Automatic merge from submit-queue (batch tested with PRs 52685, 53344). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Don't referece not-exist addon manager manifests in comment

**What this PR does / why we need it**:
`addon-manager-multinode.json` and `addon-manager-singlenode.json` have been removed by https://github.com/kubernetes/kubernetes/commit/b814b624474a387eb05172ac8155c79be3fca8b3#diff-89347a70de188b3c15f5ee15323658d2.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #NONE

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

bazel: make //cmd/kubectl:kubectl binary publicly visible

**What this PR does / why we need it**: making the `kubectl` binary visible to the release rules only seems unnecessarily restrictive (x-ref https://github.com/bazelbuild/bazel/issues/3744) - I think making this publicly visible should be fine.

**Release note**:

```release-note
NONE
```

/assign @monopole 
cc @achew22

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Version should be quoted so jq doesn't interpret it as numeric

fixes: #https://github.com/kubernetes/kubeadm/issues/477

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Upgrade fluentd-elasticsearch addon to Elasticsearch/Kibana 5.6.2

Upgrade Elasticsearch and Kibana to version 5.6.2. I also upgrade some API versions of manifests to correspond to Kubernetes 1.8, I hope the latter is uncontroversial?

```release-notes
```

Automatic merge from submit-queue (batch tested with PRs 50555, 51152). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Implement CRI stats in Docker Shim

**What this PR does / why we need it**:
This PR implements CRI Stats in the Docker Shim. It is needed to enable CRI stats for Docker and ongoing /stats/summary API changes in moving to use CRI.

Related issues:
#46984 (CRI: instruct kubelet to (optionally) consume container stats from CRI)
#45614 (CRI: add methods for container stats) 

This PR is also a followup to my original PR (https://github.com/kubernetes/kubernetes/pull/50396) to implement Windows Container Stats. The plan is that Windows Stats will use a hybrid model: pod and container level stats will come from CRI (via dockershim) and that node level stats will come from a "winstats" package that exports cadvisor like datastructures using windows specific perf counters from the node. I will update that PR to only export node level stats. 

@yujuhong @yguo0905 @dchen1107 @jdumars @anhowe @michmike

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

threadSafeMap: panic if index function call fails

**Which issue this PR fixes**
Fixes #43605

**Release note**:
```release-note
NONE
```
/kind bug
/sig api-machinery

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

moved admission interfaces WantsClientCert, WantsAuthorizer and Wants…

**What this PR does / why we need it**:
moves some admission interfaces to apiserver, hopefully moving the webhook admission in the future will be much easier.

**Release note**:

```
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove unused variables and constant from pkg/apis/componentconfig/v1…

…alpha1/defaults.go

This commit will remove variables `zeroDuration`, `defaultNodeAllocatableEnforcement` and
constants `defaultIPTablesMasqueradeBit` and `defaultIPTablesDropBit` as they are unused.



```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remake cluster size autoscaling scale to zero test

This PR affects only cluster size autoscaling test suite. Changes:
* check whether autoscaling for is enabled by looking for a node group with a given max number of nodes instead of min as the field is omitted if value is 0
* split scale to zero test into GKE & GCE versions, add GKE-specific setup and verification

Automatic merge from submit-queue (batch tested with PRs 52395, 53322). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Send VolumeMismatch event to PVC

PV controller should send events to PVCs and not PVs when a PVC requests a PV that's either too small or has mismatching StorageClass.

Regular users can't see events on PVs so `kubectl describe pvc` is the only way how to tell user that something is wrong.

**Release note**:

```release-note
NONE
```

/sig storage
@kubernetes/sig-storage-pr-reviews

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

enable to specific unconfined AppArmor profile

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #52370

**Special notes for your reviewer**:
/assign @tallclair @liggitt 

**Release note**:

```release-note
enable to specific unconfined AppArmor profile
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

openapi: Validate unregistered type, if they can be found

**What this PR does / why we need it**:
Types that are not registered/hard-coded in kubectl won't be validated, even if they could because they are defined in openapi. If they are neither registered nor in openapi, then skip validation. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes nothing

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53247, 53319). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[cluster-monitoring addon] Update monitoring-influxdb-grafana to latest version

**What this PR does / why we need it**:
In cluster-monitoring addon, the `monitoring-influxdb-grafana` part of the content is too old, so I modified some file to update, this has been tested on v1.7.7, v1.8.0.

**Special notes for your reviewer**:

**Release note**:

```release-note
Update Influxdb image to latest version.
Update Grafana image to latest version.
Change influxdb-grafana-controller resource to Deployment.
```

Automatic merge from submit-queue (batch tested with PRs 53247, 53319). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove unused function addStorageLimit

**What this PR does / why we need it**:

In package `plugin/pkg/scheduler/algorithm/predicates` remove unused
unexported function `addStorageLimit`.


**Release note**:

```release-note
NONE
```

PV controller should send events to PVCs and not PVs when a PVC requests PV
that's either too small or has mismatching StorageClass.

Regular users can't see events on PVs so `kubectl describe pvc` is the only
way how to tell user that something is wrong.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

create separate transports for liveness and readiness probes

There is currently an issue with the http2 connection pools in golang such that two GETs to the same host:port using the same Transport can collide and one gets rejected with `http2: no cached connection was available`.  This happens with readiness and liveness probes if the intervals line up such that worker goroutines invoke the two probes at the exact same time.

The result is a transient probe error that appears in the events.  If the failureThreshold is 1, which is kinda crazy, it would cause a pod restart.

The PR creates a separate `httprobe` instance for readiness and liveness probes so that they don't share a Transport and connection pool.

Fixes https://github.com/kubernetes/kubernetes/issues/49740

@smarterclayton @jhorwit2

Implement CRI stats for dockershim using docker stats. This enables use
of the summary api to get container metrics on Windows where CRI stats
are enabled.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Eliminate extra CRI call during processing cpu set

**What this PR does / why we need it**:

Encountered this during `kubernetes/frakti` node e2e test.

When cpuset is not set, there's still plenty of `runtime.UpdateContainerResources` been called, which seems unnecessary.

cc @ConnorDoyle Make sense? Fixes: #53304

**Special notes for your reviewer**:

**Release note**:

```release-note
Only do UpdateContainerResources when cpuset is set 
```

moved admission interfaces WantsClientCert, WantsAuthorizer and WantsExternalKubeClientSet to apiserver

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Migrate sig-ui e2e test

**What this PR does / why we need it**:
Migrate sig-ui e2e tests

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Ref Umbrella issue #49161

**Special notes for your reviewer**:

**Release note**:

none

Automatic merge from submit-queue (batch tested with PRs 51034, 53239). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Correct APIGroup for RoleBindingBuilder Subjects

This change corrects `RoleBindingBuilder` to use the RBAC API group with users and groups as subjects (service accounts use the empty string since they are in the legacy core group).  This is based on the defaulting in `pkg/apis/rbac/v1/defaults.go#SetDefaults_Subject`.  This is required because the bootstrap RBAC data is built with these helpers and does not go through defaulting, whereas the data retrieved from the server has already gone through defaulting.  This can lead to the reconciliation code incorrectly adding duplicate subjects because it believes that they are missing (since the API groups do not match).
Signed-off-by: Monis Khan <mkhan@redhat.com>

```release-note
Fixes an issue with RBAC reconciliation that could cause duplicated subjects in some bootstrapped rolebindings on each restart of the API server.
```

/assign @liggitt
/sig auth

Fixes #53296
Fixes openshift/origin/issues/16611

Automatic merge from submit-queue (batch tested with PRs 51034, 53239). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix conditional for warning while starting KCM without secret file

@liggitt @spiffxp @lavalamp 

Fixes #53291

A small bug was introduced in this PR - https://github.com/kubernetes/kubernetes/pull/50288, where the warning message is printed when the file is specified, and it is not printed if it is left blank - exactly the opposite of the intended behavior. 

This fixes that.

```
release-note-none
```

This change corrects RoleBindingBuilder to use the RBAC API group
with users and groups as subjects (service accounts use the empty
string since they are in the legacy core group).  This is based on
the defaulting in pkg/apis/rbac/v1/defaults.go#SetDefaults_Subject.
This is required because the bootstrap RBAC data is built with these
helpers and does not go through defaulting, whereas the data
retrieved from the server has already gone through defaulting.  This
can lead to the reconciliation code incorrectly adding duplicate
subjects because it believes that they are missing (since the API
groups do not match).
Signed-off-by: Monis Khan <mkhan@redhat.com>

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Godep scripts cleanup

Another try at sanitizing godep scripts.  Instead of messing with containers, or assuming anything about GOPATHs, let's just work with whatever GOPATH we are given.  If you want sane godep/restore behavior you can use `./hack/run-in-gopath.sh ./hack/godep-restore.sh`.  This will restore into your _output dir.  You can update deps yourself, and then run `./hack/run-in-gopath.sh ./hack/godep-save.sh`.

xref  #44873

This also checks out godep into your working GOPATH.  Without this, we have to `go get` it every time.  We should just vendor it.

Automatic merge from submit-queue (batch tested with PRs 49705, 53229). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix kubeadm upgrade grammar.

**What this PR does / why we need it**:
I noticed an erroneous word in the output from the kubeadm upgrade docs. This error message currently reads:

"Note: Before you **do** can perform this upgrade, you have to update kubeadm to..."



**Release note**:

```release-note
NONE
```

CC @kubernetes/sig-cluster-lifecycle-pr-reviews

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Ring buffer for shared informer notifications

**What this PR does / why we need it**:
Improves memory allocation for shared informer listeners. Instead of always appending to the slice use as a ring buffer, avoiding reslice operations as long as there is room in the slice. See https://github.com/kubernetes/kubernetes/pull/47045#issuecomment-317621259 for details. This is a follow up PR for #47045.

Results from BenchmarkListener:
```
Current code (from the #47045):
1000000	      1540 ns/op	     109 B/op	       1 allocs/op
```
```
New code:
1000000	      1162 ns/op	      16 B/op	       1 allocs/op
```

**Special notes for your reviewer**:
Only review the last commit, this branch is based on #47045 PR. I'll rebase onto master once it is merged.

**Release note**:

```release-note
NONE
```
/kind enhancement
/sig api-machinery
/cc @deads2k @ncdc

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

gce: remove compute-rw, see what breaks

Fixes https://github.com/kubernetes/kubernetes/issues/8074

**Release note**:
```release-note
```

Automatic merge from submit-queue (batch tested with PRs 53234, 53252, 53267, 53276, 53107). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix imagefs stats

Without this CRI stats based summary api won't work:
```console
$ curl localhost:10255/stats/summary
Internal Error: failed to get root cgroup stats: failed to get imageFs info: no imagefs label for configured runtime
```
With this PR, we could get summary api from cri-containerd now:
```console
$ curl localhost:10255/stats/summary
{
  "node": {
   "nodeName": "127.0.0.1",
   "startTime": "2017-09-23T06:26:49Z",
   "cpu": {
    "time": "2017-09-27T05:12:08Z",
    "usageNanoCores": 275510572,
    "usageCoreNanoSeconds": 11924595625329
   },
   "memory": {
    "time": "2017-09-27T05:12:08Z",
    "availableBytes": 27737075712,
    "usageBytes": 6028234752,
    "workingSetBytes": 3884470272,
    "rssBytes": 652304384,
    "pageFaults": 98472,
    "majorPageFaults": 87
   },
   "fs": {
    "time": "2017-09-27T05:12:08Z",
    "availableBytes": 75281231872,
    "capacityBytes": 104022159360,
    "usedBytes": 28724150272,
    "inodesFree": 12003204,
    "inodes": 12800000,
    "inodesUsed": 796796
   },
   "runtime": {
    "imageFs": {
     "time": "2017-09-27T05:12:00Z",
     "availableBytes": 75281231872,
     "capacityBytes": 104022159360,
     "usedBytes": 247732356,
     "inodesFree": 12003204,
     "inodes": 12800000,
     "inodesUsed": 6103
    }
   }
  },
  "pods": [
   {
    "podRef": {
     "name": "kube-dns-7797cb8758-qxkrz",
     "namespace": "kube-system",
     "uid": "4425b069-a342-11e7-ac90-42010af00002"
    },
    "startTime": "2017-09-27T05:11:23Z",
    "containers": [
     {
      "name": "kubedns",
      "startTime": "2017-09-27T05:11:24Z",
      "cpu": {
       "time": "1970-01-01T00:00:01Z",
       "usageCoreNanoSeconds": 154194917
      },
      "memory": {
       "time": "1970-01-01T00:00:01Z",
       "workingSetBytes": 7643136
      },
      "rootfs": {
       "time": "2017-09-27T05:12:00Z",
       "availableBytes": 75281231872,
       "capacityBytes": 104022159360,
       "usedBytes": 9,
       "inodesFree": 12003204,
       "inodes": 12800000,
       "inodesUsed": 32768
      },
      "logs": {
       "time": "2017-09-27T05:12:08Z",
       "availableBytes": 75281231872,
       "capacityBytes": 104022159360,
       "inodesFree": 12003204,
       "inodes": 12800000
      },
      "userDefinedMetrics": null
     },
     {
      "name": "dnsmasq",
      "startTime": "2017-09-27T05:11:24Z",
      "cpu": {
       "time": "1970-01-01T00:00:01Z",
       "usageCoreNanoSeconds": 114482989
      },
      "memory": {
       "time": "1970-01-01T00:00:01Z",
       "workingSetBytes": 7966720
      },
      "rootfs": {
       "time": "2017-09-27T05:12:00Z",
       "availableBytes": 75281231872,
       "capacityBytes": 104022159360,
       "usedBytes": 9,
       "inodesFree": 12003204,
       "inodes": 12800000,
       "inodesUsed": 28675
      },
      "logs": {
       "time": "2017-09-27T05:12:08Z",
       "availableBytes": 75281231872,
       "capacityBytes": 104022159360,
       "inodesFree": 12003204,
       "inodes": 12800000
      },
      "userDefinedMetrics": null
     },
     {
      "name": "sidecar",
      "startTime": "2017-09-27T05:11:24Z",
      "cpu": {
       "time": "1970-01-01T00:00:01Z",
       "usageCoreNanoSeconds": 140797580
      },
      "memory": {
       "time": "1970-01-01T00:00:01Z",
       "workingSetBytes": 7430144
      },
      "rootfs": {
       "time": "2017-09-27T05:12:00Z",
       "availableBytes": 75281231872,
       "capacityBytes": 104022159360,
       "usedBytes": 8,
       "inodesFree": 12003204,
       "inodes": 12800000,
       "inodesUsed": 28672
      },
      "logs": {
       "time": "2017-09-27T05:12:08Z",
       "availableBytes": 75281231872,
       "capacityBytes": 104022159360,
       "inodesFree": 12003204,
       "inodes": 12800000
      },
      "userDefinedMetrics": null
     }
    ],
    "volume": [
     {
      "time": "2017-09-27T05:12:03Z",
      "availableBytes": 15810760704,
      "capacityBytes": 15810772992,
      "usedBytes": 12288,
      "inodesFree": 3860043,
      "inodes": 3860052,
      "inodesUsed": 9,
      "name": "kube-dns-token-l2blr"
     }
    ]
   }
  ]
 }
```
Signed-off-by: Lantao Liu <lantaol@google.com>

```release-note
Fix the bug that query Kubelet's stats summary with CRI stats enabled results in error.
```