Automatic merge from submit-queue (batch tested with PRs 47073, 47457, 47479)

PodSecurityPolicy should respect and validate user-supplied RunAsNonR…

**What this PR does / why we need it**: PodSecurityPolicies overwrite and then fail to validate the RunAsNonRoot field in the container security context.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47071

**Special notes for your reviewer**: gce/gke don't use this in 1.6. You'll need to speak up if you think this is important enough to patch. It should almost certainly go into 1.7.

**Release note**:


```release-note
PodSecurityPolicy now recognizes pods that specify `runAsNonRoot: false` in their security context and does not overwrite the specified value
```

Automatic merge from submit-queue (batch tested with PRs 47302, 47389, 47402, 47468, 47459)

[GCE] Fix ILB sharing and GC 

Fixes #47092 

- Users must opt-in for sharing backend services (alpha feature - may be removed in future release)
- Shared backend services use a hash for determining similarity via settings (so far, only sessionaffinity) (again, this may be removed)
- Move resource cleanup to after the ILB setup.

/assign @bowei 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 47302, 47389, 47402, 47468, 47459)

[GCE] Bump GLBC version to 0.9.4

Fixes #47273 
/assign @bowei 
/sig network
/area platform/gce

**Release note**:
```release-note
Bump GLBC version to 0.9.4
```

Automatic merge from submit-queue (batch tested with PRs 47302, 47389, 47402, 47468, 47459)

Change port on which fluentd exposes its metrics

Fix https://github.com/kubernetes/kubernetes/issues/47397

/cc @Q-Lee @nicksardo

```release-note
Stackdriver Logging deployment exposes metrics on node port 31337 when enabled.
```

Automatic merge from submit-queue (batch tested with PRs 47302, 47389, 47402, 47468, 47459)

Update to kube-addon-manager:v6.4-beta.2: kubectl v1.6.4 and refreshed base images

**What this PR does / why we need it**: refreshes base images for kube-addon-manager with fixes for CVE-2016-9841 and CVE-2016-9843.

x-ref https://github.com/kubernetes/kubernetes/issues/47386

**Special notes for your reviewer**: the updated images are not yet pushed, so tests will fail until that's done.

**Release note**:

```release-note
```

/assign @MrHohn

Automatic merge from submit-queue (batch tested with PRs 47302, 47389, 47402, 47468, 47459)

remove leaked socket file in unit test

Fixes #47301


**Release note**:

```
NONE
```

Automatic merge from submit-queue

Update GPU e2e tests.

* Use nvidia driver installer from external repo.
    
    That installer decouples itself from COS image version (as long as the
    image version is newer than cos-stable-59-9460-60-0).
    
    A separate commit in the test-infra repo will update the cos version
    used for this test to cos-stable-59-9460-60-0.

* Use cos-stable-59-9460-60-0 and newer installer for GPU node e2e tests.

This is to enable #47388.

This supercedes #47091.

**Release note**:
```release-note
NONE
```

/sig node

Automatic merge from submit-queue

Add e2e tests for DaemonSet adopt and rollback shouldn't cause pod restart

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: xref #46981

**Special notes for your reviewer**: ~depends on #47084 (ignore commits prefixed `PICK` while reviewing)~ (merged)

1. Update DaemonSet e2e test: pod with different templateGeneration but the same template hash (meaning they came from current DaemonSet template) should not be restarted 
1. Add DaemonSet e2e test: rollback a DaemonSet before a rollout is done, and existing pods shouldn't be restarted 


**Release note**:

```release-note
NONE
```

In 1.7, we add controller history to avoid unnecessary DaemonSet pod
restarts during pod adoption. We will not restart pods with matching
templateGeneration for backward compatibility, and will not restart pods
when template hash label matches current DaemonSet history, regardless
of templateGeneration.

Automatic merge from submit-queue (batch tested with PRs 47084, 46016, 46372)

Enable iptables -w in kubeadm selfhosted

Currently containerized kube-proxy cannot support iptables -w
unless the xtables.lock is mounted.

Related: #46103
Signed-off-by: Christopher M. Luciano <cmluciano@us.ibm.com>

**Special notes for your reviewer**:
- I need to figure out how to do some pre-setup to touch the file if it does not exist.
**Release note**:
```
support iptables -w in kubeadm containerized kube-proxy
```

Automatic merge from submit-queue (batch tested with PRs 47084, 46016, 46372)

Warn, instead of failing, if 'modprobe rbd' fails

Modprobe is a kernel operation that should only be done once to load the
RBD module. The admin could've done this on the Kubernetes nodes. The
RBD plugin can still try to load the module but it shouldnt fail the
workflow if it doesnt succeed.

Partially addresses #45190

Automatic merge from submit-queue (batch tested with PRs 47084, 46016, 46372)

Update adoption/release of DaemonSet controller history, and wait for history store sync

**What this PR does / why we need it**: 
~Depends on #47075, so that DaemonSet controller can update history's controller ref. Ignore that commit when reviewing.~ (merged)

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: #46981 

**Special notes for your reviewer**: @kubernetes/sig-apps-bugs 

**Release note**:

```release-note
NONE
```

That installer decouples itself from COS image version (as long as the
image version is newer than cos-stable-59-9460-60-0).

A separate commit in the test-infra repo will update the cos version
used for this test to cos-stable-59-9460-60-0.

Automatic merge from submit-queue (batch tested with PRs 46441, 43987, 46921, 46823, 47276)

Remove PartitionStatefulSetStrategyType

This PR removes PartitionStatefulSetStrategyType add adds a parameter to RollingUpdateStatefulSetStrategyType as described in the issue below. We need this PR to ensure that the StatefulSet API conforms to the existing API for DaemonSet.

fixes #46975
```release-note
NONE
```
@kargakis 
@smarterclayton 
@janetkuo

Automatic merge from submit-queue (batch tested with PRs 46441, 43987, 46921, 46823, 47276)

kubelet/network: report but tolerate errors returned from GetNetNS() v2

Runtimes should never return "" and nil errors, since network plugin
drivers need to treat netns differently in different cases. So return
errors when we can't get the netns, and fix up the plugins to do the
right thing.

Namely, we don't need a NetNS on pod network teardown. We do need
a netns for pod Status checks and for network setup.

V2: don't return errors from getIP(), since they will block pod status :(  Just log them.  But even so, this still fixes the original problem by ensuring we don't log errors when the network isn't ready.

@freehan @yujuhong 

Fixes: https://github.com/kubernetes/kubernetes/issues/42735
Fixes: https://github.com/kubernetes/kubernetes/issues/44307

Automatic merge from submit-queue (batch tested with PRs 46441, 43987, 46921, 46823, 47276)

Enable Node authorizer and NodeRestriction admission in kubemark

xref https://github.com/kubernetes/features/issues/279

We want to ensure scale testing covers use of the authorizer/admission pair that partitions nodes. This includes enabling the authorizer, which populates a graph of existing nodes and pods.

Kubemark is still running all nodes with a single credential, so a follow-up step is to generate unique credentials per node (or enable TLS bootstrapping) and remove the temporary rolebinding added in this PR so the node authorizer is the one authorizing each call by a hollow node.

Automatic merge from submit-queue (batch tested with PRs 46441, 43987, 46921, 46823, 47276)

Azure plugin for client auth

This is an Azure Active Directory plugin for client authentification. It provides an integration with Azure CLI 2.0 login command. It can also be used standalone, in that case it will use the device code flow to acquire an access token. 

More details are provided in the README.md file. 

https://github.com/kubernetes/kubectl/issues/29

cc @brendandburns @colemickens

Automatic merge from submit-queue

Shorten eviction tests, and increase test suite timeout

After #43590, the eviction manager is less aggressive when evicting pods.  Because of that, many runs in the flaky suite time out.
To shorten the inode eviction test, I have lowered the eviction threshold.
To shorten the allocatable eviction test, I now set KubeReserved = NodeMemoryCapacity - 200Mb, so that any pod using 200Mb will be evicted.  This shortens this test from 40 minutes, to 10 minutes.
While this should be enough to not hit the flaky suite timeout anymore, it is better to keep lower individual test timeouts than a lower suite timeout, since hitting the suite timeout means that even successful test runs are not reported.

/assign @Random-Liu @mtaufen 

issue: #31362

Automatic merge from submit-queue (batch tested with PRs 46929, 47391, 47399, 47428, 47274)

Don't provision for PVCs with AccessModes unsupported by plugin

Fail early in case the user actually expects e.g. RWM from AWS when in reality that isn't possible.
@eparis @gnufied 

edit: this needs release note because it's a breaking bugfix; will write one.

https://github.com/kubernetes/kubernetes/issues/46540
```release-note
Fix dynamic provisioning of PVs with inaccurate AccessModes by refusing to provision when PVCs ask for AccessModes that can't be satisfied by the PVs' underlying volume plugin
```

Automatic merge from submit-queue (batch tested with PRs 46929, 47391, 47399, 47428, 47274)

Increase threshold for LIST apicall latencies to 2s

Fixes https://github.com/kubernetes/kubernetes/issues/47419

cc @kubernetes/sig-scalability-misc @gmarek @wojtek-t

Automatic merge from submit-queue (batch tested with PRs 46929, 47391, 47399, 47428, 47274)

AWS: Richer log message when metadata fails

Not a resolution, but should at least help determine the issue.

Issue #41904

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46929, 47391, 47399, 47428, 47274)

AWS: Perform ELB listener comparison in case-insensitive manner

Fix #47067

```release-note
AWS: Avoid spurious ELB listener recreation - ignore case when matching protocol
```

Automatic merge from submit-queue (batch tested with PRs 46929, 47391, 47399, 47428, 47274)

Remove empty lines from log

Everything() returns a new line end with "\n", it's not necessary
to add another one.
**Release note**:

```
NONE
```

Automatic merge from submit-queue

Bump Cluster Autoscaler to 0.6.0-alpha1

cc: @MaciekPytel @aleksandra-malinowska

Currently containerized kube-proxy cannot support iptables -w
unless the xtables.lock is mounted.
Signed-off-by: Christopher M. Luciano <cmluciano@us.ibm.com>

Automatic merge from submit-queue

AWS cleanup

Rationalize the existing code.

```release-note
NONE
```

 Issue #47394

Automatic merge from submit-queue

enable Node authorizer and NodeRestriction admission controller

Fixes https://github.com/kubernetes/kubernetes/issues/46999
Fixes https://github.com/kubernetes/kubernetes/issues/47135

```release-note
gce kube-up: The `Node` authorization mode and `NodeRestriction` admission controller are now enabled
```

Automatic merge from submit-queue (batch tested with PRs 47075, 46342)

Remove hardcode for blocksize, use stat(), fixes test failure on SLES

**What this PR does / why we need it**:
Removes hardcoding for blocksize, fixes test failure on SLES
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #44022

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

Change what is stored in DaemonSet history `.data`

**What this PR does / why we need it**: 
In DaemonSet history `.data`, store a strategic merge patch that can be applied to restore a DaemonSet. Only PodSpecTemplate is saved. 

This will become consistent with the data stored in StatefulSet history. 

Before this fix, a serialized pod template is stored in `.data`; however, seriazlized pod template isn't a `runtime.RawExtension`, and caused problems when controllers try to patch the history's controller ref. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47008

**Special notes for your reviewer**: @kubernetes/sig-apps-bugs @erictune @kow3ns @kargakis @lukaszo @mengqiy 

**Release note**:

```release-note
NONE
```