Test 1.14+ servers with newer metadata concealment image

test/e2e/auth/BUILD

@@ -38,6 +38,7 @@ go_library(
         "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/types:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/util/uuid:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/util/version:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/util/wait:go_default_library",
         "//staging/src/k8s.io/apiserver/pkg/apis/audit:go_default_library",
         "//staging/src/k8s.io/apiserver/pkg/apis/audit/v1beta1:go_default_library",

test/e2e/auth/metadata_concealment.go

@@ -20,6 +20,7 @@ import (
 	batch "k8s.io/api/batch/v1"
 	"k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	utilversion "k8s.io/apimachinery/pkg/util/version"
 	"k8s.io/kubernetes/test/e2e/framework"
 
 	. "github.com/onsi/ginkgo"
@@ -32,6 +33,13 @@ var _ = SIGDescribe("Metadata Concealment", func() {
 
 	It("should run a check-metadata-concealment job to completion", func() {
 		framework.SkipUnlessProviderIs("gce")
+
+		concealmentTestImage := imageutil.CheckMetadataConcealment
+		if gte, _ := framework.ServerVersionGTE(utilversion.MustParseSemantic("v1.14.0-alpha.0"), f.ClientSet.Discovery()); gte {
+			framework.Logf("using metadata concealment image 1.2 for 1.14+ server")
+			concealmentTestImage = imageutil.CheckMetadataConcealment1_2
+		}
+
 		By("Creating a job")
 		job := &batch.Job{
 			ObjectMeta: metav1.ObjectMeta{
@@ -46,7 +54,7 @@ var _ = SIGDescribe("Metadata Concealment", func() {
 						Containers: []v1.Container{
 							{
 								Name:  "check-metadata-concealment",
-								Image: imageutil.GetE2EImage(imageutil.CheckMetadataConcealment),
+								Image: imageutil.GetE2EImage(concealmentTestImage),
 							},
 						},
 						RestartPolicy: v1.RestartPolicyOnFailure,

test/utils/image/manifest.go

@@ -136,6 +136,9 @@ var (
 	VolumeISCSIServer   = Config{e2eRegistry, "volume/iscsi", "1.0"}
 	VolumeGlusterServer = Config{e2eRegistry, "volume/gluster", "1.0"}
 	VolumeRBDServer     = Config{e2eRegistry, "volume/rbd", "1.0.1"}
+
+	// Use a newer version of the metadata concealment check on 1.14+ servers. See http://issue.k8s.io/71094
+	CheckMetadataConcealment1_2 = Config{e2eRegistry, "metadata-concealment", "1.2"}
 )
 
 // GetE2EImage returns the fully qualified URI to an image (including version)