Automatic merge from submit-queue (batch tested with PRs 41287, 41636, 44881, 44826)

Enable default signer implementation

**What this PR does / why we need it**:

The Kubernetes controller manager provides a default implementation
of a signer. We should enable it by passing the --cluster-signing-cert-file
and --cluster-signing-key-file parameters to the controller manager
with paths to your Certificate Authority’s keypair. Hoping this will
help pass the "Certificates API [It] should support building a client with a CSR"
e2e test when run against k8s started using local-up-cluster.sh

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 41287, 41636, 44881, 44826)

[Federation] Only attempt to log information about pods in federation/cluster/log-dump.sh if those pods exist.

Fixes an issue where the script fails, because bash considers an empty array an unbound variable.
**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 41287, 41636, 44881, 44826)

Bump to go1.8 and remove the edge GOROOT

**What this PR does / why we need it**:

Bumps to go1.8; we get:
 - performance improvements
 - build time improvements
 - the possibility to remove the hacky edge-GOROOT for arm and ppc64le that must use go1.8
 - all other awesome features that are included in go1.8: https://golang.org/doc/go1.8

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/kubernetes/kubernetes/issues/38228

**Special notes for your reviewer**:

@ixdy Please push the image ASAP so we can see if this passes all tests

**Release note**:

```release-note
Upgrade go version to v1.8
```
cc @ixdy @bradfitz @jessfraz @wojtek-t @timothysc @spxtr @thockin @smarterclayton @bprashanth @gmarek

Automatic merge from submit-queue (batch tested with PRs 41287, 41636, 44881, 44826)

apiserver: add pkg/util/webhook tests

This commit adds tests for pkg/util/webhooks.  The purpose of this was not only for better code coverage but also to alleviate the need for consumers to write their own tests for core functionality.

**Reasoning**

While working on the generic webhook admission plugin for https://github.com/kubernetes/community/pull/132, I found out that there are no tests for `staging/k8s.io/apiserver/pkg/util/webhook` and I also noticed that various places in the k8s sources were also replicating the same core tests that could/should be handled in `staging/k8s.io/apiserver/pkg/util/webhook`:

* `staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/webhook_test.go`
* `staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/webhook/webhook_test.go`
* `plugin/pkg/admission/imagepolicy/admission_test.go`
* _possibly more..._

That's what this PR does, adds tests for `staging/k8s.io/apiserver/pkg/util/webhook` so that consumers no longer have to worry about testing client configuration issues, TLS issues, etc. just to use `staging/k8s.io/apiserver/pkg/util/webhook`.

cc @cjcullen

Automatic merge from submit-queue

Add --apiserver-advertise-address option to kubeadm alpha phase certs…

**What this PR does / why we need it**:
`kubeadm alpha phase certs` command currently does not support `--apiserver-advertise-address` options, and certificates by default are linked to the bind address of the machine where the kubeadm command is run. This behaviour is not adequate f.i. for use cases where you are using `kubeadm alpha phase certs` for an HA deployments or for use cases where you generate certificates on a machine different that the master.

The PR adds support for `--apiserver-advertise-address` to `kubeadm alpha phase certs`, with the following behaviour:
- if `--apiserver-advertise-address` is specified and valid, certificates are linked to the given IP
- if `--apiserver-advertise-address` is specified but not valid, the given ip is not valid an error is given

**Special notes for your reviewer**:
Implementation follow the track already in place for other flags (with validation, but no tests).

Automatic merge from submit-queue (batch tested with PRs 44607, 44472, 44482)

Used Pods interface for binding.

Used Pods interface for binding in scheduler.

Automatic merge from submit-queue (batch tested with PRs 44607, 44472, 44482)

[Federation] Fix the comments on FederationNameAnnotation

Follow-up for minor issues raised in #42683

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 44607, 44472, 44482)

update kubectl apply doc for required resource name

**What this PR does / why we need it**:
Update kubectl apply doc to illustrate that the resource name is required.

**Which issue this PR fixes** : fixes #44501

**Special notes for your reviewer**:
@liggitt @adohe @jayunit100

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 44583, 44139, 44753)

fix config path broken in kubeadm

fixes https://github.com/kubernetes/kubeadm/issues/234

Automatic merge from submit-queue (batch tested with PRs 44583, 44139, 44753)

Federation: Removing duplicate finalizer manipulation logic in federation controllers

Ref #40989

Using apimachinery's meta accessor to manipulate objects instead of duplicating that logic in each controller.
Just a cleanup, no behavior change.

cc @kubernetes/sig-federation-pr-reviews

Automatic merge from submit-queue

bump bazel build to go1.8.1 and remove invalid unit tests

part of https://github.com/kubernetes/kubernetes/issues/38228

I firmly believe that unit tests that check error strings are incorrect unit tests. If we care about what type of error is returned, we need to use public error types. Anywhere we are using generic errors, we don't care other then that we saw an error.

Automatic merge from submit-queue (batch tested with PRs 44601, 44842, 44893, 44491, 44588)

kubeadm: add flag to skip token print out

**What this PR does / why we need it**: When kubeadm init is used in an automated context, it still prints the token to standard out. When standard output ends up in a log file, it can be considered that the token is leaked there and can be compromised. This PR adds a flag you can select to not have it print out and explicitly disable this behavior.

This is a continuation from https://github.com/kubernetes/kubernetes/pull/42823 since it had to be closed.

**Which issue this PR fixes** : fixes #https://github.com/kubernetes/kubeadm/issues/160

**Special notes for your reviewer**: /cc @luxas @errordeveloper 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 44601, 44842, 44893, 44491, 44588)

Define const annotation variable once

We do not need to define the const annotation var twice in pkg/volume and pkg/volume/validation


**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 44601, 44842, 44893, 44491, 44588)

secret.go: add initial symbol and format err

secret.go: add initial symbol and format err
line 198： add initialization symbol 
other lines: format err.

Automatic merge from submit-queue

Cleanup: replace some hardcoded vars and remove unused functions

Replace some hardcoded vars and remove unused functions

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

fix kubeadm init when certdir changed

If --cert-dir specified, `kubeadm init`  failed.

and bump gazel to a version that supports 1.8

Automatic merge from submit-queue (batch tested with PRs 42477, 44462)

fix cluster scoped self-link

Might fix #37622, definitely fixes the cluster-scoped resource problem.  Looks like it was just a typo when compared against  https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/pkg/endpoints/installer.go#L451

@adohe @DirectXMan12

Automatic merge from submit-queue (batch tested with PRs 42477, 44462)

Use storage.v1 instead of v1beta1

storage.v1beta1 was used to work around GKE which did not expose v1. Now that GKE is updated, we can switch everything to v1.

This is simple sed v1beta1 -> v1 + enabled a new test + changed preference of exposed interfaces in `storage/install/install.go`.

@msau42, PTAL and let me know when GKE is updated with storage v1 API and this PR can be actually merged.

@kubernetes/sig-storage-pr-reviews 

```release-note
NONE
```

Automatic merge from submit-queue

Fixed a tiny issue for ShortHumanDuration printer.

Fixed a tiny issue for ShortHumanDuration printer
to avoid "0y" message.

Fixed #44599

Automatic merge from submit-queue

remove resourcename validation in create role

@liggitt Since #44659 is not correct. I think we should fix the validation in create role command.

Automatic merge from submit-queue

Add namespace-{list, create, delete} actions to the kubernetes-master layer

**What this PR does / why we need it**:

This PR adds namespace-{list,create,delete} actions to the juju kubernetes-master layer.

**Which issue this PR fixes**: fixes #43712

**Special notes for your reviewer**:

Original PR https://github.com/juju-solutions/kubernetes/pull/109

**Release note**:

```
Add  namespace-{list,create,delete} actions to the juju kubernetes-master layer
```

Automatic merge from submit-queue

Increase code coverage for pkg/api/resource

Increases coverage to 81.3% of statements as part of issue #39559 

Not particularly happy with the tests in quantity_proto_test.go so am happy to remove them if they aren't up to scratch.
Signed-off-by: Liam White <liamwhite@uk.ibm.com>

Automatic merge from submit-queue (batch tested with PRs 44853, 44572, 44797, 44439, 44902)

Revert "[Federation] Build a simple hyperkube image on-the-fly only containing the hyperkube binary for development and testing purposes."

Reverts kubernetes/kubernetes#43181

Federation CI and PR tests are completely broken. No time to root cause this, but the merge time of PR #43181 and failures match. So we are going to try by reverting this.

Automatic merge from submit-queue (batch tested with PRs 44741, 44853, 44572, 44797, 44439)

controller: fix saturation check in Deployments

Fixes https://github.com/kubernetes/kubernetes/issues/44436

@kubernetes/sig-apps-bugs 

I'll cherry-pick this back to 1.6 and 1.5

Automatic merge from submit-queue (batch tested with PRs 44741, 44853, 44572, 44797, 44439)

Check errors before logging providers

The logProviders() should check errors firstly, and do not log
providers when providers is null.

Automatic merge from submit-queue (batch tested with PRs 44741, 44853, 44572, 44797, 44439)

add tests for managed hosts file content

**What this PR does / why we need it**: a tiny refactor to separate concerns host file content from the logic ensuring that the file exists, and also adds unit test.

This is to prepare extending the host file logic to include customized entries described in https://github.com/kubernetes/kubernetes/issues/43632. I'm wary of changing that logic in absence of any unit tests.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 44741, 44853, 44572, 44797, 44439)

Print executed cmd in cluster autoscaler e2e tests

cc: @MaciekPytel @fgrzadkowski

storage.v1beta1 was used to work around GKE which does not expose v1. Now that
GKE is updated, we can switch everything to v1.

Automatic merge from submit-queue

Refine ESIPP validation logic in validation.go

Separated from #41162.

The previous ESIPP validation logic in validation.go has a huge overlap with [function healthCheckNodePortUpdate in service/rest.go](https://github.com/kubernetes/kubernetes/blob/870585e8e1ca1133a67d4d44bfd4a9722b2b93c7/pkg/registry/core/service/rest.go#L283-L373), in which we reject any invalid modifications on ESIPP annotations.

This PR removes the overlap, and make validation.go only check if values are legal and whether user mixes different API versions (alpha & beta).

We are indeed removing the alpha annotation support, but it is kept in the codes for the ease of transiting the same logic onto beta/GA.

/assign @thockin @freehan 

**Release note**:

```release-note
NONE
```

Signed-off-by: Liam White <liamwhite@uk.ibm.com>