Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Vendor gazelle and kazel

Rather that relying on upstream git repos that can break, vendor it all.  These are NOT head of tree, respectively - they are some backrev forms that were previously being used.

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fixtodo:rsDeepCopy only when sizeNeedsUpdate or annotationsNeedUpdate

**What this PR does / why we need it**:
```
// TODO: Do not mutate the replica set here, instead simply compare the annotation and if they mismatch
// call SetReplicasAnnotations inside the following if clause. Then we can also move the deep-copy from
// above inside the if too.
```
fixtodo:rsDeepCopy only when sizeNeedsUpdate or annotationsNeedUpdate
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use typed events client directly

**What this PR does / why we need it**:
This PR addresses the TODO - the typed events client can be used directly without wrapping.

**Release note**:

```release-note
NONE
```
/kind cleanup

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix broken link

**What this PR does / why we need it**:
Fix broken link for `versioning.md`

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
None

**Special notes for your reviewer**:

**Release note**:

```release-note
None
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Tolerate 406 mime-type errors attempting to load new openapi schema

Fixes #61805
Fixes #61943 

```release-note
kubectl: improves compatibility with older servers when creating/updating API objects
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Adding metrics server

**What this PR does / why we need it**:
Adds support for the metrics server in the kubernetes-master charm. This allows the use of a horizontal pod autoscaler.
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #
https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/484
**Special notes for your reviewer**:
Needs to go in after https://github.com/juju-solutions/cdk-addons/pull/28
**Release note**:

```release-note
kubernetes-master charm now supports metrics server for horizontal pod autoscaler.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

default use kube-system namespace as policyConfigmapNamespace

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubernetes/issues/61368

**Special notes for your reviewer**:
cc @kubernetes/sig-scheduling-pr-reviews

**Release note**:

```release-note
fix scheduling policy on ConfigMap breaks without the --policy-configmap-namespace flag set
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Restore show-kind function when printing multiple kinds

Fixes #61979 

* Makes the human readable printer work off the options given to it for displaying kind
* Simplifies get.go to pass showkind/kind options into the printer rather than doing conditional fixup afterward

```release-note
kubectl: restore the ability to show resource kinds when displaying multiple objects
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Updated README for ipvs.

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/area ipvs

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix flag message about TokenRequest

fix help message about TokenRequest flags



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

init annotations if it is nil to fix kubemci e2e test failures

Initializing ingress.annotations before setting an annotation to fix `assignment to entry in nil map` error.

Logs: https://storage.googleapis.com/kubernetes-jenkins/logs/ci-kubemci-ingress-conformance/1035/build-log.txt
```
I0331 21:01:42.915] [91m[1m•! Panic [43.203 seconds][0m
I0331 21:01:42.915] [sig-network] Loadbalancing: L7
I0331 21:01:42.916] [90m/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/network/framework.go:22[0m
I0331 21:01:42.916]   GCE [Slow] [Feature:kubemci]
I0331 21:01:42.916]   [90m/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/network/ingress.go:578[0m
I0331 21:01:42.917]     [91m[1mshould create ingress with backend HTTPS [It][0m
I0331 21:01:42.917]     [90m/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/network/ingress.go:636[0m
I0331 21:01:42.917] 
I0331 21:01:42.918]     [91m[1mTest Panicked[0m
I0331 21:01:42.918]     [91massignment to entry in nil map[0m
I0331 21:01:42.918]     /usr/local/go/src/runtime/panic.go:491
I0331 21:01:42.919] 
I0331 21:01:42.919]     [91mFull Stack Trace[0m
I0331 21:01:42.919]     	/usr/local/go/src/runtime/panic.go:491 +0x283
I0331 21:01:42.920]     k8s.io/kubernetes/test/e2e/framework.(*IngressTestJig).SetUpBacksideHTTPSIngress(0xc420fe6840, 0x63514e0, 0xc42092ec30, 0xc420374da0, 0x17, 0xc4217a7650, 0x2c, 0x0, 0x0, 0x0, ...)
I0331 21:01:42.920]     	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/ingress_utils.go:1630 +0x86b
I0331 21:01:42.920]     k8s.io/kubernetes/test/e2e/network.executeBacksideBacksideHTTPSTest(0xc4211d1040, 0xc420fe6840, 0xc4217a7650, 0x2c)
I0331 21:01:42.921]     	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/network/ingress.go:746 +0xbe
I0331 21:01:42.921]     k8s.io/kubernetes/test/e2e/network.glob..func6.4.5()
I0331 21:01:42.921]     	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/network/ingress.go:637 +0x4b
I0331 21:01:42.922]     k8s.io/kubernetes/vendor/github.com/onsi/ginkgo/internal/leafnodes.(*runner).runSync(0xc4213ad440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
I0331 21:01:42.922]     	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/e2e.go:332 +0x219
I0331 21:01:42.922]     k8s.io/kubernetes/test/e2e.TestE2E(0xc42092e1e0)
I0331 21:01:42.922]     	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/e2e_test.go:48 +0x2b
I0331 21:01:42.923]     testing.tRunner(0xc42092e1e0, 0x41a1c50)
I0331 21:01:42.923]     	/usr/local/go/src/testing/testing.go:746 +0xd0
I0331 21:01:42.923]     created by testing.(*T).Run
I0331 21:01:42.923]     	/usr/local/go/src/testing/testing.go:789 +0x2de
```

```release-note
NONE
```

cc @MrHohn @G-Harmon @csbell

Automatic merge from submit-queue (batch tested with PRs 59533, 61971). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Make certificate approve/deny no-op if CSR is already approved

Approval for CSRs is only needed once. If the CSR is already approved or
denied we can skip updating it. Add a `--force` flag that allows the
existing behavior for when a user has a specific need to update the CSR.

This is backwards compatible with the intended use of the conditions,
although it's possible some users are depending on the status being
updated. It makes bulk approval as an admin much faster for scripting.

@kubernetes/sig-auth-pr-reviews 

```release-note
`kubectl certificate approve|deny` will not modify an already approved or denied CSR unless the `--force` flag is provided.
```

Automatic merge from submit-queue (batch tested with PRs 59533, 61971). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Enable equiv class cache in scheduler integration test in unified way

**What this PR does / why we need it**:

Cleaned up scheduler integration tests to: 1. Use FeatureGate 2. Remove workaround const 3. In a unified way.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #59384

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 61929, 61965). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix dockershim CreateContainer error handling.

Found this bug in CRI validation test https://github.com/kubernetes-incubator/cri-tools/pull/282.

In https://github.com/kubernetes/kubernetes/pull/52077, we expect container creation to return error if `RunAsGroup` is specified without `RunAsUser` or `RunAsUsername`. However, the error returned is not handled.

@krmayankk This is only a corner case. Does this worth cherry-pick into 1.10?
@kubernetes/sig-node-bugs 
Signed-off-by: Lantao Liu <lantaol@google.com>

**Release note**:

```release-note
none
```

Automatic merge from submit-queue (batch tested with PRs 61929, 61965). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove unused code in securitycontext

```release-note
none
```

Fix import path

Fix configurator name

Clean up unused import

Automatic merge from submit-queue (batch tested with PRs 61894, 61369). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Expose kubelet health checks using new prometheus endpoint

**What this PR does / why we need it**:
Expose the results of kubelet liveness and readiness probes through a new endpoint on the kubelet called /containerHealth. This endpoint will expose a Prometheus metric. Below is a snippet of output when that endpoint is queried.

```
rramkumar@e2e-test-rramkumar-master ~ $ curl localhost:10255/metrics/probes
# HELP prober_probe_result The result of a liveness or readiness probe for a container.
# TYPE prober_probe_result gauge
prober_probe_result{container_name="kube-apiserver",namespace="kube-system",pod_name="kube-apiserver-e2e-test-rramkumar-master",pod_uid="949e11ad296ad9e3c842fd900f8cc723",probe_type="Liveness"} 0
prober_probe_result{container_name="kube-controller-manager",namespace="kube-system",pod_name="kube-controller-manager-e2e-test-rramkumar-master",pod_uid="0abfc37840bba279706ec39ae53a924c",probe_type="Liveness"} 0
prober_probe_result{container_name="kube-scheduler",namespace="kube-system",pod_name="kube-scheduler-e2e-test-rramkumar-master",pod_uid="0cd4171f9c806808291e6e24f99f0454",probe_type="Liveness"} 0
prober_probe_result{container_name="l7-lb-controller",namespace="kube-system",pod_name="l7-lb-controller-v0.9.8-alpha.2-e2e-test-rramkumar-master",pod_uid="968c792f4c1772566c71403dca2407f9",probe_type="Liveness"} 0
```

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #58235



**Release note**:
```release-note
Kubelet now exposes a new endpoint /metrics/probes which exposes a Prometheus metric containing the liveness and/or readiness probe results for a container.
```

Automatic merge from submit-queue (batch tested with PRs 61894, 61369). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use range in loops; misc fixes

**What this PR does / why we need it**:
It is cleaner to use `range` in for loops to iterate over channel until it is closed.

**Release note**:
```release-note
NONE
```
/kind cleanup

Approval for CSRs is only needed once. If the CSR is already approved or
denied we can skip updating it. Add a `--force` flag that allows the
existing behavior for when a user has a specific need to update the CSR.

This is backwards compatible with the intended use of the conditions,
although it's possible some users are depending on the status being
updated. It makes bulk approval as an admin much faster for scripting.

Automatic merge from submit-queue (batch tested with PRs 54997, 61869, 61816, 61909, 60525). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Balanced resource allocation priority to include volume count on nodes.

Scheduler balanced resource allocation priority to include volume count on nodes.

/cc @aveshagarwal @abhgupta



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #58232


**Release note**:

```release-note
Balanced resource allocation priority in scheduler to include volume count on node 
```

Automatic merge from submit-queue (batch tested with PRs 54997, 61869, 61816, 61909, 60525). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Updating multicluster e2e test to ensure that controller only creates instance groups

Ref https://github.com/kubernetes/ingress-gce/issues/182

Updating the multicluster ingress e2e test to also verify that the controller does not create any other resource than instance group.

I was planning to do that using annotations first, but turns out that we have the right check for annotations: https://github.com/kubernetes/ingress-gce/blob/61d574a2c74fbb6f47e1aec0fae385cf2ca97aaf/pkg/controller/controller.go#L317 :)

Am using `length(ListResource) == 0` now but have still kept the annotation check.

cc @nicksardo @MrHohn @G-Harmon

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54997, 61869, 61816, 61909, 60525). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove alpha annotation for volume node affinity

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes # https://github.com/kubernetes/kubernetes/issues/61785

**Special notes for your reviewer**:
/assign @msau42 

**Release note**:

```release-note
ACTION REQUIRED: Alpha annotation for PersistentVolume node affinity has been removed.  Update your PersistentVolumes to use the beta PersistentVolume.nodeAffinity field before upgrading to this release
```

Automatic merge from submit-queue (batch tested with PRs 54997, 61869, 61816, 61909, 60525). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

certs: only append locally discovered addresses when we get none from the cloudprovider

The cloudprovider is right, and only cloudprovider addresses can be verified centrally, so don't add any extra when we have them.

Automatic merge from submit-queue (batch tested with PRs 54997, 61869, 61816, 61909, 60525). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Improve api validation unit test coverage

**What this PR does / why we need it**:

Add UT for ValidatePodLogOptions and AccumulateUniqueHostPorts

Before

```
coverage: 60.0% of statements
ok  	k8s.io/kubernetes/pkg/api/v1/validation	0.058s
```

After:
```
coverage: 92.9% of statements
ok  	k8s.io/kubernetes/pkg/api/v1/validation	0.057s
```

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Signed-off-by: Lantao Liu <lantaol@google.com>

Automatic merge from submit-queue (batch tested with PRs 61871, 61890, 61786). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add unit testcases for ensureExternalLoadBalancer to make sure it doesn't panic when errors raised.

**What this PR does / why we need it**:
Add unit testcases for ensureExternalLoadBalancer to make sure it doesn't panic when errors raised. Increase code coverage from 76.5% to 81.5%.

<!--
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
-->

**Release note**: 

```release-note
NONE
```

\assign @MrHohn

Automatic merge from submit-queue (batch tested with PRs 61871, 61890, 61786). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Specify DHCP domain for hostname

**What this PR does / why we need it**:

In 9a8c6db4, we looked at the hostname
in the metadata service and used '.' as the delimiter to chop off the
dhcp_domain (specified in nova.conf). However administrators need to
better control the dhcp domain better as there may be a '.' in the host
name itself. So let's introduce a config option that we can use and
default it to what nova uses when dhcp_domain is not specified which is
"novalocal"


**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
new dhcp-domain parameter to be used for figuring out the hostname of a node
```