Automatic merge from submit-queue

Implement Stackdriver Logging e2e tests using PubSub

Makes tests faster and mitigates Stackdriver Logging quotas issue.

Fixes https://github.com/kubernetes/kubernetes/issues/47069

Automatic merge from submit-queue

Add logging to debug conflicts in kubemark-scale test

Ref #46851

Automatic merge from submit-queue

Fix flaky cluster-autoscaler e2e

Ref: https://github.com/kubernetes/autoscaler/issues/89

Add pdb to allow cluster-autoscaler to drain nodes with some kube-system components (turns out there can be enough of them to deny scale-down even with 5 healthy nodes). Increased scaleDownTimeout to take into account the time it will take to re-schedule pods running on broken node (this may reset scale-down timer).

Automatic merge from submit-queue

Turn off the alpha features by default

Fix https://github.com/kubernetes/kubernetes/issues/47687.

@liggitt @sttts do you know if it's intentional to turn on rbac v1alpha1?

```release-note
The following alpha API groups were unintentionally enabled by default in previous releases, and will no longer be enabled by default in v1.8:
rbac.authorization.k8s.io/v1alpha1
settings.k8s.io/v1alpha1
If you wish to continue using them in v1.8, please enable them explicitly using the `--runtime-config` flag of the apiserver (for example, `--runtime-config="rbac.authorization.k8s.io/v1alpha1,settings.k8s.io/v1alpha1"`)
```

Automatic merge from submit-queue (batch tested with PRs 47530, 47679)

Fix failing CassandraStatefulSet test in examples suite

Fix part of: https://github.com/kubernetes/kubernetes/issues/45677

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 47530, 47679)

Use cos-stable-59-9460-64-0 instead of cos-beta-59-9460-20-0.

Remove dead code that has now moved to another repo as part of #47467

**Release note**:
```release-note
NONE
```

/sig node

Automatic merge from submit-queue (batch tested with PRs 47626, 47674, 47683, 47290, 47688)

add admissionregistration to the list

Fix https://github.com/kubernetes/kubernetes/issues/47686

The bug is introduced by https://github.com/kubernetes/kubernetes/pull/46800

Any suggestion on how to write a unit test? Or don't bother because the hardcoded list will be gone soon after 1.7?

Automatic merge from submit-queue (batch tested with PRs 47626, 47674, 47683, 47290, 47688)

validate host paths on the kubelet for backsteps

**What this PR does / why we need it**:

This PR adds validation on the kubelet to ensure the host path does not contain backsteps that could allow the volume to escape the PSP's allowed host paths. Currently, there is validation done at in API server; however, that does not account for mismatch of OS's on the kubelet vs api server. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47107

**Special notes for your reviewer**:

cc @liggitt

**Release note**:


```release-note
Paths containing backsteps (for example, "../bar") are no longer allowed in hostPath volume paths, or in volumeMount subpaths
```

Automatic merge from submit-queue (batch tested with PRs 47626, 47674, 47683, 47290, 47688)

Use echoserver:1.6 for better debugging and XSS prevention.

**What this PR does / why we need it**: This updates our test code to use a newer echoserver with XSS preventions.

**Which issue this PR fixes**: fixes #47682

**Special notes for your reviewer**: Marking as 1.7 since it's a fix to test code.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 47626, 47674, 47683, 47290, 47688)

Fix Juju kubernetes-master idle status never being set

**What this PR does / why we need it**:

This fixes a problem with the kubernetes-master charm where the "Kubernetes master running." status message never gets set.

This happens because the `kube-api-endpoint.connected` state that it's waiting for doesn't exist. The state we need is `kube-api-endpoint.available` as seen [here](https://github.com/juju-solutions/interface-http/blob/master/provides.py#L12).

Additionally, we need to add the relation arguments to idle_status so it doesn't break when called.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47676

**Special notes for your reviewer**:

**Release note**:

```release-note
Fix Juju kubernetes-master idle status never being set
```

Automatic merge from submit-queue (batch tested with PRs 47626, 47674, 47683, 47290, 47688)

The KUBE-METADATA-SERVER firewall must be applied before the universa…

…l tcp ACCEPT



**What this PR does / why we need it**: the metadata firewall rule was broken by being appended after the universal tcp accept.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

Remove retry logic in initializer AC's config loader

A piece of https://github.com/kubernetes/features/issues/209. A follow-up of https://github.com/kubernetes/kubernetes/pull/46808.

Automatic merge from submit-queue (batch tested with PRs 38751, 44282, 46382, 47603, 47606)

Working on fixing #43716.

This will create the necessary certificates.
On GCE is will upload those certificates to Metadata.
They are then pulled down on to the kube-apiserver.
They are written to the /etc/src/kubernetes/pki directory.
Finally they are loaded vi the appropriate command line flags.
The requestheader-client-ca-file can be seen by running the following:-
kubectl get ConfigMap extension-apiserver-authentication
--namespace=kube-system -o yaml
Minor bug fixes.
Made sure AGGR_MASTER_NAME is set up in all configs.
Clean up variable names.
Added additional requestheader configuration parameters.
Added check so that if there is no Aggregator CA contents we won't start
the aggregator with the relevant flags.

**What this PR does / why we need it**:
This PR creates a request header CA. It also creates a proxy client cert/key pair.
It causes these files to end up on kube-apiserver and set the CLI flags so they are properly loaded.
Without it the customer either has to set them up themselves or re-use the master CA which is a security vulnerability.
Currently this creates everything on GCE.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #43716

**Special notes for your reviewer**:
This is a reapply of pull/47094 with the GKE issue resolved.

**Release note**: None

Automatic merge from submit-queue (batch tested with PRs 38751, 44282, 46382, 47603, 47606)

Add files specified in the kube config as a potential source of cert/…

Fixes #47208

Add files specified in the kube config as a potential source of cert/key data.

Without this change, the kubelet won't use certificates that are specified using file paths in the kubeconfig file. This specifically affects GCE clusters started with kube-up.sh with the RotateKubelet*Certificate feature gate flags enabled, but may affect other configurations.

This change only affects feature gated alpha code.

Automatic merge from submit-queue (batch tested with PRs 38751, 44282, 46382, 47603, 47606)

Adding 'flexvolume' prefix to FlexVolume plugin names.

**What this PR does / why we need it**: Adds a prefix to FlexVolume plugin names in order to more easily identify plugins as FlexVolume. Improves debugging.

**Special notes for your reviewer**: Unfortunately the delimiter after 'flexvolume' is restricted to either '-' or '.' . This makes the prefix seem like it's part of the vendor name. Not sure if this could cause issues later on.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 38751, 44282, 46382, 47603, 47606)

kubectl logs with label selector supports specifying a container name

**What this PR does / why we need it**:
Allows `kubectl logs` to take both a label selector and container name.  This allows me to fetch logs from pods by selector whose pods have multiple containers with a common name.  This is a common action when debugging components like the service-catalog that ship more than one container in their pod.  With this change, the following command lets me get logs for service-catalog.

```
$ kubectl logs -l app=sc-catalog-apiserver --namespace=service-catalog --container=apiserver
```

Automatic merge from submit-queue

Raise a warning instead of info if br-netfilter is missing or unset

Took quite a while to figure out why service VIP is unreachable on my cluster. It turns out br-nf-call-iptables is unset. I wish this message could be a warning to attract considerable attention.

Automatic merge from submit-queue

Fix cross-repo link

Fixing https://github.com/kubernetes/kubernetes/issues/47211

Fix hardcoded CIDR in the validation_test

Automatic merge from submit-queue

clientgo/examples: add ToC for examples

Also add authenticate- prefix to auth samples. This patch could use some
improvement explaining workqueue and TPR examples as I'm not entirely sure.

/assign @caesarxuchao
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>

CHANGELOG: Add known issue for GLBC Health Check overwrite.

- It contains a fix for ipaliasing.
- It contains a fix which decouples GPU driver installation from kernel
version.

Remove dead code that has now moved to another repo as part of #47467

Fixes #47107

Automatic merge from submit-queue

Fix api description

**What this PR does / why we need it**:
prefered ->  preferred
the the ->  the

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46884, 47557)

Rename DaemonSet and StatefulSet hash label

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47554

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/assign @kow3ns 
/cc @bgrant0607 
@kubernetes/sig-apps-api-reviews

Automatic merge from submit-queue (batch tested with PRs 46884, 47557)

Auto approve kubelet server certificate signing requests.

Fixes https://github.com/kubernetes/kubernetes/issues/47208

**Release note**:
```release-note
Adds an approval work flow to the the certificate approver that will approve certificate signing requests from kubelets that meet all the criteria of kubelet server certificates.
```

Automatic merge from submit-queue

fix --local flag for kubectl commands

Fixes https://github.com/kubernetes/kubernetes/issues/47079

**Release note**:
```release-note
NONE
```

Fixes the `--local` flag for `kubectl set ...` sub-commands.
**As of the 1.7 release**, `PrinterForCommand` was updated to [use a mapper and typer for unstructured objects](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubectl/cmd/util/factory_builder.go#L52), which further prevented the use of `--local` when there was no connection to an api server.


**before** (with no connection to a server)
```
$ kubectl set resources -f pod.json --limits=cpu=200m,memory=512Mi --local
error: unable to connect to a server to handle "pods": Get https://10.13.137.149:8443/api: dial tcp 10.13.137.149:8443: getsockopt: connection refused
```

**after** (with no connection to a server)
```
$ kubectl set resources -f pod.json --limits=cpu=200m,memory=512Mi --local
NAME              READY     STATUS    RESTARTS   AGE
mypod   0/1                 0          <unknown>
```

cc @smarterclayton @fabianofranz

Automatic merge from submit-queue

Fixed e2e test flake - ClusterDns - should create pod that uses dns

**What this PR does / why we need it**:
String replaced in this test for example pod yaml (dns-frontend-pod.yaml) file is incorrect.

**Which issue this PR fixes** :
fixes #45915

Automatic merge from submit-queue

Add some debug info for deployment e2e testing

Add some debug info to printout all the ReplicaSets if there is no deployment object created, and add a enhancement to wait the pod to ready
**Release note**:
```
None
```