Automatic merge from submit-queue (batch tested with PRs 63597, 63599). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

push ToRESTMapper down a layer

The RESTMapper is needed to drive some use-cases for a dynamic client and takes a little bit of wiring (nested restmappers).  This pull pushes that into information derived from the kubeconfig flags to allow easy re-use.

@kubernetes/sig-cli-maintainers 
/assign @juanvallejo 
/assign @soltysh 

assigned to original creators.


```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63597, 63599). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

don't block e2e namespace cleanup checks on metrics.k8s.io API group

e2e tests discovery persisted resource types and ensure they were cleaned up by namespace deletion

the metrics.k8s.io API group doesn't have any persisted resources, so if there is a discovery error involving that group, we can ignore it for purposes of e2e cleanup checks

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62354, 62934, 63502). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Run resource discovery in parallel

best viewed ignoring whitespace (https://github.com/kubernetes/kubernetes/pull/63502/files?w=1)

on high-latency connections, serializing resource discovery requests across group versions can take significant amounts of time. this parallelizes the network request portion of the discovery call

xref #63368 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62354, 62934, 63502). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Refactor GetResourceRequest and GetResourceLimit

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
/assign @bsalamat 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62354, 62934, 63502). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add support for AWS charm

Support AWS integration via proxy charm.



**What this PR does / why we need it**: Add support for Juju charms to connect to AWS integration charm to automatically manage IAM tags and roles, and cloud-provider setting for AWS.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 57954, 62166). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fluentd-elasticsearch addon: allow graceful shutdown in fluentd-es image.

This PR contains an optimisation to the fluentd-elasticsearch addon. Restarting fluentd pods took unnecessarily long because the start script in the image did not support propagating signals to the actual fluentd process. This patch fixes this behaviour.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 57954, 62166). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

clean up useless func in pkg/kubelet/network/plugins.go

**What this PR does / why we need it**:
clean up useless func in pkg/kubelet/network/plugins.go

**Release note**:

```release-note

```NONE

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Include more information when multiple security groups are tagged

**What this PR does / why we need it**:

When trying to create ELB we can sometime fail if there is more then one AWS
security group tagged. It very useful to get the list of security groups printed in
the error message.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
  Include the list of security groups when failing with the errors that more then one is tagged
```

Automatic merge from submit-queue (batch tested with PRs 59034, 63565, 63533). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiextensions: allow "required" at root with status subresource

In the subresources alpha we intentionally disallowed anything than `properties` at the root of the validation schema in order to allow us to project it to the .status subtree. By doing this we also disallowed `required` at the root which is necessary to enforce e.g. a spec to be set. This PR fixes this.

Moreover, it fixes that the restriction is only enforced when the status subresource is actually enabled. Before this PR we were enforcing the restriction as soon as the feature gate was enabled, leading to a backwards incompatible change.

```release-note
Allow "required" to be used at the CRD OpenAPI validation schema when the /status subresource is enabled.
```

There was an issue reporting the bug. But cannot find it.

Automatic merge from submit-queue (batch tested with PRs 59034, 63565, 63533). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Bump kube-openapi dependency

picks: https://github.com/kubernetes/kube-openapi/pull/67
ref: https://github.com/kubernetes/kubernetes/issues/63494

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 59034, 63565, 63533). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[RBD block device ]ignore the loopbackdevice error, or the rbd volume will not get detached

The rbd volume loop device maybe not found and then the volume will  not get detached.
so need to ignore the error.
@mtanino @sbezverk
Can you take a look?

Release note:
```
ignore the loopback device not found error when  `GetLoopDevice` 
```

Automatic merge from submit-queue (batch tested with PRs 63537, 63385). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[CustomResourceSubresources] fix status subresource

This change make the codes consistent with the document.
Fixes: https://github.com/kubernetes/kubernetes/issues/63359



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
/assign @nikhita 
**Release note**:

```release-note
When updating /status subresource of a custom resource, only the value at the `.status` subpath for the update is considered.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Return error when has no RequestInfo in handlerchain

**What this PR does / why we need it**:
we should return error when has no RequestInfo.
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Supported nodeSelector.matchFields in scheduler.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
part of  #61410

**Special notes for your reviewer**:

**Release note**:
```release-note
Supported nodeSelector.matchFields (node's `metadata.node`) in scheduler.
```

Automatic merge from submit-queue (batch tested with PRs 63563, 63541). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Do not check vmSetName when getting Azure node's IP

**What this PR does / why we need it**:

Do not check vmSetName when getting Azure node's IP.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #63538

**Special notes for your reviewer**:

**Release note**:

```release-note
Do not check vmSetName when getting Azure node's IP
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix cgroup names in node_container_manager_test.

**What this PR does / why we need it**:

Fix cgroup names in node_container_manager_test.

The names were made invalid for the CgroupName refactor in #62541, so update them here.

Furthermore, as the new names are now compatible with what EnforceNodeAllocatable wants, reuse the constants there as well.

Tested:
```
  $ make test-e2e-node REMOTE=true HOSTS=test-cos-beta-67-10575-27-0 FOCUS='Validate Node Allocatable' SKIP='' TEST_ARGS='--feature-gates=DynamicKubeletConfig=true'
  • [SLOW TEST:39.488 seconds]
  [k8s.io] Node Container Manager [Serial]
    Validate Node Allocatable
      set's up the node and runs the test
  Ran 1 of 261 Specs in 57.348 seconds
  SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 260 Skipped
```




**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #63549

**Special notes for your reviewer**:
/assign @dashpole 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 58580, 63120). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

-Remove TODO comment of GetNonzeroRequests function

**What this PR does / why we need it**:

-Remove TODO comment of GetNonzeroRequests function

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
NONE

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 58580, 63120). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Admit BestEffort if it tolerates memory pressure.
Signed-off-by: Da K. Ma <klaus1982.cn@gmail.com>

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #58505 

**Release note**:
```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 63297, 61883). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

set right Content-Type for configz

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63297, 61883). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix commands running crictl

**What this PR does / why we need it**:

Running "kubeadm reset --cri-socket unix:///var/run/crio/crio.sock"
fails with this error:
[reset] Cleaning up running containers using crictl with socket unix:///var/run/crio/crio.sock
[reset] Failed to list running pods using crictl. Trying using docker instead.

The actual error returned by underlying API os/exec is:
fork/exec /usr/bin/crictl -r /var/run/crio/crio.sock info: no such file or directory

This is caused by passing full command line instead of executable
path as a first parameter to the Command API.

Fixed by passing correct parameters to the Command API.
Improved error output.

**Special notes for your reviewer**:
This issue was caused by breaking crictl command execution in [PR 58802](https://github.com/kubernetes/kubernetes/pull/58802)

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63535, 63528). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Build image size map upon node info updates

@resouer 

**What this PR does / why we need it**:

The imageSizes map will be built only at each NodeInfo update and reused across pod requests between updates. 

Ideally, the node scoring part should run as fast as possible - a slow(er) one would pose as head-of-line blocking for pods in the scheduler queue. 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:

fixes #63345

**Special notes for your reviewer**:


**Release note**:

```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 63535, 63528). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Bump Heapster to v1.5.3

This PR updates heapster version in all cluster-monitoring addons

Heapster Changelog:
* Fix stackdriver metrics for node memory using wrong metric type

```release-note
Bump Heapster to v1.5.3
```
/cc @kawych

Automatic merge from submit-queue (batch tested with PRs 63364, 63464). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

vsphere: use vim25.Client directly to support token authentication

**What this PR does / why we need it**:

This refactor is in support of SAML token authentication: #63209
Avoid use of govmomi.Client as it only supports username+password authentication via SessionManager.Login().
Using vim25.Client directly will allow VCP to add other authentication methods,
such as SessionManager.LoginByToken().

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63364, 63464). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

simplify api registration

The current registration and groupmeta is only use to determine a preferred ordering to versions.  The scheme already knows about all versions, so this simply makes that knowledge official.  After doing that, the announce, registered, and apimachinery/pkg/apimachinery all drop out.

With this change we'll be able to create `install` packages for each external apigroup that accept a scheme and have suggested orderings.  This will make it possible to close the consistency gap with kubectl, client, and apiserver.

@kubernetes/sig-api-machinery-pr-reviews 
@lavalamp @smarterclayton @liggitt @sttts 

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use the logging agent's node name as the metadata agent URL.

The Stackdriver Logging agent should use the node's hostname when it constructs the Stackdriver Metadata Agent's URL, currently, it's using the GKE Master's hostname, which is a bug.

**Release note:**
```release-note
[fluentd-gcp addon] Use the logging agent's node name as the metadata agent URL.
```

The names were made invalid for the CgroupName refactor in #62541, so
update them here.

Furthermore, as the new names are now compatible with what
EnforceNodeAllocatable wants, reuse the constants there as well.

Tested:
  $ make test-e2e-node REMOTE=true HOSTS=test-cos-beta-67-10575-27-0 FOCUS='Validate Node Allocatable' SKIP='' TEST_ARGS='--feature-gates=DynamicKubeletConfig=true'
  • [SLOW TEST:39.488 seconds]
  [k8s.io] Node Container Manager [Serial]
    Validate Node Allocatable
      set's up the node and runs the test
  Ran 1 of 261 Specs in 57.348 seconds
  SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 260 Skipped

Automatic merge from submit-queue (batch tested with PRs 63526, 60371, 63444). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

update garbage collection to use the new dynamic client

Update GC to use the new and easy to use dynamic client.  This is one of two remaining stragglers.

@kubernetes/sig-api-machinery-pr-reviews 
@caesarxuchao @ironcladlou 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63526, 60371, 63444). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Support completion for kubectl cp

**What this PR does / why we need it**: With this PR, kubectl cp supports completion. I tested this PR in bash and zsh.

```
$ kubectl cp kube-system/<tab>
kube-system/kube-state-metrics-769566fdfb-4v52s:   kube-system/kubernetes-dashboard-6b6ddbd46-t5bv9:  kube-system/prometheus-694594c45b-qk5lq:
```

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes/kubectl#5

**Special notes for your reviewer**: @cblecker

**Release note**:

```release-note
`kubectl cp` supports completion.
```