Automatic merge from submit-queue

EventSink for federated controllers

So that the controllers can reuse k8s.io/kubernetes/pkg/client/record machinery.

cc: @quinton-hoole @nikhiljindal @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Separate federation build.sh into development and deployment scripts.

The idea behind this separation is that it provides a clear distinction
between the dev environment and the prod environment. The
deploy/deploy.sh script will be shipped to the users, but
develop/develop.sh will be purely for development purposes and won't
be part of a release distribution.

Purely for developer convenience, all the deployment functionality is
made available through the develop/develop.sh script.

This change also copies deploy/* files into the release distribution.

cc @kubernetes/sig-cluster-federation @colhom 

```release-note
Federation can now be deployed using the `federation/deploy/deploy.sh` script. This script does not depend on any of the development environment shell library/scripts. This is an alternative to the current `federation-up.sh`/`federation-down.sh` scripts. Both the scripts are going to co-exist in this release, but the `federation-up.sh`/`federation-down.sh` scripts might be removed in a future release in favor of `federation/deploy/deploy.sh` script.
```

Automatic merge from submit-queue

Support for TTLs in etcd migration.

Ref #20504

Automatic merge from submit-queue

controller: skip copying selector annotations from deployments

@kubernetes/deployment

Automatic merge from submit-queue

Fix a typo in resource-qos design doc

Automatic merge from submit-queue

Delete unused, deprecated scripts

This has been unused since https://github.com/kubernetes/kubernetes/pull/23415

Automatic merge from submit-queue

node e2e script: call 'gcloud compute' only if necessary

**What this PR does / why we need it**:

The ``gcloud compute`` is called everytime even if it is not needed.
When runnin node e2e tests on RHEL, the test-e2e-node.sh script is run
the way in which it takes execution path without ``gcloud`` invocation.

With the current code, ``gcloud`` is called everytime.
Thus introducing additional runtime dependency.

**Special notes for your reviewer**:

First introduced here: https://github.com/kubernetes/kubernetes/pull/29815

Automatic merge from submit-queue

Increase cache size for RCs

Ref #31589

[This should also help with failures of kubemark-scale.]

Automatic merge from submit-queue

[kube-proxy] Modify log level from Info to Warning when proxyMode unknown

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:

Currently, we use `glog.Infof` to print the log when proxy-mode is unknown, I think we may need to modify to `glog.Warningf`.

**Which issue this PR fixes**: 

fixes #31405

Automatic merge from submit-queue

add retries for add/update/remove taints on node in taints e2e

fixes taint update conflict in taints e2e by adding retries for add/update/remove taints on node.
ref #27655 and #31066

Automatic merge from submit-queue

bump cni to 9d5e6e6

fixes: #31348

Automatic merge from submit-queue

Don't error out if ${go_pkg_dir} already exists

I have 'make' aliased to 'make -j4' for various reasons, and that's always worked fine for Kubernetes in the past.  But it recently broke because EEXIST errors from this symlink creation are fatal.  So make them not fatal, because if the path already exists, why try to create it again?  It exists because two invocations of setup_env() are run in parallel due to the -j4, and they race to create the symlink and one obviously fails.

ln: failed to create symbolic link ‘/home/dcbw/Development/containers/kubernetes/_output/local/go/src/k8s.io/kubernetes’: File exists
Makefile.generated_files:285: recipe for target '_output/bin/deepcopy-gen' failed
make[1]: *** [_output/bin/deepcopy-gen] Error 1
make[1]: *** Waiting for unfinished jobs....
+++ [0826 10:18:02] Generating bindata:
    /home/dcbw/Development/containers/kubernetes/test/e2e/framework/gobindata_util.go
+++ [0826 10:18:02] Building the toolchain targets:
    k8s.io/kubernetes/hack/cmd/teststale
+++ [0826 10:18:03] Building go targets for linux/amd64:
    cmd/libs/go2idl/conversion-gen
Makefile:281: recipe for target 'generated_files' failed
make: *** [generated_files] Error 2

Automatic merge from submit-queue

Get network name via e2e environment.

This should work, right? I plan to pipe it through into the TestContext soon, just not today, and I'd like some test runtime over the weekend. Open to suggestions.

Automatic merge from submit-queue

[AppArmor] Promote AppArmor annotations to beta

Justification for promoting AppArmor to beta:

1. We will provide an upgrade path to GA
2. We don't anticipate any major changes to the design, and will continue to invest in this feature
3. We will thoroughly test it. If any serious issues are uncovered we can reevaluate, and we're committed to fixing them.
4. We plan to provide beta-level support for the feature anyway (responding quickly to issues).

Note that this does not include the yet-to-be-merged status annotation (https://github.com/kubernetes/kubernetes/pull/31382). I'd like to propose keeping that one alpha for now because I'm not sure the PodStatus is the right long-term home for it (I think a separate monitoring channel, e.g. cAdvisor, would be a better solution).

/cc @thockin @matchstick @erictune

Revert "Remove deprecated Namespace admission plug-ins"

The 'gcloud compute' is called everytime even if it is not needed.
When runnin node e2e tests on RHEL, the test-e2e-node.sh script is run
the way in which it takes execution path without gcloud invocation.

With the current code, gcloud is called everytime.
Thus introducing additional runtime dependency.

Automatic merge from submit-queue

add Makefile for building/pushing cni binary

fixes: #27211

Automatic merge from submit-queue

Set imagefs rank and reclaim functions when nodefs+imagefs share comm…

Fixes #31192 

I decided that the behavior should match the current output of the kubelet summary API.  With no dedicated imagefs, the ranking and reclaim functions will match the nodefs ranking and reclaim functions.

/cc @ronnielai @vishh

Automatic merge from submit-queue

Remove deprecated Namespace admission plug-ins

```release-note
The NamespaceExists and NamespaceAutoProvision admission controllers have been removed.

All cluster operators should use NamespaceLifecycle.
```

Fixes https://github.com/kubernetes/kubernetes/issues/31195

Automatic merge from submit-queue

In SJ e2e test, check only running jobs

We should filter "running" jobs in SJ e2e test


**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
NONE
```

cc @erictune @soltysh

Automatic merge from submit-queue

Fix missing expansion files in clientset release 1.4

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:
Fix missing expansion files in clientset release 1.4;
Update the client-gen tool to automatically update generated_expansion.go;
Update the readme to document the best practice of using client-gen.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

https://github.com/kubernetes/kubernetes/issues/29698#issuecomment-241315798


**Special notes for your reviewer**:

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
```

cc @lavalamp @krousey @mbohlool

Automatic merge from submit-queue

fix deleteVolume

Automatic merge from submit-queue

refactor destroy func in unit testing

Continued on https://github.com/kubernetes/kubernetes/pull/31390#issuecomment-242572312

Automatic merge from submit-queue

fix feature_gates salt plumbing

Fix salt plumbing for `--feature-gate` from `FEATURE_GATES kube env.

Was generating grains.conf and kube-env for master only. Verified it works now for gci and debian master/nodes.

cc @thockin @timstclair

Automatic merge from submit-queue

[GarbageCollector] make the gc e2e test more strict

See if there is any bug orphaning RC with large replicas.

Automatic merge from submit-queue

Add AppArmor feature gate

Add option to disable AppArmor via a feature gate. This PR treats AppArmor as Beta, and thus depends on https://github.com/kubernetes/kubernetes/pull/31471 (I will remove `do-not-merge` once that merges).

Note that disabling AppArmor means that pods with AppArmor annotations will be rejected in validation. It does not mean that the components act as though AppArmor was never implemented. This is by design, because we want to make it difficult to accidentally run a Pod with an AppArmor annotation without AppArmor protection.

/cc @dchen1107

Automatic merge from submit-queue

Fix the bug that SJ sees finished jobs as unexpected

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #31472 

**Special notes for your reviewer**:

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
NONE
```

cc @soltysh @erictune

Automatic merge from submit-queue

Print out resource name when evicting pods

This fixes #31397


/cc @derekwaynecarr

Automatic merge from submit-queue

[GarbageCollector] Increase log verbosity for Garbage collector tests

I cannot reproduce the flake of GC locally, see https://github.com/kubernetes/kubernetes/issues/28713#issuecomment-237842105, so I increased the log verbosity for Garbage collector tests.

Automatic merge from submit-queue

Add validation preventing recycle of / in a hostPath PV

Adds a validation that prevents a user from recycling `/` when it is used in a hostPath PV

cc @kubernetes/sig-storage

Automatic merge from submit-queue

add validation for PV spec to ensure correct values are used for ReclaimPolicy on initial create

k8 currently allows invalid values for ReclaimPolicy (i.e. "scotto") - this allows the PV to be created and even bound, however, when the pvc or pod is deleted and the recycler is triggered, an error is thrown

```
Events:
  FirstSeen	LastSeen	Count	From				SubobjectPath	Type		Reason				Message
  ---------	--------	-----	----				-------------	--------	------				-------
  36s		36s		1	{persistentvolume-controller }			Warning		VolumeUnknownReclaimPolicy	Volume has unrecognized PersistentVolumeReclaimPolicy
```

New behavior will not allow the user to create the PV:

```
[root@k8dev nfs]# kubectl create -f nfs-pv-bad.yaml 
The PersistentVolume "pv-gce" is invalid: spec.persistentVolumeReclaimPolicy: Unsupported value: "scotto": supported values: Delete, Recycle, Retain
```