Automatic merge from submit-queue (batch tested with PRs 62657, 63278, 62903, 63375). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add more volume types in e2e and fix part of them.

**What this PR does / why we need it**:

- Add dir-link/dir-bindmounted/dir-link-bindmounted/bockfs volume types for e2e tests.
- Fix fsGroup related e2e tests partially.
- Return error if we cannot resolve volume path.
  - Because we should not fallback to volume path, if it's a symbolic link, we may get wrong results.

To safely set fsGroup on local volume, we need to implement these two methods correctly for all volume types both on the host and in container:

- get volume path kubelet can access
  - paths on the host and in container are different
- get mount references
  - for directories, we cannot use its mount source (device field) to identify mount references, because directories on same filesystem have same mount source (e.g. tmpfs), we need to check filesystem's major:minor and directory root path on it

Here is current status:

| | (A) volume-path (host) | (B) volume-path (container) | (C) mount-refs (host) | (D) mount-refs (container) |
| --- | --- | --- | --- | --- |
| (1) dir | OK | FAIL | FAIL | FAIL |
| (2) dir-link | OK | FAIL | FAIL | FAIL |
| (3) dir-bindmounted | OK | FAIL | FAIL | FAIL |
| (4) dir-link-bindmounted | OK | FAIL | FAIL | FAIL |
| (5) tmpfs| OK | FAIL | FAIL | FAIL |
| (6) blockfs| OK | FAIL | OK | FAIL |
| (7) block| NOTNEEDED | NOTNEEDED | NOTNEEDED | NOTNEEDED |
| (8) gce-localssd-scsi-fs| NOTTESTED | NOTTESTED | NOTTESTED | NOTTESTED |

- This PR uses `nsenter ... readlink` to resolve path in container as @msau42  @jsafrane [suggested](https://github.com/kubernetes/kubernetes/pull/61489#pullrequestreview-110032850). This fixes B1:B6 and D6, , the rest will be addressed in https://github.com/kubernetes/kubernetes/pull/62102.
- C5:D5 marked `FAIL` because `tmpfs` filesystems can share same mount source, we cannot rely on it to check mount references. e2e tests passes due to we use unique mount source string in tests.
- A7:D7 marked `NOTNEEDED` because we don't set fsGroup on block devices in local plugin. (TODO: Should we set fsGroup on block device?)
- A8:D8 marked `NOTTESTED` because I didn't test it, I leave it to `pull-kubernetes-e2e-gce`. I think it should be same as `blockfs`.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62657, 63278, 62903, 63375). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use new Azure SDK APIs for load balancer and public IP operations

**What this PR does / why we need it**:

#63063 updated Azure SDK to a stable version. After that, we should also update existing clients to use new SDK APIs.

Without this, public IP listing will be blocked forever in some case.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

A following PR will be sent for other interfaces, e.g. routes and NSGs.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update all script shebangs to use /usr/bin/env interpreter instead of /bin/interpreter

This is required to support systems where bash doesn't reside in /bin (such as NixOS, or the *BSD family) and allow users to specify a different interpreter version through $PATH manipulation.
https://www.cyberciti.biz/tips/finding-bash-perl-python-portably-using-env.html
```release-note
Use /usr/bin/env in all script shebangs to increase portability.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add index to node-authorizer for high cardinality vertices

follow-up to https://github.com/kubernetes/kubernetes/pull/62856#issuecomment-382788780

explores adding an index to high-cardinality vertices in the node authorizer to reduce CPU usage for high density namespaces

* first commit is a refactor only - cc @mtaufen 
* second commit adds an optional per-vertex index we can maintain when there are sufficient outgoing edges.

benchmark results:
* shared_secret_via_pod cases are ~1000x faster
* throughput on processing of graph modifications is 50% higher
* there is more variance on graph modifications requiring index updates (though the 100 index-impacting graph modifications per second might be a higher-than-realistic write rate)

data profile (5000 pods per namespace, assigned to 5000 nodes, shared service account and secret):
```
        opts := sampleDataOpts{
                // To simulate high replication in a small number of namespaces:
               nodes:       5000,
               namespaces:  10,
               podsPerNode: 10,
...
```

command:
```
$ go test ./plugin/pkg/auth/authorizer/node/  -bench Authorization  -benchmem -v 
```

before
```
BenchmarkAuthorization/allowed_node_configmap-8                                  557 ns/op   530 B/op   11 allocs/op   3000000
BenchmarkAuthorization/allowed_configmap-8                                       539 ns/op   530 B/op   11 allocs/op   3000000
BenchmarkAuthorization/allowed_secret_via_pod-8                                  605 ns/op   529 B/op   11 allocs/op   3000000
BenchmarkAuthorization/allowed_shared_secret_via_pod-8                        215974 ns/op   792 B/op   19 allocs/op      5000
BenchmarkAuthorization/disallowed_node_configmap-8                               823 ns/op   694 B/op   17 allocs/op   2000000
BenchmarkAuthorization/disallowed_configmap-8                                    888 ns/op   691 B/op   17 allocs/op   2000000
BenchmarkAuthorization/disallowed_secret_via_pod-8                               868 ns/op   694 B/op   17 allocs/op   2000000
BenchmarkAuthorization/disallowed_shared_secret_via_pvc-8                       1216 ns/op   948 B/op   22 allocs/op   1000000
BenchmarkAuthorization/disallowed_pvc-8                                          918 ns/op   691 B/op   17 allocs/op   2000000
BenchmarkAuthorization/disallowed_pv-8                                          1095 ns/op   839 B/op   19 allocs/op   2000000
BenchmarkAuthorization/disallowed_attachment_-_no_relationship-8                 867 ns/op   677 B/op   16 allocs/op   2000000
BenchmarkAuthorization/disallowed_attachment_-_feature_disabled-8                220 ns/op   208 B/op    2 allocs/op  10000000
BenchmarkAuthorization/allowed_attachment_-_feature_enabled-8                    687 ns/op   594 B/op   12 allocs/op   2000000
BenchmarkAuthorization/contentious_allowed_node_configmap-8                      656 ns/op   530 B/op   11 allocs/op   3000000
BenchmarkAuthorization/contentious_allowed_configmap-8                           659 ns/op   529 B/op   11 allocs/op   2000000
BenchmarkAuthorization/contentious_allowed_secret_via_pod-8                      654 ns/op   529 B/op   11 allocs/op   2000000
BenchmarkAuthorization/contentious_allowed_shared_secret_via_pod-8            234308 ns/op  1022 B/op   22 allocs/op      5000
BenchmarkAuthorization/contentious_disallowed_node_configmap-8                  1118 ns/op   692 B/op   17 allocs/op   1000000
BenchmarkAuthorization/contentious_disallowed_configmap-8                       1054 ns/op   692 B/op   17 allocs/op   1000000
BenchmarkAuthorization/contentious_disallowed_secret_via_pod-8                  1059 ns/op   691 B/op   17 allocs/op   2000000
BenchmarkAuthorization/contentious_disallowed_shared_secret_via_pvc-8           1403 ns/op   949 B/op   22 allocs/op   1000000
BenchmarkAuthorization/contentious_disallowed_pvc-8                             1058 ns/op   692 B/op   17 allocs/op   2000000
BenchmarkAuthorization/contentious_disallowed_pv-8                              1237 ns/op   838 B/op   19 allocs/op   1000000
BenchmarkAuthorization/contentious_disallowed_attachment_-_no_relationship-8    1022 ns/op   676 B/op   16 allocs/op   1000000
BenchmarkAuthorization/contentious_disallowed_attachment_-_feature_disabled-8    260 ns/op   209 B/op    2 allocs/op   5000000
BenchmarkAuthorization/contentious_allowed_attachment_-_feature_enabled-8        793 ns/op   594 B/op   12 allocs/op   2000000
--- BENCH: BenchmarkAuthorization
   node_authorizer_test.go:596: graph modifications during non-contention test: 0
   node_authorizer_test.go:593: graph modifications during contention test: 961
   node_authorizer_test.go:594: <1ms=774, <10ms=32, <25ms=14, <50ms=29, <100ms=62, <250ms=46, <500ms=2, <1000ms=1, >1000ms=1
```

after
```
BenchmarkAuthorization/allowed_node_configmap-8                                  629 ns/op   530 B/op   11 allocs/op   3000000
BenchmarkAuthorization/allowed_configmap-8                                       641 ns/op   530 B/op   11 allocs/op   3000000
BenchmarkAuthorization/allowed_secret_via_pod-8                                  591 ns/op   530 B/op   11 allocs/op   3000000
BenchmarkAuthorization/allowed_shared_secret_via_pod-8                           217 ns/op   160 B/op    1 allocs/op  10000000
BenchmarkAuthorization/disallowed_node_configmap-8                               912 ns/op   693 B/op   17 allocs/op   2000000
BenchmarkAuthorization/disallowed_configmap-8                                    913 ns/op   694 B/op   17 allocs/op   2000000
BenchmarkAuthorization/disallowed_secret_via_pod-8                               881 ns/op   691 B/op   17 allocs/op   2000000
BenchmarkAuthorization/disallowed_shared_secret_via_pvc-8                       1271 ns/op   952 B/op   22 allocs/op   1000000
BenchmarkAuthorization/disallowed_pvc-8                                          903 ns/op   694 B/op   17 allocs/op   2000000
BenchmarkAuthorization/disallowed_pv-8                                          1024 ns/op   836 B/op   19 allocs/op   1000000
BenchmarkAuthorization/disallowed_attachment_-_no_relationship-8                1187 ns/op   678 B/op   16 allocs/op   2000000
BenchmarkAuthorization/disallowed_attachment_-_feature_disabled-8                250 ns/op   209 B/op    2 allocs/op  10000000
BenchmarkAuthorization/allowed_attachment_-_feature_enabled-8                    694 ns/op   594 B/op   12 allocs/op   2000000
BenchmarkAuthorization/contentious_allowed_node_configmap-8                      732 ns/op   530 B/op   11 allocs/op   2000000
BenchmarkAuthorization/contentious_allowed_configmap-8                           820 ns/op   530 B/op   11 allocs/op   2000000
BenchmarkAuthorization/contentious_allowed_secret_via_pod-8                     1082 ns/op   531 B/op   11 allocs/op   1000000
BenchmarkAuthorization/contentious_allowed_shared_secret_via_pod-8               274 ns/op   160 B/op    1 allocs/op   5000000
BenchmarkAuthorization/contentious_disallowed_node_configmap-8                  1332 ns/op   693 B/op   17 allocs/op   1000000
BenchmarkAuthorization/contentious_disallowed_configmap-8                       1534 ns/op   693 B/op   17 allocs/op   1000000
BenchmarkAuthorization/contentious_disallowed_secret_via_pod-8                  1077 ns/op   692 B/op   17 allocs/op   1000000
BenchmarkAuthorization/contentious_disallowed_shared_secret_via_pvc-8           1976 ns/op   949 B/op   22 allocs/op   1000000
BenchmarkAuthorization/contentious_disallowed_pvc-8                             1297 ns/op   694 B/op   17 allocs/op   1000000
BenchmarkAuthorization/contentious_disallowed_pv-8                              1632 ns/op   837 B/op   19 allocs/op   1000000
BenchmarkAuthorization/contentious_disallowed_attachment_-_no_relationship-8    1394 ns/op   677 B/op   16 allocs/op   1000000
BenchmarkAuthorization/contentious_disallowed_attachment_-_feature_disabled-8    320 ns/op   209 B/op    2 allocs/op   5000000
BenchmarkAuthorization/contentious_allowed_attachment_-_feature_enabled-8       1055 ns/op   595 B/op   12 allocs/op   2000000
--- BENCH: BenchmarkAuthorization
    node_authorizer_test.go:629: graph modifications during non-contention test: 0
    node_authorizer_test.go:626: graph modifications during contention test: 1424
    node_authorizer_test.go:627: <1ms=0, <10ms=569, <25ms=340, <50ms=145, <100ms=101, <250ms=160, <500ms=61, <1000ms=42, >1000ms=6
```

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62060, 62516). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[GCE] Add new formats to resource parser and self link creator

**What this PR does / why we need it**:
- Expands the set of parse-able strings for resource IDs, while also simplifying the code. Note that these are acceptable values for some fields in GCP API.
  - global/networks/my-network
  - regions/us-central1/subnetworks/my-sub
  - zones/us-central1-a/instances/my-hacker-instance
- Fixes the SelfLink function to return links for regions and zones:
  - https://www.googleapis.com/compute/v1/projects/proj4/regions/us-central1
- Generates helper functions to create a ResourceID for each resource
- Generates a unit test that ensures all links can be generated and all generated links can be parsed.
- Fixes an ILB test which creates a malformed URL.

**Special notes for your reviewer**:
/assign rramkumar1

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix namespace miss bug

**What this PR does / why we need it**:
This  patch fixes  the namespace miss problems.
I am not sure if this is the correct way it should be fixed.
Just offer a solution.
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62059

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Revert "apiserver: change default reconciler to LeaseEndpoint"

This reverts commit 0227534e.

Temporarily revert while the root cause for https://github.com/kubernetes/kubernetes/issues/63378 is determined

This reverts commit 0227534e.

Automatic merge from submit-queue (batch tested with PRs 63349, 63294). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add metric for throttled requests in AWS

**What this PR does / why we need it**:

This PR adds a metric for request throttling in AWS.

**Special notes for your reviewer**:

* Added metric.
* Moved metrics-related code to `aws_metrics.go`.
* Capitalized acronyms, e.g., `recordAwsMetric` to `recordAWSMetric`.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63349, 63294). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Decorator for Create should be called on out, not obj

obj is not what we return

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

	Add UT test for PolicyRuleBuilder

PolicyRuleBuilder is used to construct PolicyRule.
Add UT test to check if its construct is correct.	



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

not expose object detail when creating TokenRequest

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
/assign @liggitt @mikedanese 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

check for commands in kubelet command line

**What this PR does / why we need it**:

Kubelet doesn't support subcommands and silently ignores them.
This causes a lot of confusion among users, for example:

  Running 'kubelet logs' can produce this output:
```
    I0206 16:20:40.010949    5712 feature_gate.go:220] feature gates: &{{} map[]}
    I0206 16:20:40.011054    5712 controller.go:114] kubelet config controller: starting controller
    ...
    error: failed to run Kubelet: failed to create kubelet:
           misconfiguration: kubelet cgroup driver: "cgroupfs" is different from
           docker cgroup driver: "systemd"
```

The output in this case looks like a valid log output. The error is not
caused by incorrectly configured cgroup driver though. It's caused by
the fact that kubelet ignores 'logs' subcommand, so 'kubelet logs' is
essentially the same as 'kubelet': it runs kubelet with the default set
of parameters, including default cgroup driver.

**The fix**:
Added check to prevent kubelet from running if user specifies
subcommands in the command line.

**Which issue(s) this PR fixes**:
Fixes: kubeadm issue 639

**Release note**:
```release-note
NONE
```

	./pkg/apis/rbac/helpers_test.go

 	  namespace miss error
	2.also add a test case
	modified:   pkg/kubectl/cmd/get/get.go
	modified:   hack/make-rules/test-cmd-util.sh

- Add dir-link/dir-bindmounted/dir-link-bindmounted/blockfs volume types for e2e
tests.
- Return error if we cannot resolve volume path.
- Add GetFSGroup/GetMountRefs methods for mount.Interface.
- Fix fsGroup related e2e tests partially.

Automatic merge from submit-queue (batch tested with PRs 63335, 63308). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add set image test for sparse API group resource

Ensures set image works correctly on resources that do not exist in the preferred version of their API group

Tests scenario noticed in review of https://github.com/kubernetes/kubernetes/pull/63206#discussion_r185008596

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

update restmapping to indicate fully qualified resource

The resource of a restmapping is logically fully qualified and we have that value when we construct it.  Update the return value so that callers don't have to synthentically create one.

@kubernetes/sig-api-machinery-pr-reviews 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63138, 63091, 63201, 63341). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Adds support for arm64 to microbot example of the kubernetes-worker charm.

**What this PR does / why we need it**: Adds support for arm64 to microbot example of the kubernetes-worker charm.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63138, 63091, 63201, 63341). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Enable bypassing online checks in kubeadm upgrade plan
Signed-off-by: Chuck Ha <ha.chuck@gmail.com>

**What this PR does / why we need it**:

This PR makes `kubeadm upgrade plan` a little nicer to use in an air gapped environment. `kubeadm upgrade plan` now accepts a version and returns that instead of checking the internet.

**Which issue(s) this PR fixes**:

Fixes kubernetes/kubeadm#698

**Special notes for your reviewer**:

I also cleaned up the tests for this section of code by adding formal names for table tests and using `t.Run`.

**Release note**:

```release-note
`kubeadm upgrade plan` now accepts a version which improves the UX nicer in air-gapped environments.
```

Automatic merge from submit-queue (batch tested with PRs 63138, 63091, 63201, 63341). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Set names for OpenStack loadbalancer members and monitors

**What this PR does / why we need it**:
This PR sets names for OpenStack loadbalancer members and monitors.
ATM names for members and monitors are empty, making it difficult to identify where they belong.

Healthmonitors will be named `monitor_<lb_name>_<index>` and members
will be named `member_<lb_name>_<index>_<node_name>`.
This naming scheme should in sync with the naming of other LB resources, e.g. pools: `pool_<lb_name>_<index>`.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63138, 63091, 63201, 63341). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Api server extra args

**What this PR does / why we need it**:

This PR will correctly override the APIServer command with the values found in APIServerExtraArgs. If none are passed in a default set of flags will be used.

This also includes cleaning up tests by using `t.Run` and naming test cases so we know what they are doing. `t.Run` also provides better testing output when coupled with a name.

At some point we stopped using the k8s version to generate this command. It is trivial to add back if we need it later, but since we don't use it now it's best for it to go. This also exposed several test that were identical. Those have been removed.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes/kubeadm#760

**Special notes for your reviewer**:
I split this into two commits since it's a bit easier to think about like that, but would be fine squashing.

**Release note**:

```release-note
NONE
```

/cc @kubernetes/sig-cluster-lifecycle-pr-reviews

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

mark APIServiceSpec.CABundle optional

xref: https://github.com/kubernetes/kubernetes/issues/60690#issuecomment-382842852
mark the caBundle field optional so openapi is accurate

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 remove rootscopedkinds from groupmeta

builds on https://github.com/kubernetes/kubernetes/pull/63206

Since, a RESTMapping can only be determined based on a connection to a server, the only thing that needs to know the namespaced-ness of a resource is the code doing the registration.  Everything else is derived from that source of truth.  This removes the other dangling references and collapses down onto the existing namespaced-ness methods in the strategies backing the stores.

@kubernetes/sig-api-machinery-pr-reviews 

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add test for sparse version encoding/decoding

This adds tests that make sure the sparse version encoding and encoding work as callers will expect, with the correct version being picked from the list.  I wrote two tests, one a theoretical test not dependent on any API and another practical test using cronjobs which are currently sparse in the registry.

@liggitt turns out that because we find exact matches, sparse versions ought to work out fine.
@smarterclayton I hate that the versioner matches on type.  I'll update that separately I think.


```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add field selector support to delete, label, annotate

**What this PR does / why we need it**:

Builds out field selector support for more bulk commands

**Release note**:
```release-note
kubectl now supports --field-selector for `delete`, `label`, and `annotate`
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 kubelet: force filterContainerID to empty string when removeAll is true 

fixes https://github.com/kubernetes/kubernetes/issues/57865

alternative to https://github.com/kubernetes/kubernetes/pull/62170

There is a bug in the container deletor where if `removeAll` is `true` in `deleteContainersInPod()` the `filterContainerID` is still used to filter results in `getContainersToDeleteInPod()`.  If the filter container is not found, no containers are returned for deletion.

https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/pod_container_deletor.go#L74-L77

This is the case for the delayed deletion a pod in `CrashLoopBackoff` as the death of the infra container in response to the `DELETE` is detected by PLEG and triggers an attempt to clean up all containers but uses the infra container id as a filter with `removeAll` set to `true`.  The infra container is immediately deleted and thus can not be found when `getContainersToDeleteInPod()` tries to find it.  Thus the dead app container from the previous restart attempt still exists.

`canBeDeleted()` in the status manager will return `false` until all the pod containers are deleted, delaying the deletion of the pod on the API server.

The removal of the containers is eventually forced by the API server `REMOVE` after the grace period.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add version/group usage and example to kubectl get

Fixes #63286 

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove incorrect static restmapper from type registry

A RESTMapping can only be determined by inspecting a server since discovery is the authoritative source of mapping decisions.  This removes a deceptive method from the type registry and makes the old logic available for existing tests in a separate, clearly labeled package.

@kubernetes/sig-api-machinery-pr-reviews @kubernetes/sig-cli-maintainers 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63152, 63253). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

make dynamic client slightly easier to use and add fakes

Tweaks the dynamic client to make it more "normal" for resources to namespaces.  Adds a fake dynamic client.

@kubernetes/sig-api-machinery-pr-reviews 
/assign @hzxuzhonghu
/assign @sttts 


```release-note
NONE
```