Automatic merge from submit-queue (batch tested with PRs 41857, 41864, 40522, 41835, 41991)

Use new conversions in patch

Ref #39017

Automatic merge from submit-queue (batch tested with PRs 41857, 41864, 40522, 41835, 41991)

kubectl: Allow 'drain --force' to remove orphaned pods

If the managing resource of a given pod (e.g. DaemonSet/ReplicaSet/etc) is deleted (effectively orphaning the pod), and ``kubectl drain --force`` is invoked on the node hosting the pod, the command would fail with an error indicating that the managing resource was not found.  This PR reduces the error to a warning if ``--force`` is specified, allowing nodes with orphaned pods to be drained.   

Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1424678

cc: @derekwaynecarr 

```release-note
Allow drain --force to remove pods whose managing resource is deleted.
```

Automatic merge from submit-queue (batch tested with PRs 41857, 41864, 40522, 41835, 41991)

kubeadm: update token separator to '.'

**What this PR does / why we need it**: From SIG meetings, it was agreed upon to have '.' be the separator for tokens. This PR updates that. 

**Special notes for your reviewer**: /cc @luxas @jbeda

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 41814, 41922, 41957, 41406, 41077)

add kubectl can-i to see if you can perform an action

Adds `kubectl auth can-i <verb> <resource> [<name>]` so that a user can see if they are allowed to perform an action.

@kubernetes/sig-cli-pr-reviews @fabianofranz 

This particular command satisfies the immediate need of knowing if you can perform an action without trying that action.  When using RBAC in a script that is adding permissions, there is a lag between adding the permission and the permission being realized in the RBAC cache.  As a user on the CLI, you almost never see it, but as a script adding a binding and then using that new power, you hit it quite often.

There are natural follow-ons to the same area (hence the `auth` subcommand) to figure out if someone else can perform an action, what actions you can perform in total, and who can perform a given action.  Someone else is an API we have already, what-can-i-do was a proposed API a while back and a very useful one for interfaces, and who-can is common question if someone is administering a namespace.

Automatic merge from submit-queue (batch tested with PRs 41814, 41922, 41957, 41406, 41077)

pv_controller: Do not report exponential backoff as error.

It's not an error when recycle/delete/provision operation cannot be started
because it has failed recently. It will be restarted automatically when
backoff expires.

This just pollutes logs without any useful information:
```
E0214 08:00:30.428073   77288 pv_controller.go:1410] error scheduling operaion "delete-pvc-1fa0e8b4-f2b5-11e6-a8bb-fa163ecb84eb[1fbd52ee-f2b5-11e6-a8bb-fa163ecb84eb]": Failed to create operation with name "delete-pvc-1fa0e8b4-f2b5-11e6-a8bb-fa163ecb84eb[1fbd52ee-f2b5-11e6-a8bb-fa163ecb84eb]". An operation with that name failed at 2017-02-14 08:00:15.631133152 -0500 EST. No retries permitted until 2017-02-14 08:00:31.631133152 -0500 EST (16s). Last error: "Cannot delete the volume \"11a4faea-bfc7-4713-88b3-dec492480dba\", it's still attached to a node".
```

```release-note
NONE
```

@kubernetes/sig-storage-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 41814, 41922, 41957, 41406, 41077)

Use consistent helper for getting secret names from pod

Kubelet secret-manager and mirror-pod admission both need to know what secrets a pod spec references. Eventually, a node authorizer will also need to know the list of secrets.

This creates a single (well, double, because api versions) helper that can be used to traverse the secret names referenced from a pod, optionally short-circuiting (for places that are just looking to see if any secrets are referenced, like admission, or are looking for a particular secret ref, like authorization)

Fixes:
* secret manager not handling secrets used by env/envFrom in initcontainers
* admission allowing mirror pods with secret references

@smarterclayton @wojtek-t

Automatic merge from submit-queue

make reconcilation generic to handle roles and clusterroles

We have a need to reconcile regular roles, so this pull moves the reconciliation code to use interfaces (still tightly coupled) rather than structs.

@liggitt @kubernetes/sig-auth-pr-reviews

Automatic merge from submit-queue

add client-ca to configmap in kube-public

Client CA information is not secret and it's required for any API server trying to terminate a TLS connection.  This pull adds the information to configmaps in `kube-public` that look like this:


```yaml
apiVersion: v1
data:
  client-ca.crt: |
    -----BEGIN CERTIFICATE-----
    -----END CERTIFICATE-----
  requestheader-allowed-names: '["system:auth-proxy"]'
  requestheader-client-ca-file: |
    -----BEGIN CERTIFICATE-----
    -----END CERTIFICATE-----
  requestheader-extra-headers-prefix: '["X-Remote-Extra-"]'
  requestheader-group-headers: '["X-Remote-Group"]'
  requestheader-username-headers: '["X-Remote-User"]'
kind: ConfigMap
metadata:
  creationTimestamp: 2017-02-22T17:54:37Z
  name: extension-apiserver-authentication
  namespace: kube-system
  resourceVersion: "6"
  selfLink: /api/v1/namespaces/kube-system/configmaps/extension-apiserver-authentication
  uid: fa1dd328-f927-11e6-8b0e-28d2447dc82b

```

@kubernetes/sig-auth-api-reviews @liggitt @kubernetes/sig-api-machinery-pr-reviews @lavalamp @sttts 


There will need to be a corresponding pull for permissions

Automatic merge from submit-queue (batch tested with PRs 40932, 41896, 41815, 41309, 41628)

Factor new GetClusterNodes() out of CreateVolume().

Automatic merge from submit-queue (batch tested with PRs 40932, 41896, 41815, 41309, 41628)

Add custom CA file to openstack cloud provider config

**What this PR does / why we need it**: Adds ability to specify custom CA bundle file to verify OpenStack endpoint against. Useful in tests and PoC deployments. Similar to what https://github.com/kubernetes/kubernetes/pull/35488 did for authentication.  


**Which issue this PR fixes**: None

**Special notes for your reviewer**: Based on https://github.com/kubernetes/kubernetes/pull/35488 which added support for custom CA file for authentication.

**Release note**:

Merge pull request #41815 from kevin-wangzefeng/enable-defaulttolerationseconds-admission-controller

Automatic merge from submit-queue (batch tested with PRs 40932, 41896, 41815, 41309, 41628)

enable DefaultTolerationSeconds admission controller by default

**What this PR does / why we need it**:
Continuation of PR #41414, enable DefaultTolerationSeconds admission controller by default.


**Which issue this PR fixes**: 
fixes: #41860
related Issue: #1574, #25320
related PRs: #34825, #41133, #41414 

**Special notes for your reviewer**:

**Release note**:

```release-note
enable DefaultTolerationSeconds admission controller by default
```

Automatic merge from submit-queue (batch tested with PRs 40932, 41896, 41815, 41309, 41628)

Make DaemonSets survive taint-based evictions when nodes turn unreachable/notReady

**What this PR does / why we need it**:
DaemonPods shouldn't be deleted by NodeController in case of Node problems.
This PR is to add infinite tolerations for Unreachable/NotReady NoExecute Taints, so that they won't be deleted by NodeController when a node goes unreachable/notReady.

**Which issue this PR fixes** :
fixes #41738 
Related PR: #41133


**Special notes for your reviewer**:

**Release note**:

```release-note
Make DaemonSets survive taint-based evictions when nodes turn unreachable/notReady.
```

Automatic merge from submit-queue (batch tested with PRs 40932, 41896, 41815, 41309, 41628)

Modify CronJob API to add job history limits, cleanup jobs in controller

**What this PR does / why we need it**:
As discussed in #34710: this adds two limits to `CronJobSpec`, to limit the number of finished jobs created by a CronJob to keep.

**Which issue this PR fixes**: fixes #34710

**Special notes for your reviewer**:

cc @soltysh, please have a look and let me know what you think -- I'll then add end to end testing and update the doc in a separate commit. What is the timeline to get this into 1.6?

The plan:

- [x] API changes
  - [x] Changing versioned APIs
    - [x] `types.go`
    - [x] `defaults.go` (nothing to do)
    - [x] `conversion.go` (nothing to do?)
    - [x] `conversion_test.go` (nothing to do?)
  - [x] Changing the internal structure
    - [x] `types.go`
    - [x] `validation.go`
    - [x] `validation_test.go`
  - [x] Edit version conversions
    - [x] Edit (nothing to do?)
    - [x] Run `hack/update-codegen.sh`
  - [x] Generate protobuf objects
    - [x] Run `hack/update-generated-protobuf.sh`
  - [x] Generate json (un)marshaling code
    - [x] Run `hack/update-codecgen.sh`
  - [x] Update fuzzer
- [x] Actual logic
- [x] Unit tests
- [x] End to end tests
- [x] Documentation changes and API specs update in separate commit


**Release note**:

```release-note
Add configurable limits to CronJob resource to specify how many successful and failed jobs are preserved.
```

Automatic merge from submit-queue (batch tested with PRs 41621, 41946, 41941, 41250, 41729)

Refactor printers and describers into their own package.

This sets the stage for using printer code from the server side (decoupled from kubectl) and loosens the coupling between kubectl and the printers. `pkg/printers` contains interfaces and has an import restriction against pulling in API specific code, while `pkg/printers/internalversion` can be used for internal types.

Add a method on `Factory` for retrieving PrinterForCommand which uses the Scheme and RESTMapper from the Factory, not the hardcoded ones.  This further separates kubectl from the core API scheme and allows better composition.

Change NamePrinter to use RESTMapper (previously it was hardcoding those conversions). This means that we now return plural resource names (`pods/foo`) but is correct once aliases and shortnames start being returned by the mapper.

This is a prerequisite for server side get, but is pure refactor (contains no new features).

@deads2k @liggitt

Automatic merge from submit-queue (batch tested with PRs 41621, 41946, 41941, 41250, 41729)

controller: poll replica sets from the cache

Automatic merge from submit-queue (batch tested with PRs 41621, 41946, 41941, 41250, 41729)

Deprecate outofdisk-transition-frequency and low-diskspace-threshold-mb flags

This is a prerequisite for #41654.

See the [kubelet eviction docs](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/kubelet-eviction.md#deprecation-of-existing-features) for more information.

cc @vishh

Automatic merge from submit-queue (batch tested with PRs 41621, 41946, 41941, 41250, 41729)

bug fix for hostport-syncer

fix a bug introduced by the previous refactoring of hostport-syncer.  https://github.com/kubernetes/kubernetes/pull/39443
and fix some nits

Automatic merge from submit-queue

BestEffort QoS class has min cpu shares

**What this PR does / why we need it**:
BestEffort QoS class is given the minimum amount of CPU shares per the QoS design.

Automatic merge from submit-queue (batch tested with PRs 42106, 42094, 42069, 42098, 41852)

Write etcd_upgrade test.

Part of the fix for #40636

Automatic merge from submit-queue (batch tested with PRs 42106, 42094, 42069, 42098, 41852)

Fix availableReplicas validation

An available replica is a ready replica, not the other way around

@kubernetes/sig-apps-bugs caught while testing https://github.com/kubernetes/kubernetes/pull/42097

Automatic merge from submit-queue (batch tested with PRs 42106, 42094, 42069, 42098, 41852)

Pod deletion observation is flaking, increase timeout and debug more

We can afford to wait longer than 30 seconds, and we should be printing
more error and output information about the cause of the failure.

Fixes / triages #41902

Automatic merge from submit-queue (batch tested with PRs 42106, 42094, 42069, 42098, 41852)

Add OWNERS for sample-apiserver in staging

Automatic merge from submit-queue (batch tested with PRs 42106, 42094, 42069, 42098, 41852)

Add ncdc to test/OWNERS

**What this PR does / why we need it**: add me to test/OWNERS

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

cc @kubernetes/sig-testing-pr-reviews @smarterclayton @bgrant0607

Revert storage v1

This reverts commit 5984607c, reversing
changes made to 067f92e7.

This reverts commit 59735fb9, reversing
changes made to 197bd532.

Keep using storage v1beta1 until GKE enables it

Automatic merge from submit-queue

Protect kubeproxy deployed via kube-up from system OOMs

This change is necessary until it can be moved to Guaranteed QoS Class.

For #40573

Automatic merge from submit-queue

apiserver: self-signed in-memory cert for loopback

We had complicated logic before to find a matching (SNI- or server-) cert for the loopback device. In the worst case, bootstrapping failed because the provided certs didn't have the binding IP or localhost.

We now pass an artifical `ServerName` "apiserver-loopback-client" with the loopback client and install a self-signed in-memory cert+key into the server for that hostname. The client accepts the corresponding cert.

Fixing https://github.com/kubernetes/kubernetes/issues/41081

Automatic merge from submit-queue (batch tested with PRs 41854, 41801, 40088, 41590, 41911)

Bump gcr.io/google-containers/rescheduler to v0.2.2

**What this PR does / why we need it**: updates the rescheduler image to one based on busybox instead of ubuntu-slim. Changes for the image were in https://github.com/kubernetes/contrib/pull/2390.

Do you think this merits a release note? I'm leaning towards no.

**Release note**:

```release-note
Update gcr.io/google-containers/rescheduler to v0.2.2, which uses busybox as a base image instead of ubuntu.
```

cc @timstclair

Automatic merge from submit-queue (batch tested with PRs 41854, 41801, 40088, 41590, 41911)

add kube-aggregator to hyperkube

Adds kube-aggregator to hyperkube.

@lavalamp @pwittrock @kubernetes/sig-api-machinery-misc @smarterclayton 

Google publishes a hyperkube image somewhere, right?

Automatic merge from submit-queue (batch tested with PRs 41854, 41801, 40088, 41590, 41911)

Add storage.k8s.io/v1 API

v1 API is direct copy of v1beta1 API. This v1 API gets installed and exposed in this PR, I tested that kubectl can create both v1beta1 and v1 StorageClass.

~~Rest of Kubernetes (controllers, examples,. tests, ...) still use v1beta1 API, I will update it when this PR gets merged as these changes would get lost among generated code.~~ Most parts use v1 API now, it would not compile / run tests without it.

**Release note**:
```
Kubernetes API storage.k8s.io for storage objects is now fully supported and is available as storage.k8s.io/v1. Beta version of the API storage.k8s.io/v1beta1 is still available in this release, however it will be removed in a future Kubernetes release.

Together with the API endpoint, StorageClass annotation "storageclass.beta.kubernetes.io/is-default-class" is deprecated and  "storageclass.kubernetes.io/is-default-class" should be used instead to mark a default storage class. The beta annotation is still working in this release, however it won't be supported in the next one.
```

@kubernetes/sig-storage-misc

Automatic merge from submit-queue (batch tested with PRs 41854, 41801, 40088, 41590, 41911)

Fix  some typos

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 41854, 41801, 40088, 41590, 41911)

Default storage class for vSphere Fixes #40070

**What this PR does / why we need it**:

Create default storage class for vSphere. This is part of the storage class GA effort https://github.com/kubernetes/features/issues/36

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

fixes #40070

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 40665, 41094, 41351, 41721, 41843)

Do not run kubelet in test-cmd.sh

The tests are intended to test only `kubectl` commands and do not
require kubelet.

This fixes #41834

/cc @Random-Liu @dchen1107 @nikhiljindal

Automatic merge from submit-queue (batch tested with PRs 40665, 41094, 41351, 41721, 41843)

kubeadm: Add a --ca-cert-path flag to kubeadm join

**What this PR does / why we need it**:

This PR makes it possible to customize where the CA file is written

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```
@pires @mikedanese @dmmcquay @jbeda @errordeveloper

Automatic merge from submit-queue (batch tested with PRs 40665, 41094, 41351, 41721, 41843)

Multi master patch

**What this PR does / why we need it**: Corrects a sync files issue present when running in a HA Master configuration. This PR adds logic to syncronize on first deployment for `/etc/kubernetes/serviceaccount.key` which will cause cypto verification failure if not 1:1 on each master unit. Additionally syncs basic_auth and additional files in /srv/kubernetes. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #41019

**Special notes for your reviewer**: This requires PR #41251 as a dependency before merging. 

**Release note**:

```release-note
Juju - K8s master charm now properly keeps distributed master files in sync for an HA control plane.
```