Automatic merge from submit-queue

ScheduledJob kubectl

@erictune the last part (kubectl) of the ScheduledJob, as usual builds on top of previous PRs, so only last 2 commits matter (the kubectl one and storage leftovers).

```release-note
* Introducing ScheduledJobs as described in [the proposal](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/scheduledjob.md) as part of `batch/v2alpha1` version (experimental feature).
```
[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()

Automatic merge from submit-queue

Node disk pressure should induce image gc

If the node reports disk pressure, prior to evicting pods, the node should clean up unused images.

Automatic merge from submit-queue

fixed regex error, which replace 2 line in template file

fixes #30074 

Automatic merge from submit-queue

add alias for createconfigmap

add Aliases for cmd create configmap.
this is a supplement for [https://github.com/kubernetes/kubernetes/pull/29652]

Automatic merge from submit-queue

optimize podKiller for reading channel

Reading kl.podKillingCh should check whether ok first, then to process data

Automatic merge from submit-queue

oidc authentication plugin: don't trim issuer URLs with trailing slashes

The issuer URL passed to the plugin must identically match the issuer
URL returned by OpenID Connect discovery. However, the plugin currently
trims all trailing slashes from issuer URLs, causing a mismatch. Since
the go-oidc client already handles this case correctly, don't trim the
path.

Closes #29749

cc @hanikesn @kubernetes/sig-auth 

Automatic merge from submit-queue

make the removing pods log standardized

Automatic merge from submit-queue

refactor quota calculation for re-use

Refactors quota calculation to allow reuse. This will allow us to do "punch through" calculation inside of admission if a particular quota needs usage stats and allows downstream re-use by moving calculation closer to the evaluators and separating "needs calculation" logic from "do calculation".

@derekwaynecarr 

Automatic merge from submit-queue

Bump Libcontainer to latest head

@Random-Liu or @yujuhong Can any one of you please do a quick review.

I updated libcontainer in a previous PR but  #29492 reverted those changes. This is needed for #27204. 
Signed-off-by: Buddha Prakash <buddhap@google.com>

Automatic merge from submit-queue

Allow leading * in ingress hostname

fixes #29043

Automatic merge from submit-queue

Rewrite service controller to apply best controller pattern

This PR is a long term solution for #21625:
We apply the same pattern like replication controller to service controller to avoid the potential process order messes in service controller, the change includes:
1. introduce informer controller to watch service changes from kube-apiserver, so that every changes on same service will be kept in serviceStore as the only element.
2. put the service name to be processed to working queue
3. when process service, always get info from serviceStore to ensure the info is up-to-date
4. keep the retry mechanism, sleep for certain interval and add it back to queue.
5. remote the logic of reading last service info from kube-apiserver before processing the LB info as we trust the info from serviceStore.

The UT has been passed, manual test passed after I hardcode the cloud provider as FakeCloud, however I am not able to boot a k8s cluster with any available cloudprovider, so e2e test is not done.

Submit this PR first for review and for triggering a e2e test.

Automatic merge from submit-queue

fix annotate.go single resource check

```release-note
Fix issue with kubectl annotate when --resource-version is provided.
```

When using `kubectl annotate` with a `--resource-version` on a resource, such as `kubectl annotate pod <pod_name> --resource-version=1820 description='myannotation'`, the command fails with the error: `error: --resource-version may only be used with a single resource`.

Upon printing the output of `resources` that the annotate command receives from cli args, it prints: `Resources:[pod <pod_name>]`. In other words, it treats the name of the resource as a second resource. This PR addresses this issue by using the resource builder `Singular` flag to determine if only a single resource was passed.

Automatic merge from submit-queue

remove logging to t.lofg

Until release 1.6, golang's t.report() doesn't protect t.output with a read lock: https://github.com/golang/go/blob/release-branch.go1.6/src/testing/testing.go#L536-L538. It leads to the data race in https://github.com/kubernetes/kubernetes/issues/29975.

I think we can just remove the offending lines:
```
logWatcher1 := eventBroadcaster.StartLogging(t.Logf) // Prove that it is useful
```
It looks like the code just prints event to test log for human. The line is originally added by @lavalamp in https://github.com/kubernetes/kubernetes/pull/5535. (Thanks to @saad-ali for digging the history of the file)

Fix #29975. Marked as P0 because it fixes a P0 flake that blocks everyone.

Automatic merge from submit-queue

Replace with explicit kubernetes fork path

At other place in development.md, explicit kubernetes fork path has been existed:

    mkdir -p $GOPATH/src/k8s.io
    cd $GOPATH/src/k8s.io
    # Replace "$YOUR_GITHUB_USERNAME" below with your github username
    git clone https://github.com/$YOUR_GITHUB_USERNAME/kubernetes.git

the following is easy to be confused and can be replaced with same description:

    git clone https://path/to/your/fork .

Automatic merge from submit-queue

Set GOOGLE_APPLICATION_CREDENTIALS after activating

https://developers.google.com/identity/protocols/application-default-credentials

We should set this explicitly as https://golang.org/pkg/os/user/#User (which the oauth libraries use: [sdk.go] - [default.go] via [CreateGCECloud]) will ignore any `$HOME` overrides.

[CreateGCECloud]: https://github.com/kubernetes/kubernetes/blob/fa95788e560de7575c851d87d76c664b3753a7a6/test/e2e/e2e.go#L75
[sdk.go]: https://github.com/kubernetes/kubernetes/blob/fa95788e560de7575c851d87d76c664b3753a7a6/vendor/golang.org/x/oauth2/google/sdk.go#L165
[default.go]: https://github.com/kubernetes/kubernetes/blob/fa95788e560de7575c851d87d76c664b3753a7a6/vendor/golang.org/x/oauth2/google/default.go#L101

Mitigates https://github.com/kubernetes/kubernetes/issues/28514 and related to https://github.com/kubernetes/test-infra/issues/266

Automatic merge from submit-queue

Added test to density that will run maximum capacity pods on nodes

Added a test to the Density Suite that will load the kubelets with their maximum capacity number of pods

Automatic merge from submit-queue

Makefile cleanup

Keep the same style for each PHONY and rule.

cc @thockin 

Automatic merge from submit-queue

Reverted conversion of influx-db to PetSet.

```release-note
Reverted conversion of influx-db to Pet Set, it is now a Replication Controller.
```

Reverted conversion of influx-db to PetSet, it is now a Replication Controller and Persistent Volumes are no longer used.

Automatic merge from submit-queue

SharedInformerFactory: usage and fixes

Follow-up for #26709

Automatic merge from submit-queue

Improve developer README

Automatic merge from submit-queue

Scheduled Job proposal elaboration

Automatic merge from submit-queue

Fix the map concurrent read/write issue in deployment controller

Fixes #29960

@lavalamp @kubernetes/deployment 

Reverted conversion of influx-db to PetSet.

Automatic merge from submit-queue

Updated cadvisor version

cc @derekwaynecarr 

Automatic merge from submit-queue

spelling mistakes

- fixing the spelling mistakes in aws.go

Automatic merge from submit-queue

Fix various typos in apiserver pkg

Automatic merge from submit-queue

Handle container terminated but pod still running in conditions

Sometimes when you have a pod with more than one container, and the container runs and terminates really fast, `PodContainerRunning` can go into a state where the pod indicates it's still running, but the container is already terminated. Handle that condition by returning `ErrContainerTerminated` when it happens.

Automatic merge from submit-queue

Replacing skydns with kubedns for the juju cluster. #29720

```release-note
* Updating the cluster/juju provider to use kubedns in place of skydns.
```

Automatic merge from submit-queue

Install go-bindata in cross-build image

Another follow-up to #25584.

We need `go-bindata` to create `test/e2e/generated`, and downloading it with `go get` at build time is painful for a variety of reasons. We can just include it in the cross-build image and not worry about it, especially as it updates very infrequently.

This fixes `hack/update-generated-protobuf.sh` as well.

cc @jayunit100 @soltysh 

Automatic merge from submit-queue

pv e2e refactor and pre-bind test

refactored persistentvolume e2e so that multiple It() tests can be run. Added one test case for pre-binding, but the overall structure of the test should allow additional test cases to be more easily added.

Automatic merge from submit-queue

rbac validation: rules can't combine non-resource URLs and regular resources

This PR updates the validation used for RBAC to prevent rules from mixing non-resource URLs and regular resources.

For example the following is no longer valid

```yml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: admins
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]
    nonResourceURLs: ["*"]
```

And must be rewritten as so.

```yml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: admins
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]
  - nonResourceURLs: ["*"]
    verbs: ["*"]
``` 

It also:
* Mandates non-zero length arrays for required resources.
* Mandates non-resource URLs only be used for ClusterRoles (not namespaced Roles).
* Updates the swagger validation so `verbs` are the only required field in a rule. Further validation is done by the server.

Also, do we need to bump the API version?

Discussed by @erictune and @liggitt  in #28304

Updates kubernetes/features#2

cc @kubernetes/sig-auth 

Edit:
* Need to update the RBAC docs if this change goes in.

Automatic merge from submit-queue

Delete containers when pod is evicted

#29803