Signed-off-by: sakeven <jc5930@sina.cn>

Automatic merge from submit-queue

apiextensions: validation for customresources

- [x] Add types for validation of CustomResources
- [x] Fix conversion-gen: #49747
- [x] Fix defaulter-gen: kubernetes/gengo#61
- [x] Convert to OpenAPI types
- [x] Validate CR using go-openapi
- [x] Validate CRD Schema
- [x] Add integration tests
- [x] Fix round trip tests: #51204 
- [x] Add custom fuzzer functions
- [x] Add custom conversion functions
- [x] Fix data race while updating CRD: #50098 
- [x] Add feature gate for CustomResourceValidation
- [x] Fix protobuf generation

Proposal: https://github.com/kubernetes/community/pull/708
Additional discussion: https://github.com/kubernetes/kubernetes/issues/49879, https://github.com/kubernetes/kubernetes/pull/50625

**Release note**:

```release-note
Add validation for CustomResources via JSON Schema.
```

/cc @sttts @deads2k

Correct default cluster-ip-range subnet

Automatic merge from submit-queue

Add Google cloud KMS service for envelope encryption transformer

This adds the required pieces which will allow addition of KMS based encryption providers (envelope transformer).

For now, we will be implementing it using Google Cloud KMS, but the code should make it easy to add support for any other such provider which can expose Decrypt and Encrypt calls.

Writing tests for Google Cloud KMS Service may cause a significant overhead to the testing framework. It has been tested locally and on GKE though.

Upcoming after this PR:
* Complete implementation of the envelope transformer, which uses LRU cache to maintain decrypted DEKs in memory.
* Track key version to assist in data re-encryption after a KEK rotation.

Development branch containing the changes described above: https://github.com/sakshamsharma/kubernetes/pull/4

Envelope transformer used by this PR was merged in #49350 

Concerns #48522 

Planned configuration:
```
kind: EncryptionConfig
apiVersion: v1
resources:
  - resources:
    - secrets
    providers:
    - kms:
        cachesize: 100
        configfile: gcp-cloudkms.conf
        name: gcp-cloudkms
    - identity: {}
```

gcp-cloudkms.conf:
```
[GoogleCloudKMS]
    kms-location: global
    kms-keyring: google-container-engine
    kms-cryptokey: example-key
```

Automatic merge from submit-queue (batch tested with PRs 51298, 51510, 51511)

modifying the comment of BeforeDelete function to improve readability

**What this PR does / why we need it**:
modifying the comment of `BeforeDelete` function in `staging/src/k8s.io/apiserver/pkg/registry/rest/delete.go` to improve readability.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

`NONE`

Automatic merge from submit-queue (batch tested with PRs 51298, 51510, 51511)

Add some periods in cloud controller manager's options

Add some periods in cloud controller manager's options

Automatic merge from submit-queue (batch tested with PRs 51298, 51510, 51511)

GCE: Add a fake forwarding rule service

Also add more methods to the address service.  These
will be used for testing soon.

update feature gates for generic apiserver

Add apiextensions-apiserver features to golint_failures

Ignore alpha feature if gate is disabled

Update test schema

Add polling for TestCRValidationOnCRDUpdate

Add tests for forbidden fields

Enable featureGate for CustomResourceValidation

* convert our types to openAPI types
* update strategy to include crd
* use strategy to validate customresource
* add helper funcs
* Fix conversion of empty ref field
* add validation for forbidden fields
* add defaulting for schema field
* Validate CRD Schema

update generated proto

Remove protobuf generation because of the interface type

Add custom fuzzer funcs

Add custom marshalling

Add custom conversion functions

move jsonschema types to separate file

Automatic merge from submit-queue (batch tested with PRs 44719, 48454)

check job ActiveDeadlineSeconds

**What this PR does / why we need it**:

enqueue a sync task after ActiveDeadlineSeconds

**Which issue this PR fixes** *: 

fixes #32149

**Special notes for your reviewer**:

**Release note**:

```release-note
enqueue a sync task to wake up jobcontroller to check job ActiveDeadlineSeconds in time
```

Automatic merge from submit-queue (batch tested with PRs 44719, 48454)

Fix handling of APIserver errors when saving provisioned PVs.

When API server crashes *after* saving a provisioned PV and before sending
200 OK, the controller tries to save the PV again. In this case, it gets
AlreadyExists error, which should be interpreted as success and not as error.

Especially, a volume that corresponds to the PV should not be deleted in the
underlying storage.

Fixes #44372

```release-note
NONE
```

@kubernetes/sig-storage-pr-reviews

Automatic merge from submit-queue

Added an end-to-end test ensuring that Cluster Autoscaler does not scale up when all pending pods are unschedulable

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51425, 51404, 51459, 51504, 51488)

simplify Run in controllermanager.go

**What this PR does / why we need it**:
remove part of code in controllermanager.go to createclient,createRecorder,startHTTP function

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 51425, 51404, 51459, 51504, 51488)

fixing package comment of v1

**What this PR does / why we need it**:
fixing package comment of v1 in `staging/src/k8s.io/apimachinery/pkg/apis/meta/v1/types.go`.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

`NONE`

Automatic merge from submit-queue (batch tested with PRs 51425, 51404, 51459, 51504, 51488)

Use glog instaed of fmt.Printf
Signed-off-by: sakeven <jc5930@sina.cn>



**What this PR does / why we need it**:

The log `fmt.Printf` produces  is inconsistent with `glog`.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51425, 51404, 51459, 51504, 51488)

Admit NoNewPrivs for remote and rkt runtimes

**What this PR does / why we need it**:

#51347 is aiming to admit NoNewPrivis for remote container runtime, but it didn't actually solve the problem. See @miaoyq 's comments [here](https://github.com/kubernetes/kubernetes/pull/51347#discussion_r135379446).

This PR always admit NoNewPrivs for runtimes except docker, which should fix the problem.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 

Fixes #51319.

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51425, 51404, 51459, 51504, 51488)

Remove previous local storage resource name 'scratch" and "overlay"

Remove previous local storage resource name 'scratch" and "overlay"

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:  part of #50818

**Special notes for your reviewer**:
Now local ephemeral storage resource name is "ResourceEphemeralStorage",  remove previous names as @vishh  suggested in PR #51070

**Release note**:
```release-note
Remove previous local ephemeral storage resource names: "ResourceStorageOverlay" and "ResourceStorageScratch"
```

Automatic merge from submit-queue (batch tested with PRs 50919, 51410, 50099, 51300, 50296)

Add `retainKeys` to patchStrategy for v1 Volumes and extentions/v1beta1 DeploymentStrategy

Add `retainKeys` to patchStrategy for v1 Volumes and extentions/v1beta1 DeploymentStrategy.

With the new value in `patchStrategy`, the patch will include an optional directive that will tell the apiserver to clear defaulted fields and update. This will resolve issue like https://github.com/kubernetes/kubernetes/issues/34292#issue-181572469 and similar issue caused by defaulting in volume.

The change is [backward compatible](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/add-new-patchStrategy-to-clear-fields-not-present-in-patch.md#version-skew).

The proposal for this new patch strategy is in https://github.com/kubernetes/community/blob/master/contributors/design-proposals/add-new-patchStrategy-to-clear-fields-not-present-in-patch.md

The implementation to support the new patch strategy's logic is in #44597 and has been merged in 1.7.

```release-note
Add `retainKeys` to patchStrategy for v1 Volumes and extentions/v1beta1 DeploymentStrategy.
```

/assign @apelisse 
/assign @janetkuo for deployment change
/assign @saad-ali for volume change

Automatic merge from submit-queue (batch tested with PRs 50919, 51410, 50099, 51300, 50296)

Remove failure policy from initializer configuration

A few reasons:
* Implementing fail open initializers increases complexity a lot
* We haven't seen strong use cases
* We can always add it back

Automatic merge from submit-queue (batch tested with PRs 50919, 51410, 50099, 51300, 50296)

Remove failure check from deployment controller

@kubernetes/sig-apps-pr-reviews this check is useless w/o automatic rollback so I am removing it.

Automatic merge from submit-queue (batch tested with PRs 50919, 51410, 50099, 51300, 50296)

GCE: Read networkProjectID param

Fixes #48515 

/assign bowei

The first commit is the original PR cherrypicked. The master's kubelet isn't provided a cloud config path, so the project is retrieved via instance metadata. In the GKE case, this project cannot be retrieved by the master and caused an error.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 50919, 51410, 50099, 51300, 50296)

Take mount options to GA by adding PV.spec.mountOptions

**What this PR does / why we need it**: Implements https://github.com/kubernetes/community/pull/771

issue: https://github.com/kubernetes/features/issues/168

**Special notes for your reviewer**:

TODO:
- ~StorageClass mountOptions~

As described in proposal, this adds PV.spec.mountOptions + mountOptions parameter to every plugin that is both provisionable & supports mount options.

(personally, even having done all the work already, i don't agree w/ the proposal that mountOptions should be SC parameter but... :))

**Release note**:

```release-note
Add mount options field to PersistentVolume spec
```

Renamed ClusterSize and WaitForClusterSize to NumberOfReadyNodes and WaitForReadyNodes, respectively.

Added an end-to-end test ensuring that Cluster Autoscaler does not scale up when all pending pods are unschedulable.

Automatic merge from submit-queue (batch tested with PRs 51471, 50561, 50435, 51473, 51436)

Feature gate initializers field

The metadata.initializers field should be feature gated and disabled by default while in alpha, especially since enforcement of initializer permission that keeps users from submitting objects with their own initializers specified is done via an admission plugin most clusters do not enable yet.

Not gating the field and tests caused tests added in https://github.com/kubernetes/kubernetes/issues/51429 to fail on clusters that don't enable the admission plugin.

This PR:
* adds an `Initializers` feature gate, auto-enables the feature gate if the admission plugin is enabled
* clears the `metadata.initializers` field of objects on create/update if the feature gate is not set
* marks the e2e tests as feature-dependent (will follow up with PR to test-infra to enable the feature and opt in for GCE e2e tests)

```release-note
Use of the alpha initializers feature now requires enabling the `Initializers` feature gate. This feature gate is auto-enabled if the `Initialzers` admission plugin is enabled.
```

Automatic merge from submit-queue (batch tested with PRs 51471, 50561, 50435, 51473, 51436)

Fix inconsistent Prometheus cAdvisor metrics

**What this PR does / why we need it**:

We need this because otherwise kubelet is exposing different sets of Prometheus metrics that randomly include or do not include containers.

See also https://github.com/google/cadvisor/issues/1704; quoting here:

Prometheus requires that all metrics in the same family have the same labels, so we arrange to supply blank strings for missing labels

The function `containerPrometheusLabels()` conditionally adds various metric labels from container labels - pod name, image, etc. However, when it receives the metrics, Prometheus [checks](https://github.com/prometheus/client_golang/blob/master/prometheus/registry.go#L665) that all metrics in the same family have the same label set, and [rejects](https://github.com/prometheus/client_golang/blob/master/prometheus/registry.go#L497) those that do not.

Since containers are collected in (somewhat) random order, depending on which kind is seen first you get one set of metrics or the other.

Changing the container labels function to always add the same set of labels, adding `""` when it doesn't have a real value, eliminates the issue in my testing.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Fixes #50151

**Special notes for your reviewer**:

I have made the same fix in two places.  I am 98% sure the one in `cadvisor_linux.go` isn't used and indeed cannot be used, but have not gone fully down that rabbit-hole.

**Release note**:
```release-note
Fix inconsistent Prometheus cAdvisor metrics
```

Automatic merge from submit-queue (batch tested with PRs 51471, 50561, 50435, 51473, 51436)

Add local storage to downwards API

**Release note**:
```release-note
Add local ephemeral storage to downward API 
```


/assign @NickrenREN

Automatic merge from submit-queue (batch tested with PRs 51471, 50561, 50435, 51473, 51436)

Allow zsh completion to be autoloaded by compinit

**What this PR does / why we need it**:
Allows the kubectl zsh autocompletion to be auto loaded by compinit. Had to move the the boilerplate down into the specific shell functions as the compdef needs to be the first line in the definition file.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #50560

**Special notes for your reviewer**:

**Release note**:

```release-note
kubectl zsh autocompletion will work with compinit
```

Automatic merge from submit-queue (batch tested with PRs 51471, 50561, 50435, 51473, 51436)

Fix `gcloud compute instance-groups managed list` call

**What this PR does / why we need it**: gcloud 168.0.0 makes the `gcloud compute instance-groups managed list --format='value(instanceGroup)'` call return a URL instead of just the name, which is causing `list-instances` to fail. Switching to `--format='value(name)'` seems to restore the old behavior.

x-ref #49673 

**Release note**:

```release-note
NONE
```

/cc @wojtek-t @mwielgus @shyamjvs @jiayingz @mindprince

Automatic merge from submit-queue (batch tested with PRs 50932, 49610, 51312, 51415, 50705)

Allow running kube-proxy as a DaemonSet when using kube-up.sh on GCE

**What this PR does / why we need it**:
From #23225, this PR adds an option for user to run kube-proxy as a DaemonSet instead of static pods using GCE startup scripts. By default, kube-proxy will run as static pods.

This is the first step for moving kube-proxy into a DaemonSet in GCE, remaining tasks will be tracked on #23225.

**Special notes for your reviewer**:
The last commit are purely for testing out kube-proxy as daemonset via CIs.

cc @kubernetes/sig-network-misc @kubernetes/sig-cluster-lifecycle-misc 

**Release note**:

```release-note
When using kube-up.sh on GCE, user could set env `KUBE_PROXY_DAEMONSET=true` to run kube-proxy as a DaemonSet. kube-proxy is run as static pods by default.
```