Automatic merge from submit-queue (batch tested with PRs 43034, 43066)

Fix StatefulSet apps e2e tests

Fixes https://github.com/kubernetes/kubernetes/issues/42490

```release-note
NONE
```

cc @kubernetes/sig-apps-bugs

Automatic merge from submit-queue (batch tested with PRs 43034, 43066)

Allow StatefulSet controller to PATCH Pods.

**What this PR does / why we need it**:

StatefulSet now needs the PATCH permission on Pods since it calls into ControllerRefManager to adopt and release. This adds the permission and the missing e2e test that should have caught this.

**Which issue this PR fixes**:

**Special notes for your reviewer**:

This is based on #42925.

**Release note**:
```release-note
```
cc @kubernetes/sig-apps-pr-reviews

Automatic merge from submit-queue

Add rest of workloads team to test/OWNERS

```release-note
NONE
```

cc @kubernetes/sig-apps-misc

Automatic merge from submit-queue (batch tested with PRs 42942, 42935)

pkg/util/flock: Fix the flock so it actually locks.

With this PR, the second call to `Acquire()` will block unless the lock is released (process exits).
Also removed the memory mutex in the previous code since we don't need `Release()` here so no need to save and protect the local fd.

Fix #42929.

Automatic merge from submit-queue (batch tested with PRs 42942, 42935)

[Bug] Handle container restarts and avoid using runtime pod cache while allocating GPUs

Fixes #42412

**Background**
Support for multiple GPUs is an experimental feature in v1.6. 
Container restarts were handled incorrectly which resulted in stranding of GPUs
Kubelet is incorrectly using runtime cache to track running pods which can result in race conditions (as it did in other parts of kubelet). This can result in same GPU being assigned to multiple pods.

**What does this PR do**
This PR tracks assignment of GPUs to containers and returns pre-allocated GPUs instead of (incorrectly) allocating new GPUs.
GPU manager is updated to consume a list of active pods derived from apiserver cache instead of runtime cache.
Node e2e has been extended to validate this failure scenario.

**Risk**
Minimal/None since support for GPUs is an experimental feature that is turned off by default. The code is also isolated to GPU manager in kubelet.

**Workarounds**
In the absence of this PR, users can mitigate the original issue by setting `RestartPolicyNever`  in their pods.
There is no workaround for the race condition caused by using the runtime cache though.
Hence it is worth including this fix in v1.6.0.

cc @jianzhangbjz @seelam @kubernetes/sig-node-pr-reviews 

Replaces #42560

Also add an e2e test that should have caught this.

Automatic merge from submit-queue

remove dgoodwin and dmmcquay to kubeadm reviewers

@dgoodwin says he needs to work on other stuff right now. @dmmcquay says he wants to help with reviews.

Automatic merge from submit-queue (batch tested with PRs 43022, 43078)

Use constant time compare for bootstrap tokens

This is a subtle security issue that should go in for 1.6 on a new feature (bootstrap tokens).

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 43022, 43078)

Dumb typo in kubeadm instructions

I typo'd chown as chmod in kubeadm instructions.  Ugh.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 42802, 42927, 42669, 42988, 43012)

[Federation] Fix flakey ingress unit test

The unit test for the ingress controller was previously adding a cluster twice, which resulted in a cluster being deleted and added back.  The deletion was racing the controller shutdown to close
informer channels, sometimes resulting in closing an already closed channel.  This change ensures that the federated informer clears its map of informers when ``Stop()`` is called to insure against a double close, and fixes the test to no longer add the cluster twice.

Targets #43009

cc: @csbell @kubernetes/sig-federation-bugs

Automatic merge from submit-queue (batch tested with PRs 42802, 42927, 42669, 42988, 43012)

Update Cluster Autoscaler entrypoint

**What this PR does / why we need it**:
Update Cluster Autoscaler manifest file to use new shell wrapper instead of directly calling CA binary (the wrapper is already included in current CA image). 
Add params to improve logging.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 42802, 42927, 42669, 42988, 43012)

update to latest version of coreos/go-oidc

Includes updates that enable OIDC with OKTA as a IDP



**What this PR does / why we need it**:
Updates to the latest version of coreos/go-oidc

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes # TBD

**Special notes for your reviewer**:
Updates coreos/go-oidc module to include fixes for https://github.com/coreos/go-oidc/issues/137 which prevent OKTA being used as an IDP
**Release note**:

```release-note
NONE
```

cc:/ @ericchiang

Automatic merge from submit-queue (batch tested with PRs 42802, 42927, 42669, 42988, 43012)

Fix kubelet panic in cgroup manager.

Fixes https://github.com/kubernetes/kubernetes/issues/42920.
Fixes https://github.com/kubernetes/kubernetes/issues/42875
Fixes #42927 
Fixes #43059

Check the error in walk function, so that we don't use info when there is an error.

@yujuhong @dchen1107 @derekwaynecarr @vishh /cc @kubernetes/sig-node-bugs

Automatic merge from submit-queue (batch tested with PRs 42802, 42927, 42669, 42988, 43012)

Fix typo in kubedns-controller.yaml.sed

cc @MrHohn

Signed-off-by: Joe Beda <joe.github@bedafamily.com>

Automatic merge from submit-queue

Fix v0.0.0 in kubectl built from master

Fixes https://github.com/kubernetes/kubernetes/issues/40813

Signed-off-by: Joe Beda <joe.github@bedafamily.com>

With this PR, the second call to `Acquire()` will block unless the lock is released (process exits).
Also removed the memory mutex in the previous code since we don't need `Release()` here so no need to save and protect the local fd.

Fix #42929.

Automatic merge from submit-queue

Allow DaemonSet controller to PATCH pods, and add more steps and logs in DaemonSet pods adoption e2e test

DaemonSet pods adoption failed because DS controller aren't allowed to patch pods when claiming pods. 

[Edit] This PR fixes #42908 by modifying RBAC to allow DaemonSet controllers to patch pods, as well as adding more logs and steps to the original e2e test to make debugging easier. 

Tested locally with a local cluster and GCE cluster. 
@kargakis @lukaszo @kubernetes/sig-apps-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 42940, 42906, 42970, 42848)

Enable RollingUpdates for the fluentd daemonset addon

In anticipation of needing to rev fluentd-gcp image versions in patch releases, we should enable rolling update so the new versions get rolled out in a timely manner.

/cc @ixdy

Automatic merge from submit-queue (batch tested with PRs 42940, 42906, 42970, 42848)

Improve kubeadm init message

Now that we are locking down the insecure port, we should give clearer instructions on how to copy out the root owned admin.conf file, chmod it and use it.
Signed-off-by: Joe Beda <joe.github@bedafamily.com>

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 42940, 42906, 42970, 42848)

Move node and event observer helpers to e2e/common

**What this PR does / why we need it**:

Moves existing test helper functions in OIR e2e tests to `test/e2e/common`. These functions wrap informers to help test writers to observe events instead of long-polling for status updates.

For usage examples, see `test/e2e/opaque_resource.go`.

cc @kubernetes/sig-scheduling-misc

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 42940, 42906, 42970, 42848)

Increase timeout for the orphan e2e test

Fix #42086.

Analysis of test logs are in https://github.com/kubernetes/kubernetes/issues/42086#issuecomment-285770868 and the following comments.

@deads2k PTAL, thanks!

The unit test for the ingress controller was previously adding
a cluster twice, which resulted in a cluster being deleted and added
back.  The deletion was racing the controller shutdown to close
informer channels.  This change ensures that the informer clears its
map of informers when Stop() is called to prevent a double close, and
that the test no longer adds the cluster twice.

Signed-off-by: Vishnu kannan <vishnuk@google.com>

Signed-off-by: Vishnu kannan <vishnuk@google.com>

Signed-off-by: Vishnu kannan <vishnuk@google.com>

Signed-off-by: Vishnu Kannan <vishnuk@google.com>

Automatic merge from submit-queue

Add fabianofranz as approver for test/e2e/kubectl.go

Adding myself as approver for `kubectl` end-to-end tests.

```release-note
NONE
```

Automatic merge from submit-queue

Fixed incorrect result of getMinTolerationTime.

For the following case, `getMinTolerationTime` should return one; but  it returned -1 ：
1. for tolerations[0], TolerationSeconds is nil, minTolerationTime is not set 
2. for tolerations[1], it's TolerationSeconds (1) is bigger than `minTolerationTime`, so minTolerationTime is still -1 which means infinite.

```
+		{
+			tolerations: []v1.Toleration{
+				{
+					TolerationSeconds: nil,
+				},
+				{
+					TolerationSeconds: &one,
+				},
+			},
+		},
```

Automatic merge from submit-queue

Add pkg/printers OWNERS

Should also include more sig-api-machinery as this will be moving to server side