Automatic merge from submit-queue

move end to end validation to a dedicated phase

mostly reshuffling

Automatic merge from submit-queue

Fix a couple of typos.

Automatic merge from submit-queue

Make RBAC post-start hook conditional on RBAC authorizer being used

Makes the RBAC post-start hook (and reconciliation) conditional on the RBAC authorizer being used

Ensures we don't set up unnecessary objects.

```release-note
RBAC role and rolebinding auto-reconciliation is now performed only when the RBAC authorization mode is enabled.
```

Automatic merge from submit-queue (batch tested with PRs 43897, 43899)

Move test to flaky suite while debugging

Moves https://github.com/kubernetes/kubernetes/issues/43864 to the flaky suite. We know what caused the flakiness (https://github.com/kubernetes/kubernetes/pull/43508), but I would like to debug this more (https://github.com/kubernetes/kubernetes/pull/43865) because it seems like a race in the deployment controller.

Automatic merge from submit-queue (batch tested with PRs 43897, 43899)

Fix rs release test to poll on 409s

Fixes https://github.com/kubernetes/kubernetes/issues/43895

@caesarxuchao @fgimenez ptal

Automatic merge from submit-queue (batch tested with PRs 43133, 43865)

Log replica sets/pods for recreate test

Dumps info for debugging https://github.com/kubernetes/kubernetes/issues/43864

Automatic merge from submit-queue (batch tested with PRs 43133, 43865)

Upgrade to Hazelcast-Kubernetes 3.8 and updated docs

**What this PR does / why we need it**:
Upgrade to latest hazelcast-kubernetes version the example and update the docs reflecting the latest version

Automatic merge from submit-queue (batch tested with PRs 42360, 43109, 43737, 43853)

Fix typo
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>



**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 42360, 43109, 43737, 43853)

delete etcd socket file for unit tests

This change clean up the environment for etcd3 unit test.
Without this change, "make test" will leave some socket files in
workspace. And these socket files make hack/verify-generated-protobuf.sh
fails.

**Release note**:

```NONE
```

Automatic merge from submit-queue (batch tested with PRs 42360, 43109, 43737, 43853)

kubeadm: test-cmds for kubeadm completion

**What this PR does / why we need it**: Adding test-cmds for kubeadm completion. 

Adding tests is a WIP from #34136

**Special notes for your reviewer**: /cc @luxas

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 42360, 43109, 43737, 43853)

Include pod namespace in PSP 'use' authorization check

Follow up to https://github.com/kubernetes/kubernetes/pull/33080/files#diff-291b8dd7d08cc034975ddb3925dbb08fR341

Prior to this PR, when PodSecurityPolicy admission is active, you must be authorized to use a covering PodSecurityPolicy cluster-wide in order to create a pod. This PR changes that to only require a covering PodSecurityPolicy within the pod's namespace.

When used in concert with mechanisms that limits pods within a namespace to a particular set of nodes, this can be used to allow users to create privileged pods within specific namespaces only.

```release-note
Permission to use a PodSecurityPolicy can now be granted within a single namespace by allowing the `use` verb on the `podsecuritypolicies` resource within the namespace.
```

Automatic merge from submit-queue (batch tested with PRs 42379, 42668, 42876, 41473, 43260)

Don't use global rand for nodeport and IP allocs

Seed it at construction.

Automatic merge from submit-queue (batch tested with PRs 42379, 42668, 42876, 41473, 43260)

Bump test coverage for initialresources

**What this PR does / why we need it**:

Increases test coverage for `plugin/pkg/admission/initialresources` to 80.2%.

**Which issue this PR fixes** 

https://github.com/kubernetes/kubernetes/issues/39559

**Special notes for your reviewer**:

Some of these features require E2E tests to achieve 100% coverage, the tests here are just unit tests, so I've tried to delineate as much as possible. I also saw that we might be exporting a lot of this to Heapster in the future.

**Release note**:

```release-note
Test coverage for initialresources increased to 80.2% percent.
```

Automatic merge from submit-queue (batch tested with PRs 42379, 42668, 42876, 41473, 43260)

accurate hint

accurate hint

same err hint (Error adding network) in one method,cann't position problem

Automatic merge from submit-queue (batch tested with PRs 42379, 42668, 42876, 41473, 43260)

Silence error messages from the docker rmi call we expect to fail

**What this PR does / why we need it**: when we removed `docker tag -f` in #34361 we added a bunch of `docker rmi` calls to preserve behavior for older docker versions. That step is usually a no-op, however, and results in confusing messages like
```
Tagging docker image gcr.io/google_containers/kube-proxy:c8d0b2e7a06b451117a8ac58fc3bb3d3 as gcr.io/kubernetes-release-test/kube-proxy-amd64:v1.5.4
Error response from daemon: No such image: gcr.io/kubernetes-release-test/kube-proxy-amd64:v1.5.4
```

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #42665

**Special notes for your reviewer**: I could probably remove the `docker rmi` calls entirely, though I don't know if folks are still using docker < 1.10. (I think Jenkins still has 1.9.1.)

**Release note**:

```release-note
NONE
```

cc @jessfraz

Automatic merge from submit-queue (batch tested with PRs 42379, 42668, 42876, 41473, 43260)

Enable audit log in local cluster

fixes #42318

`ENABLE_APISERVER_BASIC_AUDIT=true hack/local-up-cluster.sh`

Automatic merge from submit-queue

Curate owners for pkg/volume/aws_ebs

The previous list was algorithmically generated; applying some curation.

```release-note
NONE
```

Automatic merge from submit-queue

don't wait for first kubelet to be ready and drop dummy deploy

Per https://github.com/kubernetes/kubernetes/issues/43815#issuecomment-290270198, I suggest that we drop both the node ready and the dummy deployment check altogether for 1.6 and move them to a validation phase for 1.7.

I really think we should drop these checks altogether. CreateClientAndWaitForAPI should create a client and wait for the API, not create dummy deployments and wait for nodes to register and be healthy. These are end to end validations and this is the wrong place to do this stuff. We need an explicit final validation phase for this.

```release-note
Fix a deadlock in kubeadm master initialization.
```

Fixes #43815

Automatic merge from submit-queue

PodSecurityPolicy example: fix explanation

cc @kubernetes/sig-auth-pr-reviews

```release-note
NONE
```

Automatic merge from submit-queue

add eparis as approver for test and examples

spread the love

```release-note
NONE
```

Automatic merge from submit-queue

Implement API usage metrics for gce storage

**What this PR does / why we need it**:

This PR implements support for emitting metrics from GCE about storage operations.

**Which issue this PR fixes** 

Fixes https://github.com/kubernetes/features/issues/182

**Release note**:
```
Add support for emitting metrics from GCE cloudprovider about storage operations.
```

Automatic merge from submit-queue (batch tested with PRs 42662, 43035, 42578, 43682)

Apply [Feature:Volumes] to subset of tests in volumes.go

**What this PR does / why we need it**:
According to [this test doc](https://github.com/kubernetes/community/blob/master/contributors/devel/e2e-tests.md#kinds-of-tests), the `[Feature:xyz]` tag indicates that the tests have a non-default requirements and should not be run in the core suite. Previously all test in _e2e/volumes.go_ were tagged `[Feature:Volumes]` but I believe only six of the tests warrant this tag: iSCSI, GlusterFS, Ceph-RBD, Ceph-FS, vSPhere, and Cinder. The remaining tests (NFS, PD, ConfigMap) do not need the `Feature:` tag.

**Special notes for your reviewer**:
I moved the `[Volume]` tags from the `It`'s to the outer `KubeDescribe` to simplify the `It` text and remove redundancy.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 42662, 43035, 42578, 43682)

Selector spreading - improving code readability.

**What this PR does / why we need it**:
To improve code readability in selector spreading.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #42577





```release-note
```

Automatic merge from submit-queue (batch tested with PRs 42662, 43035, 42578, 43682)

[Federation] Fix a typo in the ReplicaSet E2E test: s/extrace/extract/

```release-note
NONE
```

Automatic merge from submit-queue

Print dereferenced pod status fields when logging status update

Before: "Terminated:0xc421932af0"
After:"Terminated:&ContainerStateTerminated{ExitCode:0,Signal:0,Reason:Completed,Message:,StartedAt:0001-01-01 00:00:00 +0000 UTC,FinishedAt:2017-03-07 14:50:48 -0500 EST,ContainerID:docker://bd453bb969264b3ace2b3934a568af7679a0d51fee543a5f8a82429ff654970e,}"

"Ignoring same status for pod" messages already print status fully, these "Status for pod updated" messages should too IMO

```release-note
NONE
```

Automatic merge from submit-queue

Update comments for golint.

and skip dummy deployment

spread the love

Automatic merge from submit-queue

add can-i example

use * can check if the admin user or not.

Automatic merge from submit-queue

test: update replica set e2e test

Should reduce the flakiness for https://github.com/kubernetes/kubernetes/issues/30981, https://github.com/kubernetes/kubernetes/issues/36429, and https://github.com/kubernetes/kubernetes/issues/32023 by reducing the replicas from 2 to 1 and also make the test failure clearer.

@kubernetes/sig-apps-test-failures

Signed-off-by: yupengzte <yu.peng36@zte.com.cn>

Automatic merge from submit-queue

[e2e] Scheduler priority test

Fix https://github.com/kubernetes/kubernetes/issues/42439
In order to reduce the interfere of the balanced least-requested priority function, I create a balance pod to make the node have same mem/cpu use rate, not sure it's a correct way, but it did good, I have not cover all the scenarios yet, want to get feedback whether I am in the right way.
@k82cn @bsalamat Would you please help review ?