dir="auto"><strong>2. Create a pod with default permission mode: <code class="notranslate">kubectl create -f secret-permission-pod.yaml</code></strong></p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="apiVersion: v1
kind: Pod
metadata:
  name: secret-permission-pod
spec:
  containers:
  - name: secret-permission-pod
    image: redis
    volumeMounts:
    - name: foo-volume
      mountPath: &quot;/etc/foo&quot;
  volumes:
  - name: foo-volume
    secret:
      secretName: test-secret
      defaultMode: 0400"><pre class="notranslate"><code class="notranslate">apiVersion: v1
kind: Pod
metadata:
  name: secret-permission-pod
spec:
  containers:
  - name: secret-permission-pod
    image: redis
    volumeMounts:
    - name: foo-volume
      mountPath: "/etc/foo"
  volumes:
  - name: foo-volume
    secret:
      secretName: test-secret
      defaultMode: 0400
</code></pre></div>
<p dir="auto"><strong>3. Check <code class="notranslate">/etc/foo</code> directory and files permission</strong></p>
<p dir="auto"><strong>Actual results</strong>:<br>
Doesn't set S_ISGID on the directory <code class="notranslate">/etc/foo</code>.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# ls -ld /etc/foo
drwxrwxrwt. 3 root root 120 Nov 16 02:23 /etc/foo                  &lt;-- Doesn't set S_ISGID
# ls -l /etc/foo/..data/*
-r--------. 1 root root  9 Nov 16 02:23 /etc/foo/..data/data-1
-r--------. 1 root root 11 Nov 16 02:23 /etc/foo/..data/data-2"><pre class="notranslate"><code class="notranslate"># ls -ld /etc/foo
drwxrwxrwt. 3 root root 120 Nov 16 02:23 /etc/foo                  &lt;-- Doesn't set S_ISGID
# ls -l /etc/foo/..data/*
-r--------. 1 root root  9 Nov 16 02:23 /etc/foo/..data/data-1
-r--------. 1 root root 11 Nov 16 02:23 /etc/foo/..data/data-2
</code></pre></div>
<p dir="auto"><strong>Expected results</strong>:<br>
Should set S_ISGID on the directory <code class="notranslate">/etc/foo</code>.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# ls -ld /etc/foo
drwxrwsrwt. 3 root root 120 Nov 16 02:23 /etc/foo                  &lt;-- Set S_ISGID
# ls -l /etc/foo/..data/*
-r--------. 1 root root  9 Nov 16 02:23 /etc/foo/..data/data-1
-r--------. 1 root root 11 Nov 16 02:23 /etc/foo/..data/data-2"><pre class="notranslate"><code class="notranslate"># ls -ld /etc/foo
drwxrwsrwt. 3 root root 120 Nov 16 02:23 /etc/foo                  &lt;-- Set S_ISGID
# ls -l /etc/foo/..data/*
-r--------. 1 root root  9 Nov 16 02:23 /etc/foo/..data/data-1
-r--------. 1 root root 11 Nov 16 02:23 /etc/foo/..data/data-2
</code></pre></div>
<p dir="auto"><strong>Anything else do we need to know</strong>:<br>
You can refer to OCP bug: <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1387306" rel="nofollow">https://bugzilla.redhat.com/show_bug.cgi?id=1387306</a><br>
Relate Kube PR: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="187816063" data-permission-text="Title is private" data-url="https://github.com/kubernetes/kubernetes/issues/36386" data-hovercard-type="pull_request" data-hovercard-url="/kubernetes/kubernetes/pull/36386/hovercard" href="https://github.com/kubernetes/kubernetes/pull/36386">#36386</a><br>
Relate Origin cherry-pick PR: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="187822524" data-permission-text="Title is private" data-url="https://github.com/openshift/origin/issues/11816" data-hovercard-type="pull_request" data-hovercard-url="/openshift/origin/pull/11816/hovercard" href="https://github.com/openshift/origin/pull/11816">openshift/origin#11816</a></p>