Automatic merge from submit-queue (batch tested with PRs 41505, 41484, 41544, 41514, 41022)

Proxy defer on update events

This PR is a series of discrete movements in refactoring some of kube-proxy's twistier code in prep to be more async.  It should be reviewed one commit at a time.  Each commit is a smallish movement, which should be easier to examine.  I added significant tests along the way, which, unsurprisingly, found some bugs.

Automatic merge from submit-queue (batch tested with PRs 41505, 41484, 41544, 41514, 41022)

several issues hit while trying to make it easy to register APIs

I was trying to create a script that would register all API versions on a given server and ended up hitting several problems.  These are the fixes.

@sttts I suspect that I won't be able to continue down the host-network approach, since that means I won't be able to use in-cluster DNS without some finagling.  It *could* be set up (and we make it work as a for instance), but the simple enablement approach will be hosted on the infrastructure.  I'll go back to that.

Automatic merge from submit-queue (batch tested with PRs 41505, 41484, 41544, 41514, 41022)

pkg/api/install: use apimachinery/announce+registered

Make core group a little bit less special.

Automatic merge from submit-queue (batch tested with PRs 41505, 41484, 41544, 41514, 41022)

add front proxy to kubeadm created kube-apiservers

The front proxy authenticator configuration has been in a release or two.  It allows a front proxy (secured by mutual TLS auth) to provide user information for a request.  The kube-aggregator uses this to securely terminate authentication (has to terminate TLS and thus client-certs) and communicate user info to backing API servers.

Since the kube-apiserver always verifies the front-proxy via a client certificate, this isn't open for abuse unless you already have access to either the signing key or client cert which kubeadm creates locally.  If you got there, you already owned the box.  Therefore, this adds the authenticator unconditionally.

@luxas Are there e2e tests for `kubeadm`?
@liggitt @kubernetes/sig-auth-misc

Automatic merge from submit-queue (batch tested with PRs 41505, 41484, 41544, 41514, 41022)

[Federation] Fixes the newly-added test for replicaset deletion upon namespace deletion.

See #41278 for the original test.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 41466, 41456, 41550, 41238, 41416)

Don't use json.Marshal when printing error bodies

Internal types panic when json.Marshal is called to prevent accidental
use.

Fixes #40491

Automatic merge from submit-queue (batch tested with PRs 41466, 41456, 41550, 41238, 41416)

add check to authorization config

Prompt user to create the config when using abac/webhook.

Automatic merge from submit-queue (batch tested with PRs 41466, 41456, 41550, 41238, 41416)

Revert "Modify load test to not create too may services/endpoints"

Reverts kubernetes/kubernetes#40798

We seem to be ready to go for it now.

Automatic merge from submit-queue (batch tested with PRs 41466, 41456, 41550, 41238, 41416)

Delay Deletion of a Pod until volumes are cleaned up

#41436 fixed the bug that caused #41095 and #40239 to have to be reverted.  Now that the bug is fixed, this shouldn't cause problems.

 @vishh @derekwaynecarr @sjenning @jingxu97 @kubernetes/sig-storage-misc

Automatic merge from submit-queue

pkg/api/testing: add deepcopy smoke test to roundtrip test

Fixes https://github.com/kubernetes/kubernetes/issues/41438.

Automatic merge from submit-queue

Bump fluentd-gcp google_cloud plugin version

Bump the version of `fluent-plugin-google-cloud` in fluentd-gcp image, because it's broken for version `0.5.2`.

Recently, gem `google-api-client` was updated to version `0.10.0`. The new version broke `fluent-plugin-google-cloud` which doesn't specify the upper version of `google-api-client` gem. I'm bumping the version used in our image to allow future changes in this release to be run and tested.

This PR doesn't bump the version, since no effective changes has happened, leaving this for the next PR to do.

CC @igorpeshansky

Automatic merge from submit-queue

Updating reviewer list.

Revert "Remove alpha provisioning"

Automatic merge from submit-queue

Promote taint helpers from e2e/framework to util/taints

cc @kevin-wangzefeng

Automatic merge from submit-queue

Ingress e2e typos

**What this PR does / why we need it**: fix typos in e2e test

**Special notes for your reviewer**: none

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 40000, 41508, 41489)

Add toleration to fluentd daemonset to make it run on master

Because of https://github.com/kubernetes/kubernetes/pull/41172 fluentd pods stopped being allocated on master node.

This PR introduces toleration for master taint for fluentd.

CC @davidopp @janetkuo @kubernetes/sig-scheduling-bugs

Unfortunately, we don't have e2e tests to ensure that master logs are being ingested. This problem is a great signal to work on https://github.com/kubernetes/kubernetes/issues/41411

Automatic merge from submit-queue (batch tested with PRs 40000, 41508, 41489)

Make fluentd use default dns instead of cluster dns to make it work o…

Fix https://github.com/kubernetes/kubernetes/issues/41415

Fluentd for Stackdriver requires external urls (e.g. `logging.googleapis.com`) to be available in order to work. If fluentd runs on master, it cannot access the service endpoint of cluster DNS. This change makes fluentd use default dns to fix this problem.

CC @thockin @bowei

Automatic merge from submit-queue

Remove alpha provisioning

This is the first part of https://github.com/kubernetes/features/issues/36

@kubernetes/sig-storage-misc 

**Release note**:
```release-note
Alpha version of dynamic volume provisioning is removed in this release. Annotation
"volume.alpha.kubernetes.io/storage-class" does not have any special meaning. A default storage class
and  DefaultStorageClass admission plugin can be used to preserve similar behavior of Kubernetes cluster,
see https://kubernetes.io/docs/user-guide/persistent-volumes/#class-1 for details.
```

Automatic merge from submit-queue

Replace raw string with const var.

Replace raw string with const string var.

Automatic merge from submit-queue (batch tested with PRs 41531, 40417, 41434)

[CRI] beef up network teardown in  StopPodSandbox

1. Added CheckpointNotFound error to allow dockershim to conduct error handling
2. Retry network teardown if failed

ref: https://github.com/kubernetes/kubernetes/issues/41225

Automatic merge from submit-queue (batch tested with PRs 41531, 40417, 41434)

Always detach volumes in operator executor

**What this PR does / why we need it**:

Instead of marking a volume as detached immediately in Kubelet's
reconciler, delegate the marking asynchronously to the operator
executor. This is necessary to prevent race conditions with other
operations mutating the same volume state.

An example of one such problem:

1. pod is created, volume is added to desired state of the world
2. reconciler process starts
3. reconciler starts MountVolume, which is kicked off asynchronously via
   operation_executor.go
4. MountVolume mounts the volume, but hasn't yet marked it as mounted
5. pod is deleted, volume is removed from desired state of the world
6. reconciler reaches detach volume section, detects volume is no longer in desired state of world,
   removes it from volumes in use
7. MountVolume tries to mark mount, throws an error because
   volume is no longer in actual state of world list. After this, kubelet isn't aware of the mount
   so doesn't try to unmount again.
8. controller-manager tries to detach the volume, this fails because it
   is still mounted to the OS.
9. EBS gets stuck indefinitely in busy state trying to detach.



**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #32881, fixes ##37854 (maybe)

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

Add node binaries to 1.5.3 ChangeLog

`-node-` binaries are published with the release, but links were not included in the release notes. This PR adds the links.

Automatic merge from submit-queue

Apply davidopps comments to TaintController PR

Fix #41318

cc @timothysc @kevin-wangzefeng

Automatic merge from submit-queue

Switch serviceaccounts controller to generated shared informers

Originally part of #40097 

cc @deads2k @sttts @liggitt @smarterclayton @gmarek @wojtek-t @timothysc @kubernetes/sig-scalability-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 37137, 41506, 41239, 41511, 37953)

Add field to control service account token automounting

Fixes https://github.com/kubernetes/kubernetes/issues/16779

* adds an `automountServiceAccountToken *bool` field to `ServiceAccount` and `PodSpec`
* if set in both the service account and pod, the pod wins
* if unset in both the service account and pod, we automount for backwards compatibility

```release-note
An `automountServiceAccountToken *bool` field was added to ServiceAccount and PodSpec objects. If set to `false` on a pod spec, no service account token is automounted in the pod. If set to `false` on a service account, no service account token is automounted for that service account unless explicitly overridden in the pod spec.
```