Merge branch 'master' into fix_scripts_branch

Godeps/Godeps.json

@@ -2932,73 +2932,78 @@
 		},
 		{
 			"ImportPath": "google.golang.org/grpc",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/codes",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
+		},
+		{
+			"ImportPath": "google.golang.org/grpc/connectivity",
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/credentials",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/grpclb/grpc_lb_v1",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/grpclog",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/internal",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/keepalive",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/metadata",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/naming",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/peer",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/stats",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/status",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/tap",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "google.golang.org/grpc/transport",
-			"Comment": "v1.3.0",
-			"Rev": "d2e1b51f33ff8c5e4a15560ff049d200e83726c5"
+			"Comment": "v1.5.2",
+			"Rev": "b3ddf786825de56a4178401b7e174ee332173b66"
 		},
 		{
 			"ImportPath": "gopkg.in/gcfg.v1",

api/openapi-spec/README.md

@@ -4,7 +4,7 @@ This folder contains an [OpenAPI specification][openapi] for Kubernetes API.
 
 ## Vendor Extensions
 
-Kuberntes extends OpenAPI using these extensions. Note the version that 
+Kuberntes extends OpenAPI using these extensions. Note the version that
 extensions has been added.
 
 ### `x-kubernetes-group-version-kind`
@@ -56,5 +56,5 @@ For example:
 
 ### `x-kubernetes-patch-strategy` and `x-kubernetes-patch-merge-key`
 
-Some of the definitions may have these extensions. For more information about PatchStrategy and PatchMergeKey see 
-[strategic-merge-patch] (https://github.com/kubernetes/community/blob/3a1e6d22f812751ee88eccf7c59101852de63d5b/contributors/devel/strategic-merge-patch.md).
+Some of the definitions may have these extensions. For more information about PatchStrategy and PatchMergeKey see
+[strategic-merge-patch] (https://github.com/kubernetes/community/blob/master/contributors/devel/strategic-merge-patch.md).

api/openapi-spec/swagger.json

@@ -62262,6 +62262,7 @@
     "description": "AdmissionHookClientConfig contains the information to make a TLS connection with the webhook",
     "required": [
      "service",
+     "urlPath",
      "caBundle"
     ],
     "properties": {
@@ -62273,6 +62274,10 @@
      "service": {
       "description": "Service is a reference to the service for this webhook. If there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error. Required",
       "$ref": "#/definitions/io.k8s.api.admissionregistration.v1alpha1.ServiceReference"
+     },
+     "urlPath": {
+      "description": "URLPath is an optional field that specifies the URL path to use when posting the AdmissionReview object.",
+      "type": "string"
      }
     }
    },

api/swagger-spec/admissionregistration.k8s.io_v1alpha1.json

@@ -1764,6 +1764,7 @@
     "description": "AdmissionHookClientConfig contains the information to make a TLS connection with the webhook",
     "required": [
      "service",
+     "urlPath",
      "caBundle"
     ],
     "properties": {
@@ -1771,6 +1772,10 @@
       "$ref": "v1alpha1.ServiceReference",
       "description": "Service is a reference to the service for this webhook. If there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error. Required"
      },
+     "urlPath": {
+      "type": "string",
+      "description": "URLPath is an optional field that specifies the URL path to use when posting the AdmissionReview object."
+     },
      "caBundle": {
       "type": "string",
       "description": "CABundle is a PEM encoded CA bundle which will be used to validate webhook's server certificate. Required"

cluster/centos/config-build.sh

@@ -40,8 +40,7 @@ FLANNEL_DOWNLOAD_URL=\
 ETCD_DOWNLOAD_URL=\
 "https://github.com/coreos/etcd/releases/download/v${ETCD_VERSION}/etcd-v${ETCD_VERSION}-linux-amd64.tar.gz"
 
-# TODO(#33726): switch to dl.k8s.io
 K8S_CLIENT_DOWNLOAD_URL=\
-"https://storage.googleapis.com/kubernetes-release/release/v${K8S_VERSION}/kubernetes-client-linux-amd64.tar.gz"
+"https://dl.k8s.io/v${K8S_VERSION}/kubernetes-client-linux-amd64.tar.gz"
 K8S_SERVER_DOWNLOAD_URL=\
-"https://storage.googleapis.com/kubernetes-release/release/v${K8S_VERSION}/kubernetes-server-linux-amd64.tar.gz"
+"https://dl.k8s.io/v${K8S_VERSION}/kubernetes-server-linux-amd64.tar.gz"

cluster/gce/config-default.sh

@@ -250,6 +250,11 @@ if [[ -n "${GCE_ALPHA_FEATURES:-}" ]]; then
   PROVIDER_VARS="${PROVIDER_VARS:-} GCE_ALPHA_FEATURES"
 fi
 
+# Override default GLBC image
+if [[ -n "${GCE_GLBC_IMAGE:-}" ]]; then
+  PROVIDER_VARS="${PROVIDER_VARS:-} GCE_GLBC_IMAGE"
+fi
+
 # Admission Controllers to invoke prior to persisting objects in cluster
 # If we included ResourceQuota, we should keep it at the end of the list to prevent incrementing quota usage prematurely.
 ADMISSION_CONTROL=Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,Priority,ResourceQuota

cluster/gce/config-test.sh

@@ -287,6 +287,11 @@ if [[ -n "${GCE_ALPHA_FEATURES:-}" ]]; then
   PROVIDER_VARS="${PROVIDER_VARS:-} GCE_ALPHA_FEATURES"
 fi
 
+# Override default GLBC image
+if [[ -n "${GCE_GLBC_IMAGE:-}" ]]; then
+  PROVIDER_VARS="${PROVIDER_VARS:-} GCE_GLBC_IMAGE"
+fi
+
 # If we included ResourceQuota, we should keep it at the end of the list to prevent incrementing quota usage prematurely.
 ADMISSION_CONTROL="${KUBE_ADMISSION_CONTROL:-Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,PodPreset,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,Priority,ResourceQuota}"
 

cluster/gce/container-linux/configure-helper.sh

@@ -1358,8 +1358,12 @@ function start-lb-controller {
     echo "Start GCE L7 pod"
     prepare-log-file /var/log/glbc.log
     setup-addon-manifests "addons" "cluster-loadbalancing/glbc"
-    cp "${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty/glbc.manifest" \
-       /etc/kubernetes/manifests/
+
+    local -r glbc_manifest="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty/glbc.manifest"
+    if [[ ! -z "${GCE_GLBC_IMAGE:-}" ]]; then
+      sed -i "s@image:.*@image: ${GCE_GLBC_IMAGE}@" "${glbc_manifest}"
+    fi
+    cp "${glbc_manifest}" /etc/kubernetes/manifests/
   fi
 }
 

cluster/gce/gci/configure-helper.sh

@@ -1878,8 +1878,12 @@ function start-lb-controller {
     echo "Start GCE L7 pod"
     prepare-log-file /var/log/glbc.log
     setup-addon-manifests "addons" "cluster-loadbalancing/glbc"
-    cp "${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty/glbc.manifest" \
-       /etc/kubernetes/manifests/
+
+    local -r glbc_manifest="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty/glbc.manifest"
+    if [[ ! -z "${GCE_GLBC_IMAGE:-}" ]]; then
+      sed -i "s@image:.*@image: ${GCE_GLBC_IMAGE}@" "${glbc_manifest}"
+    fi
+    cp "${glbc_manifest}" /etc/kubernetes/manifests/
   fi
 }
 

cluster/juju/layers/kubernetes-master/config.yaml

@@ -7,6 +7,12 @@ options:
     type: string
     default: cluster.local
     description: The local domain for cluster dns
+  extra_sans:
+    type: string
+    default: ""
+    description: |
+      Space-separated list of extra SAN entries to add to the x509 certificate
+      created for the master nodes.
   service-cidr:
     type: string
     default: 10.152.183.0/24

cluster/juju/layers/kubernetes-master/reactive/kubernetes_master.py

@@ -356,7 +356,7 @@ def start_master(etcd):
                        'Configuring the Kubernetes master services.')
     freeze_service_cidr()
     if not etcd.get_connection_string():
-        # etcd is not returning a connection string. This hapens when
+        # etcd is not returning a connection string. This happens when
         # the master unit disconnects from etcd and is ready to terminate.
         # No point in trying to start master services and fail. Just return.
         return
@@ -457,12 +457,38 @@ def send_data(tls):
         'kubernetes.default.svc',
         'kubernetes.default.svc.{0}'.format(domain)
     ]
+
+    # maybe they have extra names they want as SANs
+    extra_sans = hookenv.config('extra_sans')
+    if extra_sans and not extra_sans == "":
+        sans.extend(extra_sans.split())
+
     # Create a path safe name by removing path characters from the unit name.
     certificate_name = hookenv.local_unit().replace('/', '_')
     # Request a server cert with this information.
     tls.request_server_cert(common_name, sans, certificate_name)
 
 
+@when('config.changed.extra_sans', 'certificates.available')
+def update_certificate(tls):
+    # I using the config.changed flag instead of something more
+    # specific to try and catch ip changes. Being a little
+    # spammy here is ok because the cert layer checks for
+    # changes to the cert before issuing a new one
+    send_data(tls)
+
+
+@when('certificates.server.cert.available',
+      'kubernetes-master.components.started')
+def kick_api_server(tls):
+    # need to be idempotent and don't want to kick the api server
+    # without need
+    if data_changed('cert', tls.get_server_cert()):
+        # certificate changed, so restart the api server
+        hookenv.log("Certificate information changed, restarting api server")
+        set_state('kube-apiserver.do-restart')
+
+
 @when('kubernetes-master.components.started')
 def configure_cdk_addons():
     ''' Configure CDK addons '''

cluster/juju/layers/kubernetes-master/templates/rbd-persistent-volume.yaml

@@ -4,13 +4,12 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: {{ RBD_NAME }}
-  annotations:
-    volume.beta.kubernetes.io/storage-class: "rbd"
 spec:
   capacity:
     storage: {{ RBD_SIZE }}M
   accessModes:
     - {{ PV_MODE }}
+  storageClassName: "rbd"
   rbd:
     monitors:
       {% for host in monitors %}

cluster/saltbase/salt/cluster-autoscaler/cluster-autoscaler.manifest

@@ -25,7 +25,7 @@
         "containers": [
             {
                 "name": "cluster-autoscaler",
-                "image": "gcr.io/google_containers/cluster-autoscaler:v1.0.1-beta1",
+                "image": "gcr.io/google_containers/cluster-autoscaler:v1.0.1",
                 "livenessProbe": {
                     "httpGet": {
                         "path": "/health-check",

cmd/kube-apiserver/app/BUILD

@@ -70,6 +70,7 @@ go_library(
         "//vendor/k8s.io/apiserver/pkg/storage/etcd3/preflight:go_default_library",
         "//vendor/k8s.io/client-go/informers:go_default_library",
         "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
         "//vendor/k8s.io/client-go/tools/cache:go_default_library",
         "//vendor/k8s.io/kube-aggregator/pkg/apis/apiregistration:go_default_library",
         "//vendor/k8s.io/kube-aggregator/pkg/apis/apiregistration/v1beta1:go_default_library",

cmd/kube-apiserver/app/server.go

@@ -84,6 +84,7 @@ import (
 	"k8s.io/kubernetes/pkg/version"
 	"k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/bootstrap"
 
+	"k8s.io/client-go/rest"
 	"k8s.io/kubernetes/pkg/api"
 	_ "k8s.io/kubernetes/pkg/util/reflector/prometheus" // for reflector metric registration
 	_ "k8s.io/kubernetes/pkg/util/workqueue/prometheus" // for workqueue metric registration
@@ -456,12 +457,15 @@ func BuildGenericConfig(s *options.ServerRunOptions, proxyTransport *http.Transp
 		client,
 		sharedInformers,
 		serviceResolver,
-		proxyTransport,
 	)
 	if err != nil {
 		return nil, nil, nil, nil, nil, fmt.Errorf("failed to create admission plugin initializer: %v", err)
 	}
 
+	webhookClientConfig := rest.AnonymousClientConfig(genericConfig.LoopbackClientConfig)
+	if proxyTransport != nil && proxyTransport.Dial != nil {
+		webhookClientConfig.Dial = proxyTransport.Dial
+	}
 	// TODO: this is the wrong cert/key pair.
 	// Given the generic case of webhook admission from a generic apiserver,
 	// this key pair should be signed by the the API server's client CA.
@@ -477,14 +481,17 @@ func BuildGenericConfig(s *options.ServerRunOptions, proxyTransport *http.Transp
 		if err != nil {
 			return nil, nil, nil, nil, nil, fmt.Errorf("failed to read proxy client key file from: %s, err: %v", s.ProxyClientKeyFile, err)
 		}
+		webhookClientConfig.TLSClientConfig.CertData = certBytes
+		webhookClientConfig.TLSClientConfig.KeyData = keyBytes
 	}
+	webhookClientConfig.UserAgent = "kube-apiserver-admission"
+	webhookClientConfig.Timeout = 30 * time.Second
 
 	err = s.Admission.ApplyTo(
 		genericConfig,
 		versionedInformers,
-		certBytes,
-		keyBytes,
 		kubeClientConfig,
+		webhookClientConfig,
 		legacyscheme.Scheme,
 		pluginInitializer)
 	if err != nil {
@@ -494,7 +501,7 @@ func BuildGenericConfig(s *options.ServerRunOptions, proxyTransport *http.Transp
 }
 
 // BuildAdmissionPluginInitializer constructs the admission plugin initializer
-func BuildAdmissionPluginInitializer(s *options.ServerRunOptions, client internalclientset.Interface, sharedInformers informers.SharedInformerFactory, serviceResolver aggregatorapiserver.ServiceResolver, proxyTransport *http.Transport) (admission.PluginInitializer, error) {
+func BuildAdmissionPluginInitializer(s *options.ServerRunOptions, client internalclientset.Interface, sharedInformers informers.SharedInformerFactory, serviceResolver aggregatorapiserver.ServiceResolver) (admission.PluginInitializer, error) {
 	var cloudConfig []byte
 
 	if s.CloudProvider.CloudConfigFile != "" {
@@ -515,7 +522,6 @@ func BuildAdmissionPluginInitializer(s *options.ServerRunOptions, client interna
 	pluginInitializer := kubeapiserveradmission.NewPluginInitializer(client, sharedInformers, cloudConfig, restMapper, quotaRegistry)
 
 	pluginInitializer = pluginInitializer.SetServiceResolver(serviceResolver)
-	pluginInitializer = pluginInitializer.SetProxyTransport(proxyTransport)
 
 	return pluginInitializer, nil
 }

cmd/kube-proxy/app/validation.go

@@ -120,9 +120,10 @@ func validateProxyMode(mode componentconfig.ProxyMode, fldPath *field.Path) fiel
 	switch mode {
 	case componentconfig.ProxyModeUserspace:
 	case componentconfig.ProxyModeIPTables:
+	case componentconfig.ProxyModeIPVS:
 	case "":
 	default:
-		modes := []string{string(componentconfig.ProxyModeUserspace), string(componentconfig.ProxyModeIPTables)}
+		modes := []string{string(componentconfig.ProxyModeUserspace), string(componentconfig.ProxyModeIPTables), string(componentconfig.ProxyModeIPVS)}
 		errMsg := fmt.Sprintf("must be %s or blank (blank means the best-available proxy (currently iptables)", strings.Join(modes, ","))
 		allErrs = append(allErrs, field.Invalid(fldPath.Child("ProxyMode"), string(mode), errMsg))
 	}

cmd/kube-proxy/app/validation_test.go

@@ -374,6 +374,7 @@ func TestValidateProxyMode(t *testing.T) {
 	successCases := []componentconfig.ProxyMode{
 		componentconfig.ProxyModeUserspace,
 		componentconfig.ProxyModeIPTables,
+		componentconfig.ProxyModeIPVS,
 		componentconfig.ProxyMode(""),
 	}
 

cmd/kubeadm/app/cmd/reset.go

@@ -133,6 +133,9 @@ func (r *Reset) Run(out io.Writer) error {
 	}
 
 	// Remove contents from the config and pki directories
+	if r.certsDir != kubeadmapiext.DefaultCertificatesDir {
+		fmt.Printf("[reset] WARNING: Cleaning a non-default certificates directory: %q\n", r.certsDir)
+	}
 	resetConfigDir(kubeadmconstants.KubernetesDir, r.certsDir)
 
 	return nil

cmd/kubeadm/app/cmd/util/cmdutil.go

@@ -39,19 +39,21 @@ func SubCmdRunE(name string) func(*cobra.Command, []string) error {
 
 // ValidateExactArgNumber validates that the required top-level arguments are specified
 func ValidateExactArgNumber(args []string, supportedArgs []string) error {
+	lenSupported := len(supportedArgs)
 	validArgs := 0
 	// Disregard possible "" arguments; they are invalid
 	for _, arg := range args {
 		if len(arg) > 0 {
 			validArgs++
 		}
+		// break early for too many arguments
+		if validArgs > lenSupported {
+			return fmt.Errorf("too many arguments. Required arguments: %v", supportedArgs)
+		}
 	}
 
-	if validArgs < len(supportedArgs) {
+	if validArgs < lenSupported {
 		return fmt.Errorf("missing one or more required arguments. Required arguments: %v", supportedArgs)
 	}
-	if validArgs > len(supportedArgs) {
-		return fmt.Errorf("too many arguments, only %d argument(s) supported: %v", validArgs, supportedArgs)
-	}
 	return nil
 }

cmd/kubeadm/app/preflight/checks.go

@@ -55,6 +55,7 @@ import (
 
 const (
 	bridgenf                    = "/proc/sys/net/bridge/bridge-nf-call-iptables"
+	bridgenf6                   = "/proc/sys/net/bridge/bridge-nf-call-ip6tables"
 	externalEtcdRequestTimeout  = time.Duration(10 * time.Second)
 	externalEtcdRequestRetries  = 3
 	externalEtcdRequestInterval = time.Duration(5 * time.Second)
@@ -700,6 +701,13 @@ func RunInitMasterChecks(cfg *kubeadmapi.MasterConfiguration) error {
 		}
 	}
 
+	if ip := net.ParseIP(cfg.API.AdvertiseAddress); ip != nil {
+		if ip.To4() == nil && ip.To16() != nil {
+			checks = append(checks,
+				FileContentCheck{Path: bridgenf6, Content: []byte{'1'}},
+			)
+		}
+	}
 	return RunChecks(checks, os.Stderr)
 }
 
@@ -734,6 +742,15 @@ func RunJoinNodeChecks(cfg *kubeadmapi.NodeConfiguration) error {
 		InPathCheck{executable: "touch", mandatory: false},
 	}
 
+	if len(cfg.DiscoveryTokenAPIServers) > 0 {
+		if ip := net.ParseIP(cfg.DiscoveryTokenAPIServers[0]); ip != nil {
+			if ip.To4() == nil && ip.To16() != nil {
+				checks = append(checks,
+					FileContentCheck{Path: bridgenf6, Content: []byte{'1'}},
+				)
+			}
+		}
+	}
 	return RunChecks(checks, os.Stderr)
 }
 

cmd/kubeadm/app/preflight/checks_test.go

@@ -205,6 +205,12 @@ func TestRunInitMasterChecks(t *testing.T) {
 			},
 			expected: false,
 		},
+		{
+			cfg: &kubeadmapi.MasterConfiguration{
+				API: kubeadmapi.API{AdvertiseAddress: "2001:1234::1:15"},
+			},
+			expected: false,
+		},
 	}
 
 	for _, rt := range tests {
@@ -229,6 +235,18 @@ func TestRunJoinNodeChecks(t *testing.T) {
 			cfg:      &kubeadmapi.NodeConfiguration{},
 			expected: false,
 		},
+		{
+			cfg: &kubeadmapi.NodeConfiguration{
+				DiscoveryTokenAPIServers: []string{"192.168.1.15"},
+			},
+			expected: false,
+		},
+		{
+			cfg: &kubeadmapi.NodeConfiguration{
+				DiscoveryTokenAPIServers: []string{"2001:1234::1:15"},
+			},
+			expected: false,
+		},
 	}
 
 	for _, rt := range tests {

cmd/kubelet/app/options/options.go

@@ -156,6 +156,8 @@ type KubeletFlags struct {
 	// This flag, if set, instructs the kubelet to keep volumes from terminated pods mounted to the node.
 	// This can be useful for debugging volume related issues.
 	KeepTerminatedPodVolumes bool
+	// enable gathering custom metrics.
+	EnableCustomMetrics bool
 }
 
 // NewKubeletFlags will create a new KubeletFlags with default values
@@ -184,6 +186,8 @@ func NewKubeletFlags() *KubeletFlags {
 		ExperimentalQOSReserved:             make(map[string]string),
 		RemoteRuntimeEndpoint:               remoteRuntimeEndpoint,
 		RotateCertificates:                  false,
+		// TODO(#54161:v1.11.0): Remove --enable-custom-metrics flag, it is deprecated.
+		EnableCustomMetrics: false,
 	}
 }
 
@@ -316,6 +320,9 @@ func (f *KubeletFlags) AddFlags(fs *pflag.FlagSet) {
 	fs.MarkDeprecated("non-masquerade-cidr", "will be removed in a future version")
 	fs.BoolVar(&f.KeepTerminatedPodVolumes, "keep-terminated-pod-volumes", f.KeepTerminatedPodVolumes, "Keep terminated pod volumes mounted to the node after the pod terminates.  Can be useful for debugging volume related issues.")
 	fs.MarkDeprecated("keep-terminated-pod-volumes", "will be removed in a future version")
+	// TODO(#54161:v1.11.0): Remove --enable-custom-metrics flag, it is deprecated.
+	fs.BoolVar(&f.EnableCustomMetrics, "enable-custom-metrics", f.EnableCustomMetrics, "Support for gathering custom metrics.")
+	fs.MarkDeprecated("enable-custom-metrics", "will be removed in a future version")
 
 }
 
@@ -428,7 +435,6 @@ func AddKubeletConfigFlags(fs *pflag.FlagSet, c *kubeletconfig.KubeletConfigurat
 	fs.Int32Var(&c.KubeAPIBurst, "kube-api-burst", c.KubeAPIBurst, "Burst to use while talking with kubernetes apiserver")
 	fs.BoolVar(&c.SerializeImagePulls, "serialize-image-pulls", c.SerializeImagePulls, "Pull images one at a time. We recommend *not* changing the default value on nodes that run docker daemon with version < 1.9 or an Aufs storage backend. Issue #10959 has more details.")
 
-	fs.BoolVar(&c.EnableCustomMetrics, "enable-custom-metrics", c.EnableCustomMetrics, "Support for gathering custom metrics.")
 	fs.StringVar(&c.RuntimeCgroups, "runtime-cgroups", c.RuntimeCgroups, "Optional absolute name of cgroups to create and run the runtime in.")
 	fs.StringVar(&c.EvictionHard, "eviction-hard", c.EvictionHard, "A set of eviction thresholds (e.g. memory.available<1Gi) that if met would trigger a pod eviction.")
 	fs.StringVar(&c.EvictionSoft, "eviction-soft", c.EvictionSoft, "A set of eviction thresholds (e.g. memory.available<1.5Gi) that if met over a corresponding grace period would trigger a pod eviction.")

docs/api-reference/admissionregistration.k8s.io/v1alpha1/definitions.html

@@ -720,6 +720,13 @@ Depending on the enclosing object, subresources might not be allowed. Required.<
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">urlPath</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">URLPath is an optional field that specifies the URL path to use when posting the AdmissionReview object.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
+<td class="tableblock halign-left valign-top"></td>
+</tr>
+<tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">caBundle</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">CABundle is a PEM encoded CA bundle which will be used to validate webhook&#8217;s server certificate. Required</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>

examples/cockroachdb/cockroachdb-statefulset.yaml

@@ -163,8 +163,6 @@ spec:
   volumeClaimTemplates:
   - metadata:
       name: datadir
-      annotations:
-        volume.alpha.kubernetes.io/storage-class: anything
     spec:
       accessModes:
         - "ReadWriteOnce"

examples/storage/cassandra/cassandra-statefulset.yaml

@@ -82,13 +82,12 @@ spec:
   volumeClaimTemplates:
   - metadata:
       name: cassandra-data
-      annotations:
-        volume.beta.kubernetes.io/storage-class: fast
     spec:
       accessModes: [ "ReadWriteOnce" ]
       resources:
         requests:
           storage: 1Gi
+      storageClassName: fast
 ---
 kind: StorageClass
 apiVersion: storage.k8s.io/v1beta1

examples/storage/minio/minio-distributed-statefulset.yaml

@@ -39,8 +39,6 @@ spec:
   volumeClaimTemplates:
   - metadata:
       name: data
-      annotations:
-        volume.alpha.kubernetes.io/storage-class: anything
     spec:
       accessModes:
         - ReadWriteOnce

examples/storage/minio/minio-standalone-pvc.yaml

@@ -3,8 +3,6 @@ kind: PersistentVolumeClaim
 metadata:
   # This name uniquely identifies the PVC. Will be used in deployment below.
   name: minio-pv-claim
-  annotations:
-    volume.alpha.kubernetes.io/storage-class: anything
   labels:
     app: minio-storage-claim
 spec:

examples/volumes/nfs/provisioner/nfs-server-gce-pv.yaml

@@ -4,8 +4,6 @@ metadata:
   name: nfs-pv-provisioning-demo
   labels:
     demo: nfs-pv-provisioning
-  annotations:
-    volume.alpha.kubernetes.io/storage-class: any
 spec:
   accessModes: [ "ReadWriteOnce" ]
   resources:

examples/volumes/portworx/portworx-volume-pvcsc.yaml

@@ -2,11 +2,10 @@ kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
   name: pvcsc001
-  annotations:
-    volume.beta.kubernetes.io/storage-class: portworx-io-priority-high
 spec:
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
       storage: 2Gi
+  storageClassName: portworx-io-priority-high

examples/volumes/scaleio/sc-pvc.yaml

@@ -2,11 +2,10 @@ kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
   name: pvc-sio-small
-  annotations:
-      volume.beta.kubernetes.io/storage-class: sio-small
 spec:
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
       storage: 10Gi
+  storageClassName: sio-small

examples/volumes/vsphere/simple-statefulset.yaml

@@ -37,10 +37,9 @@ spec:
   volumeClaimTemplates:
   - metadata:
       name: www
-      annotations:
-        volume.beta.kubernetes.io/storage-class: thin-disk
     spec:
       accessModes: [ "ReadWriteOnce" ]
       resources:
         requests:
           storage: 1Gi
+      storageClassName: thin-disk

examples/volumes/vsphere/vsphere-volume-pvcsc.yaml

@@ -2,11 +2,10 @@ kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
   name: pvcsc001
-  annotations:
-    volume.beta.kubernetes.io/storage-class: fast
 spec:
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
       storage: 2Gi
+  storageClassName: fast

federation/cmd/federation-apiserver/app/BUILD

@@ -84,6 +84,7 @@ go_library(
         "//vendor/k8s.io/apiserver/pkg/server/storage:go_default_library",
         "//vendor/k8s.io/client-go/informers:go_default_library",
         "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
         "//vendor/k8s.io/kube-openapi/pkg/common:go_default_library",
     ],
 )

federation/cmd/federation-apiserver/app/server.go

@@ -42,6 +42,7 @@ import (
 	serverstorage "k8s.io/apiserver/pkg/server/storage"
 	clientgoinformers "k8s.io/client-go/informers"
 	clientgoclientset "k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
 	openapicommon "k8s.io/kube-openapi/pkg/common"
 	federationv1beta1 "k8s.io/kubernetes/federation/apis/federation/v1beta1"
 	"k8s.io/kubernetes/federation/cmd/federation-apiserver/app/options"
@@ -215,9 +216,8 @@ func NonBlockingRun(s *options.ServerRunOptions, stopCh <-chan struct{}) error {
 	err = s.Admission.ApplyTo(
 		genericConfig,
 		versionedInformers,
-		nil,
-		nil,
 		kubeClientConfig,
+		rest.AnonymousClientConfig(kubeClientConfig),
 		legacyscheme.Scheme,
 		pluginInitializer,
 	)

federation/pkg/kubefed/init/init.go

@@ -136,6 +136,8 @@ type initFederation struct {
 type initFederationOptions struct {
 	dnsZoneName                      string
 	serverImage                      string
+	imagePullPolicy                  string
+	imagePullSecrets                 string
 	dnsProvider                      string
 	dnsProviderConfig                string
 	etcdImage                        string
@@ -161,6 +163,8 @@ type initFederationOptions struct {
 func (o *initFederationOptions) Bind(flags *pflag.FlagSet, defaultServerImage, defaultEtcdImage string) {
 	flags.StringVar(&o.dnsZoneName, "dns-zone-name", "", "DNS suffix for this federation. Federated Service DNS names are published with this suffix.")
 	flags.StringVar(&o.serverImage, "image", defaultServerImage, "Image to use for federation API server and controller manager binaries.")
+	flags.StringVar(&o.imagePullPolicy, "image-pull-policy", string(api.PullIfNotPresent), "PullPolicy describes a policy for if/when to pull a container image. The default pull policy is IfNotPresent which will not pull an image if it already exists.")
+	flags.StringVar(&o.imagePullSecrets, "image-pull-secrets", "", "Provide secrets that can access the private registry.")
 	flags.StringVar(&o.dnsProvider, "dns-provider", "", "Dns provider to be used for this deployment.")
 	flags.StringVar(&o.dnsProviderConfig, "dns-provider-config", "", "Config file path on local file system for configuring DNS provider.")
 	flags.StringVar(&o.etcdImage, "etcd-image", defaultEtcdImage, "Image to use for etcd server.")
@@ -368,7 +372,7 @@ func (i *initFederation) Run(cmdOut io.Writer, config util.AdminConfig) error {
 
 	fmt.Fprint(cmdOut, "Creating federation component deployments...")
 	glog.V(4).Info("Creating federation control plane components")
-	_, err = createAPIServer(hostClientset, i.commonOptions.FederationSystemNamespace, serverName, i.commonOptions.Name, i.options.serverImage, i.options.etcdImage, advertiseAddress, serverCredName, i.options.apiServerEnableHTTPBasicAuth, i.options.apiServerEnableTokenAuth, i.options.apiServerOverrides, pvc, i.options.dryRun, i.options.nodeSelector)
+	_, err = createAPIServer(hostClientset, i.commonOptions.FederationSystemNamespace, serverName, i.commonOptions.Name, i.options.serverImage, i.options.etcdImage, advertiseAddress, serverCredName, i.options.apiServerEnableHTTPBasicAuth, i.options.apiServerEnableTokenAuth, i.options.apiServerOverrides, pvc, i.options.dryRun, i.options.nodeSelector, i.options.imagePullPolicy, i.options.imagePullSecrets)
 	if err != nil {
 		return err
 	}
@@ -403,7 +407,7 @@ func (i *initFederation) Run(cmdOut io.Writer, config util.AdminConfig) error {
 
 	glog.V(4).Info("Creating federation controller manager deployment")
 
-	_, err = createControllerManager(hostClientset, i.commonOptions.FederationSystemNamespace, i.commonOptions.Name, svc.Name, cmName, i.options.serverImage, cmKubeconfigName, i.options.dnsZoneName, i.options.dnsProvider, i.options.dnsProviderConfig, sa.Name, dnsProviderSecret, i.options.controllerManagerOverrides, i.options.dryRun, i.options.nodeSelector)
+	_, err = createControllerManager(hostClientset, i.commonOptions.FederationSystemNamespace, i.commonOptions.Name, svc.Name, cmName, i.options.serverImage, cmKubeconfigName, i.options.dnsZoneName, i.options.dnsProvider, i.options.dnsProviderConfig, sa.Name, dnsProviderSecret, i.options.controllerManagerOverrides, i.options.dryRun, i.options.nodeSelector, i.options.imagePullPolicy, i.options.imagePullSecrets)
 	if err != nil {
 		return err
 	}
@@ -709,7 +713,7 @@ func createPVC(clientset client.Interface, namespace, svcName, federationName, e
 	return clientset.Core().PersistentVolumeClaims(namespace).Create(pvc)
 }
 
-func createAPIServer(clientset client.Interface, namespace, name, federationName, serverImage, etcdImage, advertiseAddress, credentialsName string, hasHTTPBasicAuthFile, hasTokenAuthFile bool, argOverrides map[string]string, pvc *api.PersistentVolumeClaim, dryRun bool, nodeSelector map[string]string) (*extensions.Deployment, error) {
+func createAPIServer(clientset client.Interface, namespace, name, federationName, serverImage, etcdImage, advertiseAddress, credentialsName string, hasHTTPBasicAuthFile, hasTokenAuthFile bool, argOverrides map[string]string, pvc *api.PersistentVolumeClaim, dryRun bool, nodeSelector map[string]string, imagePullPolicy, imagePullSecrets string) (*extensions.Deployment, error) {
 	command := []string{
 		"/hyperkube",
 		"federation-apiserver",
@@ -755,9 +759,10 @@ func createAPIServer(clientset client.Interface, namespace, name, federationName
 				Spec: api.PodSpec{
 					Containers: []api.Container{
 						{
-							Name:    "apiserver",
-							Image:   serverImage,
-							Command: command,
+							Name:            "apiserver",
+							Image:           serverImage,
+							ImagePullPolicy: api.PullPolicy(imagePullPolicy),
+							Command:         command,
 							Ports: []api.ContainerPort{
 								{
 									Name:          apiServerSecurePortName,
@@ -787,6 +792,11 @@ func createAPIServer(clientset client.Interface, namespace, name, federationName
 						},
 					},
 					NodeSelector: nodeSelector,
+					ImagePullSecrets: []api.LocalObjectReference{
+						{
+							Name: imagePullSecrets,
+						},
+					},
 					Volumes: []api.Volume{
 						{
 							Name: credentialsName,
@@ -884,7 +894,7 @@ func createRoleBindings(clientset client.Interface, namespace, saName, federatio
 	return newRole, newRolebinding, err
 }
 
-func createControllerManager(clientset client.Interface, namespace, name, svcName, cmName, image, kubeconfigName, dnsZoneName, dnsProvider, dnsProviderConfig, saName string, dnsProviderSecret *api.Secret, argOverrides map[string]string, dryRun bool, nodeSelector map[string]string) (*extensions.Deployment, error) {
+func createControllerManager(clientset client.Interface, namespace, name, svcName, cmName, image, kubeconfigName, dnsZoneName, dnsProvider, dnsProviderConfig, saName string, dnsProviderSecret *api.Secret, argOverrides map[string]string, dryRun bool, nodeSelector map[string]string, imagePullPolicy, imagePullSecrets string) (*extensions.Deployment, error) {
 	command := []string{
 		"/hyperkube",
 		"federation-controller-manager",
@@ -931,9 +941,10 @@ func createControllerManager(clientset client.Interface, namespace, name, svcNam
 				Spec: api.PodSpec{
 					Containers: []api.Container{
 						{
-							Name:    "controller-manager",
-							Image:   image,
-							Command: command,
+							Name:            "controller-manager",
+							Image:           image,
+							ImagePullPolicy: api.PullPolicy(imagePullPolicy),
+							Command:         command,
 							VolumeMounts: []api.VolumeMount{
 								{
 									Name:      kubeconfigName,
@@ -954,6 +965,11 @@ func createControllerManager(clientset client.Interface, namespace, name, svcNam
 						},
 					},
 					NodeSelector: nodeSelector,
+					ImagePullSecrets: []api.LocalObjectReference{
+						{
+							Name: imagePullSecrets,
+						},
+					},
 					Volumes: []api.Volume{
 						{
 							Name: kubeconfigName,

federation/pkg/kubefed/init/init_test.go

@@ -97,6 +97,8 @@ func TestInitFederation(t *testing.T) {
 		apiserverServiceType         v1.ServiceType
 		advertiseAddress             string
 		serverImage                  string
+		imagePullPolicy              string
+		imagePullSecrets             string
 		etcdImage                    string
 		etcdPVCapacity               string
 		etcdPVStorageClass           string
@@ -120,6 +122,7 @@ func TestInitFederation(t *testing.T) {
 			lbIP:                  lbIP,
 			apiserverServiceType:  v1.ServiceTypeLoadBalancer,
 			serverImage:           "example.test/foo:bar",
+			imagePullPolicy:       "IfNotPresent",
 			etcdPVCapacity:        "5Gi",
 			etcdPersistence:       "true",
 			expectedErr:           "",
@@ -138,6 +141,7 @@ func TestInitFederation(t *testing.T) {
 			lbIP:                 lbIP,
 			apiserverServiceType: v1.ServiceTypeLoadBalancer,
 			serverImage:          "example.test/foo:bar",
+			imagePullPolicy:      "IfNotPresent",
 			etcdPVCapacity:       "", //test for default value of pvc-size
 			etcdPersistence:      "true",
 			expectedErr:          "",
@@ -151,6 +155,7 @@ func TestInitFederation(t *testing.T) {
 			lbIP:                 lbIP,
 			apiserverServiceType: v1.ServiceTypeLoadBalancer,
 			serverImage:          "example.test/foo:bar",
+			imagePullPolicy:      "IfNotPresent",
 			etcdPVCapacity:       "",
 			etcdPersistence:      "true",
 			expectedErr:          "",
@@ -164,6 +169,7 @@ func TestInitFederation(t *testing.T) {
 			lbIP:                 lbIP,
 			apiserverServiceType: v1.ServiceTypeLoadBalancer,
 			serverImage:          "example.test/foo:bar",
+			imagePullPolicy:      "IfNotPresent",
 			etcdPVCapacity:       "5Gi",
 			etcdPersistence:      "false",
 			expectedErr:          "",
@@ -176,6 +182,7 @@ func TestInitFederation(t *testing.T) {
 			dnsZoneName:          "example.test.",
 			apiserverServiceType: v1.ServiceTypeNodePort,
 			serverImage:          "example.test/foo:bar",
+			imagePullPolicy:      "IfNotPresent",
 			etcdPVCapacity:       "5Gi",
 			etcdPersistence:      "true",
 			expectedErr:          "",
@@ -189,6 +196,7 @@ func TestInitFederation(t *testing.T) {
 			apiserverServiceType: v1.ServiceTypeNodePort,
 			advertiseAddress:     nodeIP,
 			serverImage:          "example.test/foo:bar",
+			imagePullPolicy:      "IfNotPresent",
 			etcdPVCapacity:       "5Gi",
 			etcdPersistence:      "true",
 			expectedErr:          "",
@@ -202,6 +210,7 @@ func TestInitFederation(t *testing.T) {
 			apiserverServiceType: v1.ServiceTypeNodePort,
 			advertiseAddress:     nodeIP,
 			serverImage:          "example.test/foo:bar",
+			imagePullPolicy:      "IfNotPresent",
 			etcdImage:            "gcr.io/google_containers/etcd:latest",
 			etcdPVCapacity:       "5Gi",
 			etcdPVStorageClass:   "fast",
@@ -248,8 +257,11 @@ func TestInitFederation(t *testing.T) {
 		if tc.etcdImage == "" {
 			tc.etcdImage = defaultEtcdImage
 		}
+		if tc.imagePullPolicy == "" {
+			tc.imagePullPolicy = "IfNotPresent"
+		}
 
-		hostFactory, err := fakeInitHostFactory(tc.apiserverServiceType, tc.federation, util.DefaultFederationSystemNamespace, tc.advertiseAddress, tc.lbIP, tc.dnsZoneName, tc.serverImage, tc.etcdImage, tc.dnsProvider, tc.dnsProviderConfig, tc.etcdPersistence, tc.etcdPVCapacity, tc.etcdPVStorageClass, tc.apiserverArgOverrides, tc.cmArgOverrides, tmpDirPath, tc.apiserverEnableHTTPBasicAuth, tc.apiserverEnableTokenAuth, tc.isRBACAPIAvailable, tc.nodeSelector)
+		hostFactory, err := fakeInitHostFactory(tc.apiserverServiceType, tc.federation, util.DefaultFederationSystemNamespace, tc.advertiseAddress, tc.lbIP, tc.dnsZoneName, tc.serverImage, tc.etcdImage, tc.dnsProvider, tc.dnsProviderConfig, tc.etcdPersistence, tc.etcdPVCapacity, tc.etcdPVStorageClass, tc.apiserverArgOverrides, tc.cmArgOverrides, tmpDirPath, tc.apiserverEnableHTTPBasicAuth, tc.apiserverEnableTokenAuth, tc.isRBACAPIAvailable, tc.nodeSelector, tc.imagePullPolicy, tc.imagePullSecrets)
 		if err != nil {
 			t.Fatalf("[%d] unexpected error: %v", i, err)
 		}
@@ -266,6 +278,7 @@ func TestInitFederation(t *testing.T) {
 		cmd.Flags().Set("dns-zone-name", tc.dnsZoneName)
 		cmd.Flags().Set("image", tc.serverImage)
 		cmd.Flags().Set("etcd-image", tc.etcdImage)
+		cmd.Flags().Set("image-pull-policy", tc.imagePullPolicy)
 		cmd.Flags().Set("dns-provider", tc.dnsProvider)
 		cmd.Flags().Set("apiserver-arg-overrides", tc.apiserverArgOverrides)
 		cmd.Flags().Set("controllermanager-arg-overrides", tc.cmArgOverrides)
@@ -282,6 +295,9 @@ func TestInitFederation(t *testing.T) {
 		if tc.etcdPersistence != "true" {
 			cmd.Flags().Set("etcd-persistent-storage", tc.etcdPersistence)
 		}
+		if tc.imagePullSecrets != "" {
+			cmd.Flags().Set("image-pull-secrets", tc.imagePullSecrets)
+		}
 		if tc.apiserverServiceType != v1.ServiceTypeLoadBalancer {
 			cmd.Flags().Set(apiserverServiceTypeFlag, string(tc.apiserverServiceType))
 			cmd.Flags().Set(apiserverAdvertiseAddressFlag, tc.advertiseAddress)
@@ -627,7 +643,7 @@ func TestCertsHTTPS(t *testing.T) {
 	}
 }
 
-func fakeInitHostFactory(apiserverServiceType v1.ServiceType, federationName, namespaceName, advertiseAddress, lbIp, dnsZoneName, serverImage, etcdImage, dnsProvider, dnsProviderConfig, etcdPersistence, etcdPVCapacity, etcdPVStorageClass, apiserverOverrideArg, cmOverrideArg, tmpDirPath string, apiserverEnableHTTPBasicAuth, apiserverEnableTokenAuth, isRBACAPIAvailable bool, nodeSelectorString string) (cmdutil.Factory, error) {
+func fakeInitHostFactory(apiserverServiceType v1.ServiceType, federationName, namespaceName, advertiseAddress, lbIp, dnsZoneName, serverImage, etcdImage, dnsProvider, dnsProviderConfig, etcdPersistence, etcdPVCapacity, etcdPVStorageClass, apiserverOverrideArg, cmOverrideArg, tmpDirPath string, apiserverEnableHTTPBasicAuth, apiserverEnableTokenAuth, isRBACAPIAvailable bool, nodeSelectorString string, imagePullPolicy, imagePullSecrets string) (cmdutil.Factory, error) {
 	svcName := federationName + "-apiserver"
 	svcUrlPrefix := "/api/v1/namespaces/federation-system/services"
 	credSecretName := svcName + "-credentials"
@@ -923,9 +939,10 @@ func fakeInitHostFactory(apiserverServiceType v1.ServiceType, federationName, na
 				Spec: v1.PodSpec{
 					Containers: []v1.Container{
 						{
-							Name:    "apiserver",
-							Image:   serverImage,
-							Command: apiserverCommand,
+							Name:            "apiserver",
+							Image:           serverImage,
+							ImagePullPolicy: v1.PullPolicy(imagePullPolicy),
+							Command:         apiserverCommand,
 							Ports: []v1.ContainerPort{
 								{
 									Name:          apiServerSecurePortName,
@@ -955,6 +972,11 @@ func fakeInitHostFactory(apiserverServiceType v1.ServiceType, federationName, na
 						},
 					},
 					NodeSelector: nodeSelector,
+					ImagePullSecrets: []v1.LocalObjectReference{
+						{
+							Name: imagePullSecrets,
+						},
+					},
 					Volumes: []v1.Volume{
 						{
 							Name: credSecretName,
@@ -1041,9 +1063,10 @@ func fakeInitHostFactory(apiserverServiceType v1.ServiceType, federationName, na
 				Spec: v1.PodSpec{
 					Containers: []v1.Container{
 						{
-							Name:    "controller-manager",
-							Image:   serverImage,
-							Command: cmCommand,
+							Name:            "controller-manager",
+							Image:           serverImage,
+							ImagePullPolicy: v1.PullPolicy(imagePullPolicy),
+							Command:         cmCommand,
 							VolumeMounts: []v1.VolumeMount{
 								{
 									Name:      cmKubeconfigSecretName,
@@ -1064,6 +1087,11 @@ func fakeInitHostFactory(apiserverServiceType v1.ServiceType, federationName, na
 						},
 					},
 					NodeSelector: nodeSelector,
+					ImagePullSecrets: []v1.LocalObjectReference{
+						{
+							Name: imagePullSecrets,
+						},
+					},
 					Volumes: []v1.Volume{
 						{
 							Name: cmKubeconfigSecretName,

federation/test/e2e/BUILD

@@ -34,7 +34,6 @@ go_library(
         "//test/e2e/chaosmonkey:go_default_library",
         "//test/e2e/common:go_default_library",
         "//test/e2e/framework:go_default_library",
-        "//test/utils/image:go_default_library",
         "//vendor/github.com/onsi/ginkgo:go_default_library",
         "//vendor/github.com/onsi/gomega:go_default_library",
         "//vendor/k8s.io/api/batch/v1:go_default_library",

federation/test/e2e/job.go

@@ -29,7 +29,6 @@ import (
 	fedutil "k8s.io/kubernetes/federation/pkg/federation-controller/util"
 	fedframework "k8s.io/kubernetes/federation/test/e2e/framework"
 	"k8s.io/kubernetes/test/e2e/framework"
-	imageutils "k8s.io/kubernetes/test/utils/image"
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
@@ -279,7 +278,7 @@ func newJobForFed(namespace string, name string, completions int32, parallelism
 					Containers: []v1.Container{
 						{
 							Name:    "sleep",
-							Image:   imageutils.GetBusyBoxImage(),
+							Image:   "busybox",
 							Command: []string{"sleep", "1"},
 						},
 					},

federation/test/e2e/util.go

@@ -36,7 +36,6 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
-	imageutils "k8s.io/kubernetes/test/utils/image"
 )
 
 var (
@@ -403,7 +402,7 @@ func discoverService(f *fedframework.Framework, name string, exists bool, podNam
 			Containers: []v1.Container{
 				{
 					Name:    "federated-service-discovery-container",
-					Image:   imageutils.GetBusyBoxImage(),
+					Image:   "busybox",
 					Command: command,
 				},
 			},

hack/.golint_failures

@@ -209,7 +209,7 @@ pkg/kubelet
 pkg/kubelet/apis
 pkg/kubelet/apis/cri/testing
 pkg/kubelet/apis/cri/v1alpha1/runtime
-pkg/kubelet/apis/deviceplugin/v1alpha1
+pkg/kubelet/apis/deviceplugin/v1alpha
 pkg/kubelet/apis/kubeletconfig
 pkg/kubelet/apis/kubeletconfig/v1alpha1
 pkg/kubelet/cadvisor
@@ -778,6 +778,14 @@ staging/src/k8s.io/sample-apiserver/pkg/client/informers/internalversion/interna
 staging/src/k8s.io/sample-apiserver/pkg/cmd/server
 staging/src/k8s.io/sample-apiserver/pkg/registry/wardle/fischer
 staging/src/k8s.io/sample-apiserver/pkg/registry/wardle/flunder
+staging/src/k8s.io/sample-controller/pkg/apis/samplecontroller
+staging/src/k8s.io/sample-controller/pkg/apis/samplecontroller/v1alpha1
+staging/src/k8s.io/sample-controller/pkg/client/clientset/versioned
+staging/src/k8s.io/sample-controller/pkg/client/clientset/versioned/fake
+staging/src/k8s.io/sample-controller/pkg/client/clientset/versioned/scheme
+staging/src/k8s.io/sample-controller/pkg/client/clientset/versioned/typed/samplecontroller/v1alpha1
+staging/src/k8s.io/sample-controller/pkg/client/clientset/versioned/typed/samplecontroller/v1alpha1/fake
+staging/src/k8s.io/sample-controller/pkg/client/informers/externalversions/internalinterfaces
 test/e2e
 test/e2e/apimachinery
 test/e2e/apps

hack/make-rules/helpers/cache_go_dirs.sh

@@ -39,7 +39,7 @@ function kfind() {
     # include the "special" vendor directories which are actually part
     # of the Kubernetes source tree - generators will use these for
     # including certain core API concepts.
-    find -H . ./vendor/k8s.io/apimachinery ./vendor/k8s.io/apiserver ./vendor/k8s.io/kube-aggregator ./vendor/k8s.io/apiextensions-apiserver ./vendor/k8s.io/metrics ./vendor/k8s.io/sample-apiserver ./vendor/k8s.io/api ./vendor/k8s.io/client-go ./vendor/k8s.io/code-generator \
+    find -H . ./vendor/k8s.io/apimachinery ./vendor/k8s.io/apiserver ./vendor/k8s.io/kube-aggregator ./vendor/k8s.io/apiextensions-apiserver ./vendor/k8s.io/metrics ./vendor/k8s.io/sample-apiserver ./vendor/k8s.io/api ./vendor/k8s.io/client-go ./vendor/k8s.io/code-generator ./vendor/k8s.io/sample-controller \
         \(                         \
         -not \(                    \
             \(                     \

hack/make-rules/test-cmd-util.sh

@@ -915,6 +915,32 @@ __EOF__
   set +o errexit
 }
 
+# runs specific kubectl create tests
+run_create_tests() {
+    set -o nounset
+    set -o errexit
+
+    ### Create generic secret with explicit namespace
+    # Pre-condition: secret 'mysecret' does not exist
+    output_message=$(! kubectl get secrets mysecret 2>&1 "${kube_flags[@]}")
+    kube::test::if_has_string "${output_message}" 'secrets "mysecret" not found'
+    # Command
+    output_message=$(kubectl create "${kube_flags[@]}" secret generic mysecret --dry-run --from-literal=foo=bar -o jsonpath='{.metadata.namespace}' --namespace=user-specified)
+    # Post-condition: mysecret still not created since --dry-run was used
+    # Output from 'create' command should contain the specified --namespace value
+    failure_message=$(! kubectl get secrets mysecret 2>&1 "${kube_flags[@]}")
+    kube::test::if_has_string "${failure_message}" 'secrets "mysecret" not found'
+    kube::test::if_has_string "${output_message}" 'user-specified'
+    # Command
+    output_message=$(kubectl create "${kube_flags[@]}" secret generic mysecret --dry-run --from-literal=foo=bar -o jsonpath='{.metadata.namespace}')
+    # Post-condition: jsonpath for .metadata.namespace should be empty for object since --namespace was not explicitly specified
+    kube::test::if_empty_string "${output_message}"
+
+    set +o nounset
+    set +o errexit
+}
+
+
 # Runs tests related to kubectl apply.
 run_kubectl_apply_tests() {
   set -o nounset
@@ -4568,6 +4594,14 @@ runTests() {
     record_command run_kubectl_get_tests
   fi
 
+
+  ######################
+  # Create             #
+  ######################
+  if kube::test::if_supports_resource "${secrets}" ; then
+    record_command run_create_tests
+  fi
+
   ##################
   # Global timeout #
   ##################

hack/update-codegen.sh

@@ -125,5 +125,6 @@ ${informergen} \
 CODEGEN_PKG=./vendor/k8s.io/code-generator vendor/k8s.io/code-generator/hack/update-codegen.sh
 CODEGEN_PKG=./vendor/k8s.io/code-generator vendor/k8s.io/kube-aggregator/hack/update-codegen.sh
 CODEGEN_PKG=./vendor/k8s.io/code-generator vendor/k8s.io/sample-apiserver/hack/update-codegen.sh
+CODEGEN_PKG=./vendor/k8s.io/code-generator vendor/k8s.io/sample-controller/hack/update-codegen.sh
 CODEGEN_PKG=./vendor/k8s.io/code-generator vendor/k8s.io/apiextensions-apiserver/hack/update-codegen.sh
 CODEGEN_PKG=./vendor/k8s.io/code-generator vendor/k8s.io/metrics/hack/update-codegen.sh

hack/update-generated-device-plugin-dockerized.sh

@@ -19,8 +19,7 @@ set -o nounset
 set -o pipefail
 
 KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE}")/../" && pwd -P)"
-DEVICE_PLUGIN_ROOT="${KUBE_ROOT}/pkg/kubelet/apis/deviceplugin/v1alpha1/"
+DEVICE_PLUGIN_ROOT="${KUBE_ROOT}/pkg/kubelet/apis/deviceplugin/v1alpha/"
 
 source "${KUBE_ROOT}/hack/lib/protoc.sh"
-
 kube::protoc::generate_proto ${DEVICE_PLUGIN_ROOT}

hack/verify-codegen.sh

@@ -30,6 +30,7 @@ kube::golang::setup_env
 CODEGEN_PKG=./vendor/k8s.io/code-generator vendor/k8s.io/code-generator/hack/verify-codegen.sh
 CODEGEN_PKG=./vendor/k8s.io/code-generator vendor/k8s.io/kube-aggregator/hack/verify-codegen.sh
 CODEGEN_PKG=./vendor/k8s.io/code-generator vendor/k8s.io/sample-apiserver/hack/verify-codegen.sh
+CODEGEN_PKG=./vendor/k8s.io/code-generator vendor/k8s.io/sample-controller/hack/verify-codegen.sh
 CODEGEN_PKG=./vendor/k8s.io/code-generator vendor/k8s.io/apiextensions-apiserver/hack/verify-codegen.sh
 CODEGEN_PKG=./vendor/k8s.io/code-generator vendor/k8s.io/metrics/hack/verify-codegen.sh
 

hack/verify-generated-device-plugin.sh

@@ -19,8 +19,8 @@ set -o nounset
 set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
-DEVICE_PLUGIN_ROOT="${KUBE_ROOT}/pkg/kubelet/apis/deviceplugin/v1alpha1/"
 ERROR="Device plugin api is out of date. Please run hack/update-generated-device-plugin.sh"
+DEVICE_PLUGIN_ROOT="${KUBE_ROOT}/pkg/kubelet/apis/deviceplugin/v1alpha/"
 
 source "${KUBE_ROOT}/hack/lib/protoc.sh"
 kube::golang::setup_env

pkg/apis/admissionregistration/types.go

@@ -199,6 +199,10 @@ type AdmissionHookClientConfig struct {
 	// ports open, port 443 will be used if it is open, otherwise it is an error.
 	// Required
 	Service ServiceReference
+
+	// URLPath is an optional field that specifies the URL path to use when posting the AdmissionReview object.
+	URLPath string
+
 	// CABundle is a PEM encoded CA bundle which will be used to validate webhook's server certificate.
 	// Required
 	CABundle []byte

pkg/apis/admissionregistration/v1alpha1/zz_generated.conversion.go

@@ -63,6 +63,7 @@ func autoConvert_v1alpha1_AdmissionHookClientConfig_To_admissionregistration_Adm
 	if err := Convert_v1alpha1_ServiceReference_To_admissionregistration_ServiceReference(&in.Service, &out.Service, s); err != nil {
 		return err
 	}
+	out.URLPath = in.URLPath
 	out.CABundle = *(*[]byte)(unsafe.Pointer(&in.CABundle))
 	return nil
 }
@@ -76,6 +77,7 @@ func autoConvert_admissionregistration_AdmissionHookClientConfig_To_v1alpha1_Adm
 	if err := Convert_admissionregistration_ServiceReference_To_v1alpha1_ServiceReference(&in.Service, &out.Service, s); err != nil {
 		return err
 	}
+	out.URLPath = in.URLPath
 	out.CABundle = *(*[]byte)(unsafe.Pointer(&in.CABundle))
 	return nil
 }

pkg/apis/admissionregistration/validation/validation.go

@@ -182,6 +182,44 @@ func validateExternalAdmissionHook(hook *admissionregistration.ExternalAdmission
 	if hook.FailurePolicy != nil && !supportedFailurePolicies.Has(string(*hook.FailurePolicy)) {
 		allErrors = append(allErrors, field.NotSupported(fldPath.Child("failurePolicy"), *hook.FailurePolicy, supportedFailurePolicies.List()))
 	}
+
+	if len(hook.ClientConfig.URLPath) != 0 {
+		allErrors = append(allErrors, validateURLPath(fldPath.Child("clientConfig", "urlPath"), hook.ClientConfig.URLPath)...)
+	}
+
+	return allErrors
+}
+
+func validateURLPath(fldPath *field.Path, urlPath string) field.ErrorList {
+	var allErrors field.ErrorList
+	if urlPath == "/" || len(urlPath) == 0 {
+		return allErrors
+	}
+	if urlPath == "//" {
+		allErrors = append(allErrors, field.Invalid(fldPath, urlPath, "segment[0] may not be empty"))
+		return allErrors
+	}
+
+	if !strings.HasPrefix(urlPath, "/") {
+		allErrors = append(allErrors, field.Invalid(fldPath, urlPath, "must start with a '/'"))
+	}
+
+	urlPathToCheck := urlPath[1:]
+	if strings.HasSuffix(urlPathToCheck, "/") {
+		urlPathToCheck = urlPathToCheck[:len(urlPathToCheck)-1]
+	}
+	steps := strings.Split(urlPathToCheck, "/")
+	for i, step := range steps {
+		if len(step) == 0 {
+			allErrors = append(allErrors, field.Invalid(fldPath, urlPath, fmt.Sprintf("segment[%d] may not be empty", i)))
+			continue
+		}
+		failures := validation.IsDNS1123Subdomain(step)
+		for _, failure := range failures {
+			allErrors = append(allErrors, field.Invalid(fldPath, urlPath, fmt.Sprintf("segment[%d]: %v", i, failure)))
+		}
+	}
+
 	return allErrors
 }
 

pkg/apis/admissionregistration/validation/validation_test.go

@@ -482,18 +482,111 @@ func TestValidateExternalAdmissionHookConfiguration(t *testing.T) {
 				}),
 			expectedError: `externalAdmissionHooks[0].failurePolicy: Unsupported value: "other": supported values: "Fail", "Ignore"`,
 		},
+		{
+			name: "URLPath must start with slash",
+			config: getExternalAdmissionHookConfiguration(
+				[]admissionregistration.ExternalAdmissionHook{
+					{
+						Name: "webhook.k8s.io",
+						ClientConfig: admissionregistration.AdmissionHookClientConfig{
+							URLPath: "foo/",
+						},
+					},
+				}),
+			expectedError: `clientConfig.urlPath: Invalid value: "foo/": must start with a '/'`,
+		},
+		{
+			name: "URLPath accepts slash",
+			config: getExternalAdmissionHookConfiguration(
+				[]admissionregistration.ExternalAdmissionHook{
+					{
+						Name: "webhook.k8s.io",
+						ClientConfig: admissionregistration.AdmissionHookClientConfig{
+							URLPath: "/",
+						},
+					},
+				}),
+			expectedError: ``,
+		},
+		{
+			name: "URLPath accepts no trailing slash",
+			config: getExternalAdmissionHookConfiguration(
+				[]admissionregistration.ExternalAdmissionHook{
+					{
+						Name: "webhook.k8s.io",
+						ClientConfig: admissionregistration.AdmissionHookClientConfig{
+							URLPath: "/foo",
+						},
+					},
+				}),
+			expectedError: ``,
+		},
+		{
+			name: "URLPath fails //",
+			config: getExternalAdmissionHookConfiguration(
+				[]admissionregistration.ExternalAdmissionHook{
+					{
+						Name: "webhook.k8s.io",
+						ClientConfig: admissionregistration.AdmissionHookClientConfig{
+							URLPath: "//",
+						},
+					},
+				}),
+			expectedError: `clientConfig.urlPath: Invalid value: "//": segment[0] may not be empty`,
+		},
+		{
+			name: "URLPath no empty step",
+			config: getExternalAdmissionHookConfiguration(
+				[]admissionregistration.ExternalAdmissionHook{
+					{
+						Name: "webhook.k8s.io",
+						ClientConfig: admissionregistration.AdmissionHookClientConfig{
+							URLPath: "/foo//bar/",
+						},
+					},
+				}),
+			expectedError: `clientConfig.urlPath: Invalid value: "/foo//bar/": segment[1] may not be empty`,
+		}, {
+			name: "URLPath no empty step 2",
+			config: getExternalAdmissionHookConfiguration(
+				[]admissionregistration.ExternalAdmissionHook{
+					{
+						Name: "webhook.k8s.io",
+						ClientConfig: admissionregistration.AdmissionHookClientConfig{
+							URLPath: "/foo/bar//",
+						},
+					},
+				}),
+			expectedError: `clientConfig.urlPath: Invalid value: "/foo/bar//": segment[2] may not be empty`,
+		},
+		{
+			name: "URLPath no non-subdomain",
+			config: getExternalAdmissionHookConfiguration(
+				[]admissionregistration.ExternalAdmissionHook{
+					{
+						Name: "webhook.k8s.io",
+						ClientConfig: admissionregistration.AdmissionHookClientConfig{
+							URLPath: "/apis/foo.bar/v1alpha1/--bad",
+						},
+					},
+				}),
+			expectedError: `clientConfig.urlPath: Invalid value: "/apis/foo.bar/v1alpha1/--bad": segment[3]: a DNS-1123 subdomain`,
+		},
 	}
 	for _, test := range tests {
-		errs := ValidateExternalAdmissionHookConfiguration(test.config)
-		err := errs.ToAggregate()
-		if err != nil {
-			if e, a := test.expectedError, err.Error(); !strings.Contains(a, e) || e == "" {
-				t.Errorf("test case %s, expected to contain %s, got %s", test.name, e, a)
-			}
-		} else {
-			if test.expectedError != "" {
-				t.Errorf("test case %s, unexpected no error, expected to contain %s", test.name, test.expectedError)
+		t.Run(test.name, func(t *testing.T) {
+			errs := ValidateExternalAdmissionHookConfiguration(test.config)
+			err := errs.ToAggregate()
+			if err != nil {
+				if e, a := test.expectedError, err.Error(); !strings.Contains(a, e) || e == "" {
+					t.Errorf("expected to contain %s, got %s", e, a)
+				}
+			} else {
+				if test.expectedError != "" {
+					t.Errorf("unexpected no error, expected to contain %s", test.expectedError)
+				}
 			}
-		}
+		})
+
 	}
 }

pkg/apis/componentconfig/types.go

@@ -158,6 +158,7 @@ type ProxyMode string
 const (
 	ProxyModeUserspace ProxyMode = "userspace"
 	ProxyModeIPTables  ProxyMode = "iptables"
+	ProxyModeIPVS      ProxyMode = "ipvs"
 )
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

pkg/client/listers/admissionregistration/internalversion/BUILD

@@ -16,7 +16,6 @@ go_library(
     deps = [
         "//pkg/apis/admissionregistration:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
         "//vendor/k8s.io/client-go/tools/cache:go_default_library",
     ],

pkg/client/listers/admissionregistration/internalversion/externaladmissionhookconfiguration.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	admissionregistration "k8s.io/kubernetes/pkg/apis/admissionregistration"
@@ -55,8 +54,7 @@ func (s *externalAdmissionHookConfigurationLister) List(selector labels.Selector
 
 // Get retrieves the ExternalAdmissionHookConfiguration from the index for a given name.
 func (s *externalAdmissionHookConfigurationLister) Get(name string) (*admissionregistration.ExternalAdmissionHookConfiguration, error) {
-	key := &admissionregistration.ExternalAdmissionHookConfiguration{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/admissionregistration/internalversion/initializerconfiguration.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	admissionregistration "k8s.io/kubernetes/pkg/apis/admissionregistration"
@@ -55,8 +54,7 @@ func (s *initializerConfigurationLister) List(selector labels.Selector) (ret []*
 
 // Get retrieves the InitializerConfiguration from the index for a given name.
 func (s *initializerConfigurationLister) Get(name string) (*admissionregistration.InitializerConfiguration, error) {
-	key := &admissionregistration.InitializerConfiguration{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/authentication/internalversion/BUILD

@@ -15,7 +15,6 @@ go_library(
     deps = [
         "//pkg/apis/authentication:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
         "//vendor/k8s.io/client-go/tools/cache:go_default_library",
     ],

pkg/client/listers/authentication/internalversion/tokenreview.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	authentication "k8s.io/kubernetes/pkg/apis/authentication"
@@ -55,8 +54,7 @@ func (s *tokenReviewLister) List(selector labels.Selector) (ret []*authenticatio
 
 // Get retrieves the TokenReview from the index for a given name.
 func (s *tokenReviewLister) Get(name string) (*authentication.TokenReview, error) {
-	key := &authentication.TokenReview{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/authorization/internalversion/BUILD

@@ -18,7 +18,6 @@ go_library(
     deps = [
         "//pkg/apis/authorization:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
         "//vendor/k8s.io/client-go/tools/cache:go_default_library",
     ],

pkg/client/listers/authorization/internalversion/selfsubjectaccessreview.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	authorization "k8s.io/kubernetes/pkg/apis/authorization"
@@ -55,8 +54,7 @@ func (s *selfSubjectAccessReviewLister) List(selector labels.Selector) (ret []*a
 
 // Get retrieves the SelfSubjectAccessReview from the index for a given name.
 func (s *selfSubjectAccessReviewLister) Get(name string) (*authorization.SelfSubjectAccessReview, error) {
-	key := &authorization.SelfSubjectAccessReview{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/authorization/internalversion/selfsubjectrulesreview.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	authorization "k8s.io/kubernetes/pkg/apis/authorization"
@@ -55,8 +54,7 @@ func (s *selfSubjectRulesReviewLister) List(selector labels.Selector) (ret []*au
 
 // Get retrieves the SelfSubjectRulesReview from the index for a given name.
 func (s *selfSubjectRulesReviewLister) Get(name string) (*authorization.SelfSubjectRulesReview, error) {
-	key := &authorization.SelfSubjectRulesReview{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/authorization/internalversion/subjectaccessreview.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	authorization "k8s.io/kubernetes/pkg/apis/authorization"
@@ -55,8 +54,7 @@ func (s *subjectAccessReviewLister) List(selector labels.Selector) (ret []*autho
 
 // Get retrieves the SubjectAccessReview from the index for a given name.
 func (s *subjectAccessReviewLister) Get(name string) (*authorization.SubjectAccessReview, error) {
-	key := &authorization.SubjectAccessReview{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/certificates/internalversion/BUILD

@@ -15,7 +15,6 @@ go_library(
     deps = [
         "//pkg/apis/certificates:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
         "//vendor/k8s.io/client-go/tools/cache:go_default_library",
     ],

pkg/client/listers/certificates/internalversion/certificatesigningrequest.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	certificates "k8s.io/kubernetes/pkg/apis/certificates"
@@ -55,8 +54,7 @@ func (s *certificateSigningRequestLister) List(selector labels.Selector) (ret []
 
 // Get retrieves the CertificateSigningRequest from the index for a given name.
 func (s *certificateSigningRequestLister) Get(name string) (*certificates.CertificateSigningRequest, error) {
-	key := &certificates.CertificateSigningRequest{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/core/internalversion/BUILD

@@ -33,7 +33,6 @@ go_library(
     deps = [
         "//pkg/api:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
         "//vendor/k8s.io/client-go/tools/cache:go_default_library",
     ],

pkg/client/listers/core/internalversion/componentstatus.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	api "k8s.io/kubernetes/pkg/api"
@@ -55,8 +54,7 @@ func (s *componentStatusLister) List(selector labels.Selector) (ret []*api.Compo
 
 // Get retrieves the ComponentStatus from the index for a given name.
 func (s *componentStatusLister) Get(name string) (*api.ComponentStatus, error) {
-	key := &api.ComponentStatus{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/core/internalversion/namespace.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	api "k8s.io/kubernetes/pkg/api"
@@ -55,8 +54,7 @@ func (s *namespaceLister) List(selector labels.Selector) (ret []*api.Namespace,
 
 // Get retrieves the Namespace from the index for a given name.
 func (s *namespaceLister) Get(name string) (*api.Namespace, error) {
-	key := &api.Namespace{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/core/internalversion/node.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	api "k8s.io/kubernetes/pkg/api"
@@ -55,8 +54,7 @@ func (s *nodeLister) List(selector labels.Selector) (ret []*api.Node, err error)
 
 // Get retrieves the Node from the index for a given name.
 func (s *nodeLister) Get(name string) (*api.Node, error) {
-	key := &api.Node{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/core/internalversion/persistentvolume.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	api "k8s.io/kubernetes/pkg/api"
@@ -55,8 +54,7 @@ func (s *persistentVolumeLister) List(selector labels.Selector) (ret []*api.Pers
 
 // Get retrieves the PersistentVolume from the index for a given name.
 func (s *persistentVolumeLister) Get(name string) (*api.PersistentVolume, error) {
-	key := &api.PersistentVolume{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/extensions/internalversion/podsecuritypolicy.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	extensions "k8s.io/kubernetes/pkg/apis/extensions"
@@ -55,8 +54,7 @@ func (s *podSecurityPolicyLister) List(selector labels.Selector) (ret []*extensi
 
 // Get retrieves the PodSecurityPolicy from the index for a given name.
 func (s *podSecurityPolicyLister) Get(name string) (*extensions.PodSecurityPolicy, error) {
-	key := &extensions.PodSecurityPolicy{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/extensions/internalversion/thirdpartyresource.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	extensions "k8s.io/kubernetes/pkg/apis/extensions"
@@ -55,8 +54,7 @@ func (s *thirdPartyResourceLister) List(selector labels.Selector) (ret []*extens
 
 // Get retrieves the ThirdPartyResource from the index for a given name.
 func (s *thirdPartyResourceLister) Get(name string) (*extensions.ThirdPartyResource, error) {
-	key := &extensions.ThirdPartyResource{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/imagepolicy/internalversion/BUILD

@@ -15,7 +15,6 @@ go_library(
     deps = [
         "//pkg/apis/imagepolicy:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
         "//vendor/k8s.io/client-go/tools/cache:go_default_library",
     ],

pkg/client/listers/imagepolicy/internalversion/imagereview.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	imagepolicy "k8s.io/kubernetes/pkg/apis/imagepolicy"
@@ -55,8 +54,7 @@ func (s *imageReviewLister) List(selector labels.Selector) (ret []*imagepolicy.I
 
 // Get retrieves the ImageReview from the index for a given name.
 func (s *imageReviewLister) Get(name string) (*imagepolicy.ImageReview, error) {
-	key := &imagepolicy.ImageReview{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/rbac/internalversion/BUILD

@@ -18,7 +18,6 @@ go_library(
     deps = [
         "//pkg/apis/rbac:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
         "//vendor/k8s.io/client-go/tools/cache:go_default_library",
     ],

pkg/client/listers/rbac/internalversion/clusterrole.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	rbac "k8s.io/kubernetes/pkg/apis/rbac"
@@ -55,8 +54,7 @@ func (s *clusterRoleLister) List(selector labels.Selector) (ret []*rbac.ClusterR
 
 // Get retrieves the ClusterRole from the index for a given name.
 func (s *clusterRoleLister) Get(name string) (*rbac.ClusterRole, error) {
-	key := &rbac.ClusterRole{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/rbac/internalversion/clusterrolebinding.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	rbac "k8s.io/kubernetes/pkg/apis/rbac"
@@ -55,8 +54,7 @@ func (s *clusterRoleBindingLister) List(selector labels.Selector) (ret []*rbac.C
 
 // Get retrieves the ClusterRoleBinding from the index for a given name.
 func (s *clusterRoleBindingLister) Get(name string) (*rbac.ClusterRoleBinding, error) {
-	key := &rbac.ClusterRoleBinding{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/scheduling/internalversion/BUILD

@@ -15,7 +15,6 @@ go_library(
     deps = [
         "//pkg/apis/scheduling:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
         "//vendor/k8s.io/client-go/tools/cache:go_default_library",
     ],

pkg/client/listers/scheduling/internalversion/priorityclass.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	scheduling "k8s.io/kubernetes/pkg/apis/scheduling"
@@ -55,8 +54,7 @@ func (s *priorityClassLister) List(selector labels.Selector) (ret []*scheduling.
 
 // Get retrieves the PriorityClass from the index for a given name.
 func (s *priorityClassLister) Get(name string) (*scheduling.PriorityClass, error) {
-	key := &scheduling.PriorityClass{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/client/listers/storage/internalversion/BUILD

@@ -15,7 +15,6 @@ go_library(
     deps = [
         "//pkg/apis/storage:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
         "//vendor/k8s.io/client-go/tools/cache:go_default_library",
     ],

pkg/client/listers/storage/internalversion/storageclass.go

@@ -20,7 +20,6 @@ package internalversion
 
 import (
 	"k8s.io/apimachinery/pkg/api/errors"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/tools/cache"
 	storage "k8s.io/kubernetes/pkg/apis/storage"
@@ -55,8 +54,7 @@ func (s *storageClassLister) List(selector labels.Selector) (ret []*storage.Stor
 
 // Get retrieves the StorageClass from the index for a given name.
 func (s *storageClassLister) Get(name string) (*storage.StorageClass, error) {
-	key := &storage.StorageClass{ObjectMeta: v1.ObjectMeta{Name: name}}
-	obj, exists, err := s.indexer.Get(key)
+	obj, exists, err := s.indexer.GetByKey(name)
 	if err != nil {
 		return nil, err
 	}

pkg/controller/node/node_controller.go

@@ -186,7 +186,6 @@ type Controller struct {
 	cidrAllocator     ipam.CIDRAllocator
 	taintManager      *scheduler.NoExecuteTaintManager
 
-	forcefullyDeletePod        func(*v1.Pod) error
 	nodeExistsInCloudProvider  func(types.NodeName) (bool, error)
 	computeZoneStateFunc       func(nodeConditions []*v1.NodeCondition) (int, ZoneState)
 	enterPartialDisruptionFunc func(nodeNum int) float32
@@ -285,9 +284,6 @@ func NewNodeController(
 		serviceCIDR:            serviceCIDR,
 		allocateNodeCIDRs:      allocateNodeCIDRs,
 		allocatorType:          allocatorType,
-		forcefullyDeletePod: func(p *v1.Pod) error {
-			return util.ForcefullyDeletePod(kubeClient, p)
-		},
 		nodeExistsInCloudProvider: func(nodeName types.NodeName) (bool, error) {
 			return util.NodeExistsInCloudProvider(cloud, nodeName)
 		},

pkg/controller/node/util/controller_utils.go

@@ -129,17 +129,6 @@ func SetPodTerminationReason(kubeClient clientset.Interface, pod *v1.Pod, nodeNa
 	return updatedPod, nil
 }
 
-// ForcefullyDeletePod deletes the pod immediately.
-func ForcefullyDeletePod(c clientset.Interface, pod *v1.Pod) error {
-	var zero int64
-	glog.Infof("NodeController is force deleting Pod: %v:%v", pod.Namespace, pod.Name)
-	err := c.Core().Pods(pod.Namespace).Delete(pod.Name, &metav1.DeleteOptions{GracePeriodSeconds: &zero})
-	if err == nil {
-		glog.V(4).Infof("forceful deletion of %s succeeded", pod.Name)
-	}
-	return err
-}
-
 // ForcefullyDeleteNode deletes the node immediately. The pods on the
 // node are cleaned up by the podGC.
 func ForcefullyDeleteNode(kubeClient clientset.Interface, nodeName string) error {

pkg/controller/podautoscaler/horizontal.go

@@ -88,6 +88,7 @@ func NewHorizontalController(
 
 ) *HorizontalController {
 	broadcaster := record.NewBroadcaster()
+	broadcaster.StartLogging(glog.Infof)
 	// TODO: remove the wrapper when every clients have moved to use the clientset.
 	broadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: evtNamespacer.Events("")})
 	recorder := broadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: "horizontal-pod-autoscaler"})

pkg/controller/route/route_controller.go

@@ -66,8 +66,8 @@ type RouteController struct {
 }
 
 func New(routes cloudprovider.Routes, kubeClient clientset.Interface, nodeInformer coreinformers.NodeInformer, clusterName string, clusterCIDR *net.IPNet) *RouteController {
-	if kubeClient != nil && kubeClient.Core().RESTClient().GetRateLimiter() != nil {
-		metrics.RegisterMetricAndTrackRateLimiterUsage("route_controller", kubeClient.Core().RESTClient().GetRateLimiter())
+	if kubeClient != nil && kubeClient.CoreV1().RESTClient().GetRateLimiter() != nil {
+		metrics.RegisterMetricAndTrackRateLimiterUsage("route_controller", kubeClient.CoreV1().RESTClient().GetRateLimiter())
 	}
 
 	if clusterCIDR == nil {
@@ -75,7 +75,8 @@ func New(routes cloudprovider.Routes, kubeClient clientset.Interface, nodeInform
 	}
 
 	eventBroadcaster := record.NewBroadcaster()
-	recorder := eventBroadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: "route-controller"})
+	eventBroadcaster.StartLogging(glog.Infof)
+	recorder := eventBroadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: "route_controller"})
 
 	rc := &RouteController{
 		routes:           routes,
@@ -114,7 +115,7 @@ func (rc *RouteController) Run(stopCh <-chan struct{}, syncPeriod time.Duration)
 		if err := rc.reconcileNodeRoutes(); err != nil {
 			glog.Errorf("Couldn't reconcile node routes: %v", err)
 		}
-	}, syncPeriod, wait.NeverStop)
+	}, syncPeriod, stopCh)
 
 	<-stopCh
 }
@@ -254,7 +255,7 @@ func (rc *RouteController) updateNetworkingCondition(nodeName types.NodeName, ro
 			glog.Errorf("Error updating node %s: %v", nodeName, err)
 			return err
 		}
-		glog.Errorf("Error updating node %s, retrying: %v", nodeName, err)
+		glog.V(4).Infof("Error updating node %s, retrying: %v", nodeName, err)
 	}
 	glog.Errorf("Error updating node %s: %v", nodeName, err)
 	return err

pkg/controller/service/service_controller.go

@@ -112,6 +112,7 @@ func New(
 	clusterName string,
 ) (*ServiceController, error) {
 	broadcaster := record.NewBroadcaster()
+	broadcaster.StartLogging(glog.Infof)
 	broadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: v1core.New(kubeClient.Core().RESTClient()).Events("")})
 	recorder := broadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: "service-controller"})
 	broadcaster.StartLogging(glog.Infof)

pkg/controller/volume/attachdetach/cache/actual_state_of_world.go

@@ -475,7 +475,6 @@ func (asw *actualStateOfWorld) updateNodeStatusUpdateNeeded(nodeName types.NodeN
 		// should not happen
 		errMsg := fmt.Sprintf("Failed to set statusUpdateNeeded to needed %t because nodeName=%q  does not exist",
 			needed, nodeName)
-		glog.Errorf(errMsg)
 		return fmt.Errorf(errMsg)
 	}
 

pkg/controller/volume/persistentvolume/pv_controller_base.go

@@ -70,6 +70,7 @@ func NewController(p ControllerParameters) (*PersistentVolumeController, error)
 	eventRecorder := p.EventRecorder
 	if eventRecorder == nil {
 		broadcaster := record.NewBroadcaster()
+		broadcaster.StartLogging(glog.Infof)
 		broadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: v1core.New(p.KubeClient.Core().RESTClient()).Events("")})
 		eventRecorder = broadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: "persistentvolume-controller"})
 	}

pkg/kubeapiserver/admission/initializer.go

@@ -17,7 +17,6 @@ limitations under the License.
 package admission
 
 import (
-	"net/http"
 	"net/url"
 
 	"k8s.io/apimachinery/pkg/api/meta"
@@ -71,12 +70,6 @@ type ServiceResolver interface {
 	ResolveEndpoint(namespace, name string) (*url.URL, error)
 }
 
-// WantsProxyTransport defines a fuction that accepts a proxy transport for admission
-// plugins that need to make calls to pods.
-type WantsProxyTransport interface {
-	SetProxyTransport(proxyTransport *http.Transport)
-}
-
 type PluginInitializer struct {
 	internalClient  internalclientset.Interface
 	externalClient  clientset.Interface
@@ -86,9 +79,6 @@ type PluginInitializer struct {
 	restMapper      meta.RESTMapper
 	quotaRegistry   quota.Registry
 	serviceResolver ServiceResolver
-
-	// for proving we are apiserver in call-outs
-	proxyTransport *http.Transport
 }
 
 var _ admission.PluginInitializer = &PluginInitializer{}
@@ -118,12 +108,6 @@ func (i *PluginInitializer) SetServiceResolver(s ServiceResolver) *PluginInitial
 	return i
 }
 
-// SetProxyTransport sets the proxyTransport which is needed by some plugins.
-func (i *PluginInitializer) SetProxyTransport(proxyTransport *http.Transport) *PluginInitializer {
-	i.proxyTransport = proxyTransport
-	return i
-}
-
 // Initialize checks the initialization interfaces implemented by each plugin
 // and provide the appropriate initialization data
 func (i *PluginInitializer) Initialize(plugin admission.Interface) {
@@ -150,8 +134,4 @@ func (i *PluginInitializer) Initialize(plugin admission.Interface) {
 	if wants, ok := plugin.(WantsServiceResolver); ok {
 		wants.SetServiceResolver(i.serviceResolver)
 	}
-
-	if wants, ok := plugin.(WantsProxyTransport); ok {
-		wants.SetProxyTransport(i.proxyTransport)
-	}
 }

pkg/kubectl/cmd/create.go

@@ -23,7 +23,9 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+
 	"k8s.io/kubernetes/pkg/kubectl"
 	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
 	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
@@ -242,7 +244,7 @@ type CreateSubcommandOptions struct {
 
 // RunCreateSubcommand executes a create subcommand using the specified options
 func RunCreateSubcommand(f cmdutil.Factory, cmd *cobra.Command, out io.Writer, options *CreateSubcommandOptions) error {
-	namespace, _, err := f.DefaultNamespace()
+	namespace, nsOverriden, err := f.DefaultNamespace()
 	if err != nil {
 		return err
 	}
@@ -283,6 +285,10 @@ func RunCreateSubcommand(f cmdutil.Factory, cmd *cobra.Command, out io.Writer, o
 		if err != nil {
 			return err
 		}
+	} else {
+		if meta, err := meta.Accessor(obj); err == nil && nsOverriden {
+			meta.SetNamespace(namespace)
+		}
 	}
 
 	if useShortOutput := options.OutputFormat == "name"; useShortOutput || len(options.OutputFormat) == 0 {

pkg/kubectl/cmd/create_secret.go

@@ -169,6 +169,7 @@ func NewCmdCreateSecretDockerRegistry(f cmdutil.Factory, cmdOut io.Writer) *cobr
 	cmd.Flags().String("docker-email", "", i18n.T("Email for Docker registry"))
 	cmd.Flags().String("docker-server", "https://index.docker.io/v1/", i18n.T("Server location for Docker registry"))
 	cmd.Flags().Bool("append-hash", false, "Append a hash of the secret to its name.")
+
 	cmdutil.AddInclude3rdPartyFlags(cmd)
 	return cmd
 }

pkg/kubectl/cmd/create_service.go

@@ -47,13 +47,13 @@ func NewCmdCreateService(f cmdutil.Factory, cmdOut, errOut io.Writer) *cobra.Com
 
 var (
 	serviceClusterIPLong = templates.LongDesc(i18n.T(`
-    Create a clusterIP service with the specified name.`))
+    Create a ClusterIP service with the specified name.`))
 
 	serviceClusterIPExample = templates.Examples(i18n.T(`
-    # Create a new clusterIP service named my-cs
+    # Create a new ClusterIP service named my-cs
     kubectl create service clusterip my-cs --tcp=5678:8080
 
-    # Create a new clusterIP service named my-cs (in headless mode)
+    # Create a new ClusterIP service named my-cs (in headless mode)
     kubectl create service clusterip my-cs --clusterip="None"`))
 )
 
@@ -61,11 +61,11 @@ func addPortFlags(cmd *cobra.Command) {
 	cmd.Flags().StringSlice("tcp", []string{}, "Port pairs can be specified as '<port>:<targetPort>'.")
 }
 
-// NewCmdCreateServiceClusterIP is a command to create a clusterIP service
+// NewCmdCreateServiceClusterIP is a command to create a ClusterIP service
 func NewCmdCreateServiceClusterIP(f cmdutil.Factory, cmdOut io.Writer) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "clusterip NAME [--tcp=<port>:<targetPort>] [--dry-run]",
-		Short:   i18n.T("Create a clusterIP service."),
+		Short:   i18n.T("Create a ClusterIP service."),
 		Long:    serviceClusterIPLong,
 		Example: serviceClusterIPExample,
 		Run: func(cmd *cobra.Command, args []string) {
@@ -86,7 +86,7 @@ func errUnsupportedGenerator(cmd *cobra.Command, generatorName string) error {
 	return cmdutil.UsageErrorf(cmd, "Generator %s not supported. ", generatorName)
 }
 
-// CreateServiceClusterIP implements the behavior to run the create service clusterIP command
+// CreateServiceClusterIP is the implementation of the create service clusterip command
 func CreateServiceClusterIP(f cmdutil.Factory, cmdOut io.Writer, cmd *cobra.Command, args []string) error {
 	name, err := NameFromCommandArgs(cmd, args)
 	if err != nil {
@@ -114,10 +114,10 @@ func CreateServiceClusterIP(f cmdutil.Factory, cmdOut io.Writer, cmd *cobra.Comm
 
 var (
 	serviceNodePortLong = templates.LongDesc(i18n.T(`
-    Create a nodeport service with the specified name.`))
+    Create a NodePort service with the specified name.`))
 
 	serviceNodePortExample = templates.Examples(i18n.T(`
-    # Create a new nodeport service named my-ns
+    # Create a new NodePort service named my-ns
     kubectl create service nodeport my-ns --tcp=5678:8080`))
 )
 
@@ -198,7 +198,7 @@ func NewCmdCreateServiceLoadBalancer(f cmdutil.Factory, cmdOut io.Writer) *cobra
 	return cmd
 }
 
-// CreateServiceLoadBalancer is the implementation of the service loadbalancer command
+// CreateServiceLoadBalancer is the implementation of the create service loadbalancer command
 func CreateServiceLoadBalancer(f cmdutil.Factory, cmdOut io.Writer, cmd *cobra.Command, args []string) error {
 	name, err := NameFromCommandArgs(cmd, args)
 	if err != nil {
@@ -237,7 +237,7 @@ var (
 	kubectl create service externalname my-ns --external-name bar.com`))
 )
 
-// NewCmdCreateServiceExternalName is a macro command for creating a ExternalName service
+// NewCmdCreateServiceExternalName is a macro command for creating an ExternalName service
 func NewCmdCreateServiceExternalName(f cmdutil.Factory, cmdOut io.Writer) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "externalname NAME --external-name external.name [--dry-run]",
@@ -259,7 +259,7 @@ func NewCmdCreateServiceExternalName(f cmdutil.Factory, cmdOut io.Writer) *cobra
 	return cmd
 }
 
-// CreateExternalNameService is the implementation of the service externalname command
+// CreateExternalNameService is the implementation of the create service externalname command
 func CreateExternalNameService(f cmdutil.Factory, cmdOut io.Writer, cmd *cobra.Command, args []string) error {
 	name, err := NameFromCommandArgs(cmd, args)
 	if err != nil {

pkg/kubectl/cmd/expose.go

@@ -98,7 +98,7 @@ func NewCmdExposeService(f cmdutil.Factory, out io.Writer) *cobra.Command {
 	cmd.Flags().String("generator", "service/v2", i18n.T("The name of the API generator to use. There are 2 generators: 'service/v1' and 'service/v2'. The only difference between them is that service port in v1 is named 'default', while it is left unnamed in v2. Default is 'service/v2'."))
 	cmd.Flags().String("protocol", "", i18n.T("The network protocol for the service to be created. Default is 'TCP'."))
 	cmd.Flags().String("port", "", i18n.T("The port that the service should serve on. Copied from the resource being exposed, if unspecified"))
-	cmd.Flags().String("type", "", i18n.T("Type for this service: ClusterIP, NodePort, or LoadBalancer. Default is 'ClusterIP'."))
+	cmd.Flags().String("type", "", i18n.T("Type for this service: ClusterIP, NodePort, LoadBalancer, or ExternalName. Default is 'ClusterIP'."))
 	cmd.Flags().String("load-balancer-ip", "", i18n.T("IP to assign to the Load Balancer. If empty, an ephemeral IP will be created and used (cloud-provider specific)."))
 	cmd.Flags().String("selector", "", i18n.T("A label selector to use for this service. Only equality-based selector requirements are supported. If empty (the default) infer the selector from the replication controller or replica set.)"))
 	cmd.Flags().StringP("labels", "l", "", "Labels to apply to the service created by this call.")

pkg/kubectl/cmd/util/openapi/validation/validation_test.go

@@ -335,4 +335,63 @@ items:
 
 		Expect(err).To(BeNil())
 	})
+
+	It("fails because apiVersion is not provided", func() {
+		err := validator.ValidateBytes([]byte(`
+kind: Pod
+metadata:
+  name: name
+spec:
+  containers:
+  - name: name
+    image: image
+`))
+		Expect(err.Error()).To(Equal("apiVersion not set"))
+	})
+
+	It("fails because apiVersion type is not string and kind is not provided", func() {
+		err := validator.ValidateBytes([]byte(`
+apiVersion: 1
+metadata:
+  name: name
+spec:
+  containers:
+  - name: name
+    image: image
+`))
+		Expect(err.Error()).To(Equal("[apiVersion isn't string type, kind not set]"))
+	})
+
+	It("fails because List first item is missing kind and second item is missing apiVersion", func() {
+		err := validator.ValidateBytes([]byte(`
+apiVersion: v1
+kind: List
+items:
+- apiVersion: v1
+  metadata:
+    name: name
+  spec:
+    replicas: 1
+    template:
+      metadata:
+        labels:
+          name: name
+      spec:
+        containers:
+        - name: name
+          image: image
+- kind: Service
+  metadata:
+    name: name
+  spec:
+    type: NodePort
+    ports:
+    - port: 123
+      targetPort: 1234
+      name: name
+    selector:
+      name: name
+`))
+		Expect(err.Error()).To(Equal("[kind not set, apiVersion not set]"))
+	})
 })

pkg/kubectl/secret_for_docker_registry.go

@@ -141,7 +141,9 @@ func handleDockercfgContent(username, password, email, server string) ([]byte, e
 		Email:    email,
 	}
 
-	dockerCfg := map[string]credentialprovider.DockerConfigEntry{server: dockercfgAuth}
+	dockerCfg := credentialprovider.DockerConfigJson{
+		Auths: map[string]credentialprovider.DockerConfigEntry{server: dockercfgAuth},
+	}
 
 	return json.Marshal(dockerCfg)
 }

pkg/kubectl/secret_for_docker_registry_test.go

@@ -70,7 +70,7 @@ func TestSecretForDockerRegistryGenerate(t *testing.T) {
 			},
 			expected: &api.Secret{
 				ObjectMeta: metav1.ObjectMeta{
-					Name: "foo-gb4kftc655",
+					Name: "foo-94759gc65b",
 				},
 				Data: map[string][]byte{
 					api.DockerConfigKey: secretData,

pkg/kubectl/service.go

@@ -135,7 +135,7 @@ func generate(genericParams map[string]interface{}) (runtime.Object, error) {
 	if portString, found = params["ports"]; !found {
 		portString, found = params["port"]
 		if !found && !isHeadlessService {
-			return nil, fmt.Errorf("'port' is a required parameter.")
+			return nil, fmt.Errorf("'ports' or 'port' is a required parameter.")
 		}
 	}
 

pkg/kubelet/apis/BUILD

@@ -26,7 +26,7 @@ filegroup(
     srcs = [
         ":package-srcs",
         "//pkg/kubelet/apis/cri:all-srcs",
-        "//pkg/kubelet/apis/deviceplugin/v1alpha1:all-srcs",
+        "//pkg/kubelet/apis/deviceplugin/v1alpha:all-srcs",
         "//pkg/kubelet/apis/kubeletconfig:all-srcs",
         "//pkg/kubelet/apis/stats/v1alpha1:all-srcs",
     ],

pkg/kubelet/apis/deviceplugin/v1alpha1/BUILD → pkg/kubelet/apis/deviceplugin/v1alpha/BUILD

@@ -11,7 +11,7 @@ go_library(
         "api.pb.go",
         "constants.go",
     ],
-    importpath = "k8s.io/kubernetes/pkg/kubelet/apis/deviceplugin/v1alpha1",
+    importpath = "k8s.io/kubernetes/pkg/kubelet/apis/deviceplugin/v1alpha",
     deps = [
         "//vendor/github.com/gogo/protobuf/gogoproto:go_default_library",
         "//vendor/github.com/gogo/protobuf/proto:go_default_library",

pkg/kubelet/apis/deviceplugin/v1alpha1/api.proto → pkg/kubelet/apis/deviceplugin/v1alpha/api.proto

@@ -81,25 +81,21 @@ message AllocateRequest {
 	repeated string devicesIDs = 1;
 }
 
+// AllocateResponse includes the artifacts that needs to be injected into
+// a container for accessing 'deviceIDs' that were mentioned as part of
+// 'AllocateRequest'.
 // Failure Handling:
 // if Kubelet sends an allocation request for dev1 and dev2.
 // Allocation on dev1 succeeds but allocation on dev2 fails.
 // The Device plugin should send a ListAndWatch update and fail the
 // Allocation request
 message AllocateResponse {
-	repeated DeviceRuntimeSpec spec = 1;
-}
-
-// The list to be added to the CRI spec
-message DeviceRuntimeSpec {
-	// ID of the Device
-	string ID = 1;
-	// List of environment variable to set in the container.
-	map<string, string> envs = 2;
+  	// List of environment variable to be set in the container to access one of more devices.
+	map<string, string> envs = 1;
 	// Mounts for the container.
-	repeated Mount mounts = 3;
-	// Devices for the container
-	repeated DeviceSpec devices = 4;
+	repeated Mount mounts = 2;
+	// Devices for the container.
+	repeated DeviceSpec devices = 3;
 }
 
 // Mount specifies a host volume to mount into a container.