Automatic merge from submit-queue

Fix forbidden message format

Before this change:
 $ kubectl get pods --as=tom
 Error from server (Forbidden): pods "" is forbidden: User "tom" cannot list pods in the namespace "default".
After this change:
 $ kubectl get pods --as=tom
 Error from server (Forbidden): pods is forbidden: User "tom" cannot list pods in the namespace "default".



**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```
Fix forbidden message format, remove extra ""
```

Automatic merge from submit-queue (batch tested with PRs 49849, 50334, 51414)

kubeadm: Use the --enable-bootstrap-token-auth flag when possible

**What this PR does / why we need it**:

Uses the right API server flag for the right version.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

fixes: https://github.com/kubernetes/kubeadm/issues/414

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews @mattmoyer

Automatic merge from submit-queue (batch tested with PRs 49849, 50334, 51414)

Support iscsi volume attach and detach

**What this PR does / why we need it**:

Support iSCSI volume attach and detach to enforce RWO access

**Which issue this PR fixes** : fixes #48953

**Special notes for your reviewer**:

**Release note**:

```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49849, 50334, 51414)

make volumesInUse sorted in node status updates

**What this PR does / why we need it**:

`volumesInUse` is not sent in a stable sort order. This will make node status patch requests larger than needed, and makes debugging nodes harder than necessary.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #49731

**Special notes for your reviewer**:

/cc @derekwaynecarr @jboyd01

**Release note**:

```release-note
make volumesInUse sorted in node status updates
```

Automatic merge from submit-queue

Fixes cross platform build failure

Fixes #48953

This change is prerequisite for implementing iSCSI attacher
and detacher.

In order to use chap authentication at iSCSI plugin after
implementing attacher and detacher, secret is needed at
AttachDisk() which is called from WaitForAttach().
To obtain secret, pod information is required, but
WaitForAttach() doesn't pass pod information inside.

This patch adds 'pod' as an argument of WaitForAttach()
and adds changes to drivers who implements WaitForAttach().

Fixes #48953

Automatic merge from submit-queue

Remove null -> [] slice hack

Closes #44593

When 1.6 added protobuf storage, the storage layer lost the ability to persist slice fields with empty but non-null values.

As a workaround, we tried to convert empty slice fields to `[]`, rather than `null`. Compressing `null` -> `[]` was just as much of an API breakage as `[]` -> `null`, but was hoped to cause fewer problems in clients that don't do null checks.

Because of conversion optimizations around converting lists of objects, the `null` -> `[]` hack was discovered to only apply to individual get requests, not to a list of objects. 1.6 and 1.7 was released with this behavior, and the world didn't explode. 1.7 documented the breaking API change that `null` and `[]` should be considered equivalent, unless otherwise noted on a particular field.

This PR:

* Reverts the earlier attempt (https://github.com/kubernetes/kubernetes/pull/43422) at ensuring non-null json slice output in conversion
* Makes results of `get` consistent with the results of `list` (which helps naive clients that do deepequal comparisons of objects obtained via list/watch and get), and allows empty slice fields to be returned as `null`

```release-note
Protobuf serialization does not distinguish between `[]` and `null`.
API fields previously capable of storing and returning either `[]` and `null` via JSON API requests (for example, the Endpoints `subsets` field) can now store only `null` when created using the protobuf content-type or stored in etcd using protobuf serialization (the default in 1.6+). JSON API clients should tolerate `null` values for such fields, and treat `null` and `[]` as equivalent in meaning unless specifically documented otherwise for a particular field.
```

Automatic merge from submit-queue

Implement GetZoneByProviderID and GetZoneByNodeName for openstack

This is part of #50926
cc @wlan0

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51391, 51338, 51340, 50773, 49599)

Remove duplicate code

This PR cleans up Kubelet test code. Adds a function enabling the removal of duplicate code for Mock chaining. Also adds a function to check the pod status, again enabling removal of duplicate code.

Fixes #22470

**Special notes for your reviewer**:

This is my first PR for the Kubernetes project. Keeping it simple.

Automatic merge from submit-queue (batch tested with PRs 51391, 51338, 51340, 50773, 49599)

Delete "hugetlb" from whitelistControllers

**What this PR does / why we need it**:
Delete "hugetlb" from whitelistControllers

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #50770

**Special notes for your reviewer**:

**Release note**:

```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51391, 51338, 51340, 50773, 49599)

add an starting info log of namespace controller.

**What this PR does / why we need it**:

add an starting info log of namespace controller.

**Release note**:
NA

Automatic merge from submit-queue (batch tested with PRs 51391, 51338, 51340, 50773, 49599)

modify an little gammer error.

**What this PR does / why we need it**:
I found that it used "Found" in the middle of sentence. I think use "found" in the middle of sentence is better than "Found" ,so I modified it.

Automatic merge from submit-queue

Fix swallowed error in iscsi package

**What this PR does / why we need it**: Fixes a swallowed error in the iscsi package.


```release-note NONE
```

Automatic merge from submit-queue

Fix swallowed errors in tests of photon_pd package

**What this PR does / why we need it**: Fixes swallowed errors in the tests of the photon_pd package.

```release-note NONE
```

Closes #51358

Automatic merge from submit-queue (batch tested with PRs 51174, 51363, 51087, 51382, 51388)

Fix swallowed error in scaleio package tests

**What this PR does / why we need it**: Fixes a dropped error in the tests of the scaleio package.

**Release note**:
```release-note NONE
```

Automatic merge from submit-queue (batch tested with PRs 51174, 51363, 51087, 51382, 51388)

Revert "GCE: Consume new config value for network project id"

Reverts kubernetes/kubernetes#51038

Broke GKE tests

Automatic merge from submit-queue (batch tested with PRs 51174, 51363, 51087, 51382, 51388)

Add InstanceExistsByProviderID to cloud provider interface for CCM

**What this PR does / why we need it**:

Currently, [`MonitorNode()`](https://github.com/kubernetes/kubernetes/blob/02b520f0a40be2056d91fc0661c2b4fdb2694c30/pkg/controller/cloud/nodecontroller.go#L240) in the node controller checks with the CCM if a node still exists by calling `ExternalID(nodeName)`. `ExternalID` is supposed to return the provider id of a node which is not supported on every cloud. This means that any clouds who cannot infer the provider id by the node name from a remote location will never remove nodes that no longer exist. 


**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #50985

**Special notes for your reviewer**:

We'll want to create a subsequent issue to track the implementation of these two new methods in the cloud providers.

**Release note**:

```release-note
Adds `InstanceExists` and `InstanceExistsByProviderID` to cloud provider interface for the cloud controller manager
```

/cc @wlan0 @thockin @andrewsykim @luxas @jhorwit2

/area cloudprovider
/sig cluster-lifecycle

Automatic merge from submit-queue (batch tested with PRs 51174, 51363, 51087, 51382, 51388)

kubeadm: Move the uploadconfig phase right in the beginning of cluster init

**What this PR does / why we need it**:

In order to be forwards-compatible, I'm moving the uploadconfig to be the first thing in the chain in order to make it possible to rely on it being present in future releases when we have a beta or higher API to rely on.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews

Automatic merge from submit-queue

Let the quota evaluator handle mutating specs of pod & pvc

### Background
The final goal is to address https://github.com/kubernetes/kubernetes/issues/47837, which aims to allow more mutation for uninitialized objects.

To do that, we [decided](https://github.com/kubernetes/kubernetes/issues/47837#issuecomment-321462433) to let the admission controllers to handle mutation of uninitialized objects.

### Issue
#50399 attempted to fix all admission controllers so that can handle mutating uninitialized objects. It was incomplete. I didn't realize although the resourcequota admission plugin handles the update operation, the underlying evaluator didn't. This PR updated the evaluators to handle updates of uninitialized pods/pvc.

### TODO
We still miss another piece. The [quota replenish controller](https://github.com/kubernetes/kubernetes/blob/master/pkg/controller/resourcequota/replenishment_controller.go) uses the sharedinformer, which doesn't observe the deletion of uninitialized pods at the moment. So there is a quota leak if a pod is deleted before it's initialized. It will be addressed with https://github.com/kubernetes/kubernetes/issues/48893.

Automatic merge from submit-queue

Make coreos test images sshd not allow password login.

This will prevent security scanners from triggering.

Configuration is verbatim from:
https://coreos.com/os/docs/latest/customizing-sshd.html

```release-note
NONE
```

Automatic merge from submit-queue

fix error message for pdb.go

**What this PR does / why we need it**:
fix error message for pdb.go

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
NONE

**Special notes for your reviewer**:
NONE

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51054, 51101, 50031, 51296, 51173)

Print multiple node roles, remove kubeadm-specific annotation from kubectl

related to #50010

Follow up to https://github.com/kubernetes/kubernetes/pull/50438 that removes the kubeadm-specific label, makes kubectl role-agnostic, and outputs multiple roles if present

Automatic merge from submit-queue (batch tested with PRs 51054, 51101, 50031, 51296, 51173)

Add host mountpath to controller-manager for flexvolume dir

Controller manager needs access to Flexvolume plugin when using attach-detach controller interface.

This PR adds the host mount path for the default directory of flexvolume plugins

Fixes https://github.com/kubernetes/kubeadm/issues/410

Automatic merge from submit-queue (batch tested with PRs 51054, 51101, 50031, 51296, 51173)

Dynamic Flexvolume plugin discovery, probing with filesystem watch.

**What this PR does / why we need it**: Enables dynamic Flexvolume plugin discovery. This model uses a filesystem watch (fsnotify library), which notifies the system that a probe is necessary only if something changes in the Flexvolume plugin directory.

This PR uses the dependency injection model in https://github.com/kubernetes/kubernetes/pull/49668.

**Release Note**:
```release-note
Dynamic Flexvolume plugin discovery. Flexvolume plugins can now be discovered on the fly rather than only at system initialization time.
```

/sig-storage

/assign @jsafrane @saad-ali 
/cc @bassam @chakri-nelluri @kokhang @liggitt @thockin

Automatic merge from submit-queue (batch tested with PRs 51054, 51101, 50031, 51296, 51173)

Refactor kuberuntime test case with sets.String

**What this PR does / why we need it**:
change to make got and want use sets.String instead, since that is both safe and more clearly shows the intent.

ref: https://github.com/kubernetes/kubernetes/pull/50554

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/kubernetes/kubernetes/issues/51396

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51054, 51101, 50031, 51296, 51173)

hack/local-up-cluster.sh defaults to allow swap

**What this PR does / why we need it**:
developers on linux typically have swap on while developing.
defaults local-up-cluster experience to not fail kubelet if swap is enabled.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 50889, 51347, 50582, 51297, 51264)

Fix e2e network util wrong output message

**What this PR does / why we need it**:

See https://github.com/kubernetes/kubernetes/blob/master/test/e2e/framework/networking_utils.go#L217

and 

https://github.com/kubernetes/kubernetes/blob/master/test/e2e/framework/networking_utils.go#L273

I assume it should be `minTries` -> `MaxTries`

This PR fixes the wrong output message.

**Which issue this PR fixes**: fixes #51265

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 50889, 51347, 50582, 51297, 51264)

bazel: use fast docker_pull

**What this PR does / why we need it**: takes advantage of https://github.com/bazelbuild/rules_docker/pull/71.

Faster builds = yay.

**Release note**:

```release-note
NONE
```

/assign @Q-Lee @spxtr @mikedanese

Automatic merge from submit-queue (batch tested with PRs 50889, 51347, 50582, 51297, 51264)

support fieldSelector spec.schedulerName

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #49190

**Special notes for your reviewer**:
/assign @davidopp  @bsalamat
/cc @lavalamp

**Release note**:

```release-note
add fieldSelector spec.schedulerName
```

Automatic merge from submit-queue (batch tested with PRs 50889, 51347, 50582, 51297, 51264)

Fix NoNewPrivs and also allow remote runtime to provide the support.

Fixes https://github.com/kubernetes/kubernetes/issues/51319.

This PR:
1) Let kubelet admit remote runtime for `NoNewPrivis` container runtime.
2) Fix a `NoNewPrivis` bug which checks wrong runtime type.

/cc @kubernetes/sig-node-bugs @jessfraz

Automatic merge from submit-queue (batch tested with PRs 50889, 51347, 50582, 51297, 51264)

Change eviction manager to manage one single local storage resource

**What this PR does / why we need it**:
We decided to manage one single resource name, eviction policy should be modified too.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:  part of #50818

**Special notes for your reviewer**:

**Release note**:
```release-note
Change eviction manager to manage one single local ephemeral storage resource
```

/assign @jingxu97

Automatic merge from submit-queue (batch tested with PRs 49850, 47782, 50595, 50730, 51341)

fix ReadOnlyPort defaulting, CAdvisorPort documentation

The ReadOnlyPort defaulting prevented passing 0 to diable via
the KubeletConfiguraiton struct.

The HealthzPort defaulting prevented passing 0 to disable via the
KubeletConfiguration struct. The documentation also failed to mention
this, but the check is performed in code.

The CAdvisorPort documentation failed to mention that you can pass 0 to
disable.


fixes #51345

Automatic merge from submit-queue (batch tested with PRs 49850, 47782, 50595, 50730, 51341)

Cloud Controller Manager now sets Node.Spec.ProviderID

**What this PR does / why we need it**:
Cloud Controller Manager now sets `Node.Spec.ProviderID`.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
https://github.com/kubernetes/kubernetes/issues/49836. 

**Special notes for your reviewer**:
* As part of an effort to move cloud controller manager into beta https://github.com/kubernetes/kubernetes/issues/48690.

Automatic merge from submit-queue (batch tested with PRs 49850, 47782, 50595, 50730, 51341)

NodeConditionPredicates should return NodeOutOfDisk error.

**What this PR does / why we need it**:
In https://github.com/kubernetes/kubernetes/pull/49932 , I moved node condition check into a predicates; but it return incorrect error :(. 

We also need to add more cases to `TestNodeShouldRunDaemonPod` which is key function of DaemonSet.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #50594 

**Release note**:

```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 49850, 47782, 50595, 50730, 51341)

Fix benchmarks to really test reverse order of the keys

**What this PR does / why we need it**:
This PR modifies the code to do what comments says -- reverse the order of keys. It also fixes the logic that was wrong and didn't allow stale data.

**Special notes for your reviewer**:
This change resolves the following review comments:
- https://github.com/kubernetes/kubernetes/pull/41939#discussion_r117068104
- https://github.com/kubernetes/kubernetes/pull/46916#discussion_r122763350
- https://github.com/kubernetes/kubernetes/pull/46916#discussion_r122764000

**Release note**:
```release-note
NONE
```

PTAL @smarterclayton