Tighten validation of mirror pod annotations

[liggitt]

Tightens validation for pods with a mirror pod annotation:

1. spec.nodeName must be set
2. makes the mirror pod annotation immutable
3. starts validating pod-specific annotations during pod status update

None of these changes affect usage of the mirror pod annotation by kubelets, which only set it on pod creation (verified this is true back to 1.5.x)

the second commit updates the pod validation tests to look for specific error messages (best reviewed ignoring whitespace changes)

This is the validation portion of https://github.com/kubernetes/community/blob/master/contributors/design-proposals/kubelet-authorizer.md and kubernetes/enhancements#279

Mirror pods must now indicate the nodeName they are bound to on creation. The mirror pod annotation is now treated as immutable and cannot be added to an existing pod, removed from a pod, or modified.

[liggitt]

cc @kubernetes/sig-auth-pr-reviews @kubernetes/sig-node-pr-reviews

[k8s-ci-robot]

@liggitt: The following test(s) failed:

Test name	Commit	Details	Rerun command
pull-kubernetes-federation-e2e-gce	eb0e4fa	link	@k8s-bot pull-kubernetes-federation-e2e-gce test this

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[liggitt]

@k8s-bot kubemark e2e test this

[deads2k]

lgtm

[timstclair]

/lgtm
/approve

Nice!

[smarterclayton]

/approve

API changes LGTM - annotation move to public package decoupled from kubelet.

[k8s-github-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, smarterclayton, timstclair

Needs approval from an approver in each of these OWNERS Files:

• pkg/api/OWNERS [smarterclayton]
• pkg/kubelet/OWNERS [smarterclayton,timstclair]
• plugin/pkg/admission/serviceaccount/OWNERS [liggitt,smarterclayton]
• staging/src/k8s.io/client-go/pkg/api/OWNERS [smarterclayton]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[k8s-github-robot]

Automatic merge from submit-queue (batch tested with PRs 44337, 45775, 45832, 45574, 45758)