Automatic merge from submit-queue

CRI: Enable custom infra container image

A minor fix to enable custom infra container image ref #29478 

- Need to address: 
Not sure how do deal with infra image credential, leave it as it is today. Should we allow user to specify credentials in pod yaml?

Automatic merge from submit-queue

CRI: Add init containers

This PR adds init containers support in CRI.

CC @yujuhong @Random-Liu @yifan-gu 

Also CC @kubernetes/sig-node @kubernetes/sig-rktnetes

Automatic merge from submit-queue

Migrate EqualPriority in scheduler to map-reduce-like framework

Ref #24246

Automatic merge from submit-queue

stop plumbing options to start

The API server should have sufficient information to start itself without relying on an `options` object from a different packages focused on CLI interaction.  This provides that separation

@liggitt distinct from other changes

Automatic merge from submit-queue

Typos and englishify pkg/volume

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**: Just typos

**Which issue this PR fixes**: None

**Special notes for your reviewer**: Just typos

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
`NONE`

Revert "move pod networking tests common"

Automatic merge from submit-queue

Heal the namespaceless ingresses in federation e2e.

For createIngressOrFail, it incorrectly returned the ingress passed in as an argument, which does not include the namespace, instead of the ingress returned from the create call (which does).

This in turn leads to errors in e2e tests like this:

INFO: Waiting for Ingress federated-ingress to acquire IP, error an empty namespace may not be set when a resource name is provided.

Self-applying LGTM label, as this is the same code that was LGTM'd by @nikhiljindal in #33502

Automatic merge from submit-queue

move pod networking tests common

This allows pod networking tests to run in both e2e and node e2e

Automatic merge from submit-queue

Delete evicted pet

If pet was evicted by kubelet - it will stuck in this state forever.
By analogy to regular pod we need to re-create pet so that it will
be re-scheduled to another node, so in order to re-create pet
and preserve consitent naming we will delete it in petset controller
and create after that.

fixes: https://github.com/kubernetes/kubernetes/issues/31098

Automatic merge from submit-queue

Kubelet: fix port forward for dockershim

This PR fixes port forward for dockershim and also adds a `kubecontainer.FormatPod`.

Locally cluster has passed `--ginkgo.focus=Port\sforwarding'` tests.

cc/ @Random-Liu @yujuhong

Automatic merge from submit-queue

Fix issue in updating device path when volume is attached multiple times

When volume is attached, it is possible that the actual state
already has this volume object (e.g., the volume is attached to multiple
nodes, or volume was detached and attached again). We need to update the
device path in such situation, otherwise, the device path would be stale
information and cause kubelet mount to the wrong device.

This PR partially fixes issue #29324

Automatic merge from submit-queue

Fix #33784, IN_CREATE event does not guarantee file content written

Fixed #33784.

The CREATE inotify event [here](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/config/file_linux_test.go#L275) is triggered by os.OpenFile(), however the content would be written by the following f.Write(). It will fail if the program try to process the event in between.

IN_CREAE event is triggered by open(2), mkdir(2), link(2), symlink(2), bind(2), but not all of them will guarantee the content is written ([ref](http://man7.org/linux/man-pages/man7/inotify.7.html)). <s>Hence we should not respond to IN_CREATE event for pod creation. I believe listen on IN_MODIFY and IN_MOVED_TO would be sufficient for pod addition&update.

Would like to see the Jenkins test results for further evaluation.

@Random-Liu

Automatic merge from submit-queue

Split NodeDiskPressure into NodeInodePressure and NodeDiskPressure

Added NodeInodePressure as a NodeConditionType.  SignalImageFsInodesFree and SignalNodeFsInodesFree signal this pressure.  Also added simple pieces to the scheduler predicates so that it takes InodePressure into account.

Automatic merge from submit-queue

Enable alpha features in local-up-cluster

because why not

Modify api protoc for infra

Automatic merge from submit-queue

Add seccomp and apparmor support.

This PR adds seccomp and apparmor support in new CRI.

This a WIP because I'm still adding unit test for some of the functions. Sent this PR here for design discussion.

This PR is similar with https://github.com/kubernetes/kubernetes/pull/33450.
The differences are:
* This PR passes seccomp and apparmor configuration via annotations;
* This PR keeps the seccomp handling logic in docker shim because current seccomp implementation is very docker specific, and @timstclair told me that even the json seccomp profile file is defined by docker.

Notice that this PR almost passes related annotations in `api.Pod` to the runtime directly instead of introducing new CRI annotation.

@yujuhong @feiskyer @timstclair

Automatic merge from submit-queue

e2e.go / kops: Add ssh-key option to override ssh key

**What this PR does / why we need it**: By default, Jenkins stuffs the ssh key in `/workspace/.aws/kube_aws_rsa`. This allow the SSH key to be overridden easily on the command line.

Automatic merge from submit-queue

wait for federation informer store to catch up before update

Fixes #33838 #33880 

There is a flake in the federation-controller code where an update to a resource is done too quickly after the create.  Because the resource is not yet in the federated informer store, when the reconcile<Resource>() is called, it can't find the resource and treats the change as a create rather than a update.

This causes a failure (actually a panic) in the test code, which expects an update event, not a create, in response to the resource modification.

@derekwaynecarr @apelisse @mwielgus

By default, Jenkins stuffs the ssh key in
/workspace/.aws/kube_aws_rsa. Allow this to be overridden easily on
the command line.

Automatic merge from submit-queue

Deregister clusters during federated namespace e2e tear down.

This is causing other tests to leak resources.

cc @mwielgus @kubernetes/sig-cluster-federation

When volume is attached, it is possible that the actual state
already has this volume object (e.g., the volume is attached to multiple
nodes, or volume was detached and attached again). We need to update the
device path in such situation, otherwise, the device path would be stale
information and cause kubelet mount to the wrong device.

This PR partially fixes issue #29324

Automatic merge from submit-queue

Fix condition for deleting master etcd firewall rule

Fix tiny bug in #33094.

cc @fgrzadkowski @jszczepkowski

Automatic merge from submit-queue

DeltaFIFO should not report HasSynced until deletes are reported

Deletions identified by knownObjects on the initial sync replace
(immediately after the List from a reflector) should be considered part
of the initial sync since we have the information available at the time
we do the deletion.

An error during Replace() can result in Populated not being set, but it
was incorrect before (population would be wrong) and queueActionLocked
does not error except on "my cache is broken because I gave an incorrect
keyFunc".

@lavalamp @deads2k hit this while trying to use DeltaFIFO to implement an "external" controller (one that uses the knownObjects as provided by a call to a remote system of record).

Not 1.4

Automatic merge from submit-queue

CRI: Fix bug in dockershim to set sandbox id properly.

For https://github.com/kubernetes/kubernetes/issues/33189#issuecomment-249307796.

During debugging `Variable Expansion should allow composing env vars into new env vars`, I found that the root cause is that the sandbox was removed before all containers were deleted, which caused the pod to be started again after succeed.

This happened because the `PodSandboxID` field is not set. This PR fixes the bug.

Some other test flakes are also caused by this
```
Downward API volume should provide node allocatable (cpu) as default cpu limit if the limit is not set
Downward API volume should provide container's memory limit
EmptyDir volumes should support (non-root,0666,tmpfs)
...
```

/cc @yujuhong @feiskyer

Automatic merge from submit-queue

fix loopback authorizer

Fixes the loopback authorizer to properly inspect groups.  P0 for security problem.

@liggitt @dims let's get this fixed.

Automatic merge from submit-queue

Fix URL in README

Automatic merge from submit-queue

Fix summary test

Issue was comparing an `unversioned.Time` rather than `time.Time`. I temporarily removed the `[Flaky]` tag so the PR builder will run the test. I will revert that change before submitting.

Fixes #33888