Automatic merge from submit-queue (batch tested with PRs 62448, 59317, 59947, 62418, 62352). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix assert.Equal argument order

Reference:
https://godoc.org/github.com/stretchr/testify/assert#Equal



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62448, 59317, 59947, 62418, 62352). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Removed no-empty validation of nodeSelectorTerm.matchExpressions.
Signed-off-by: Da K. Ma <klaus1982.cn@gmail.com>

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
part of #62002

**Release note**:

```release-note
Pod affinity `nodeSelectorTerm.matchExpressions` may now be empty, and works as previously documented: nil or empty `matchExpressions` matches no objects in scheduler.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add @andrewsykim to OWNERS for cmd/cloud-controller-manager,pkg/contr…

**What this PR does / why we need it**:
Add myself as an approver for CCM related code.

cc @wlan0 

**Release note**:
```release-note
Add @andrewsykim as an approver for CCM related code.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove unneeded deps from vendor

**What this PR does / why we need it**:
#58784 removed the initresource admission plugin, but didn't remove it's dependencies. 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62696.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

wording

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add CaoShuFeng as a reviewer of kube-apiserver

My contributions:
https://github.com/pulls?q=is%3Apr+author%3ACaoShuFeng+is%3Aclosed

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
/assign @deads2k @sttts @liggitt 
**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

sample-apiserver: add v1beta1 with advanced conversion example from v1alpha1

Follow-up of discussion in https://github.com/kubernetes/kubernetes/pull/60594.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix an issue in inter-pod affinity predicate that cause affinity to self being processed incorrectly

**What this PR does / why we need it**:
Fixes the anti-affinity issue explained in #62232.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62232

**Special notes for your reviewer**:

**Release note**:

```release-note
Fix an issue in inter-pod affinity predicate that cause affinity to self being processed incorrectly
```

/sig scheduling

Automatic merge from submit-queue (batch tested with PRs 62676, 62612). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix WaitForAttach failure issue for azure disk

**What this PR does / why we need it**:
From v1.10, `devicePath` will be updated due to following code change:
https://github.com/kubernetes/kubernetes/blob/568afb4ecca99bc3b54fddc20927b3713369d357/pkg/volume/util/operationexecutor/operation_generator.go#L517-L518

So in v1.10.0, MountVolume.WaitForAttach will fail in the azure disk remount, error logs would be like following:
```
MountVolume.WaitForAttach failed for volume "pvc-f1562ecb-3e5f-11e8-ab6b-000d3af9f967" : azureDisk - Wait for attach expect device path as a lun number, instead got: /dev/disk/azure/scsi1/lun1 (strconv.Atoi: parsing "/dev/disk/azure/scsi1/lun1": invalid syntax)
  Warning  FailedMount             1m (x10 over 21m)   kubelet, k8s-agentpool-66825246-0  Unable to mount volumes for pod  
```

This PR does not use `devicePath` anymore since it could be changed, instead, it use `diskController.GetDiskLun(diskName, volumeSource.DataDiskURI, nodeName)` to get disk LUN, this ARM api call would cost about 0.12s

The GCE disk won't have this issue since `devicePath` is not used in [WaitForAttach func](https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/gce_pd/attacher.go#L133), while aws disk is also using `devicePath`  in [WaitForAttach func](https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/aws_ebs/attacher.go#L145), I think there is potentical issue for aws_ebs

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62540

**Special notes for your reviewer**:
should cherry-pick to v1.10

**Release note**:

```
fix WaitForAttach failure issue for azure disk
```
/assign @feiskyer 
/sig azure

FYI @khenidak

Automatic merge from submit-queue (batch tested with PRs 62676, 62612). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update kube-dns to Version 1.14.10

**What this PR does / why we need it**:
kube-dns version bump for kubeadm will be on a speparate PR.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #NONE 

**Special notes for your reviewer**:
/assign @rramkumar1 @bowei 
cc @grayluck 

**Release note**:

```release-note
Update kube-dns to Version 1.14.10. Major changes:
- Fix a bug in DNS resolution for externalName services
and PTR records that need to query from upstream nameserver.
```

Automatic merge from submit-queue (batch tested with PRs 57224, 61911). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update Istio addon to 0.6.0 and mirror images in gcr

**What this PR does / why we need it:**
PR addresses two issues:
1. Update Istio addon version to latest stable 0.6.0 (required for e2e test integration).
2. Mirror images in gcr.io for security scanning, since this is an addon.

Fixes #61910 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add phase command for dynamic kubelet configuration in kubeadm.

**What this PR does / why we need it**:
As the title says.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
partially fixes this: https://github.com/kubernetes/kubeadm/issues/571

**Special notes for your reviewer**:
/cc @luxas @fabriziopandini 
@kubernetes/sig-cluster-lifecycle-pr-reviews 

**Release note**:

```release-note
Phase `kubeadm alpha phase kubelet` is added to support dynamic kubelet configuration in kubeadm.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix kubelet flags.

pflag now sets golang flag `Parsed` before parsing flags https://github.com/spf13/pflag/commit/1ce0cc6db4029d97571db82f85092fccedb572ce. With that, all kubelet flags setting will be skipped.

We initially added `flag.Parsed` check to work around a issue that flags are parsed twice, thus kubelet flags are appended twice.

However, it doesn't seem to be the case now. I removed the `Parsed` check, and kubelet flags are only appended once.
```
/tmp/node-e2e-20180416T200912/kubelet --kubeconfig /tmp/node-e2e-20180416T200912/kubeconfig --root-dir /var/lib/kubelet --v 4 --logtostderr --allow-privileged true --network-plugin=kubenet --cni-bin-dir /tmp/node-e2e-20180416T200912/cni/bin --cni-conf-dir /tmp/node-e2e-20180416T200912/cni/net.d --hostname-override test-cos-beta-66-10452-53-0 --container-runtime docker --container-runtime-endpoint unix:///var/run/dockershim.sock --config /tmp/node-e2e-20180416T200912/kubelet-config --experimental-mounter-path=/tmp/node-e2e-20180416T200912/mounter --experimental-kernel-memcg-notification=true --runtime-cgroups=/system.slice/docker.service
```

This PR removes the unnecessary `Parsed` check to fix the test. @mtaufen 

/cc @kubernetes/sig-node-pr-reviews 
Signed-off-by: Lantao Liu <lantaol@google.com>

**Release note**:

```release-note
none
```

Automatic merge from submit-queue (batch tested with PRs 56040, 62627). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Support groups (organizations) to be specified in client cert.

**What this PR does / why we need it**:
Provide a flag `--org` for `kubeadm alpha phase kubeconfig user` to support groups (organizations) to be specified in client cert.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubeadm/issues/753

**Special notes for your reviewer**:
cc @TomRK1089

**Release note**:

```release-note
 `kubeadm alpha phase kubeconfig user` supports groups (organizations) to be specified in client cert.
```

Automatic merge from submit-queue (batch tested with PRs 56040, 62627). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Node-level Checkpointing manager: Migrate dockershim and device plugin manager checkpointing  

**What this PR does / why we need it**:
This PR abstracts checkpoint manager at kubelet level. Currently,  `dockershim`, `deviceplugin` have their own native checkpointing primitives. And most recently `cpumanager` also added package native checkpointing primitives. This adds to the redundancy at implementation level. Also degrades code readability and consistency.

To help this:

1.  Checkpointing interface is being abstracted at kubelet level as `checkpointmanager` package.
2.  `dockershim` and `deviceplugin` packages are modified to use `checkpointmanager` instead native checkpointing.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #



```release-note
None
```
cc @jeremyeder @vishh @derekwaynecarr @sjenning @yujuhong @dchen1107 @RenaudWasTaken @ConnorDoyle @RenaudWasTaken @jiayingz @mindprince @timstclair 
/sig node

Automatic merge from submit-queue (batch tested with PRs 62650, 62303, 62545, 62375). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix user visible files creation for windows

**What this PR does / why we need it**:

Fix user visible files creation for windows. Without this, [createUserVisibleFiles](https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/util/atomic_writer.go#L415:24) will get linkname with subpath included, and then symlink will fail. This is because "/" is used in pod spec (e.g. `"new/path/data-1"`) while "\" is used on Windows to get linkname. 


**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62338

**Special notes for your reviewer**:

Should also be cherry-picked to old releases.

**Release note**:

```release-note
Fix user visible files creation for windows
```

Automatic merge from submit-queue (batch tested with PRs 62650, 62303, 62545, 62375). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Move podsecuritypolicy registry to policy package

**What this PR does / why we need it:**
This is a part of the PSP migration from extensions to policy API group. This PR moves registry to policy package and changes preferred storage format to policy/v1beta1

**Which issue(s) this PR fixes:**
Addressed to https://github.com/kubernetes/features/issues/5

Automatic merge from submit-queue (batch tested with PRs 62650, 62303, 62545, 62375). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Refactor subpath reconstruction tests to use util test

**What this PR does / why we need it**:
Use common util method for reconstruction tests so that test updates will be reflected in all e2es.  Also increase termination grace period to allow more time for volume manager to cleanup before the tests check for leftover mounts

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62293

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Increase max requests inflight limits in gce for very large clusters

Signed-off-by: Lantao Liu <lantaol@google.com>

Automatic merge from submit-queue (batch tested with PRs 58784, 62057, 62621, 62652, 62656). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[GCE] Remove parallel 

**What this PR does / why we need it**:
Removes the parallel from the Loadbalancer tests. Looks like one mock method modifies a singleton variable, hence the tests currently cannot be run in parallel. 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62601 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 58784, 62057, 62621, 62652, 62656). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Set kubemark default verbosity to 4

To match with our default for tests.
This shouldn't break large kubemark jobs (as https://github.com/kubernetes/test-infra/pull/7705 is merged which explicitly sets it to v2 for those), but will make more logs available for smaller-scale ones.

```release-note
NONE
```

/cc @wojtek-t

Automatic merge from submit-queue (batch tested with PRs 58784, 62057, 62621, 62652, 62656). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Show deprecated kube-apiserver flags

**What this PR does / why we need it**:

This PR unhides deprecated kube-apiserver flags, so that the deprecation notice is clearly visible in --help.

Fixes #62617

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 58784, 62057, 62621, 62652, 62656). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update docker run flags for containized kubelet in hack/local-up-cluster.sh

**What this PR does / why we need it**:

I'm working on https://github.com/kubernetes/kubernetes/issues/61741, and found `docker run` flags in `hack/local-up-cluster.sh` for kubelet container is too old.

- /var/lib/docker should be mount read-write, because kubelet needs to
  update /etc/resolv.conf file in container, see #29378
- /var/lib/kubelet should be mount shared, because mountpoints under
  this directory must be propagated to other containers
- `--pid=host` is needed to run `nsenter --mount=/rootfs/proc/1/ns/mnt -- /usr/bin/systemd-run --scope` correctly (don't know exact reason, but with `--pid=host`, it works)
- configure cluster dns for kubelet running in a container
- should propagate sub-mounts of / to kubelet for local volume

With this fix, we can start a local cluster with containerized kubelet.

```
# pull or build a hyperkube image first
docker tag k8s.gcr.io/hyperkube-amd64:<tag> k8s.gcr.io/kubelet:latest
export DOCKERIZE_KUBELET=y
./hack/local-up-cluster.sh
```

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

refer to: https://github.com/kubernetes/kubernetes-anywhere/blob/master/phase2/ignition/vanilla/kubelet.service.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 58784, 62057, 62621, 62652, 62656). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove deprecated initresource admission plugin

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:

xref https://github.com/kubernetes/kubernetes/pull/55375#issuecomment-360329586

**Special notes for your reviewer**:
/assign @piosz @deads2k 

**Release note**:

```release-note
remove deprecated initresource admission plugin
```

- Fix a bug in DNS resolution for externalName services
and PTR records that need to query from upstream nameserver.

Automatic merge from submit-queue (batch tested with PRs 62407, 62602, 62539, 62639, 62647). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Capture API call logs from kubemark apiserver

Ref https://github.com/kubernetes/kubernetes/issues/62468

/cc @wojtek-t 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62407, 62602, 62539, 62639, 62647). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Autocalculate ALLOWED_NOTREADY_NODES based on NUM_NODES

As an alternative for https://github.com/kubernetes/test-infra/pull/7698

/cc @wojtek-t

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62407, 62602, 62539, 62639, 62647). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix kubemark image-registry name assignment

Allows to create kubemark instance without explicitly specifying the project name.
start-kubemark.sh used to not run properly when using project name acquired from the cloud provider.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62407, 62602, 62539, 62639, 62647). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add ConnectionReset, InternalError, etc also as retryable API errors

Ref https://github.com/kubernetes/kubernetes/issues/55860

We're seeing transient InternalError causing failures for e.g in our GKE large-scale tests:
- https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/logs/ci-kubernetes-e2e-gke-large-performance/34
- https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/logs/ci-kubernetes-e2e-gke-large-performance/35

I'm making the change from what we're doing for webhooks - https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/pkg/util/webhook/webhook.go#L107-L114

```release-note
NONE
```

/cc @wojtek-t

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

hack/test-update-storage-objects.sh: don't build a binary that the script doesn't use

**What this PR does / why we need it**:
This PR removes unused code that was building a binary that script doesn't use.

**Special notes for your reviewer**:
`hack/test-update-storage-objects.sh` used `attachlease` and `migrate-if-needed.sh` for performing etcd2 -> etcd3 migration. In the commit 39e5a566 we stopped migrating data, but still built unused `attachlease` binary.

Later, in the dc4d92e1 commit, `migrate-if-needed.sh` was reimplemented in go and unused `attachlease` was replaced by `migrate` that also wasn't needed.