Automatic merge from submit-queue (batch tested with PRs 46441, 43987, 46921, 46823, 47276)

kubelet/network: report but tolerate errors returned from GetNetNS() v2

Runtimes should never return "" and nil errors, since network plugin
drivers need to treat netns differently in different cases. So return
errors when we can't get the netns, and fix up the plugins to do the
right thing.

Namely, we don't need a NetNS on pod network teardown. We do need
a netns for pod Status checks and for network setup.

V2: don't return errors from getIP(), since they will block pod status :(  Just log them.  But even so, this still fixes the original problem by ensuring we don't log errors when the network isn't ready.

@freehan @yujuhong 

Fixes: https://github.com/kubernetes/kubernetes/issues/42735
Fixes: https://github.com/kubernetes/kubernetes/issues/44307

Automatic merge from submit-queue (batch tested with PRs 46441, 43987, 46921, 46823, 47276)

Enable Node authorizer and NodeRestriction admission in kubemark

xref https://github.com/kubernetes/features/issues/279

We want to ensure scale testing covers use of the authorizer/admission pair that partitions nodes. This includes enabling the authorizer, which populates a graph of existing nodes and pods.

Kubemark is still running all nodes with a single credential, so a follow-up step is to generate unique credentials per node (or enable TLS bootstrapping) and remove the temporary rolebinding added in this PR so the node authorizer is the one authorizing each call by a hollow node.

Automatic merge from submit-queue (batch tested with PRs 46441, 43987, 46921, 46823, 47276)

Azure plugin for client auth

This is an Azure Active Directory plugin for client authentification. It provides an integration with Azure CLI 2.0 login command. It can also be used standalone, in that case it will use the device code flow to acquire an access token. 

More details are provided in the README.md file. 

https://github.com/kubernetes/kubectl/issues/29

cc @brendandburns @colemickens

Automatic merge from submit-queue

Shorten eviction tests, and increase test suite timeout

After #43590, the eviction manager is less aggressive when evicting pods.  Because of that, many runs in the flaky suite time out.
To shorten the inode eviction test, I have lowered the eviction threshold.
To shorten the allocatable eviction test, I now set KubeReserved = NodeMemoryCapacity - 200Mb, so that any pod using 200Mb will be evicted.  This shortens this test from 40 minutes, to 10 minutes.
While this should be enough to not hit the flaky suite timeout anymore, it is better to keep lower individual test timeouts than a lower suite timeout, since hitting the suite timeout means that even successful test runs are not reported.

/assign @Random-Liu @mtaufen 

issue: #31362

Automatic merge from submit-queue (batch tested with PRs 46929, 47391, 47399, 47428, 47274)

Don't provision for PVCs with AccessModes unsupported by plugin

Fail early in case the user actually expects e.g. RWM from AWS when in reality that isn't possible.
@eparis @gnufied 

edit: this needs release note because it's a breaking bugfix; will write one.

https://github.com/kubernetes/kubernetes/issues/46540
```release-note
Fix dynamic provisioning of PVs with inaccurate AccessModes by refusing to provision when PVCs ask for AccessModes that can't be satisfied by the PVs' underlying volume plugin
```

Automatic merge from submit-queue (batch tested with PRs 46929, 47391, 47399, 47428, 47274)

Increase threshold for LIST apicall latencies to 2s

Fixes https://github.com/kubernetes/kubernetes/issues/47419

cc @kubernetes/sig-scalability-misc @gmarek @wojtek-t

Automatic merge from submit-queue (batch tested with PRs 46929, 47391, 47399, 47428, 47274)

AWS: Richer log message when metadata fails

Not a resolution, but should at least help determine the issue.

Issue #41904

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46929, 47391, 47399, 47428, 47274)

AWS: Perform ELB listener comparison in case-insensitive manner

Fix #47067

```release-note
AWS: Avoid spurious ELB listener recreation - ignore case when matching protocol
```

Automatic merge from submit-queue (batch tested with PRs 46929, 47391, 47399, 47428, 47274)

Remove empty lines from log

Everything() returns a new line end with "\n", it's not necessary
to add another one.
**Release note**:

```
NONE
```

Automatic merge from submit-queue

Bump Cluster Autoscaler to 0.6.0-alpha1

cc: @MaciekPytel @aleksandra-malinowska

Automatic merge from submit-queue

AWS cleanup

Rationalize the existing code.

```release-note
NONE
```

 Issue #47394

Automatic merge from submit-queue

enable Node authorizer and NodeRestriction admission controller

Fixes https://github.com/kubernetes/kubernetes/issues/46999
Fixes https://github.com/kubernetes/kubernetes/issues/47135

```release-note
gce kube-up: The `Node` authorization mode and `NodeRestriction` admission controller are now enabled
```

Automatic merge from submit-queue (batch tested with PRs 47075, 46342)

Remove hardcode for blocksize, use stat(), fixes test failure on SLES

**What this PR does / why we need it**:
Removes hardcoding for blocksize, fixes test failure on SLES
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #44022

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

Change what is stored in DaemonSet history `.data`

**What this PR does / why we need it**: 
In DaemonSet history `.data`, store a strategic merge patch that can be applied to restore a DaemonSet. Only PodSpecTemplate is saved. 

This will become consistent with the data stored in StatefulSet history. 

Before this fix, a serialized pod template is stored in `.data`; however, seriazlized pod template isn't a `runtime.RawExtension`, and caused problems when controllers try to patch the history's controller ref. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47008

**Special notes for your reviewer**: @kubernetes/sig-apps-bugs @erictune @kow3ns @kargakis @lukaszo @mengqiy 

**Release note**:

```release-note
NONE
```

Fix #47067

Not a resolution, but should at least help determine the issue.

Issue #41904

Also reuse existing mapping code, rather than reimplementing.

Issue #47394

Issue #47394

Automatic merge from submit-queue

Fix bad check in node e2e tests for GPUs.

When no nvidia device was attached, the -ne check had a syntax error:

    sh: -ne: argument expected

This resulted in `Success` being echoed and the test passing incorrectly.
This was found while debugging issue #47216

/release-note-none
/sig node
/area node-e2e
/kind bug

Automatic merge from submit-queue (batch tested with PRs 46678, 45545, 47375)

bazel: update debian-iptables-amd64 digest

**What this PR does / why we need it**: upstream debian has fixed several CVEs recently, so we should apply those fixes:
* CVE-2017-2616
* CVE-2017-6512

x-ref #47386

**Special notes for your reviewer**: nothing has been pushed yet, so this will likely fail many of the tests.

Do you think these version numbers make sense? We also need to fix debian-iptables v5, and I don't know what to do there. (v5.1?)

**Release note**:

```release-note
NONE
```
/assign @timstclair

Automatic merge from submit-queue (batch tested with PRs 46678, 45545, 47375)

update gophercloud/gophercloud dependency

**What this PR does / why we need it**:

**Which issue this PR fixes** 
fixes #44461

**Special notes for your reviewer**:

**Release note**:

```release-note
update gophercloud/gophercloud dependency for reauthentication fixes
```

Automatic merge from submit-queue

fix#46039: iptables proxier need use '--bind-address' if set

**What this PR does / why we need it**: 
iptables proxier need use '--bind-address' if set

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #46039 

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 47000, 47188, 47094, 47323, 47124)

fix sync loop health check

This PR will do error logging about the fall behind sync for kubelet instead of sync loop healthz checking.

The reason is kubelet can not do sync loop and therefore can not update sync loop time when there is any runtime error, such as docker hung. 

When there is any runtime error, according to current implementation, kubelet will not do sync operation and thus kubelet's sync loop time will not be updated. This will make when there is any runtime error, kubelet will also return non 200 response status code when accessing healthz endpoint. This is contrary with #37865 which prevents kubelet from being killed when docker hangs.

**Release note**:
```release-note
fix sync loop health check with seperating runtime errors
```

/cc @yujuhong @Random-Liu @dchen1107

Automatic merge from submit-queue (batch tested with PRs 47000, 47188, 47094, 47323, 47124)

Fix hostconfig device map logic in dockershim.

**What this PR does / why we need it**:
Fixes for device injection logic in dockershim , please help verify e2e run.

Should do updateCreateConfig before Resources assignment.

Related change:
https://github.com/kubernetes/kubernetes/pull/46744/files#diff-c7dd39479fd733354254e70845075db5L137


**Which issue this PR fixes**
https://github.com/kubernetes/kubernetes/issues/47216

**Special notes for your reviewer**:

**Release note**:
```release-note
```

Automatic merge from submit-queue (batch tested with PRs 47000, 47188, 47094, 47323, 47124)

Set up proxy certs for Aggregator.

Working on fixing https://github.com/kubernetes/kubernetes/issues/43716.
This will create the necessary certificates.
On GCE is will upload those certificates to Metadata.
They are then pulled down on to the kube-apiserver.
They are written to the /etc/src/kubernetes/pki directory.
Finally they are loaded vi the appropriate command line flags.
The requestheader-client-ca-file can be seen by running the following:-
kubectl get ConfigMap extension-apiserver-authentication --namespace=kube-system -o yaml

**What this PR does / why we need it**: 
This PR creates a request header CA. It also creates a proxy client cert/key pair. 
It causes these files to end up on kube-apiserver and set the CLI flags so they are properly loaded.
Without it the customer either has to set them up themselves or re-use the master CA which is a security vulnerability.
Currently this creates everything on GCE.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #43716

**Special notes for your reviewer**:

Automatic merge from submit-queue (batch tested with PRs 47000, 47188, 47094, 47323, 47124)

Add Calico typha agent

**What this PR does / why we need it**:

- Adds the Calico typha agent with autoscaling to the GCE scripts. 
- Adds logic to adjust Calico resource requests based on cluster size.

Fixes https://github.com/kubernetes/kubernetes/issues/47269

**Special notes for your reviewer**:

CC @dnardo 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 47000, 47188, 47094, 47323, 47124)

GC should retry on patch error

Fixing https://github.com/kubernetes/kubernetes/issues/46998.

This is fixing a bug, so applying the 1.7 milestone.

Automatic merge from submit-queue

Fix missing __kubectl_parse_config

**What this PR does / why we need it**:

This PR fixes the broken completion of kubectl config use-context. I checked that the completions of kubectl config use-context, --user and --cluster work correctly.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #29386 

**Special notes for your reviewer**: @pwittrock @janetkuo

**Release note**:

```release-note
NONE
```

Don't delete docker image if building a release

test/e2e: fix empty namespace being passed to wait

[Nginx] Run nginx ingress test in slow suite