Automatic merge from submit-queue (batch tested with PRs 62495, 63003, 62829, 62151, 62002). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[e2e ingress-gce] Fix race condition for appending services and ingresses

**What this PR does / why we need it**:
From https://github.com/kubernetes/ingress-gce/issues/219, how the test appends services and ingresses is not thread-safe. This PR fixes it by using channel.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #https://github.com/kubernetes/ingress-gce/issues/219

**Special notes for your reviewer**:
/assign @nicksardo 
I picked this up as it is fun :) Hoping you haven't worked on it yet.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62495, 63003, 62829, 62151, 62002). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix scheduler informers to receive events for all the pods in the cluster

**What this PR does / why we need it**:
This PR has an important change to fix scheduler informers. More information in #63002.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #63002

**Special notes for your reviewer**:
This should be back-ported to 1.10 and 1.9.

**Release note**:

```release-note
Fix scheduler informers to receive events for all the pods in the cluster.
```

Automatic merge from submit-queue (batch tested with PRs 62495, 63003, 62829, 62151, 62002). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add a GCS mirror to WORKSPACE URLs, along with a script to update them.

**What this PR does / why we need it**:
We get occasional flakes when WORKSPACE downloads fail. This should make that much more unlikely, by having two independent endpoints to try.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Volunteer for local-up-cluster related files

**What this PR does / why we need it**:

Wish to help with changes to hack/local-up-cluster.sh and any spill over
into other files that affect hack/local-up-cluster.sh.


**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note

```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

we should use Infof when we are using format string

**What this PR does / why we need it**:
we should use Infof when we are using format string.
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62464, 62947). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

make API.ControlPlaneEndpoint accept IP

**What this PR does / why we need it**:
This PR implements one of the actions defined by https://github.com/kubernetes/kubeadm/issues/751 (checklist form implementing HA in kubeadm).

With this PR, the `API.ControlPlaneEndpoint` value in the kubeadm MasterConfiguration file now accepts both DNS and IP.

The `API.ControlPlaneEndpoint` should be used to set a stable IP address for the control plane; in an HA configuration, this should be the load balancer address (no matter if identified by a DNS name or by a stable IP).

**Special notes for your reviewer**:
/CC @timothysc 
This PR is the same of https://github.com/kubernetes/kubernetes/pull/62667, that I closed by error 😥

**Release note**:
```release-note
NONE
```
Nb. first https://github.com/kubernetes/kubernetes/pull/62667 already has the release note

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

avoid dobule RLock() in cpumanager

**What this PR does / why we need it**:

We met a deadlock when removing pod.
kubelet keeps logging:
```
Pod "xxxx" is terminated, but some containers are still running 
```
After debug, we found it stuck in `SetDefaultCPUSet` [here](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/cm/cpumanager/policy_static.go#L184)  while another goroutine are calling `GetCPUSetOrDefault` [here](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/cm/cpumanager/cpu_manager.go#L256).

According  golang/go#15418, It is not safe to double RLock a RWMutex.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:

none

**Special notes for your reviewer**:

**Release note**:

```release-note
removed unsafe double RLock in cpumanager
```

Automatic merge from submit-queue (batch tested with PRs 63007, 62919, 62669, 62860). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

e2e: save raw profiles too

#62808

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63007, 62919, 62669, 62860). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add unit test for configure-helper.sh.

**What this PR does / why we need it**:
Add a framework for unit-testing configure-helper.sh.
configure-helper.sh plays a critical role in initializing clusters both on GCE and GKE. It is currently, over 2K lines of code, yet it has no unit test coverage.
This PR proposes a framework/approach on how to provide test coverage for this component.
Notes: 
1. Changes to configure-helper.sh itself were necessary to enable sourcing of this script for the purposes of testing.
2. As POC api_manifest_test.go covers the logic related to the initialization of apiserver when integration with KMS was requested. The hope is that the same approach could be extended to the rest of the script.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63007, 62919, 62669, 62860). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix vSphere Cloud Provider to handle upgrade from k8s version less than v1.9.4 to v1.9.4+

**What this PR does / why we need it**:
vSphere Cloud Provider in kubernetes master v1.9.4+ is not able to identify the kubernetes nodes of version less than 1.9.4. Hence, volume operations fail in this case. This PR fixes this.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62435

**Special notes for your reviewer**:
Internally reviewed here: https://github.com/vmware/kubernetes/pull/477

**Release note**:

```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 63007, 62919, 62669, 62860). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

juju: Use k8s.gcr.io url for arm64 ingress image

**What this PR does / why we need it**:

This updates the kubernetes-worker charm to point to k8s.gcr.io for the nginx-ingress-controller-arm64 image. This should have no impact on functionality today, but as I understand it, we're all standardizing on k8s.gcr.io to allow for future changes.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove request context mapper

http.Request now allows setting/retrieving a per-request context, which removes the need for plumbing a request-context mapper throughout the stack

In addition to being way simpler, this has the benefit of removing a potentially contentious lock object from the handling path

This PR:
* removes RequestContextMapper
* converts context fetchers to use `req.Context()`
* converts context setters to use `req = req.WithContext(...)`
* updates filter plumbing in two places (audit and timeout) to properly return the request with modified context
* updates tests that used a fake context mapper to set the context in the request instead

Fixes https://github.com/kubernetes/kubernetes/issues/62796

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63001, 62152, 61950). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Unit test for internal load balancer

**What this PR does / why we need it**:
Unit tests for internal load balancer. Coverage increases from 76.7% to 91.0%.

Fix the volatile fakeApiService issue. Now tests should use GetApiService to get a copy of fakeApiService to prevent testcase interferences.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63001, 62152, 61950). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

When bootstrapping a client cert, store it with other client certs

The kubelet uses two different locations to store certificates on
initial bootstrap and then on subsequent rotation:

* bootstrap: certDir/kubelet-client.(crt|key)
* rotation:  certDir/kubelet-client-(DATE|current).pem

Bootstrap also creates an initial node.kubeconfig that points to the
certs. Unfortunately, with short rotation the node.kubeconfig then
becomes out of date because it points to the initial cert/key, not the
rotated cert key.

Alter the bootstrap code to store client certs exactly as if they would
be rotated (using the same cert Store code), and reference the PEM file
containing cert/key from node.kubeconfig, which is supported by kubectl
and other Go tooling. This ensures that the node.kubeconfig continues to
be valid past the first expiration.

Example:

```
bootstrap:
  writes to certDir/kubelet-client-DATE.pem and symlinks to certDir/kubelet-client-current.pem
  writes node.kubeconfig pointing to certDir/kubelet-client-current.pem
rotation:
  writes to certDir/kubelet-client-DATE.pem and symlinks to certDir/kubelet-client-current.pem
```

This will also allow us to remove the wierd "init store with bootstrap cert" stuff, although I'd prefer to do that in a follow up.

@mikedanese @liggitt as per discussion on Slack today

```release-note
The `--bootstrap-kubeconfig` argument to Kubelet previously created the first bootstrap client credentials in the certificates directory as `kubelet-client.key` and `kubelet-client.crt`.  Subsequent certificates created by cert rotation were created in a combined PEM file that was atomically rotated as `kubelet-client-DATE.pem` in that directory, which meant clients relying on the `node.kubeconfig` generated by bootstrapping would never use a rotated cert.  The initial bootstrap certificate is now generated into the cert directory as a PEM file and symlinked to `kubelet-client-current.pem` so that the generated kubeconfig remains valid after rotation.
```

Automatic merge from submit-queue (batch tested with PRs 63001, 62152, 61950). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Bump kube-dns version for kubeadm upgrade
Signed-off-by: Chuck Ha <ha.chuck@gmail.com>

**What this PR does / why we need it**: This PR bumps the version of kube-dns to the correct version for the kubeadm upgrade path.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Related to kubernetes/kubeadm#739 although that is a different ticket, the bug was reported there.

**Special notes for your reviewer**:

This should also be cherry picked to the 1.9 release since the kube-dns was also cherry picked.

related PR
https://github.com/kubernetes/kubernetes/pull/62678

**Release note**:

```release-note
NONE
```
/cc @kubernetes/sig-cluster-lifecycle-pr-reviews

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update upgrade/downgrade images for ingress-gce

/assign @MrHohn 

**Release note**:

```release-note
None
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update addon manifests to use policy/v1beta1

**What this PR does / why we need it:**
This is a part of the PSP migration from extensions to policy API group. This PR updates addon manifests to use policy/v1beta1 and grant permissions in policy API group.

**Which issue(s) this PR fixes:**
Addressed to https://github.com/kubernetes/features/issues/5

Signed-off-by: Chuck Ha <ha.chuck@gmail.com>

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Timeout on instances.NodeAddresses cloud provider request

**What this PR does / why we need it**:

In cases the cloud provider does not respond before the node gets evicted.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:


**Release note**:
```release-note
stop kubelet to cloud provider integration potentially wedging kubelet sync loop
```

The kubelet uses two different locations to store certificates on
initial bootstrap and then on subsequent rotation:

* bootstrap: certDir/kubelet-client.(crt|key)
* rotation:  certDir/kubelet-client-(DATE|current).pem

Bootstrap also creates an initial node.kubeconfig that points to the
certs. Unfortunately, with short rotation the node.kubeconfig then
becomes out of date because it points to the initial cert/key, not the
rotated cert key.

Alter the bootstrap code to store client certs exactly as if they would
be rotated (using the same cert Store code), and reference the PEM file
containing cert/key from node.kubeconfig, which is supported by kubectl
and other Go tooling. This ensures that the node.kubeconfig continues to
be valid past the first expiration.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Manage Metadata Agent Config with Addon Manager

**What this PR does / why we need it**:
Fixes error where config map for Metadata Agent was not created by addon manager.

**Release note**:
```release-note
Fix error where config map for Metadata Agent was not created by addon manager.
```

Automatic merge from submit-queue (batch tested with PRs 62409, 62856). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add node authorizer contention benchmark

* Makes the node authorization benchmark run in parallel
* Runs the tests a second time with a background goroutine pushing graph modifications at a rate of 100x per second (to test authorization performance with contention on the graph lock).

Graph modifications come from the informers watching objects relevant to node authorization, and only fire when a relevant change is made (for example, most node updates do not trigger a graph modification, only ones which change the node's config source configmap reference; most pod updates do not trigger a graph modification, only ones that set the pod's nodeName or uid)

The results do not indicate bottlenecks in the authorizer, even under higher-than-expected write contention.

```
$ go test ./plugin/pkg/auth/authorizer/node/ -run foo -bench 'Authorization' -benchmem -v
goos: darwin
goarch: amd64
pkg: k8s.io/kubernetes/plugin/pkg/auth/authorizer/node
BenchmarkAuthorization/allowed_node_configmap-8                                 596 ns/op   529 B/op   11 allocs/op    3000000
BenchmarkAuthorization/allowed_configmap-8                                      609 ns/op   529 B/op   11 allocs/op    3000000
BenchmarkAuthorization/allowed_secret_via_pod-8                                 586 ns/op   529 B/op   11 allocs/op    3000000
BenchmarkAuthorization/allowed_shared_secret_via_pod-8                        18202 ns/op   542 B/op   11 allocs/op     100000
BenchmarkAuthorization/disallowed_node_configmap-8                              900 ns/op   691 B/op   17 allocs/op    2000000
BenchmarkAuthorization/disallowed_configmap-8                                   868 ns/op   693 B/op   17 allocs/op    2000000
BenchmarkAuthorization/disallowed_secret_via_pod-8                              875 ns/op   693 B/op   17 allocs/op    2000000
BenchmarkAuthorization/disallowed_shared_secret_via_pvc-8                      1215 ns/op   948 B/op   22 allocs/op    1000000
BenchmarkAuthorization/disallowed_pvc-8                                         912 ns/op   693 B/op   17 allocs/op    2000000
BenchmarkAuthorization/disallowed_pv-8                                         1137 ns/op   834 B/op   19 allocs/op    2000000
BenchmarkAuthorization/disallowed_attachment_-_no_relationship-8                892 ns/op   677 B/op   16 allocs/op    2000000
BenchmarkAuthorization/disallowed_attachment_-_feature_disabled-8               236 ns/op   208 B/op    2 allocs/op   10000000
BenchmarkAuthorization/allowed_attachment_-_feature_enabled-8                   723 ns/op   593 B/op   12 allocs/op    2000000

BenchmarkAuthorization/contentious_allowed_node_configmap-8                     726 ns/op   529 B/op   11 allocs/op    2000000
BenchmarkAuthorization/contentious_allowed_configmap-8                          698 ns/op   529 B/op   11 allocs/op    2000000
BenchmarkAuthorization/contentious_allowed_secret_via_pod-8                     778 ns/op   529 B/op   11 allocs/op    2000000
BenchmarkAuthorization/contentious_allowed_shared_secret_via_pod-8            21406 ns/op   638 B/op   13 allocs/op     100000
BenchmarkAuthorization/contentious_disallowed_node_configmap-8                 1135 ns/op   692 B/op   17 allocs/op    1000000
BenchmarkAuthorization/contentious_disallowed_configmap-8                      1239 ns/op   691 B/op   17 allocs/op    1000000
BenchmarkAuthorization/contentious_disallowed_secret_via_pod-8                 1043 ns/op   692 B/op   17 allocs/op    1000000
BenchmarkAuthorization/contentious_disallowed_shared_secret_via_pvc-8          1404 ns/op   950 B/op   22 allocs/op    1000000
BenchmarkAuthorization/contentious_disallowed_pvc-8                            1177 ns/op   693 B/op   17 allocs/op    1000000
BenchmarkAuthorization/contentious_disallowed_pv-8                             1295 ns/op   834 B/op   19 allocs/op    1000000
BenchmarkAuthorization/contentious_disallowed_attachment_-_no_relationship-8   1170 ns/op   676 B/op   16 allocs/op    1000000
BenchmarkAuthorization/contentious_disallowed_attachment_-_feature_disabled-8   262 ns/op   208 B/op    2 allocs/op   10000000
BenchmarkAuthorization/contentious_allowed_attachment_-_feature_enabled-8       790 ns/op   593 B/op   12 allocs/op    2000000

--- BENCH: BenchmarkAuthorization
   node_authorizer_test.go:592: graph modifications during non-contention test: 0
   node_authorizer_test.go:589: graph modifications during contention test: 6301
   node_authorizer_test.go:590: <1ms=5507, <10ms=128, <25ms=43, <50ms=65, <100ms=135, <250ms=328, <500ms=93, <1000ms=2, >1000ms=0
PASS
ok     k8s.io/kubernetes/plugin/pkg/auth/authorizer/node   112.616s
```

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62409, 62856). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

DNS-Autoscaler support for CoreDNS

**What this PR does / why we need it**:
This PR provides the dns-horizontal autoscaler for CoreDNS in kube-up, enabling the tests to pass once CoreDNS is the default. 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #61176 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix pr No. from 517326 to 57326

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62780, 62886). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Only count local mounts that are from other pods

**What this PR does / why we need it**:
In GCE, we mount the same local SSD in two different paths (for backwards compatability).  This makes the fsGroup conflict check fail because it thinks the 2nd mount is from another pod.  For the fsgroup check, we only want to detect if other pods are mounting the same volume, so this PR filters the mount list to only those mounts under "/var/lib/kubelet".

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62867

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62780, 62886). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Change Capacity log verbosity in status update

*What this PR does / why we need it:*

While in production we noticed that the log verbosity for the Capacity field in the node status was to high.
This log message is called for every device plugin resource at every update.

A proposed solution is to tune it down from V(2) to V(5). In a normal setting you'll be able to see the effect by looking at the node status.

Release note:
```
NONE
```

/sig node
/area hw-accelerators
/assign @vikaschoudhary16 @jiayingz @vishh

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

new testcase to helpers_linux.go

new testcase to helpers_linux.go, PTAL.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 61324, 62880, 62765). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

-Fix the name could cause a conflict if an object with the same name …

…is created in a different namespace

**What this PR does / why we need it**:
/kind bug

Using the name could cause a conflict if an object with the same name is created in a different namespace

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #
#62750

**Special notes for your reviewer**:
/assign @bsalamat 

**Release note**:
```
NONE
```