Automatic merge from submit-queue

Increase the AppArmor pod stop timeout to match the start timeout

Fixes https://github.com/kubernetes/kubernetes/issues/30750

Automatic merge from submit-queue

Let Services preserve client IPs and not double-hop from external LBs (alpha)

Closes #19754

Automatic merge from submit-queue

Fix path to kubernetes_skew

Previously this was `$(pwd)/kubernetes/../kubernetes_old` this is equivalent to `$(pwd)/kubernetes_old` although we also changed the `old` to `skew` instead.

Fixes https://github.com/kubernetes/kubernetes/issues/31149

Automatic merge from submit-queue

Clarify documentation that new admission control plugin must be imported

```release-note
```

Admission control design doc doesn't mention importing the plugin to plugins.go. I was unable to get the plugin to build into my binary without it. Updated documentation to prevent future confusion.

Automatic merge from submit-queue

Sort hack/.linted packages

Appending to the file by default creates merge conflicts in the submit queue. Sorting will reduce that considerably.

Add feature gate (ExternalTrafficLocalOnly) for alpha feature

Automatic merge from submit-queue

Node E2E: Extend serial test suite timeout to 3 hours.

Addresses https://github.com/kubernetes/kubernetes/issues/30550#issuecomment-241176666.

Extend the serial test timeout to 3 hours.

@coufon

Revert kubelet dynamic config

Automatic merge from submit-queue

two nits for kubelet syncPod

a useless ‘(’ and a log level should be info

This reverts commit fe808ec2, reversing
changes made to f297ea96.

This reverts commit 5981aa8b, reversing
changes made to fe808ec2.

Mark dynamic kubelet configuration test serial

Automatic merge from submit-queue

[Kubelet] Optionally consume configuration from <node-name> named config maps

This extends the Kubelet to check the API server for new node-specific config, and exit when it finds said new config.

/cc @kubernetes/sig-node @mikedanese @timstclair @vishh

**Release note**:
```
Extends Kubelet with Alpha Dynamic Kubelet Configuration. Please note that this alpha feature does not currently work with cloud provider auto-detection.
```

Admission control design doc doesn't mention importing the plugin to plugins.go. I was unable to get the plugin to build into my binary without it.

Automatic merge from submit-queue

[GarbageCollector] Allow per-resource default garbage collection behavior

What's the bug:
When deleting an RC with `deleteOptions.OrphanDependents==nil`, garbage collector is supposed to treat it as `deleteOptions.OrphanDependents==true", and orphan the pods created by it. But the apiserver is not doing that.

What's in the pr:
Allow each resource to specify the default garbage collection behavior in the registry. For example, RC registry's default GC behavior is Orphan, and Pod registry's default GC behavior is CascadingDeletion.

Automatic merge from submit-queue

Test if 2 federated informers in rs controller are in sync

cc: @quinton-hoole @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Enable v3 Client as the default on UTs

Updates the default initialization to use clientv3 interface to etcd3, and fixes the UTs.  

This PR includes a cherry-pick of https://github.com/kubernetes/kubernetes/pull/30634 so we can validate the tests, so do not merge until that PR is complete.

Automatic merge from submit-queue

Federated namespace controller e2e test

Depends on #30443

cc: @quinton-hoole @wojtek-t @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Tests for data update in federated secret controller

cc: @quinton-hoole @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Reduce size of images fluentd-gcp and fluentd-elasticsearch

replaces #26652

```
aledbf/fluentd-elasticsearch                   1.19 769ece5c8ba8 About an hour ago 269.9 MB
gcr.io/google_containers/fluentd-elasticsearch 1.18 0a8cbfbea7f7 5 weeks ago       530.3 MB

aledbf/fluentd-gcp                             1.22 ef979b82a767 About an hour ago 307.9 MB
gcr.io/google_containers/fluentd-gcp           1.21 0ef09b1bcfd7 2 weeks ago       498.5 MB
```

closes #29782

Automatic merge from submit-queue

Enabled Rescheduler e2e test for serial suites

Automatic merge from submit-queue

ObjectMeta equivalence in federated controller handlers + update in fed secrets

Federated secrets should trigger also on data/type update, not only on object meta.

cc: @quinton-hoole @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Implements Attacher Plugin Interface for vSphere

This PR does the following,

Fixes #29028 (vsphere volume should implement attacher interface):  Implements Attacher Plugin Interface for vSphere. 
See file: 
pkg/volume/vsphere_volume/vsphere_volume.go. - Removed attach and detach calls from SetupAt and TearDownAt.
pkg/volume/vsphere_volume/attacher.go. - Implements Attacher & Detacher Plugin Interface for vSphere. (Ref :- GCE_PD & AWS attacher.go)
pkg/cloudproviders/provider/vsphere.go - Added DiskIsAttach method.

The vSphere plugin code needs clean up. (ex: The code for getting vSphere instance is repeated in file pkg/cloudprovider/providers/vsphere.go). I will fix this in next PR.

Automatic merge from submit-queue

Add Cluster field in ObjectMeta

There will be no sub-rs, but add `Cluster` field to the ObjectMeta (for all the objects)

"To distinguish the object at the federation level from it's constituents at the cluster level we will add a "Cluster" field to the metadata of all objects (where the federation itself will also have a cluster identifier).  That way it is possible to list, interact with, and distinguish between the objects either at the federation level or at the individual cluster level based on the cluster identifier. "


@quinton-hoole @nikhiljindal @deepak-vij @mfanjie @huangyuqi

[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()

Automatic merge from submit-queue

Set annotation name in federated replica set controller

cc: @quinton-hoole @jianhuiz @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Fix quota constraints funcs for pvc and service objects

Fixes https://github.com/kubernetes/kubernetes/issues/30315

Automatic merge from submit-queue

AppArmor PodSecurityPolicy support

Implements the AppArmor PodSecurityPolicy support based on the alpha API proposed [here](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/apparmor.md#pod-security-policy)

This implementation deviates from the original proposal in one way: it adds a separate option for specifying a default profile:
```
apparmor.security.alpha.kubernetes.io/defaultProfileName
```
This has several advantages over the original proposal:

- The default is explicit, rather than implicit on the ordering
- The default can be specified without constraining the allowed profiles
- The allowed profiles can be restricted without specifying a default (requires every pod to explicitly set a profile)

The E2E cluster does not currently enable the PodSecurityPolicy, so I will submit E2E tests in a separate PR.

/cc @dchen1107 @pweil- @sttts @jfrazelle @Amey-D