Automatic merge from submit-queue (batch tested with PRs 48576, 49010)

adding validations on kube-apiserver audit log options

**What this PR does / why we need it**:
The kube-apiserver does not check the validity of the following audit log options `--audit-log-maxage`, `--audit-log-maxage`, `--audit-log-maxage`. If these options are set to negative numbers, the kube-apiserver will not detect these invalid settings. This PR adds validations on these audit log options.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

`NONE`

Automatic merge from submit-queue (batch tested with PRs 48576, 49010)

make externalAdmissionHookConfigurationManager distinguish API disabled error

The externalAdmissionHookConfigurationManager does not return "DisabledErr" even if the API is disabled, so the GenericWebhook admission controller will not fail open.

The GenericWebhook admission controller is default to off, so the bug is hidden in most cases. To be safe, we should cherrypick it to 1.7.

```release-note
Fix a bug where the GenericWebhook admission plugin does not fail open when the admissionregistration API is disabled
```

Automatic merge from submit-queue

[Scheduler] Remove error since err is always nil
Signed-off-by: sakeven <jc5930@sina.cn>



**What this PR does / why we need it**:

No need to log error since err is always nil.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49043, 49001, 49057, 49066, 48102)

Make doc generation on cherry-picks optional

Follow up of https://github.com/kubernetes/kubernetes/pull/46993, xref #44533

Most cherry-picks don't require doc changes, and doing it unconditionally actually breaks picking to the release-1.6 branch

Automatic merge from submit-queue (batch tested with PRs 49043, 49001, 49057, 49066, 48102)

Always use gcr.io/google_containers for side-loaded Docker images

**What this PR does / why we need it**: #45391 changed the behavior for what registry we use in the sideloaded docker images tarfiles shipped with releases. As a result of that change, if `KUBE_DOCKER_REGISTRY` is set to anything other than `gcr.io/google_containers`, clusters will fail to start on GCE (and other places where the side-loaded images are used).

This PR reverts that change in behavior, which I believe was unintentional; we'll always use `gcr.io/google_containers` for the docker image tarfiles, but will tag the images with `$KUBE_DOCKER_REGISTRY` if different.

Also, I'm fixing a small bug in variable names that I introduced in #47939.

Note that with recent changes here and in the release repo, we don't even need to tag with `KUBE_DOCKER_REGISTRY` and `KUBE_DOCKER_IMAGE_TAG`, but that's a more extensive change, and this smaller fix is more suitable for cherry-picking to 1.7.

**Release note**:

```release-note
NONE
```
/release-note-none
/sig release
/assign @david-mcmahon

Automatic merge from submit-queue (batch tested with PRs 49043, 49001, 49057, 49066, 48102)

bootstrap token auth: don't accept deleted tokens

Closes #48345

Same fix as #48343


```release-note
Previously a deleted bootstrapping token secret would be considered valid until it was reaped.  Now it is invalid as soon as the deletionTimestamp is set.
```

cc @luxas @kubernetes/sig-auth-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 49043, 49001, 49057, 49066, 48102)

Explicitly set --cluster-ip-range --clean-start --minStartupPods

ref https://github.com/kubernetes/test-infra/pull/3535 https://github.com/kubernetes/test-infra/pull/3375

Also remove unused `GINKGO_PARALLELISM`

/assign @krzyzacy @ixdy

Automatic merge from submit-queue (batch tested with PRs 49043, 49001, 49057, 49066, 48102)

cluster/gke: If NODE_INSTANCE_GROUP is set, don't execute any bash

Transitional part of kubernetes/test-infra#3307, should be eliminated by kubernetes/test-infra#3330: 
Allow NODE_INSTANCE_GROUP to be set externally from `hack/ginkgo-e2e.sh`, which eliminates any cluster/gke use if KUBERNETES_CONFORMANCE_PROVIDER is set to `gke`.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49019, 48919, 49040, 49018, 48874)

Set default snap channel on charms to 1.7 stable

**What this PR does / why we need it**: This PR sets the default snap channel on charms to 1.7/stable. 
This addresses problems where the the user might want to deploy the charm and get the same kubernetes version found on the bundles.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/305

**Special notes for your reviewer**:

**Release note**:

```Set default snap channel on charms to 1.7/stable
```

Automatic merge from submit-queue (batch tested with PRs 49019, 48919, 49040, 49018, 48874)

kubeadm: Remove the old KubernetesDir envparam

**What this PR does / why we need it**:

The last piece of https://github.com/kubernetes/kubernetes/issues/48053 for moving the env params into the API, and the KubernetesDir into a constant.

After this pretty mechanical change, we might offer short-hand functions in constants like `GetStaticPodManifestDir()` etc easily in order to centralize the `filepath.Join` logic into one place.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
fixes https://github.com/kubernetes/kubeadm/issues/326

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
cc @kubernetes/sig-cluster-lifecycle-pr-reviews @fabriziopandini

Automatic merge from submit-queue (batch tested with PRs 49019, 48919, 49040, 49018, 48874)

Fix if condition in cluster/log-dump/log-dump.sh

Fixes https://github.com/kubernetes/kubernetes/issues/49039

/cc @yujuhong

Automatic merge from submit-queue (batch tested with PRs 49019, 48919, 49040, 49018, 48874)

correcting spell mistake

**What this PR does / why we need it**:
Correcting spell mistake.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
NONE
**Special notes for your reviewer**:
NONE
**Release note**:
NONE
```release-note
```

Automatic merge from submit-queue

kubeadm: Remove some old comments

**What this PR does / why we need it**:

Removes old and outdated comments.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@dmmcquay

Automatic merge from submit-queue

Sanitize test names before using them as namespaces

**What this PR does / why we need it**: It sanitizes upgrade test names before creating namespaces.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #48876

Signed-off-by: huangjiuyuan <jiuyuan.huang@daocloud.io>

Automatic merge from submit-queue (batch tested with PRs 48231, 47377, 48797, 49020, 49033)

prevent unsetting of nonexistent previous port in kubeapi-load-balancer charm

**What this PR does / why we need it**: prevent unsetting of nonexistent previous port in kubeapi-load-balancer charm

**Release note**:
```release-note
prevent unsetting of nonexistent previous port in kubeapi-load-balancer charm
```

Automatic merge from submit-queue (batch tested with PRs 48231, 47377, 48797, 49020, 49033)

Update yaml and json with multi arch test images

**What this PR does / why we need it**:
This PR is for updating the yaml and json files under test/images folder with multi arch images
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```NONE
```

Automatic merge from submit-queue (batch tested with PRs 48231, 47377, 48797, 49020, 49033)

Fix parsing empty CIDR

Fix #48795
Checking ClusterCIDR and ServiceCIDR before parsing them.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 48231, 47377, 48797, 49020, 49033)

Invert .linted_packages into .golint_failures.

See #47370.
cc @cblecker

Automatic merge from submit-queue (batch tested with PRs 48231, 47377, 48797, 49020, 49033)

Migrate kubelet and linked code from clientset_generated to client-go

Ran a script in the kubernetes repo to migrate kubelet and linked code from clientset_generated package imports to client-go imports.

**NOTE:** There are also some manual changes that were made in order to accommodate some
differences between clientset_generated and client-go. The manual changes are isolated into a
single commit titled "Manual changes."

```sh
#! /bin/bash

for file in $(find . \( -name "clientset_generated" -o -name "informers_generated" \) -prune -o -type f -name "*.go"); do

  if [[ -d $file ]]; then
    continue
  fi

  if [[ $file == "./cmd/libs/go2idl/informer-gen/main.go" ]]; then
    continue
  fi

  sed -i '
      s|"k8s.io/kubernetes/pkg/client/clientset_generated/clientset"|clientset "k8s.io/client-go/kubernetes"|;

      # Correct a couple of unique cases.
      s|clientset clientset "k8s.io/client-go/kubernetes"|clientset "k8s.io/client-go/kubernetes"|;
      s|cs clientset "k8s.io/client-go/kubernetes"|clientset "k8s.io/client-go/kubernetes"|;
      s|VersionedClientSetPackage: clientset "k8s.io/client-go/kubernetes"|VersionedClientSetPackage: "k8s.io/client-go/kubernetes"|;

      s|"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/certificates/v1beta1"|"k8s.io/client-go/kubernetes/typed/certificates/v1beta1"|;

      s|"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/core/v1"|"k8s.io/client-go/kubernetes/typed/core/v1"|;

      s|"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/extensions/v1beta1"|"k8s.io/client-go/kubernetes/typed/extensions/v1beta1"|;

      s|"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/autoscaling/v1"|"k8s.io/client-go/kubernetes/typed/autoscaling/v1"|;

      s|"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/authentication/v1"|"k8s.io/client-go/kubernetes/typed/authentication/v1"|;

      s|"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/authorization/v1beta1"|"k8s.io/client-go/kubernetes/typed/authorization/v1beta1"|;

      s|"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/apps/v1beta1"|"k8s.io/client-go/kubernetes/typed/apps/v1beta1"|;

      s|"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/rbac/v1beta1"|"k8s.io/client-go/kubernetes/typed/rbac/v1beta1"|;

      s|"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/fake"|"k8s.io/client-go/kubernetes/fake"|;

      s|"k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/core/v1/fake"|"k8s.io/client-go/kubernetes/typed/core/v1/fake"|;

      s|k8s.io/kubernetes/pkg/client/clientset_generated/clientset|k8s.io/client-go/kubernetes|;



      s|informers "k8s.io/kubernetes/pkg/client/informers/informers_generated/externalversions"|"k8s.io/client-go/informers"|;

      s|"k8s.io/kubernetes/pkg/client/informers/informers_generated/externalversions/core/v1"|"k8s.io/client-go/informers/core/v1"|;

      s|"k8s.io/kubernetes/pkg/client/informers/informers_generated/externalversions/apps/v1beta1"|"k8s.io/client-go/informers/apps/v1beta1"|;

      s|"k8s.io/kubernetes/pkg/client/informers/informers_generated/externalversions/extensions/v1beta1"|"k8s.io/client-go/informers/extensions/v1beta1"|;

      s|"k8s.io/kubernetes/pkg/client/informers/informers_generated/externalversions/batch/v1"|"k8s.io/client-go/informers/batch/v1"|;

      s|"k8s.io/kubernetes/pkg/client/informers/informers_generated/externalversions/autoscaling/v1"|"k8s.io/client-go/informers/autoscaling/v1"|;

      s|"k8s.io/kubernetes/pkg/client/informers/informers_generated/externalversions/policy/v1beta1"|"k8s.io/client-go/informers/policy/v1beta1"|;

      s|"k8s.io/kubernetes/pkg/client/informers/informers_generated/externalversions/certificates/v1beta1"|"k8s.io/client-go/informers/certificates/v1beta1"|;

      s|"k8s.io/kubernetes/pkg/client/informers/informers_generated/externalversions/storage/v1"|"k8s.io/client-go/informers/storage/v1"|;



      s|"k8s.io/kubernetes/pkg/client/listers/core/v1"|"k8s.io/client-go/listers/core/v1"|;

      s|"k8s.io/kubernetes/pkg/client/listers/apps/v1beta1"|"k8s.io/client-go/listers/apps/v1beta1"|;

      s|"k8s.io/kubernetes/pkg/client/listers/extensions/v1beta1"|"k8s.io/client-go/listers/extensions/v1beta1"|;

      s|"k8s.io/kubernetes/pkg/client/listers/autoscaling/v1"|"k8s.io/client-go/listers/autoscaling/v1"|;

      s|"k8s.io/kubernetes/pkg/client/listers/batch/v1"|"k8s.io/client-go/listers/batch/v1"|;

      s|"k8s.io/kubernetes/pkg/client/listers/certificates/v1beta1"|"k8s.io/client-go/listers/certificates/v1beta1"|;

      s|"k8s.io/kubernetes/pkg/client/listers/storage/v1"|"k8s.io/client-go/listers/storage/v1"|;

      s|"k8s.io/kubernetes/pkg/client/listers/policy/v1beta1"|"k8s.io/client-go/listers/policy/v1beta1"|;


  ' $file
done

hack/update-bazel.sh

hack/update-gofmt.sh
```

Automatic merge from submit-queue (batch tested with PRs 49017, 45440, 48384, 45894, 48808)

Make sure that image tags contain only allowed characters.

**What this PR does / why we need it**:
Version strings can contain symbols that are not allowed
as part of image tags. Replace those with underscores.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
Part of work related to usage of CI images which has versions like "v1.8.0-alpha.1.910+5ca03d67" but image tags in registry are "v1.8.0-alpha.1.910_5ca03d67"

Attn @luxas 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49017, 45440, 48384, 45894, 48808)

Export BaseControllerRefManager

**What this PR does / why we need it**:
It exports go struct `baseControllerRefManager`. This is needed so other distributions like OpenShift or TPR controllers can reuse that code for writing ref managers for other objects. 

**Release note**:
It is not worthy of a release note.

Automatic merge from submit-queue (batch tested with PRs 49017, 45440, 48384, 45894, 48808)

Update two dependencies

**What this PR does / why we need it**:
github.com/stretchr/testify - main desired update. Old version has bugs. Specifically I encountered https://github.com/stretchr/testify/issues/347 which was fixed a year ago.

github.com/davecgh/go-spew/spew is set to the newest version, a bit
newer than required by testify. Updated from version 6 Nov 2015 to
27 Jun 2017.

github.com/stretchr/objx is not updated - testify uses version
from 27 May 2014 which is older than 28 Sep 2015 used now (latest
actually). In practice there is only a tiny difference - one method was
removed in new version.

**Release note**:

```release-note
NONE
```
/sig testing

Automatic merge from submit-queue (batch tested with PRs 49017, 45440, 48384, 45894, 48808)

Fix typo in ExecCommandParam

**What this PR does / why we need it**: Makes ExecCommandParam look like all of the other "Param"s

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49017, 45440, 48384, 45894, 48808)

kubeadm: Make kube-proxy tolerate the uninitialized cloud taint

**What this PR does / why we need it**:

This is needed in order to start the cloud-controller-manager successfully. The cloud controller manager should run as a DaemonSet with a nodeSelector for master nodes. The cloud controller manager should run on the hostNetwork to avoid the bootstrap problem when there is no CNI network yet. But the cloud controller manager needs to know how to address the master. It does this by talking to the kubernetes service (e.g. 10.96.0.1). That iptables rule must exist at the time, which now isn't the case when kube-proxy isn't running. kube-proxy isn't running due to that the kubelet is tainted with the external cloud taint.

This PR makes kube-proxy tolerate the cloud taint, so that the cloud controller manager can run easily on kubeadm clusters.

This was found by @prydie, thanks! 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

This should probably be a cherrypick candidate so folks can use kubeadm to easily create external cloud clusters. The change is small and isolated.

cc @wojtek-t 

**Release note**:

```release-note
kubeadm: Make kube-proxy tolerate the external cloud provider taint so that an external cloud provider can be easily used on top of kubeadm
```
cc @kubernetes/sig-cluster-lifecycle-pr-reviews @wlan0 @thockin

Transitional part of kubernetes/test-infra#3307, should be eliminated
by kubernetes/test-infra#3330: Allow NODE_INSTANCE_GROUP to be set
before we get here, which eliminates any cluster/gke use if
KUBERNETES_CONFORMANCE_PROVIDER is set to "gke".

Version strings can contain symbols that are not allowed
as part of image tags. Replace those with underscores.