Automatic merge from submit-queue

Update sftp package

In support of #34328

Looks like some folks need:
https://github.com/pkg/sftp/commit/4d0e916071f68db74f8a73926335f809396d6b42

Automatic merge from submit-queue

Enable service account signing key rotation

fixes #21007

```release-note
The kube-apiserver --service-account-key-file option can be specified multiple times, or can point to a file containing multiple keys, to enable rotation of signing keys.
```

This PR enables the apiserver authenticator to verify service account tokens signed by different private keys. This can be done two different ways:
* including multiple keys in the specified keyfile (e.g. `--service-account-key-file=keys.pem`)
* specifying multiple key files (e.g. `--service-account-key-file current-key.pem --service-account-key-file=old-key.pem`)

This is part of enabling signing key rotation:

1. update apiserver(s) to verify tokens signed with a new public key while still allowing tokens signed with the current public key (which is what this PR enables)
2. give controllermanager the new private key to sign new tokens with
3. remove old service account tokens (determined by verifying signature or by checking creationTimestamp) once they are no longer in use (determined using garbage collection or magic) or some other algorithm (24 hours after rotation, etc). For the deletion to immediately revoke the token, `--service-account-lookup` must be enabled on the apiserver.
4. once all old tokens are gone, update apiservers again, removing the old public key.

Automatic merge from submit-queue

Run flaky tests in parallel

We should try to emulate the main CI environment in the flaky test suite so that it is clear when a test can be moved out of the flaky suite. Since a common source of flakes is unintended interactions between tests running in parallel, we should run the flaky suite in parallel to better detect such flakes.

Automatic merge from submit-queue

Clarify MinAvailable approval semantics.

Automatic merge from submit-queue

Fix panic in #34459

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:
Use the correct variable in the thirdpartyresourcedata codec so it doesn't panic on a nil pointer reference

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #34459

**Special notes for your reviewer**:

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
```

Automatic merge from submit-queue

Bump kubeadm to use kubernetes v1.4.1

v1.4.1 is going to be released tomorrow, so make kubeadm use it by default

This will make it possible to run kubeadm on Raspberry Pi's OOTB

We should strive towards releasing a second kubeadm release this week that's stable and has the small new tweaks we've coded these two weeks.
@errordeveloper @mikedanese

Automatic merge from submit-queue

log-dump.sh: Add a LOG_DUMP_USE_KUBECTL mode, refactor

**What this PR does / why we need it**: This refactors log-dump.sh so that it can optionally just use `"kubectl get node"` output, for dumping logs off a cluster that was brought up using something other than kube-up.sh (e.g. kops or kubeadm).

Note that for obvious reasons, if the cluster is fried, it'll probably fail to hit the apiserver and all bets are off, but for the 95% case where you're debugging tests, this is good. To cover the remaining 5%, you could actually squirrel away the relevant external IPs after the e2e.go:Up stage (because we better be able to hit the apiserver then) and fetch them from cache later.

**Special notes for your reviewer**: Sorry for so many changes. :)

Automatic merge from submit-queue

Clean up the link in cassandra

**What this PR does / why we need it**:
Clean up the link in  README for cassandra

**Which issue this PR fixes** :
 fixes #34431
Signed-off-by: yuexiao-wang <wang.yuexiao@zte.com.cn>

Automatic merge from submit-queue

Remove onlyLocal NodePort e2e till pr #33957

We were basically testing this bug: https://github.com/kubernetes/kubernetes/issues/30809
We fixed the bug: https://github.com/kubernetes/kubernetes/pull/33587, but forgot to remove the "test". 
This pr adds a test for the new feature: https://github.com/kubernetes/kubernetes/pull/33957 (ensure that nodePort with onlyLocal works only on nodes with endpoints and fails otherwise)

fixes https://github.com/kubernetes/kubernetes/issues/34124

This refactors log-dump.sh so that it can optionally just use "kubectl
get node" output, for dumping logs off a cluster that was brought up
using sometihng other than kube-up.sh (e.g. kops or kubeadm).

Note that for obvious reasons, if the cluster is fried, it'll probably
fail to hit the apiserver and all bets are off, but for the 95% case
where you're debugging tests, this is good. To cover the remaining 5%,
you could actually squirrel away the relevant external IPs after the
e2e.go:Up stage (because we better be able to hit the apiserver then)
and fetch them from cache later.

Automatic merge from submit-queue

Move periodic backoff gc to federation utils

Plus put it into a for loop.

cc: @quinton-hoole

Automatic merge from submit-queue

openstack: Support config-drive and improve CurrentNodeName, GetZone

This PR adds support for fetching local instance metadata via config-drive (as well as querying metadata service), and surfaces some additional metadata information (from either source):

- `CurrentNodeName` now returns the OpenStack instance name, rather than the current hostname (they might not be the same)
- `GetZone` includes availability zone label in `FailureDomain`

Thanks to @kiall for a WIP implementation of the latter.

Automatic merge from submit-queue

hack: update cherry-pick script to show subject when patch is split

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:

This is a continuation of #34049, which worked, but then I realized some patch files have more than one subject, see example: https://github.com/kubernetes/kubernetes/pull/34228

This cleans the output so it looks like this:

```
Automated cherry pick of #32593

Cherry pick of #32593 on release-1.4.

#32593: Fix audit_test regex for iso8601 timestamps
```

pretty!!!

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
Signed-off-by: Jess Frazelle <acidburn@google.com>

Automatic merge from submit-queue

Use nodeutil.GetHostIP consistently when talking to nodes

Most of our communications from apiserver -> nodes used
    nodutil.GetNodeHostIP, but a few places didn't - and this meant that the
    node name needed to be resolvable _and_ we needed to populate valid IP
    addresses.

```release-note
The apiserver now uses addresses reported by the kubelet in the Node object's status for apiserver->kubelet communications, rather than the name of the Node object. The address type used defaults to `InternalIP`, `ExternalIP`, and `LegacyHostIP` address types, in that order.
```

Fixes #34459

Fixes doc comments to be in line with #33143

Automatic merge from submit-queue

Federated deployment controller - part 1

Based on federated replicaset controller (copy + find/replace).

Remaining stuff:
- refacing out common elements to libs
- using owerref in pod analysis
- e2e tests
- renaming concurrency flag for rs and reusing it in deployment
- updating only one cluster at a time if rollingupdate strategy is used.

cc: @quinton-hoole @kubernetes/sig-cluster-federation

**Release note**:

```release-note
Federated deployment controller that supports the same api as the regular kubernetes deployment controller.
```

Automatic merge from submit-queue

kubeadm: turn api into a real apigroup

@kubernetes/sig-cluster-lifecycle

Automatic merge from submit-queue

hack/e2e.go: listen for Interrupt signal and attempt cleanup if run with --down

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**: adds a listener on ^C, so if `hack/e2e.go` is run with `--down` and the user ^C, then it will attempt to cleanup the resources.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
NONE
```
Signed-off-by: Jess Frazelle <me@jessfraz.com>

Automatic merge from submit-queue

kubectl: add --revision flag in rollout status

Fixes https://github.com/kubernetes/kubernetes/issues/33185

@kubernetes/kubectl ptal

Signed-off-by: yuexiao-wang <wang.yuexiao@zte.com.cn>

Automatic merge from submit-queue

refactor controller as posthook when configured and enabled

builds on https://github.com/kubernetes/kubernetes/pull/33785 .

Models the bootstrap controller as a PostHook which is added when its API group is available and its configured.

@liggitt Stefan is out for a while.

Automatic merge from submit-queue

no need to remove file respectively

Automatic merge from submit-queue

Match GroupVersionKind against specific version

Currently when multiple GVK match a specific kind in `KindForGroupVersionKinds` only the first will be matched, which not necessarily will be the correct one. I'm proposing to extend this to pick the best match, instead.

Here's my problematic use-case, of course it involves ScheduledJobs :wink::
I have a `GroupVersions` with `batch/v1` and `batch/v2alpha1` in that order. I'm calling `KindForGroupVersionKinds` with kind `batch/v2alpha1 ScheduledJob` and that currently results this matching first `GroupVersion`, instead of picking more concrete one. There's a [clear description](https://github.com/kubernetes/kubernetes/blob/ee77d4e6ca1e174a189071e50997a377bcb6fc37/pkg/api/unversioned/group_version.go#L183) why it is on single `GroupVersion`, but `GroupVersions` should pick this more carefully.

@deads2k this is your baby, wdyt?

Automatic merge from submit-queue

Small refactoring of scheduler predicates

Ref #34336, #34441

Automatic merge from submit-queue

Rescheduling for critical pods proposal

ref #29023

Automatic merge from submit-queue

[Part 1] Implementation of equivalence pod

Part 1 of #30844

This PR: 

- Refactored `predicate.go`, so that `GetResourceRequest` can be used in other places to `GetEquivalencePod`.
- Implement a `equivalence_cache.go` to deal with all information we need to calculate an equivalent pod.
- Define and register a `RegisterGetEquivalencePodFunction `.

Work in next PR:
- The update of `equivalence_cache.go`
- Unit test
- Integration/e2e test

I think we can begin from the `equivalence_cache.go`? Thanks.  cc @wojtek-t @davidopp 

If I missed any other necessary part, please point it out.

Update equivalent class & remove priority

Use controller ref

Directly clear the cache

Automatic merge from submit-queue

Support upgrade/downgrade in etcd image.

Ref #22448 #20504

Automatic merge from submit-queue

Update documentation for running e2e tests locally

**What this PR does / why we need it**:

The docs for running e2e tests locally needs to be updated.
check_node_count option has been removed and developers usually
need to perform additional steps do get it going.