Automatic merge from submit-queue (batch tested with PRs 44862, 42241, 42101, 43181, 44147)

Feature/hpa upscale downscale delay configurable

**What this PR does / why we need it**:
Makes "upscale forbidden window" and "downscale forbidden window"  duration configurable in arguments of kube-controller-manager. Those are options of horizontal pod autoscaler.

**Special notes for your reviewer**:
Please have a look @DirectXMan12 , the PR as discussed in Slack.

**Release note**:
```
Make "upscale forbidden window" and "downscale forbidden window"  duration configurable in arguments of kube-controller-manager. Those are options of horizontal pod autoscaler. Right now are hardcoded 3 minutes for upscale, and 5 minutes to downscale.  But sometimes cluster administrator might want to change this for his own needs.
```

Automatic merge from submit-queue (batch tested with PRs 44862, 42241, 42101, 43181, 44147)

Add short name "netpol" for networkpolicies

**What this PR does / why we need it**:
Add short name for `networkpolicies` in kubectl command for good user experience.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
None

**Special notes for your reviewer**:
None

**Release note**:

```release-note
Add short name "netpol" for networkpolicies
```

Automatic merge from submit-queue

Stop treating in-cluster-config namespace as an override

Fixes #44835

The namespace of an in-cluster config should behave like the namespace specified in a kubeconfig file... it should be used as the default namespace, but be able to be overridden by namespaces specified in yaml files passed to `kubectl create -f`.

```release-note
Restored the ability of kubectl running inside a pod to consume resource files specifying a different namespace than the one the pod is running in.
```

Automatic merge from submit-queue

add EditOptions to make edit reusable

FYI. Added `EditOptions` to decouple edit implementation from cobra command, thus make edit reusable. Once this get merged, we can refactor `create` commands to put them in their own package. @kubernetes/sig-cli-misc please give a quick review, and I would like to get this merged asap.

Automatic merge from submit-queue (batch tested with PRs 44788, 44859)

e2e: handle nil ReplicaSet in checkDeploymentRevision

Automatic merge from submit-queue

PATCH: Fix erroneous meaningful conflict for numeric values.

The wrong json package was used, resulting in patches being unmarshaled with numbers as float64 rather than int64. This in turn confused `HasConflicts()` which expects numeric types to match.

The end result was false positives of meaningful conflicts, such as:

```
there is a meaningful conflict (firstResourceVersion: "8517", currentResourceVersion: "8519"):
 diff1={"metadata":{"resourceVersion":"8519"},"spec":{"replicas":0},"status":"conditions":null,"fullyLabeledReplicas":null,"replicas":0}}
, diff2={"spec":{"replicas":0}}
```

This is branched from a discussion on https://github.com/kubernetes/kubernetes/pull/43469.

```release-note
Fix false positive "meaningful conflict" detection for strategic merge patch with integer values.
```

Automatic merge from submit-queue

Document the NodePort workflow for kubernetes-worker

closes
https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/259

NodePort networking model has no daemon listening to lend a hand so any
NodePort services will need to be manually declared and exposed.


**What this PR does / why we need it**: Updates the documentation around using NodePort networking with the kubernetes-worker charm.


**Special notes for your reviewer**: This is a working fix for using NodePort style networking with kubernetes-workers in the juju ecosystem. Declaring a simple workload as type NodePort, then following the updated documentation will make it reachable via the open-world network connection.

**Release note**:

```release-note
Documented NodePort networking for CDK.
```

Automatic merge from submit-queue (batch tested with PRs 43575, 44672)

Update deployment and daemonset completeness checks

maxUnavailable being taken into account for deployment completeness has caused a lot of confusion (https://github.com/kubernetes/kubernetes/issues/44395, https://github.com/kubernetes/kubernetes/issues/44657, https://github.com/kubernetes/kubernetes/issues/40496, others as well I am sure) so I am willing to just stop using it and require all of the new Pods for a Deployment to be available for the Deployment to be considered complete (hence both `rollout status` and ProgressDeadlineSeconds will not be successful in cases where a 1-pod Deployment never becomes successful because its Pod never transitions to ready).

@kubernetes/sig-apps-api-reviews thoughts?
```release-note
Deployments and DaemonSets are now considered complete once all of the new pods are up and running - affects `kubectl rollout status` (and ProgressDeadlineSeconds for Deployments)
```
Fixes https://github.com/kubernetes/kubernetes/issues/44395

Automatic merge from submit-queue (batch tested with PRs 43575, 44672)

util/iptables: check for and use new iptables-restore 'wait' argument

iptables-restore did not previously perform any locking, meaning that
when callers (like kube-proxy) asked iptables-restore to write large
numbers of rules, the iptables-restore process might run in parallel
with other 'iptables' invocations in kubelet (hostports), docker,
and other software.  This causes errors like:

"CNI request failed with status 400: 'Failed to ensure that nat chain
POSTROUTING jumps to MASQUERADE: error checking rule: exit status 4:
iptables: Resource temporarily  unavailable."

or from Docker:

"Failed to allocate and map port 1095-1095: iptables failed:
iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 1095
-j DNAT --to-destination 10.1.0.2:1095 ! -i lbr0: iptables:
Resource temporarily unavailable.\n (exit status 4)"

iptables-restore "wait" functionality was added in iptables git
commit 999eaa241212d3952ddff39a99d0d55a74e3639e which
is not yet in a release.

See also https://bugzilla.redhat.com/show_bug.cgi?id=1417234

@eparis @knobunc @kubernetes/rh-networking @kubernetes/sig-network-misc @freehan @thockin @brendandburns

closes
https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/259

NodePort networking model has no daemon listening to lend a hand so any
NodePort services will need to be manually declared and exposed.

Automatic merge from submit-queue

Remove unused function - verifyDNSPodIsRunning

**What this PR does / why we need it**:

In ea4a7e24, we removed the cluster
DNS verification check from the test, but neglected to remove the
method itself. Let's remove this as it is not used anywhere else.


**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

deploymentutil.GetNewReplicaSet is allowed to return nil.

Automatic merge from submit-queue

configmap.go: add one initialization symbol

Automatic merge from submit-queue (batch tested with PRs 44837, 44779, 44492)

remove duplicate code from restful namer

The deleted codes have the same logic with function ObjectName.

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 44837, 44779, 44492)

Default ObjectNameFunc for all REST Stores

All `Store`s in Kubernetes follow the same logic for determining the name of an object.  This change makes it so that `CompleteWithOptions` defaults the `ObjectNameFunc` if it is not specified.  Thus a user does not need to remember to use `ObjectMeta.Name`.  Using the wrong field as the name can lead to an object which has a name that bypasses normal object name validation.
Signed-off-by: Monis Khan <mkhan@redhat.com>

cc @liggitt @soltysh for review

**Release note**:

```
NONE
```

Automatic merge from submit-queue

Fix Content-Type error of apis

**What this PR does / why we need it**:
Response's Content-type of `/apis` is `text/plain`, not `application/json`.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #44646 

**Special notes for your reviewer**:
We could use `responsewriters.WriteObjectNegotiated()` to write Content-type correctly.

**Release note**:

```release-note
```

Automatic merge from submit-queue

Update basic audit filter's comment message

**Release note**:

```NONE
```

Automatic merge from submit-queue

unit test for kubectl config set

**What this PR does / why we need it**:
unit test for kubectl config set

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
think you

**Release note**:

```release-note
```

Automatic merge from submit-queue

Lower limit for allowed losses in Stackdriver Logging tests

Automatic merge from submit-queue

support subresource when running kubectl create role

```
#kubect create role foo --verb=get,list,watch --resource=pods/status
the server doesn't have a resource type "pods/status"
```

In ea4a7e24, we removed the cluster
DNS verification check from the test, but neglected to remove the
method itself. Let's remove this as it is not used anywhere else.

Automatic merge from submit-queue

make certs used in roundtripper_test same as those used in proxy_test

This fixes an invalid cert error in 1.8. Gross copy paste but we will likely never have to do this again.

Part of https://github.com/kubernetes/kubernetes/issues/38228

https://github.com/kubernetes/kubernetes/blame/master/staging/src/k8s.io/apiserver/pkg/endpoints/proxy_test.go#L524-L570

Automatic merge from submit-queue

Exclude master from LoadBalancer / NodePort

The servicecontroller documents that the master is excluded from the
LoadBalancer / NodePort, but this is broken for clusters where we are
using taints for the master (as introduced in 1.6), instead of marking
the master as unschedulable.

This restores the desired documented behaviour, by excluding nodes that
are labeled as masters with the new 1.6 labels, even if they use the new
1.6 taints.

Fix #33884

```release-note
Exclude nodes labeled as master from LoadBalancer / NodePort; restores documented behaviour
```

Automatic merge from submit-queue

Use provided VipPortID for OpenStack LB

**What this PR does / why we need it**:

When creating an OpenStack LoadBalancer, Kubernetes will search through the tenant trying to match the LB's VIP with a port. This is problematic because multiple ports may have the same fixed IP, therefore leading to routing inconsistencies. We should use the port ID provided by the LB's response body instead.

**Which issue this PR fixes**:

https://github.com/kubernetes/kubernetes/issues/43909

**Special notes for your reviewer**:

Since this involves non-deterministic testing, it'd be best if we can run this in a staging environment for a few days before merging (say until early next week).

**Release note**:
```release-note
Fixes issue during LB creation where ports where incorrectly assigned to a floating IP
```

Automatic merge from submit-queue

Remove unused function - verifyDNSPodIsRunning

**What this PR does / why we need it**:

In ea4a7e24, we removed the cluster
DNS verification check from the test, but neglected to remove the
method itself.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

In ea4a7e24, we removed the cluster
DNS verification check from the test, but neglected to remove the
method itself.

Automatic merge from submit-queue

Improve Service controller's code coverage a little bit

**What this PR does / why we need it**:
Improves the code coverage for Service Controller
Before
```
go test --cover ./pkg/controller/service
ok      k8s.io/kubernetes/pkg/controller/service        0.101s  coverage: 23.4% of statements
```
After
```
go test --cover ./pkg/controller/service/
ok      k8s.io/kubernetes/pkg/controller/service        0.094s  coverage: 62.0% of statements
```

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
More unit testing

**Special notes for your reviewer**:

**Release note**: 

```release-note
NONE
```

Automatic merge from submit-queue

Reorganize the output of "kubectl get -o json"

"resourceVersion" and "selfLink" are members of "metadata" rather than
the list. This change reorganize the struct to provide consistency with
other places.

Before this change:
```json
    "kind": "List",
    "metadata": {},
    "resourceVersion": "",
    "selfLink": ""
```
After this change:
```json
    "kind": "List",
    "metadata": {
        "resourceVersion": "",
        "selfLink": ""
    }
```

Reference:
https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/apis/meta/v1/types.go#L57



**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Remove redis-proxy example

The docker image is nowhere to be found, so lets remove it.
There have been a request for the Dockerfile here [1], but nobody
seems to care.


[1] https://github.com/kubernetes/kubernetes/issues/4914#issuecomment-77209779
----
**What this PR does / why we need it**:
This PR remove a k8s manifest which use a image which source is nowhere to be found.

```release-note
Remove redis-proxy.yaml sample, as the image is nowhere to be found.
```

Automatic merge from submit-queue

Skip pods marked for deletion

Fixes #44144

The docker image is nowhere to be found, so lets remove it.
There have been a request for the Dockerfile here [1], but nobody
seems to care.

redis-proxy is replaced with redis-master in test-cmd-util.sh, to
ensure that the tests still works.
The redis-proxy pod in test/fixtures/doc-yaml/user-guide/multi-pod.yaml
is replaced with valid-pod from test/fixtures/doc-yaml/admin/limitrange/valid-pod.yaml,
so redis-proxy is removed every where.

[1] https://github.com/kubernetes/kubernetes/issues/4914#issuecomment-77209779

Automatic merge from submit-queue

Fixed typos and issues in examples/volumes/glusterfs/README.md

**What this PR does / why we need it**:

This PR updates the GlusterFS `README.md` to fix several typos, outdated documentation and examples that did not work anymore.

**Which issue this PR fixes** 

None

**Special notes for your reviewer**:

None

**Release note**:

`release-note-NONE`

Fixes #44144

Automatic merge from submit-queue

add "bind" to validResourceVerbs in "create role" cli 

"bind" and "impersonate" are also a legal verbs according this:
https://github.com/kubernetes/kubernetes.github.io/pull/2771/files
**Release note**:

```NONE
```