Automatic merge from submit-queue (batch tested with PRs 54160, 54016). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix `kubeadm upgrade plan` for offline operation

**What this PR does / why we need it**:
This PR allows `kubeadm upgrade plan` to work in firewalled/offline/otherwise restricted environments by ignoring errors when trying to reach dl.k8s.io. Instead, we fall back to the current kubeadm version as the latest stable version. This is a reasonable as a user is [expected to install a recent version of kubeadm before upgrading](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm-upgrade-1-8/#upgrading-your-control-plane).

**Which issue this PR fixes**: Fixes kubernetes/kubeadm#498

**Special notes for your reviewer**: Should preferably be cherrypicked to 1.8.

```release-note
Fix `kubeadm upgrade plan` for offline operation: ignore errors when trying to fetch latest versions from dl.k8s.io
```

Automatic merge from submit-queue (batch tested with PRs 54160, 54016). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Move runtime-related flags from KubeletConfiguration to KubeletFlags

With respect to https://github.com/kubernetes/kubernetes/pull/53833#issuecomment-336317287, move runtime-related flags out of KubeletConfiguration.

Broader issue: https://github.com/kubernetes/features/issues/281

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54572, 54686). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix service session affinity e2e failure cases

**What this PR does / why we need it**:

Fix service session affinity e2e failure cases - debuging...

**Which issue this PR fixes**:

xref #54571 #54524

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/sig network

Automatic merge from submit-queue (batch tested with PRs 54572, 54686). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubectl partial env docs & examples

**What this PR does / why we need it**:

It adds documentation and examples to kubectl env.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: This PR partially addresses [#98](https://github.com/kubernetes/kubectl/issues/98).

**Special notes for your reviewer**:

This is a partial PR. I'm mostly looking for feedback as to whether I'm on the right track with this issue. Any feedback is appreciated. Thanks.

(This is my contribution to Outreachy's Kubernetes internship application.)

**Release note**:


```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54728, 54818). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

diff: Propragate errors when diffing

Because of that, errors while diffing would potentially not do anything,
leaving the user clueless of what was going on.

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54728, 54818). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Metadata concealment e2e

**What this PR does / why we need it**: Add e2e for metadata concealment.  Ref #8867.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update PR template

**What this PR does / why we need it**:
Update release notes and a nit

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
ref: https://github.com/kubernetes/community/pull/1221
https://github.com/kubernetes/test-infra/pull/4718
Fixes: #45799 (just for issue association)

**Special notes for your reviewer**:
/cc @cjwagner @Bradamant3 

**Release note**:

```release-note
NoNe
```

Automatic merge from submit-queue (batch tested with PRs 54533, 54777, 54763, 54806, 54703). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

examples/podsecuritypolicy/rbac: fix names in comments and sync with examples repository

**What this PR does / why we need it**:
This PR fixes policies, roles, and bindings names in the comments. Also it sync examples with the examples from https://github.com/kubernetes/examples/tree/master/staging/podsecuritypolicy/rbac 

**Release note**:
```release-note
NONE
```

CC @simo5

Automatic merge from submit-queue (batch tested with PRs 54533, 54777, 54763, 54806, 54703). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Change bucket info of volume operations

The default buckets for volume operations are mostly incorrect because most metric tend to cluster in >10s bucket. 

This fixes the problem with buckets.

cc @kubernetes/sig-storage-pr-reviews @jingxu97

Automatic merge from submit-queue (batch tested with PRs 54533, 54777, 54763, 54806, 54703). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

make iptables wait flag generic and tune it to 5 seconds

Excerpt from [bug](https://bugzilla.redhat.com/show_bug.cgi?id=1506396) opened by @eparis 

> iptables-restore has a 2s wait timeout. Data collected today shows that even with a much faster kernel we can reasonably expect iptables-restore to take upwards of 2.4 seconds. (with unpatched/released RHEL kernel this can easily take 7-8 second)

> longest runs I saw over about 30 minutes were:
> 2.267244
> 2.284707
> 2.291535
> 2.376457

> If we get 2 iptables restores going at the same time, with a 2s timeout it is very likely the second will fail.

> I'd like to suggest a 5s timeout. It should still bound the number of thread we may be waiting on and increases the reliability that a common situation will be automatically resolved without failing up the stack.

Automatic merge from submit-queue (batch tested with PRs 54533, 54777, 54763, 54806, 54703). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add CRI log format support in fluentd.

Without this fluentd will log a lot of errors for each line, because it doesn't recognize the CRI log format.
With this PR, it could support CRI log format now. I've tried with cri-containerd.

The PR is using https://github.com/repeatedly/fluent-plugin-multi-format-parser.
This PR depends on https://github.com/GoogleCloudPlatform/k8s-stackdriver/pull/62.

@crassirostris Should I build/push image before the PR is merged? What is our process?

**Release note**:

```release-note
fluentd now supports CRI log format.
```

Automatic merge from submit-queue (batch tested with PRs 54533, 54777, 54763, 54806, 54703). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create kubectl's own instance of Scheme and Registry

Create kubectl's own instance of Registry and Scheme.
Switch most command that doesn't depend on internal types to use kubectl's own scheme and register.

There are some hack of registering the internal types in some of unit test now, they should be gone after switch to the external type.

Switch kubectl's factory code to use kubectl's scheme will create a lot of ripples.
I don't want make this PR a super giant PR, so I will do it in a followup PR.

Partially addressed #48564.

Copy the summary from https://github.com/kubernetes/kubernetes/pull/54533#issuecomment-340522302:
- creates pkg/kubectl/scheme (install.go and scheme.go) with
deps on properly vendored k8s.io packages.
- deletes about 80% percent of dependence on pkg/api/legacyscheme
- replaces direct dependence from pkg/kubectl on
pkg/apis/rbac
to a vendor style dependence on
k8s.io/api/rbac
and removes dependencies on rbac paths containing internalversion
- replaces almost 50% of direct dependence on pkg/api with (properly vendored)
k8s.io/api/core/v1
- deletes all of dependence on pkg/apis/policy and k8s.io/api/policy/v1beta1

```release-note
NONE
```

/assign @monopole @apelisse
cc: @pwittrock

Automatic merge from submit-queue (batch tested with PRs 54761, 54748, 53991, 54485, 46951). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Enhanced the network policy describer.

**Which issue this PR fixes**: Fixes https://github.com/kubernetes/kubectl/issues/17

**Special notes for your reviewer**: I need help to set up the right clientset for the unt tests

@kubernetes/sig-network-pr-reviews 

ping @adohe 

As suggested in https://github.com/kubernetes/kubectl/issues/17 , the output is similar to:
```
Name:           access-backend
Namespace:      default
Created on:     2017-06-04 21:45:56 -0700 PDT
Labels:         <none>
Annotations:    <none>
Spec:
  Pod Selector:     foo in (bar1,bar2),foo2 notin (bar1,bar2),id=app1,id2=app3
  Allowing ingress traffic:
    To Port: 80/TCP
    To Port: 82/TCP
    From Pod Selector: id=app2,id2=app3
    From Namespace Selector: id=app2,id2=app3
    From Namespace Selector: foo in (bar1,bar2),id=app2,id2=app3
    ----------
    To Port: <any> (traffic allowed to all ports)
    From: <any> (traffic not restricted by source)
```

Automatic merge from submit-queue (batch tested with PRs 54761, 54748, 53991, 54485, 46951). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

admission: unify plugin constructors

It's common in Go to return the actual object in constructors, not **one interface**
it implements. This allows us to implement multiple interfaces, but only have
one constructor. As having private types in constructors, we export all plugin structs, of course with private fields.

Note: super interfaces do not work if there are overlapping methods.

Automatic merge from submit-queue (batch tested with PRs 54761, 54748, 53991, 54485, 46951). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Cosmetical cleanup after pkg/api/legacyscheme move

Follow-up of https://github.com/kubernetes/kubernetes/pull/53984

- Fix and update comment with api.Scheme
- Remove all api.Scheme references by using explicit package aliases

Automatic merge from submit-queue (batch tested with PRs 54761, 54748, 53991, 54485, 46951). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Make HugePages const name consistent.

**What this PR does / why we need it**:
Make HugePages const name in v1 be consistent with the name in api.
https://github.com/kubernetes/kubernetes/blob/f9e6142f925a33a9d8a252ab79b9dabbee596ea2/pkg/api/types.go#L686

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54761, 54748, 53991, 54485, 46951). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Validate that PersistentVolumeSource is not changed during PV Update

**What this PR does / why we need it**: An administrator might change `PV.Spec.PersistentVolumeSource`, but Kubernetes does not have the ability perform this type of update.

**Which issue this PR fixes** : fixes #54562

**Special notes for your reviewer**: N/A

**Release note**:
```
Prevent updates to PV.Spec.PersistentVolumeSource.
```

Because of that, errors while diffing would potentially not do anything,
leaving the user clueless of what was going on.

Automatic merge from submit-queue (batch tested with PRs 53796, 54666, 54516, 54625, 54704). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix TestCRD Flake

**What this PR does / why we need it**:

The DestroyFunc functions returned by generic.NewRawStorage is never
called when we do a StartTestServer() in the test suite. For a quick
hack for now, added TrackStorageCleanup/RegisterStorageCleanup and
CleanupStorage. Note that unless TrackStorageCleanup is called (which
is called only from the test suite) the other two methods are
no-ops essentially. So no change in behavior at runtime. This vastly
brings down the number of goroutines that are left behind when this
test is executed and should reduce if not eliminate the flakiness
of TestCRD

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53796, 54666, 54516, 54625, 54704). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

print priority when describe pod

**What this PR does / why we need it**:

show the priority of pod when describe pod when we use pod priority

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #54624 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53796, 54666, 54516, 54625, 54704). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Deprecate using cloud provider to set host address feature

**What this PR does / why we need it**:

Long term plan is to remove all uses of cloud provider from kube api
server. As part of that, we need to remove the dependency on
figuring out the host address of the node running the kube api server
using the cloud provider. In this review, we log a warning that this
feature that is usually used for example with swagger generation
will go away in the future.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Part of fix for 54077

**Special notes for your reviewer**:

**Release note**:

```release-note
If you are using the cloud provider API to determine the external host address of the apiserver, set --external-hostname explicitly instead. The cloud provider detection has been deprecated and will be removed in the future
```

Automatic merge from submit-queue (batch tested with PRs 53796, 54666, 54516, 54625, 54704). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove +linux restriction in ipvs/fake for running UTs in !linux platform

**What this PR does / why we need it**:

Remove +linux restriction in ipvs/fake for running UTs in !linux platform

**Which issue this PR fixes**: 

fixes #54667

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/sig network

/kind bug

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix print format of rootScoped resourced in kubectl

**What this PR does / why we need it**:
remove _NAMESPACE_ filed when querying rootScoped resource with kubectl

**Which issue this PR fixes**

fixes #53767

**Special notes for your reviewer**:
/cc @smarterclayton 


**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update ipvs proxy local up way in README.md

**What this PR does / why we need it**:

Update ipvs proxy local up way in README.md, since https://github.com/kubernetes/kubernetes/pull/54288 which support specify proxy mode for local-up.sh is already in.

**Which issue this PR fixes**: fixes #54742

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix subresource discovery and versioning

Fixes https://github.com/kubernetes/kubernetes/issues/54684
Related to https://github.com/kubernetes/kubernetes/pull/54586

Allows distinct subresource group/version/kind to be used for each version (gives us a path to move to autoscaling/v1 for apps, or policy/v1 for eviction, etc)

Added tests to ensure scale subresources have expected discovery info, and that the object returned matches discovery, and that the endpoint accepts the advertised version

```release-note
Fixes discovery information for scale subresources in the apps API group
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

update wrong group for priorityclasses

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #54690

**Special notes for your reviewer**:

assgin @bsalamat 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Revert: Shutdown http handlers before shutting down audit backend

Fixes https://github.com/kubernetes/kubernetes/issues/54793

This reverts commit f4268608.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiserver: return 4xx for invalid patch

Fixes #54423 

Currently, an invalid patch returns 500. The apiserver should return a 400 (`BadRequest`) or 422 (`Unprocessable Entity`).

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix import path error

**What this PR does / why we need it**:

fix import warning.
"k8s.io/apiserver/pkg/admission/plugin/webhook" import packages that expects import "k8s.io/kubernetes/plugin/pkg/admission/webhook"

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```