On macOS mktemp -d drops something in /var/folders, which isn't
shared by default with Docker for Mac. Thus I can't run docker
with that volume mounted to build binaries for test images. So
instead, tell mktemp to use kubernetes/_tmp as its base, which
is what I see some of the hack/verify-* scripts use.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

use v1 version of advanced audit policy in kubeadm

audit api version has been updated to v1 #65891 

**Release note**:
```release-note
kubeadm uses audit policy v1 instead of v1beta1
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: Deduplicate kube-proxy image logic

**What this PR does / why we need it**:

Until now, kube-proxy image was handled in two separate places:
    
- In images.go along with the pre-pull code and without having the image override capabilities (via UnifiedControlPlaneImage)

- In the kube-proxy manifest, where image override was possible.

This duplicates the kube-proxy image logic and makes it prone to errors.
Therefore, this change aims to deduplicate it and make it more straightforward.
This is achieved in the following ways:

- GetKubeControlPlaneImage is used for kube-proxy image fetching, thus allowing for the image to be overriden by UnifiedControlPlaneImage.

- Remove duplicated logic from the manifest and use GetKubeControlPlaneImage to generate the image for the manifest.

This PR also removes GetKubeControlPlaneImageNoOverride as it's no longer needed.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
None

**Special notes for your reviewer**:

/cc @kubernetes/sig-cluster-lifecycle-pr-reviews
/area kubeadm
/assign @luxas
/assign @timothysc

**Release note**:

```release-note
kubeadm: make sure pre-pulled kube-proxy image and the one specified in its daemon set manifest are the same
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

ensure ScheduleDSPods respects tainted nodes

- add PodToleratesNodeTaints to ~~nodeSelectionPredicates()~~ checkNodeFitness()
- add integration testcase

Fixes #66348, and would keep the behavior consistent with it was when ScheduleDSPods is disabled.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 67058, 67083, 67220, 67222, 67209). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Make the request attributes clearer in forbidden messages

This makes the resource and API group components of a forbidden message explicit (including the "" core API group), to help people trying to match up forbidden errors to required policy changes.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 67058, 67083, 67220, 67222, 67209). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix permissions of qemu-ARCH-static in debian-base and other images

**What this PR does / why we need it**: proper fix for the issue I found in #67215. Some machines (like apparently workstations at Google) have a restrictive umask, so the `qemu-ARCH-static` binaries were getting installed in images without world read/execute permissions, causing utilities like `apt-get` to fail.

There was also a duplicate download/install of these binaries for `debian-iptables`, which further confused the issue. I've since removed that duplicate installation.

Many thanks to @BenTheElder for asking the right question to get me to look at the permissions again.

I haven't pushed any images yet. After merge, I'll build/promote `debian-base:0.3.2`, then update everything to use it, then push some more images, write some more PRs, ...

**Release note**:

```release-note
NONE
```
/assign @tallclair

Automatic merge from submit-queue (batch tested with PRs 67058, 67083, 67220, 67222, 67209). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fixed unsafe type cast in vSphere volume plugin

**What this PR does / why we need it**: Fixes the controller manager panic caused by vSphere volumes being used on the wrong cloud provider.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #67218

**Release note**:

```release-note
NONE
```

/assign @saad-ali

Automatic merge from submit-queue (batch tested with PRs 67058, 67083, 67220, 67222, 67209). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add a check for docker version to push fat manifest images

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #
This is for adding a check to avoid any corrupted fat manifest creation.

**Special notes for your reviewer**:
@dims @luxas 
**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 67058, 67083, 67220, 67222, 67209). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

use const v1.ProtocolTCP replace of string TCP

**What this PR does / why we need it**:
use const v1.ProtocolTCP replace of string TCP
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 67161, 67093, 67077). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Graduate ResourceQuotaScopeSelectors to beta

All the pre-requisite items listed in the tracker issue, https://github.com/kubernetes/kubernetes/issues/66673, have got merged. Therefore, opening this PR to graduate scope selectors field in the resource quota spec.

**Release note**:

```release-note
Graduate Resource Quota ScopeSelectors to beta, and enable it by default.
```
/cc @derekwaynecarr @deads2k @smarterclayton

Automatic merge from submit-queue (batch tested with PRs 67161, 67093, 67077). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

improve kubeconfig file modification time

In cases where there are few destination filenames for a given
amount of contexts, but a large amount of contexts, this patch
prevents reading and writing to the same file (or small number
of files) over and over again needlessly.

**Release note**:
```release-note
Decrease the amount of time it takes to modify kubeconfig files with large amounts of contexts
```

cc @deads2k

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove the local manifest list after push

**What this PR does / why we need it**:

Manifests seem sticky in docker, so let's try to purge so if
we have re-push a fresh set of containers (with same version number as
before) during testing, the manifests are created fresh.

Change-Id: I41c010c08bd50b68ff6973a4ae1e004824fab178

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

- add PodToleratesNodeTaints to nodeSelectionPredicates()
- add integration testcases

Automatic merge from submit-queue (batch tested with PRs 67090, 67159, 66866, 62111, 66476). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix to handle hash collisions correctly for DaemonSets

**What this PR does / why we need it**: This adds an integration test for the case where there is a hash collision when creating a ControllerRevision for a DaemonSet. It also fixes a shadowed variable that prevented this functionality from working as intended.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62519 

**Special notes for your reviewer**:
/sig apps

**Release note**:

```release-note
Fixes issue when updating a DaemonSet causes a hash collision.
```

Also, don't re-download qemu-ARCH-static binaries for debian-iptables

Automatic merge from submit-queue (batch tested with PRs 67160, 67090, 67159, 66866, 62111). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Upgraded TaintNodesByCondition to beta.
Signed-off-by: Da K. Ma <klaus1982.cn@gmail.com>

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
part of #62109 

**Release note**:
```release-note
Upgraded TaintNodesByCondition to beta.
```

Automatic merge from submit-queue (batch tested with PRs 67160, 67090, 67159, 66866, 62111). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Refactor checkRequest to allow it to be called from outside

**What this PR does / why we need it**:

Refactor checkRequest method to allow it to be called from outside of admission controller (most of its body does not depend on any quotaEvaluator properties).

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 67160, 67090, 67159, 66866, 62111). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Write manually-created conversion funcs for shared ComponentConfig types

**What this PR does / why we need it**:

Due to how `conversion-gen` works today, it only discovers manually-generated conversion functions when creating autogenerated content for a referencing package. So in the example of `pkg/apis/componentconfig` referencing `k8s.io/apiserver/pkg/apis/config` types, no "native" conversion functions will be called from `pkg/apis/componentconfig/v1alpha1/zz_generated.conversion.go` unless these `Convert_*` functions exist in `k8s.io/apiserver/pkg/apis/config/v1alpha1/`.

We might consider this a bug in `conversion-gen`, I don't know, but to unblock the process of moving componentconfigs out of `pkg/apis/` I'm sending this PR so https://github.com/kubernetes/kubernetes/pull/66722 eventually can merge.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
ref: kubernetes/community#2354

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
/assign @liggitt @sttts

Automatic merge from submit-queue (batch tested with PRs 67160, 67090, 67159, 66866, 62111). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove references to `pkg/apis/componentconfig/install` and fix inconsistencies

**What this PR does / why we need it**:
This PR fixes a bunch of problems with the (deprecated, monolithic, to be removed) componentconfig API group:
 - As discussed with @liggitt, the current structure of k-c-m componentconfig types is really bad, and we don't want anyone to think it can be serialized (not that we have any such code, but anyway). So we deciided to remove all JSON tags from the types to be consistent, register the violations, then move types out, get the structure right, and **first then** add JSON tags.
 - There should not be an `install` package for componentconfigs that installs stuff in `legacyscheme`,  removed the package and references to it.
 - Added myself and @sttts to approvers for `pkg/apis/componentconfig`, which we intend to remove in favor for dedicated API groups in different staging repos.
 - Removed the componentconfig types from the API testing in `pkg/api/testing`, that roundtrip and defaulting testing will exist in the dedicated API groups instead. Added a TODO to add roundtrip, defaulting and type tag testing later.
 - Made the `register.go` files more consistent to the common template.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
ref https://github.com/kubernetes/community/pull/2354

**Special notes for your reviewer**:

This PR must merge before https://github.com/kubernetes/kubernetes/pull/66722 and https://github.com/kubernetes/kubernetes/pull/66993

**Release note**:

```release-note
NONE
```
@kubernetes/sig-api-machinery-pr-reviews @kubernetes/sig-cluster-lifecycle-pr-reviews 
/assign @sttts @thockin @jbeda @liggitt

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Removes dependency on RBAC within kubernetes core

**What this PR does / why we need it**:

Removes an unneeded dependency. Kubectl should depend on repo "k8s.io/api/rbac"; not "k8s.io/kubernetes/pkg/apis/rbac"

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:

Fixes # 

https://github.com/kubernetes/kubectl/issues/91

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 67195, 67184). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove redundant code in aws_ebs_block.go

**What this PR does / why we need it**:
Remove redundant code in aws_ebs_block.go
There is the same code in aws_ebs.go

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
NONE

**Special notes for your reviewer**:
NONE

**Release note**:
```release-note
NONE
```

/sig storage

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix provision fail issue for aws provisioner if fsType specified

**What this PR does / why we need it**:
Fix provision fail issue for aws provisioner if fsType specified

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes # #67146

**Special notes for your reviewer**:
/sig storage
@ddebroy

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 66652, 67034). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Multi-arch images for metadata-concealment check container

**What this PR does / why we need it**:

Originally from:
https://github.com/GoogleCloudPlatform/k8s-metadata-proxy/tree/master/test

Moving the code here to prevent bit-rot and to be sure we can recreate
or update the images on demand. Moving it here also ensures we can use
the common harness to build the multi-arch manifests needed for running
the metadata concealment e2e test can run on multiple architectures.

Change-Id: I15009268da4e7809a1c03d9af3181b585afa8139

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 66652, 67034). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix cluster-info dump error

**Which issue(s) this PR fixes** :
Fixes #65221 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 65297, 67179, 67116, 67011, 66842). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

clean up unused parameter in func restrictedPod and testPrivilegedPods

**What this PR does / why we need it**:
clean up unused parameter in func restrictedPod and testPrivilegedPods
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
/kind cleanup
**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 65297, 67179, 67116, 67011, 66842). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

list the default enabled admission plugins

**Which issue(s) this PR fixes** :
Fixes #66979 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 65297, 67179, 67116, 67011, 66842). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Externalize node admission controller

**Release note**:

```release-note
NONE
```



**What this PR does / why we need it**:

/sig api-machinery

under unbrella: #66680

We start with injecting external informer/lister into node admission controller for that it's slightly simpler than the others.

Here is the thing I actually did in this pull:

1. Enable plugin initializer to inject external/internal clientset/informers into the admission controllers.
2. Receive external informer in node admission controller.
3. Create a `AdmissionConfig` following how we did in `AuthenticationConfig` and `AuthorizationConfig` and creates the actual plugin initializers and the admission post-start hook in its `New()` method

Automatic merge from submit-queue (batch tested with PRs 65297, 67179, 67116, 67011, 66842). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix print error

**What this PR does / why we need it**:
Fixes a print error in convert.go

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 65297, 67179, 67116, 67011, 66842). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

improve kubectl completion help

**What this PR does / why we need it**:
Add note that 'bash-completion' is required on Linux too.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Just like what we did in #64361

**Special notes for your reviewer**:
cc @neolit123

**Release note**:

```release-note
NONE
```

fixes: #67146

Automatic merge from submit-queue (batch tested with PRs 66507, 67188). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Log error in autoscaling e2e tests when creating priority classes

Log error in autoscaling e2e tests when creating priority classes

```release-note
NONE
```

/cc @MaciekPytel 
/sig autoscaling

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Promote ShareProcessNamespace to beta

**What this PR does / why we need it**: The ability to configure PID namespace sharing per-pod was added as an alpha feature in 1.10. This promotes the feature to beta and makes the feature available by default.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
WIP #1615

**Special notes for your reviewer**:
/assign @yujuhong 

**Release note**:

```release-note
The PodShareProcessNamespace feature to configure PID namespace sharing within a pod has been promoted to beta.
```