When using OpenID Connect authentication, don't cause the API
server to fail if the provider is unavailable. This allows
installations to run OpenID Connect providers after starting the
API server, a common case when the provider is running on the
cluster itself.

Errors are now deferred to the authenticate method.

Automatic merge from submit-queue

vSphere provider - Adding config for working dir

This allows the user the set "working-dir" in their vsphere.cfg file.
The value should be a path in the vSphere datastore in which the
provider will look for vms.  This should help compartmentalize 
workloads in vSphere.

Automatic merge from submit-queue

Fix error checks after cloning.

We should not use clone result When cloning fails. Fixes issues found in #28108.

Automatic merge from submit-queue

Fix node problem detector e2e flake

Fix #28069.

The [original code](https://github.com/kubernetes/kubernetes/blob/master/test/e2e/node_problem_detector.go#L198-L204) assumes the test condition will be generated after 5s ([`pollConsistently`](https://github.com/kubernetes/kubernetes/blob/master/test/e2e/node_problem_detector.go#L39)), however sometimes that may not be enough, see #28096

So, this PR changes it to use `Eventually` instead of `Consistently` to make the code waits longer before the test condition to be generated. The original `Consistently` checking is a bit redundant, so I removed it.

@dchen1107 

[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()

Automatic merge from submit-queue

Add EndpointReconcilerConfig to master Config

Add EndpointReconcilerConfig to master Config to allow downstream integrators to customize the reconciler and reconciliation interval when starting a customized master

@kubernetes/sig-api-machinery @deads2k @smarterclayton @liggitt @kubernetes/rh-cluster-infra 

Automatic merge from submit-queue

Skip test if ssh is not supported by provider

Automatic merge from submit-queue

add lastsyncresourceversion to sharedinformer

Indexer consumers can use the `LastSyncResourceVersion` to know if its possible that any change has happened since they last checked.

@derekwaynecarr you used this downstream.

Automatic merge from submit-queue

Adding option to deploy fluentd-elasticsearch in different namespace.

Fixes #27608 .

Automatic merge from submit-queue

Skip multi-zone e2e tests unless provider is GCE, GKE or AWS

No need to fail the tests. If label is not present then it means that node is not in any zone.
Related issue: #27372

Automatic merge from submit-queue

Add upgrade Docker VM

Add an Error Message to upgarde your Docker VM if needed, example output:

```bash
+++ [0622 13:19:48] No docker host is set. Checking options for setting one...
+++ [0622 13:19:49] docker-machine was found.
+++ [0622 13:19:49] A Docker host using docker-machine named 'kube-dev' is ready to go!
Can't connect to 'docker' daemon.  please fix and retry.

Possible causes:
  - On Mac OS X, DOCKER_HOST hasn't been set. You may need to:
    - Create and start your VM using docker-machine or boot2docker:
      - docker-machine create -d virtualbox --virtualbox-memory 4096 --virtualbox-cpu-count -1 kube-dev
      - boot2docker init && boot2docker start
    - Set your environment variables using:
      - eval $(docker-machine env kube-dev)
      - $(boot2docker shellinit)
  - On Linux, user isn't in 'docker' group.  Add and relogin.
    - Something like 'sudo usermod -a -G docker jscheuermann'
    - RHEL7 bug and workaround: https://bugzilla.redhat.com/show_bug.cgi?id=1119282#c8
  - On Linux, Docker daemon hasn't been started or has crashed.
!!! Error in hack/../hack/update-generated-protobuf.sh:53
  'return 1' exited with status 1
Call stack:
  1: hack/../hack/update-generated-protobuf.sh:53 main(...)
Exiting with status 1
Updating generated-protobuf FAILED

$docker info
Error response from daemon: client is newer than server (client API version: 1.24, server API version: 1.23)
```

After running `docker-machine upgrade kube-dev` everything is fine again. So we should add a hint in the error message that this can also happen.

Automatic merge from submit-queue

Remove all traces of travis.

Automatic merge from submit-queue

Omit invalid affinity error in admission

Fixes #27645  cc @smarterclayton 

Not sure if this is too aggressive, but user should expect failure if they disable validation after all.

Automatic merge from submit-queue

Making DHCP_OPTION_SET_ID creation optional

Reason: We have a pre-configured VPC in AWS. `kube-up.sh` should not making changes to the VPC DHCP option if there's already DHCP options configured. 

PR Changes: When `DHCP_OPTION_SET_ID` is given in environment variable, kube-up.sh will skip the `DHCP_OPTION_SET_ID` creation.

We should not use clone result When cloning fails. Fixes issues found in #28108.

Automatic merge from submit-queue

Add optional slice and map support to protobuf generation

See the last commit message for a description.

Fixes #25835

Automatic merge from submit-queue

[ubuntu]honor original docker_opts

Automatic merge from submit-queue

Include init containers in error messages

Automatic merge from submit-queue

Mount hollow-node logs to parent node hostpath

Automatic merge from submit-queue

Test cases for Rest Client

Specifying // +protobuf.nullable=true on a Go type that is an alias of a
map or slice will generate a synthetic protobuf message with the type
name that will serialize to the wire in a way that allows the difference
between empty and nil to be recorded.

For instance:

    // +protobuf.nullable=true
    types OptionalMap map[string]string

will create the following message:

    message OptionalMap {
      map<string, string> Items = 1
    }

and generate marshallers that use the presence of OptionalMap to
determine whether the map is nil (rather than Items, which protobuf
provides no way to delineate between empty and nil).

Automatic merge from submit-queue

kubectl: fix sort logic for logs

@kubernetes/kubectl 

Automatic merge from submit-queue

Increase kube-dns requirements on CoreOS.

[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()

Missed changing the kube-dns memory limit on CoreOS. Follow of PR #28032.

Automatic merge from submit-queue

Convert service account token controller to use a work queue

Converts the service account token controller to use a work queue. This allows parallelization of token generation (useful when there are several simultaneous namespaces or service accounts being created). It also lets us requeue failures to be retried sooned than the next sync period (which can be very long).

Fixes an issue seen when a namespace is created with secrets quotaed, and the token controller tries to create a token secret prior to the quota status having been initialized. In that case, the secret is rejected at admission, and the token controller wasn't retrying until the resync period.

Automatic merge from submit-queue

Fix pvc label selector validation error

This is for https://github.com/kubernetes/kubernetes/issues/26866. Other selectors are e.g. v1beta1.x , the pvc one is unversioned.x

Automatic merge from submit-queue

Mark "RW PD, remove it, then schedule" test flaky

Mark test as flaky while it is being investigated. Tracked by https://github.com/kubernetes/kubernetes/issues/27691

Assigning to @jlowdermilk since he's on call

Automatic merge from submit-queue

Fix initialization of volume controller caches.

Fix `PersistentVolumeController.initializeCaches()` to pass pointers to volume or claim to  `storeObjectUpdate()` and add extra functions to enforce that the right types are checked in the future.

Fixes #28076

Automatic merge from submit-queue

introduce shell2junit

fork shell2junit from https://github.com/manolo/shell2junit

Automatic merge from submit-queue

daemon/controller.go: minor code cleanup

Automatic merge from submit-queue

Adding OWNERS for federation

Adding OWNERS for the federation dir

cc @kubernetes/sig-cluster-federation 

This allows the user the set "working-dir" in their vsphere.cfg file.
The value should be a path in the vSphere datastore in which the
provider will look for vms.

Automatic merge from submit-queue

Enable setting up Kubernetes cluster in Ubuntu on Azure

Implement basic cloud provider functionality to deploy Kubernetes on
Azure.  SaltStack is used to deploy Kubernetes on top of Ubuntu 
virtual machines.  OpenVpn provides network connectivity.  For
kubelet authentication, we use basic authentication (username and 
password).  The scripts use the legacy Azure Service Management APIs.
  
We have set up a nightly test job in our Jenkins server for federated
testing to run the e2e test suite on Azure.  With the cloud provider
scripts in this commit, 14 e2e test cases pass in this environment.
We plan to implement additional Azure functionality to support more
test cases.

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/21207)
<!-- Reviewable:end -->

Automatic merge from submit-queue

Should verify --secure-port and --insecure-port when starting kube-apiserver

When starting kube-apiserver, if we pass the flag `--secure-port` or `--insecure-port` with an invalid value (i.e. < 1 or > 65535), though there is an error message, the apiserver still runs normally. Actually, it should exit (as when not passing the flag `--etcd-servers` does), or else it's meaningless.

This fix is similar to #27762.

Maybe there is still other flags which have to be verified, if found, I will try to fix them.

Before fix:
```
root@vm:/home/paas/zxp/log/kube# kube-apiserver --etcd-servers=http://172.16.1.11:4001 --service-cluster-ip-range=192.168.122.0/24 --insecure-bind-address=0.0.0.0 --logtostderr=false --log-dir=/home/paas/zxp/log/kube --v=10 --secure-port=-1 &
[1] 1500
root@vm:/home/paas/zxp/log/kube# E0623 04:14:15.378332    1500 controller.go:97] Unable to perform initial Kubernetes service initialization: Endpoints "kubernetes" is invalid: [subsets[0].ports[0].port: Invalid value: -1: must be between 1 and 65535, inclusive, subsets[0].ports[0].port: Invalid value: -1: must be between 1 and 65535, inclusive]
[restful] 2016/06/23 04:14:15 log.go:30: [restful/swagger] listing is available at https://172.16.1.11:-1/swaggerapi/
[restful] 2016/06/23 04:14:15 log.go:30: [restful/swagger] https://172.16.1.11:-1/swaggerui/ is mapped to folder /swagger-ui/
E0623 04:14:15.422742    1500 genericapiserver.go:730] Unable to listen for secure (listen tcp: invalid port -1); will try again.

root@vm:/home/paas/zxp/log/kube# 
root@vm:/home/paas/zxp/log/kube# E0623 04:14:30.425211    1500 genericapiserver.go:730] Unable to listen for secure (listen tcp: invalid port -1); will try again.

root@vm:/home/paas/zxp/log/kube# ps -ef|grep kube
root      1500 13507  1 04:14 pts/1    00:00:00 kube-apiserver --etcd-servers=http://172.16.1.11:4001 --service-cluster-ip-range=192.168.122.0/24 --insecure-bind-address=0.0.0.0 --logtostderr=false --log-dir=/home/paas/zxp/log/kube --v=10 --secure-port=-1
```

After:
```
root@vm:/home/paas/zxp/log/kube# kube-apiserver --etcd-servers=http://172.16.1.11:4001 --service-cluster-ip-range=192.168.122.0/24 --insecure-bind-address=0.0.0.0 --logtostderr=false --log-dir=/home/paas/zxp/log/kube --v=10 --insecure-port=-1 &
[1] 10570
root@vm:/home/paas/zxp/log/kube# F0623 05:37:16.124206   10570 genericapiserver.go:594] --insecure-port -1 must be between 1 and 65535, inclusive
goroutine 1 [running]:
k8s.io/kubernetes/vendor/github.com/golang/glog.stacks(0x4418400, 0x0, 0x0, 0x0)
	/home/paas/zxp/code/k8s/train_test/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/github.com/golang/glog/glog.go:766 +0xb8
k8s.io/kubernetes/vendor/github.com/golang/glog.(*loggingT).output(0x43f7f60, 0xc800000003, 0xc8200e4600, 0x42b2d5a, 0x13, 0x252, 0x0)
	/home/paas/zxp/code/k8s/train_test/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/github.com/golang/glog/glog.go:717 +0x259
k8s.io/kubernetes/vendor/github.com/golang/glog.(*loggingT).printf(0x43f7f60, 0xc800000003, 0x32278a0, 0x39, 0xc82037ac90, 0x1, 0x1)
	/home/paas/zxp/code/k8s/train_test/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/github.com/golang/glog/glog.go:655 +0x1d4
k8s.io/kubernetes/vendor/github.com/golang/glog.Fatalf(0x32278a0, 0x39, 0xc82037ac90, 0x1, 0x1)
	/home/paas/zxp/code/k8s/train_test/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/github.com/golang/glog/glog.go:1145 +0x5d
k8s.io/kubernetes/pkg/genericapiserver.verifyInsecurePort(0xc820199800)
	/home/paas/zxp/code/k8s/train_test/kubernetes/_output/local/go/src/k8s.io/kubernetes/pkg/genericapiserver/genericapiserver.go:594 +0x103
k8s.io/kubernetes/pkg/genericapiserver.ValidateRunOptions(0xc820199800)
	/home/paas/zxp/code/k8s/train_test/kubernetes/_output/local/go/src/k8s.io/kubernetes/pkg/genericapiserver/genericapiserver.go:603 +0x59
k8s.io/kubernetes/pkg/genericapiserver.DefaultAndValidateRunOptions(0xc820199800)
	/home/paas/zxp/code/k8s/train_test/kubernetes/_output/local/go/src/k8s.io/kubernetes/pkg/genericapiserver/genericapiserver.go:607 +0x4e
k8s.io/kubernetes/cmd/kube-apiserver/app.Run(0xc820468b40, 0x0, 0x0)
	/home/paas/zxp/code/k8s/train_test/kubernetes/_output/local/go/src/k8s.io/kubernetes/cmd/kube-apiserver/app/server.go:83 +0x344
main.main()
	/home/paas/zxp/code/k8s/train_test/kubernetes/_output/local/go/src/k8s.io/kubernetes/cmd/kube-apiserver/apiserver.go:50 +0x121

[1]+  Exit 255                kube-apiserver --etcd-servers=http://172.16.1.11:4001 --service-cluster-ip-range=192.168.122.0/24 --insecure-bind-address=0.0.0.0 --logtostderr=false --log-dir=/home/paas/zxp/log/kube --v=10 --insecure-port=-1
root@vm:/home/paas/zxp/log/kube# 
```