Automatic merge from submit-queue

Fix godoc comments

This PR fixes godoc comments.

CC @simo5

Automatic merge from submit-queue

Add local ephemeral storage support in LimitRange

**Special notes for your reviewer**:
For a single local ephemeral storage resource

xref #43607 

**Release note**:
```release-note
Add local ephemeral storage support to LimitRange
```

/assign @jingxu97 
cc @ddysher

Automatic merge from submit-queue

Only list hollow-node pods while trying to count them

Otherwise it's counting 1 extra due to heapster pod.

Automatic merge from submit-queue

AWS: check validity of KSM key before creating a new encrypted disk.

AWS CreateVolume call does not check if referenced encryption key actually exists and returns a valid new AWS EBS volume even though an invalid key was specified. Later on it removes the EBS silently when its encryption fails.

To work around this buggy behavior we manually check that the key exists before calling CreateVolume.

Fixes #48438

/sig aws

Please review carefully. Can we safely assume that Kubernetes controller-manager can read encryption keys?

```release-note
aws: Kubernetes now checks existence of provided KSM (Key Management Service) key before creating an encrypted AWS EBS.
```

Automatic merge from submit-queue

e2e: Add tests for network tiers in GCE

This test depends on #51301, which adds the new feature. Only the `e2e: Add tests for network tiers in GCE` commit is new.
#51301 should pass this new test.

Automatic merge from submit-queue

Retry master instance creation in case of retriable error (with sleep)

To help with our 5k-node CI tests failing to startup the cluster.
And also towards the greater goal - https://github.com/kubernetes/kubernetes/issues/43140

cc @kubernetes/sig-scalability-misc @kubernetes/sig-cluster-lifecycle-misc

Automatic merge from submit-queue (batch tested with PRs 51439, 51361, 51140, 51539, 51585)

[Scheduler] regroup imports
Signed-off-by: sakeven <jc5930@sina.cn>



**What this PR does / why we need it**:

>Imports are organized in groups, with blank lines between them. The standard library packages are always in the first group.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51439, 51361, 51140, 51539, 51585)

Enable alpha GCE disk API

This PR builds on top of #50467 to allow the GCE disk API to use either the alpha or stable APIs.

CC @freehan

Automatic merge from submit-queue (batch tested with PRs 51439, 51361, 51140, 51539, 51585)

CPU manager interfaces.

Please review / merge #51132 first.
Blocker for CPU manager #49186 (3 of 6)

@sjenning @derekwaynecarr

Automatic merge from submit-queue (batch tested with PRs 51439, 51361, 51140, 51539, 51585)

Iscsi handle failed mount

**What this PR does / why we need it**:

**Which issue this PR fixes**: fixes #50556

**Special notes for your reviewer**:

**Release note**:

```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 51439, 51361, 51140, 51539, 51585)

Fix list-features script

Automatic merge from submit-queue (batch tested with PRs 47054, 50398, 51541, 51535, 51545)

e2e/integration: simplify deepcopy calls

Automatic merge from submit-queue (batch tested with PRs 47054, 50398, 51541, 51535, 51545)

allow disabling the scheduler port

Unlike the `kube-apiserver`, the scheduler can function without exposing a status port.  This provides the option to disable it by explicitly passing a `-1`.  This does not change default behavior.

@aveshagarwal

Automatic merge from submit-queue (batch tested with PRs 47054, 50398, 51541, 51535, 51545)

scheduler: simplify deepcopy calls

Pre-requisite of https://github.com/kubernetes/kubernetes/pull/49575.

Automatic merge from submit-queue (batch tested with PRs 47054, 50398, 51541, 51535, 51545)

Switch away from gcloud deprecated flags in compute resource listings

**What is fixed**

Remove deprecated `gcloud compute` flags, see linked issue.

**Which issue this PR fixes**:

fixes #49673 

**Special notes for your reviewer**:

The change in `gcloudComputeResourceList` in `test/e2e/framework/ingress_utils.go` isn't strictly needed as currently no affected resources are called on within that file, however the function has the _potential_ to access affected resources so I covered it as well. Happy to change if deemed unnecessary.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Improve description for --masquerade-all and --cluster-cidr flags

**What this PR does / why we need it**:

Improves the help text for the kube-proxy's `--masquerade-all` and `--cluster-cidr` flags, which previously were vague and confusing.

Fixes https://github.com/kubernetes/kubernetes/issues/47213

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51228, 50185, 50940, 51544, 51543)

admission plugins: simplify deepcopy calls

Automatic merge from submit-queue (batch tested with PRs 51228, 50185, 50940, 51544, 51543)

pkg/api: simplify deepcopy calls

Automatic merge from submit-queue (batch tested with PRs 51228, 50185, 50940, 51544, 51543)

Add upgrades tests for kube-proxy daemonset migration path

**What this PR does / why we need it**:
From #23225, this is a part of setting up CIs to validate the kube-proxy migration path (static pods -> daemonset and reverse).
The other part of the works (adding real CIs that run these tests) will be in a separate PR against [kubernetes/test-infra](https://github.com/kubernetes/test-infra).

Though this is currently blocked by #50705.

**Special notes for your reviewer**:
cc @roberthbailey  @pwittrock 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51228, 50185, 50940, 51544, 51543)

Task 4: Ignored node condition predicates if TaintsByCondition enabled.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: part of #42001 

**Release note**:
```release-note
None
```

Automatic merge from submit-queue

Add storageClass.mountOptions and use it in all applicable plugins

split off from https://github.com/kubernetes/kubernetes/pull/50919 and still dependent on it. cc @gnufied


issue: https://github.com/kubernetes/features/issues/168

```release-note
Add mount options field to StorageClass. The options listed there are automatically added to PVs provisioned using the class.
```

Automatic merge from submit-queue (batch tested with PRs 51377, 46580, 50998, 51466, 49749)

Adding e2e SELinux test for local storage

Adding e2e test for SELinux enabled local storage
/sig storage
Closes #45054

Automatic merge from submit-queue (batch tested with PRs 51377, 46580, 50998, 51466, 49749)

Use the pre-built docker binaries on Ubuntu for benchmark tests

- Tested manually.
- The `ubuntu-init-docker.yaml` is copied from `cos-init-docker.yaml` with the following changes needed by Ubuntu. This change is temporary -- we will remove the script and the tests once we know the performance of using the pre-built Docker 1.12 on Ubuntu.

```
71,72c71,72
<         mount --bind "${install_location}"/docker-containerd /usr/bin/docker-containerd
<         mount --bind "${install_location}"/docker-containerd-shim /usr/bin/docker-containerd-shim
---
>         mount --bind "${install_location}"/docker-containerd /usr/bin/containerd
>         mount --bind "${install_location}"/docker-containerd-shim /usr/bin/containerd-shim
75c75
<         mount --bind "${install_location}"/docker-runc /usr/bin/docker-runc
---
>         mount --bind "${install_location}"/docker-runc /usr/sbin/runc
88c88
<         local requested_version="$(get_metadata "gci-docker-version")"
---
>         local requested_version="$(get_metadata "ubuntu-docker-version")"
93,98d92
<         # Check if we have the requested version installed.
<         if check_installed /usr/bin/docker "${requested_version}"; then
<           echo "Requested version already installed. Exiting."
<           exit 0
<         fi
< 
100c94
<         /usr/bin/systemctl stop docker
---
>         systemctl stop docker
106c100
<         /usr/bin/systemctl start docker && exit $rc
---
>         systemctl start docker && exit $rc
```

- Updated all tests to use the latest Ubuntu image.

**Release note**:
```
None
```

/assign @Random-Liu

Automatic merge from submit-queue (batch tested with PRs 51377, 46580, 50998, 51466, 49749)

feat(#21648 )Add kubectl set env command.

**What this PR does / why we need it**:
#21648
Moved from OpenShift to Kubenetes.
@kargakis @smarterclayton 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51377, 46580, 50998, 51466, 49749)

Implement IPVS-based in-cluster service load balancing

**What this PR does / why we need it**:

Implement IPVS-based in-cluster service load balancing. It can provide some performance enhancement and some other benefits to kube-proxy while comparing iptables and userspace mode. Besides, it also support more sophisticated load balancing algorithms than iptables (least conns, weighted, hash and so on).

**Which issue this PR fixes**

#17470 #44063

**Special notes for your reviewer**:


* Since the PR is a bit large, I splitted it and move the commits related to ipvs util pkg to PR #48994. Hopefully can make it easier to review.

@thockin @quinton-hoole @kevin-wangzefeng @deepak-vij @haibinxie @dhilipkumars @fisherxu 

**Release note**:

```release-note
Implement IPVS-based in-cluster service load balancing
```

Automatic merge from submit-queue

Implement stop function in streaming server.

Implement streaming server stop, so that we could properly stop streaming server.

We need this to properly stop cri-containerd.

Automatic merge from submit-queue (batch tested with PRs 49961, 50005, 50738, 51045, 49927)

adding validations on kubelet starting configurations

**What this PR does / why we need it**:
I found some validations of kubelet starting options were missing when I was creating a custom cluster from scratch. The kubelet does not check invalid configurations on `--cadvisor-port`, `--event-burst`, `--image-gc-high-threshold`, etc. I have added some validations in kubelet like validations in `cmd/kube-apiserver/app/options/validation.go`.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Adds additional validation for kubelet in `pkg/kubelet/apis/kubeletconfig/validation`.
```

Automatic merge from submit-queue (batch tested with PRs 49961, 50005, 50738, 51045, 49927)

Move rotating kubelet client certificate to beta.

```release-note
Release the kubelet client certificate rotation as beta.
```

Automatic merge from submit-queue (batch tested with PRs 49961, 50005, 50738, 51045, 49927)

controllers: simplify deepcopy calls

Automatic merge from submit-queue (batch tested with PRs 49961, 50005, 50738, 51045, 49927)

Add cluster e2es to verify scheduler local storage support

Add cluster e2es to verify scheduler local storage support and remove some unused private functions

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:  
part of #50818

**Release note**:
```release-note
Add cluster e2es to verify scheduler local ephemeral storage support
```

/assign @jingxu97 
/cc @ddysher

Automatic merge from submit-queue (batch tested with PRs 49961, 50005, 50738, 51045, 49927)

Add --append-hash flag to kubectl create configmap/secret

**What this PR does / why we need it**:
Specifying this new flag will automatically hash the configmap/secret
contents with sha256 and append the first 40 hex-encoded bits of the
hash to the name of the configmap/secret. This is especially useful for
workflows that generate configmaps/secrets from files (e.g.
--from-file).

See this Google doc for more background:
https://docs.google.com/document/d/1x1fJ3pGRx20ujR-Y89HUAw8glUL8-ygaztLkkmQeCdU/edit

**Release note**:
```release-note
Adds --append-hash flag to kubectl create configmap/secret, which will append a short hash of the configmap/secret contents to the name during creation.
```

Signed-off-by: sakeven <jc5930@sina.cn>

Conflicts:
	pkg/util/ipvs/ipvs_unsupported.go

Automatic merge from submit-queue

apiextensions: validation for customresources

- [x] Add types for validation of CustomResources
- [x] Fix conversion-gen: #49747
- [x] Fix defaulter-gen: kubernetes/gengo#61
- [x] Convert to OpenAPI types
- [x] Validate CR using go-openapi
- [x] Validate CRD Schema
- [x] Add integration tests
- [x] Fix round trip tests: #51204 
- [x] Add custom fuzzer functions
- [x] Add custom conversion functions
- [x] Fix data race while updating CRD: #50098 
- [x] Add feature gate for CustomResourceValidation
- [x] Fix protobuf generation

Proposal: https://github.com/kubernetes/community/pull/708
Additional discussion: https://github.com/kubernetes/kubernetes/issues/49879, https://github.com/kubernetes/kubernetes/pull/50625

**Release note**:

```release-note
Add validation for CustomResources via JSON Schema.
```

/cc @sttts @deads2k