Since its hard for an individual to remember that we need codecgen and
ginkgo in godeps but don't actually have that dependancy listed in a way
that godep can automatically find.

Automatic merge from submit-queue

Add utility for kubelet to log resource lists consistently

This is a simple utility for logging resource lists with standardized output.

I find it useful when logging work in node eviction, similar to kubelet logging convention for pods in same package.

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/24742)
<!-- Reviewable:end -->

Add interface check in Deployment's client

Modify Detach method to take disk name

Reduce LOC in kubelet tests

Reduce LOC in daemon controller tests

Code cleanups in kubelet_test.go

Added negative test case for namespace

Automatic merge from submit-queue

Resource name constants were incorrect in versioned types.go

The constant field names and actual values to quota requests and limits for cpu and memory were incorrect in the v1 types.go file.

Important to note for reviewer:
* the constant fields here are unused in the project at this time
* the values those unused constant fields mapped to are not actually supported by the project
* there is no backwards compatibility concern, but if/when we look to convert to using versioned clients, we should have the correct constant fields and values.

The correct values were here:
https://github.com/kubernetes/kubernetes/blob/master/pkg/api/types.go#L2213

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/24136)
<!-- Reviewable:end -->

tolerate nil error in HandleError

AWS kube-up: default some variables to empty, to avoid warnings

Automatic merge from submit-queue

Reduce allocations during conversion, enable new UnsafeConvertToVersion path

Cleans up the conversion path to avoid a few unnecessary allocations, then creates a new UnsafeConvertToVersion path that will allow encode/decode to bypass copying the object for performance. In that subsequent PR, ConvertToVersion will start to call Copy() and we will refactor conversions to reuse as much of the existing object as possible.

Also changes the unversioned.ObjectKind signature to not require allocations - speeds up a few common paths.

Automatic merge from submit-queue

WIP v0 NVIDIA GPU support

```release-note
* Alpha support for scheduling pods on machines with NVIDIA GPUs whose kubelets use the `--experimental-nvidia-gpus` flag, using the alpha.kubernetes.io/nvidia-gpu resource 
```

Implements part of #24071 for  #23587

I am not familiar with the scheduler enough to know what to do with the scores. Mostly punting for now.

Missing items from the implementation plan: limitranger, rkt support, kubectl
support and docs

cc @erictune @davidopp @dchen1107 @vishh @Hui-Zhi @gopinatht 

Automatic merge from submit-queue

Removed obsolete metrics API proposal

As requested in https://github.com/kubernetes/kubernetes/pull/24253#discussion_r60985010

ref #23376

Automatic merge from submit-queue

pkg/apis/rbac: Add Openshift authorization API types

This PR updates #23396 by adding the Openshift RBAC types to a new API group.

Changes from Openshift:

* Omission of [ResourceGroups](https://github.com/openshift/origin/blob/458998788337e983fa3e5f9a837664ec00a89204/pkg/authorization/api/types.go#L32-L104) as most of these were Openshift specific. Would like to add the concept back in for a later release of the API.
* Omission of IsPersonalSubjectAccessReview as its implementation relied on Openshift capability.
* Omission of SubjectAccessReview and ResourceAccessReview types. These are defined in `authorization.k8s.io`

~~API group is named `rbac.authorization.openshift.com` as we omitted the AccessReview stuff and that seemed to be the lest controversial based on conversations in #23396. Would be happy to change it if there's a dislike for the name.~~ Edit: API groups is named `rbac`, sorry misread the original thread.

As discussed in #18762, creating a new API group is kind difficult right now and the documentation is very out of date. Got a little help from @soltysh but I'm sure I'm missing some things. Also still need to add validation and a RESTStorage registry interface. Hence "WIP".

Any initial comments welcome.

cc @erictune @deads2k @sym3tri @philips

Automatic merge from submit-queue

Add a service annotation that allows endpoints for unready pods

See https://github.com/kubernetes/kubernetes/issues/25283 for context 
@smarterclayton @thockin yes?

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/25284)
<!-- Reviewable:end -->

Automatic merge from submit-queue

Automatically create the kube-system namespace

At the same time we ensure that the `default` namespace is present, it also creates `kube-system` if it doesn't exist.

`kube-system` will now exist from the beginning, and will be recreated every 10s if deleted, in the same manner as the `default` ns

This makes UX much better, no need for `kubectl`ing a `kube-system.yaml` file anymore for a function that is essential to Kubernetes (addons). For instance, this makes dashboard deployment much easier when there's no need to check for the `kube-system` ns first.

A follow up in the future may remove places where logic to manually create the kube-system namespace is present.

Also fixed a small bug where `CreateNamespaceIfNeeded` ignored the `ns` parameter and was hardcoded to `api.NamespaceDefault`.

@davidopp @lavalamp @thockin @mikedanese @bryk @cheld @fgrzadkowski @smarterclayton @wojtek-t @dlorenc @vishh @dchen1107 @bgrant0607 @roberthbailey

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/25196)
<!-- Reviewable:end -->

Automatic merge from submit-queue

kubenet: set bridge promiscuous mode based on hairpinMode

Closes: https://github.com/kubernetes/kubernetes/issues/23657
Closes: https://github.com/kubernetes/kubernetes/issues/20475

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/23711)
<!-- Reviewable:end -->

Closes: https://github.com/kubernetes/kubernetes/issues/23657
Closes: https://github.com/kubernetes/kubernetes/issues/20475

Automatic merge from submit-queue

AWS: SSL support for ELB listeners through annotations

In the API, ports have only either TCP or UDP as their protocols, but ELB distinguishes HTTPS->HTTP[S]? from SSL->(SSL|TCP). 

Per #24978, this is implemented through two separate annotations:

`service.beta.kubernetes.io/aws-load-balancer-ssl-cert=arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012`
`service.beta.kubernetes.io/aws-load-balancer-backend-protocol=(https|http|ssl|tcp)`

Mixing plain-text and encrypted listeners will be in a separate PR, implementing #24978's `aws-load-balancer-ssl-ports=LIST`

Only encode/decode will call this path, to allow us to optimize for
unsafe operations.

Long delayed refactor, avoids a few more allocations.

We don't need to pass a pointer into SetGroupKindVersion() - a
struct works just as well.

We will probably readd these as an opaque object passed down to
conversions that lets the caller get access to more info (like
a negotiated serializer).

Automatic merge from submit-queue

Add `kubectl rollout status`

## Pull Request Guidelines

1. Please read our [contributor guidelines](https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md).
1. See our [developer guide](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md).
1. Follow the instructions for [labeling and writing a release note for this PR](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes) in the block below.

```release-note
Implement `kubectl rollout status` that can be used to watch a deployment's rollout status
```

Addresses #17168; depends on #19882 (the "Add kubectl rollout" commit).
See [proposal](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/deploy.md#deployment-version). 

cc @bgrant0607 @nikhiljindal @ironcladlou @kargakis @kubernetes/sig-config @kubernetes/kubectl  @madhusudancs

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/19946)
<!-- Reviewable:end -->

Automatic merge from submit-queue

Add pod condition PodScheduled to detect situation when scheduler tried to schedule a Pod, but failed

Set `PodSchedule` condition to `ConditionFalse` in `scheduleOne()` if scheduling failed and to `ConditionTrue` in `/bind` subresource.

Ref #24404

@mml (as it seems to be related to "why pending" effort)

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/24459)
<!-- Reviewable:end -->

Revert "Add configuration for GCP webhook authorization."

when scheduler tried to schedule a Pod, but failed.

Ref #24404

Support renegotiation in client based on response ContentType

Automatic merge from submit-queue

Updating hack/update-codegen to keep federation_clientset updated

Right now, there is no check for this and hence federation_clientset becomes stale over time.
Updating hack/update-codegen to keep federation_clientset updated.

hack/verify-codegen.sh ensures that it is updated.


cc @caesarxuchao @lavalamp @jianhuiz @kubernetes/sig-cluster-federation 

Automatic merge from submit-queue

Add configuration for GCP webhook authorization.

Plumb through configuration of webhook authorization on GCE.

Automatic merge from submit-queue

Webhook Token Authenticator

Add a webhook token authenticator plugin to allow a remote service to make authentication decisions.

Automatic merge from submit-queue

PSP admission

```release-note
Update PodSecurityPolicy types and add admission controller that could enforce them
```

Still working on removing the non-relevant parts of the tests but I wanted to get this open to start soliciting feedback.

- [x] bring PSP up to date with any new features we've added to SCC for discussion
- [x] create admission controller that is a pared down version of SCC (no ns based strategies, no user/groups/service account permissioning)
- [x] fix tests

@liggitt @pmorie - this is the simple implementation requested that assumes all PSPs should be checked for each requests.  It is a slimmed down version of our SCC admission controller

@erictune @smarterclayton 

Automatic merge from submit-queue

Add a flag to disable dumpig logs after e2e test failure

cc @kubernetes/sig-testing 

Automatic merge from submit-queue

Scheduledjob api

@erictune ScheduledJob api types, based on #21675, so only last two commits counts.
@sdminonne fyi

```release-note
Introducing ScheduledJobs as described in [the proposal](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/scheduledjob.md) as part of `batch/v2alpha1` version (experimental feature).
```


[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()

Automatic merge from submit-queue

Remove myself from a bunch of OWNERS files

For the time being I am too overloaded to do non scheduler/admission related reviews that aren't explicitly assigned to me.

cc/ @brendandburns