UPSTREAM: <carry>: Add DOWNSTREAM_OWNERS

UPSTREAM: <carry>: clarify downstream approver rules

DOWNSTREAM_OWNERS

@@ -0,0 +1,32 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+filters:
+  ".*":
+    # Downstream reviewers, don't have to match those in OWNERS
+    reviewers:
+    - deads2k
+    - sttts
+    - soltysh
+    - mfojtik
+    - marun
+    - tnozicka
+
+    # Approvers are limited to the team that manages rebases and pays the price for carries that are introduced
+    approvers:
+    - deads2k
+    - sttts
+    - soltysh
+    - mfojtik
+    - marun
+    - tnozicka
+
+  "^\\.go.(mod|sum)$":
+    labels:
+    - "vendor-update"
+  "^vendor/.*":
+    labels:
+    - "vendor-update"
+  "^staging/.*":
+    labels:
+    - "vendor-update"
+component: kube-apiserver

pkg/kubelet/DOWNSTREAM_OWNERS

@@ -0,0 +1,17 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+# Downstream reviewers, don't have to match those in OWNERS
+reviewers:
+  - rphillips
+  - sjenning
+  - mrunalp
+
+# Sub-package approvers from upstream with permission to approve downstream backports following these rules:
+# - they MUST be approvers upstream (here compare https://github.com/kubernetes/kubernetes/blob/17bb2fc050ec786b60db7d8d6d4d3ac8eeac205b/pkg/kubelet/OWNERS#L10-L11)
+# - they may approve "UPSTREAM: <PR>: ..." changes that merged upstream.
+# - carry patches for "UPSTREAM: <carry>: ..." and any unmerged PRs of the previous kind will have to be approved by the top-level approvers.
+approvers:
+  - sjenning
+  - mrunalp
+
+component: node