Automatic merge from submit-queue

servicecontroller: use consistent node criteria

We have two node selection functions: includeNodeFromNodeList and
getNodeConditionPredicate, and the logic is different.

The logic should be the same, so remove includeNodeFromNodeList and just
use getNodeConditionPredicate everywhere.

Fix #45772

```release-note
servicecontroller: Fix node selection logic on initial LB creation
```

Automatic merge from submit-queue

iSCSI plugin: Update devicepath with filepath.Glob result

**What this PR does / why we need it**:

If iscsiTransport is not tcp, iSCSI plugin tries to
find devicepath using filepath.Glob but never updates
devicepath with the filepath.Glob result.

This patch fixes the problem.

**Which issue this PR fixes** : fixes #47253
**Special notes for your reviewer**:

**Release note**:

```
NONE
```

Automatic merge from submit-queue

AWS for cloud-controller-manager

fixes #47214

This implements the NodeAddressesByProviderID and InstanceTypeByProviderID methods used by the cloud-controller-manager for the AWS provider.

NodeAddressesByProvider uses DescribeInstances (for normal addresses) and DescribeAddresses (for Elastic IP addresses).

InstanceTypeByProviderID uses DescribeInstances.

```release-note
NONE
```

Automatic merge from submit-queue

Made image as required in v1 Container struct.

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47244 

**Special notes for your reviewer**:

**Release note**:

```release-note
none
```

Automatic merge from submit-queue

bazel: stamp multiple packages by using x_defs instead of linkstamp in go_binary rules

**What this PR does / why we need it**: Fixes regression introduced sometime in the last few months that prevented bazel-built clusters from identifying version properly. 

It does so by updating the bazelbuild/rules_go and kubernetes/repo-infra dependencies to support using stamp values in `go_binary` `x_defs`, and then changing our `go_binary` rules to use `x_defs` instead of `linkstamp`.

This whole charade is necessary because we need to stamp version information in multiple packages.

This pretty much only affects the bazel build, so it should be low risk.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #45298

**Special notes for your reviewer**: depends on https://github.com/kubernetes/repo-infra/pull/18; should not be merged before it.

**Release note**:

```release-note
NONE
```

/assign @spxtr @mikedanese

Automatic merge from submit-queue

Azure for cloud-controller-manager

**What this PR does / why we need it**:
This implements the NodeAddressesByProviderID and InstanceTypeByProviderID methods used by the cloud-controller-manager to the Azure provider.

**Release note**:

```release-note
NONE
```
Addresses #47257

Automatic merge from submit-queue

Incorrect output in kubefed init

**What this PR does / why we need it**:
Fixes incorrect output in `kubefed init`.

fixes https://github.com/kubernetes/kubernetes/issues/47291

**Special notes for your reviewer**:
none

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

kubectl drain errors if pod is already deleted

**What this PR does / why we need it**:
kubectl drain can throw an error if the pod it attempts to delete has already been deleted.

fixes https://github.com/kubernetes/kubectl/issues/28

If iscsiTransport is not tcp, iSCSI plugin tries to
find devicepath using filepath.Glob but never updates
devicepath with the filepath.Glob result.

This patch fixes the problem.

Fixes #47253

Automatic merge from submit-queue

StorageOS Volume Plugin

**What this PR does / why we need it**:
This PR adds a new volume plugin for StorageOS volumes.  StorageOS runs as a container on Kubelet nodes, aggregating local or attached storage and making its capacity available to all nodes within the cluster. More information at http://storageos.com.

The StorageOS plugin supports:

1. Dynamic Provisioning using Storage Classes
2. Persistent Volumes and Persistent Volume Claims.

**Which issue this PR fixes**
A feature request has been created:
https://github.com/kubernetes/features/issues/190

This isn't on the schedule for 1.6 as I wasn't sure when it would be ready.  We intend to make the StorageOS container openly available within the 1.6 lifetime.

**Special notes for your reviewer**:

Separate commits for feature and godep changes.

**Release note**:
```release-note
StorageOS Volume Driver
[StorageOS](http://www.storageos.com) can be used as a storage provider for Kubernetes.  With StorageOS, capacity from local or attached storage is pooled across the cluster, providing converged infrastructure for cloud-native applications. 
```

Make kubelet touch iptables lock file during initialization

Automatic merge from submit-queue (batch tested with PRs 45057, 47259)

Drecrease parallelism in load test

Automatic merge from submit-queue (batch tested with PRs 45057, 47259)

Allow conversion-gen to take types that are not in the output path

Part of fixing https://github.com/kubernetes/kubernetes/issues/44065.

Partially address https://github.com/kubernetes/features/issues/282.

The first commit is the changes to the conversion-gen (and vendor).

The second commit moves the api/v1 types to staging, and the third commit shows the resulted changes in the generated conversions.

Automatic merge from submit-queue (batch tested with PRs 46750, 47141)

Speed up volume integration test

Partly solves https://github.com/kubernetes/kubernetes/issues/47129 . 

On my local box:

before -  7m56.751s  
after - 5m53.132s  

So approx. 2m time saving. More saving will require refactoring of attach detach controller.

cc @mikedanese

Automatic merge from submit-queue

Remove e2e-rbac-bindings.

Replace todo-grabbag binding w/ more specific heapster roles/bindings.
Move kubelet binding.

**What this PR does / why we need it**:
The "e2e-rbac-bindings" held 2 leftovers from the 1.6 RBAC rollout process:
 - One is the "kubelet-binding" which grants the "system:node" role to kubelet. This is needed until we enable the node authorizer. I moved this to the folder w/ some other kubelet related bindings.
 - The other is the "todo-remove-grabbag-cluster-admin" binding, which grants the cluster-admin role to the default service account in the kube-system namespace. This appears to only be required for heapster. Heapster will instead use a "heapster" service account, bound to a "system:heapster" role on the cluster (no write perms), and a "system:pod-nanny" role in the kube-system namespace.

**Which issue this PR fixes**: Addresses part of #39990

**Release Note**: 
```release-note
New and upgraded 1.7 GCE/GKE clusters no longer have an RBAC ClusterRoleBinding that grants the `cluster-admin` ClusterRole to the `default` service account in the `kube-system` namespace.
If this permission is still desired, run the following command to explicitly grant it, either before or after upgrading to 1.7:
    kubectl create clusterrolebinding kube-system-default --serviceaccount=kube-system:default --clusterrole=cluster-admin
```

Automatic merge from submit-queue (batch tested with PRs 47144, 46699)

Update statefulset reaper use StatefulSetHasDesiredReplicas

**What this PR does / why we need it**:
StatefulSetHasDesiredReplicas condition should check ObservedGeneration and update statefulset reaper use StatefulSetHasDesiredReplicas
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #43325

**Special notes for your reviewer**:

**Release note**:
```
None
```

Automatic merge from submit-queue

Fix local capacity isolation test

Automatic merge from submit-queue (batch tested with PRs 36376, 47251)

client-go: GetOptions for dynamic client

Looks like `GetOptions` were forgotten in the dynamic client. Without them it's hard to write a dynamic initializer controller (useful for custom resources).

Automatic merge from submit-queue

test: set failure traps for all deployment e2e tests

@kubernetes/sig-apps-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 47113, 46665, 47189)

kube-apiserver: cleanup node proxy setup code

Follow-up of https://github.com/kubernetes/kubernetes/pull/46680, fixing #46679

- move `proxyTransport` from `New` func to config
- use self-explaining variable names
- remove redundant temporary var
- make `CreateNodeDialer` side-effect-free
- make imports follow conventions
- lower-case error messages

Automatic merge from submit-queue (batch tested with PRs 47113, 46665, 47189)

Improve the e2e node restart test

This commit includes the following two changes:
 * Move pre-test checks (pods/nodes ready) to BeforeEach() so that it's
   clear whether the test has run or not.
 * Dumping logs for unready pods.

Automatic merge from submit-queue

Kubelet: rename cri package name to pkg/kubelet/apis/cri/v1alpha1/runtime

**What this PR does / why we need it**:

We have moved CRI from api/v1alpha1/runtime to apis/cri/v1alpha1, which changed the package name of CRI. This would cause a significant problem: old-versioned runtime (based on CRI in v1.6) doesn't work with latest kubelet v1.7, and vice versa.

This PR renames cri package name to `pkg/kubelet/apis/cri/v1alpha1/runtime` for fixing the problem.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 

fixes #47012

**Special notes for your reviewer**:

Should be included in v1.7.

**Release note**:

```release-note
CRI has been moved to package `pkg/kubelet/apis/cri/v1alpha1/runtime`.
```

Automatic merge from submit-queue

Move the nvidia installer to the beginning.

When the installer runs for the first time, it disables loadpin and restarts
the node. So, it is better to run it in the beginning so that we can avoid
redoing the later steps. One of the later steps include downloading a tar file
and untarring it. Doing that only once saves around 1m30s in test runtime for
the gci image.

/sig node
/area node-e2e

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46835, 46856)

Made tests that create Horizontal Pod Autoscaler delete it after they are done.

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #46847

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46835, 46856)

Made WaitForReplicas and EnsureDesiredReplicas use PollImmediate and improved logging.

**What this PR does / why we need it**: Most importantly, this results in better logging: timeout is logged at the level of the caller, not the helper function, helping debugging.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 45575, 47218)

nodeidentifier: require nodes to have wellformed usernames

xref #46999

Split @mikedanese's identifier change out from the GCE/GKE enablement in https://github.com/kubernetes/kubernetes/pull/46796, so the authorization/admission behavior works as intended for kubeadm, which already has it enabled

Automatic merge from submit-queue

Make gcp auth provider not to override the Auth header if it's already exits

**What this PR does / why we need it**:
Make AuthProvider not wrap the transport if beartoken or basic auth is enabled
**Which issue this PR fixes** :
 fixes #44476 

**Special notes for your reviewer**:

**Release note**:
```
GCP auth plugin no longer overwrites existing Authorization headers.
```

Automatic merge from submit-queue

Allow pods to opt out of PodPreset mutation via an annotation on the pod

An annotation in the pod spec of the form:
podpreset.admission.kubernetes.io/PodPresetOptOut: "true"
Will cause the admission controller to skip manipulating the pod spec,
no matter the labelling.

This is an alternative implementation to pull #44163.

```release-note
Allow pods to opt out of PodPreset mutation via an annotation on the pod.
```