Automatic merge from submit-queue

kube-apiextensions-server: Fix potential SEGV with null delegate handler

**What this PR does / why we need it**:
In the kube-apiextensions-server there is a fallback value for `null` delegate to `http.NotFoundHandler()` in handling group and versions discovery, but no fallback for custom resources endpoint.
It leads to SEGV when running with `genericapiserver.EmptyDelegate`.

Automatic merge from submit-queue

Fix discovery version for autoscaling to be v1

The order of the storage setup blocks in the setup for the autoscaling
API group was accidentally inverted, meaning that if the v2alpha1 API
group was turned on, it would be set to the preferred API group-version
for discovery.

This was unintentional; the latest stable version should (v1) should be
preferred instead.

**Release note**:
```release-note
Ensure that autoscaling/v1 is the preferred version for API discovery when autoscaling/v2alpha1 is enabled.
```

Automatic merge from submit-queue

[Federation] Fix federated service reconcilation issue due to addition of External…

…TrafficPolicy field to v1.Service

**What this PR does / why we need it**:
New fields (ExternalTrafficPolicy) are introduced to v1.Service by this PR #41162. If this field is not specified in service spec, the service controller will assign default and updates the service spec.
In federation, the service spec is not updated and we continuously try to reconcile as the federated service and the service in federated cluster do not match.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #45795


**Special notes for your reviewer**:

**Release note**:
```
NONE
```

cc @kubernetes/sig-federation-bugs @madhusudancs

Automatic merge from submit-queue

util/iptables: fix cross-build failures due to syscall.Flock()

Fixes: https://github.com/kubernetes/kubernetes/issues/45554
Related: https://github.com/kubernetes/kubernetes/pull/44895

@luxas @k82cn @danwinship

Fix federated service reconcilation issue due to addition of ExternalTrafficPolicy field to v1.Service

Fixes: https://github.com/kubernetes/kubernetes/issues/45554

Automatic merge from submit-queue

use StringArrayVar for ResourceName

ref to https://github.com/kubernetes/kubernetes/pull/43903

```release-note
`kubectl create role` and `kubectl create clusterrole` no longer allow specifying multiple resource names as comma-separated arguments. Use repeated `--resource-name` arguments to specify multiple resource names. 
```

Automatic merge from submit-queue

Adding missing verify-*.sh scripts for autogenerated federation docs

Fixes https://github.com/kubernetes/kubernetes/issues/41866

Automatic merge from submit-queue

Add plural name for CustomResources example

**What this PR does / why we need it**: Adds plural name for CustomResources example.

There is no field called `name` for CustomResources. Instead it is `plural`. This will also fail validation (https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/kube-apiextensions-server/pkg/apis/apiextensions/validation/validation.go#L33) while executing the instructions mentioned here: https://github.com/kubernetes/kubernetes/issues/45510.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:

**Special notes for your reviewer**:

**Release note**:

```
NONE
```
@sttts

Automatic merge from submit-queue

Add support for continuous testing of GPU node e2es in GCP.

This PR adds support for testing Nvidia GPUs on Ubuntu 14.04 base image.

Signed-off-by: Vishnu kannan <vishnuk@google.com>

Automatic merge from submit-queue

Add LogPath for container status in CRI

In order to get log path of container from CRI runtime, we need to add `LogPath` to `ContainerStatus` in CRI.
@Random-Liu @feiskyer

Signed-off-by: heartlock <21521209@zju.edu.cn>

Signed-off-by: heartlock <21521209@zju.edu.cn>

Automatic merge from submit-queue (batch tested with PRs 42759, 45553)

Allow certificate manager to be initialized with client.

Add test coverage to the certificate manager covering the initialization
scenario where it is initialized with no Certificate Request Signing
client, then the client is added later. This matches how it will be used
when the Certificate Request Signing client is also the consumer of the
certificate manager.

Automatic merge from submit-queue

Reorganize kubelet tree so apis can be independently versioned

@yujuhong @lavalamp @thockin @bgrant0607 
This is an example of how we might reorganize `pkg/kubelet` so the apis it exposes can be independently versioned. This would also provide a logical place to put the `KubeletConfiguration` type, which currently lives in `pkg/apis/componentconfig`; it could live in e.g. `pkg/kubelet/apis/config` instead.

Take a look when you have a chance and let me know what you think. The most significant change in this PR is reorganizing `pkg/kubelet/api` to `pkg/kubelet/apis`, the rest is pretty much updating import paths and `BUILD` files.

Automatic merge from submit-queue (batch tested with PRs 44748, 45692)

Limiting client go packages visibility, round 3

Continue the work in the merged PR https://github.com/kubernetes/kubernetes/pull/45258

These packages in client-go will be gone after #44065 is fixed:
pkg/api/helper, pkg/api/util, internal version of api groups, API install packages. 

This PR removes the dependency on these packages and add bazel visibility rules to prevent relapse.

Automatic merge from submit-queue

cleancode: graph_builder.go

It make the code clean and light.

Automatic merge from submit-queue (batch tested with PRs 45623, 45241, 45460, 41162)

Promotes Source IP preservation for Virtual IPs from Beta to GA

Fixes #33625. Feature issue: kubernetes/features#27.

Bullet points:
- Declare 2 fields (ExternalTraffic and HealthCheckNodePort) that mirror the ESIPP annotations.
- ESIPP alpha annotations will be ignored.
- Existing ESIPP beta annotations will still be fully supported.
- Allow promoting beta annotations to first class fields or reversely.
- Disallow setting invalid ExternalTraffic and HealthCheckNodePort on services. Default ExternalTraffic field for nodePort or loadBalancer type service to "Global" if not set.

**Release note**:

```release-note
Promotes Source IP preservation for Virtual IPs to GA.

Two api fields are defined correspondingly:
- Service.Spec.ExternalTrafficPolicy <- 'service.beta.kubernetes.io/external-traffic' annotation.
- Service.Spec.HealthCheckNodePort <- 'service.beta.kubernetes.io/healthcheck-nodeport' annotation.
```

Automatic merge from submit-queue (batch tested with PRs 45623, 45241, 45460, 41162)

Replacing “Pod Injection Policy” with “Pod Preset” in the code documentation

**What this PR does / why we need it**:
Replacing the leftovers of the old term "Pod Injection Policy" with "Pod Preset" in the code documentation.

Automatic merge from submit-queue (batch tested with PRs 45623, 45241, 45460, 41162)

Revert #45101 Mark PersistentVolumes as [Feature:Volumes]

**What this PR does / why we need it**:
Reverts #45101 

`Feature` tag should only be used when a test/suite has dependencies not met by core CI.  That is not the case for NFS backed PV tests.

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Don't attempt to make and chmod subPath if it already exists

fixes https://github.com/kubernetes/kubernetes/issues/45613

https://github.com/kubernetes/kubernetes/pull/43775 fixed one bug and introduced another... I overlooked that subPaths can be files, in which case MkDirAll will simply fail and the pod will not able to start.

Regardless of whether it is a directory or a file, there is no need to introduce the MkdirAll->Chmod  procedure if it exists, because if it exists, it should already have the correct permissions.

This needs to be cherry-picked into 1.6.

```release-note
Fix pods failing to start if they specify a file as a volume subPath to mount
```

Automatic merge from submit-queue (batch tested with PRs 45685, 45572, 45624, 45723, 45733)

Remove a test utility function that is redundant and kinda broken

Framework.WaitForAnEndpoint() has no timeout, so if something goes wrong and the endpoint doesn't get created, the test will hang forever. (This is happening for some reason sometimes in OpenShift right now, and when the CI system eventually times out and kills the VM, it loses the logs that would explain what failed.)

There's already another nearly-identical WaitForEndpoint() method that *does* take a timeout, so people can just use that instead.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 45685, 45572, 45624, 45723, 45733)

Remove reasons from iptables syncProxyRules

The reasons are no longer useful, since we know if something changed anyway, I think.

Automatic merge from submit-queue (batch tested with PRs 45685, 45572, 45624, 45723, 45733)

Remove unused fields from Kubelet struct

Just a small attempt to clean up some unused fields in the kubelet struct.  This doesn't make any actual code changes.

/assign @mtaufen

Automatic merge from submit-queue (batch tested with PRs 45685, 45572, 45624, 45723, 45733)

Display <none> for "kubectl get pods -o wide" when node is empty.

**What this PR does / why we need it**:
If pods are pending due to no matched node to be scheduled, `Spec.NodeName` would be empty. In this case, "kubectl get pods -o wide" displays `<none>` instead of empty.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 45685, 45572, 45624, 45723, 45733)

resource quota full resync was removed in error

**What this PR does / why we need it**:
the quota controller should have had a full resync interval, and it was inadvertently removed in the move to shared informers.

**Which issue this PR fixes** 
This fixes quota recalculation happening at the specified interval.

**Special notes for your reviewer**:

**Release note**:
```release-note
the resource quota controller was not adding quota to be resynced at proper interval
```

Add test coverage to the certificate manager covering the initialization
scenario where it is initialized with no Certificate Request Signing
client, then the client is added later. This matches how it will be used
when the Certificate Request Signing client is also the consumer of the
certificate manager.

Automatic merge from submit-queue (batch tested with PRs 45653, 45719, 45729, 45730, 44250)

Mark kubelet's master-service-namespace flag deprecated

This flag is already deprecated in the API server:
- https://kubernetes.io/docs/admin/kube-apiserver/
- https://kubernetes.io/docs/admin/federation-apiserver/

It doesn't really make sense to adjust this on the Kubelet if you can't change it on the API server anymore.

```release-note
Marks the Kubelet's --master-service-namespace flag deprecated
```

Automatic merge from submit-queue (batch tested with PRs 45653, 45719, 45729, 45730, 44250)

Remove kubemark.sh as we don't use pod IP from it anymore

This has been pending for sometime now. We no longer seem to actually depend on the downwarp api for the pod IP (hollow-proxy for example now gets it using api call).

cc @wojtek-t @gmarek

Automatic merge from submit-queue (batch tested with PRs 45653, 45719, 45729, 45730, 44250)

get pod -o wide: add unittest for nodeName

**What this PR does / why we need it**:

get pod -o wide: add unittest for nodeName

In case that when nodeName is empty, we can get correct info.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```