Automatic merge from submit-queue (batch tested with PRs 39695, 37054, 39627, 39546, 39615)

Always --pull in docker build to ensure recent base images

**What this PR does / why we need it**: By default, Docker will use a locally cached image rather than looking for a newer image. This can be problematic when using a common base image like debian:jessie, since you may end up unintentionally using a very old base image.

I think everything here is only used on release paths, so it shouldn't affect any regular development workflows.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 34488, 39511, 39619, 38342, 39491)

Update FitError as a message component into the PodConditionUpdater.

Fixes #20064 , after a roundabout volley of ideas, we ended up digging into existing Conditions for this, rather then a first class API object.  This is just a quick sketch of the skeleton minimal implementation, it should pretty much "just work".  I'll test it more later today.


Release Note:
```
Histogram data of predicate failures is contained in pod conditions and thus available to users by kubectl commands.
```

Automatic merge from submit-queue (batch tested with PRs 34488, 39511, 39619, 38342, 39491)

Make StrategicPatch delete all matching maps in a merging list

fixes #38332

```release-note
NONE
```

cc: @lavalamp @pwittrock

Automatic merge from submit-queue (batch tested with PRs 34488, 39511, 39619, 38342, 39491)

rename kubernetes-discovery to kube-aggregator

Rename `kubernetes-discovery` to `kube-aggregator`.  Move and bulk rename.

@kubernetes/sig-api-machinery-misc

Automatic merge from submit-queue (batch tested with PRs 34488, 39511, 39619, 38342, 39491)

use fake clock in lruexpiration cache test

when the system clock is extremely slow(usually see in VMs), this [check](https://github.com/kubernetes/kubernetes/blob/master/pkg/util/cache/lruexpirecache.go#L74) might still return the value.  

```go
if c.clock.Now().After(e.(*cacheEntry).expireTime) {
	go c.remove(key)
	return nil, false
}
```

that means even we set the ttl to be 0 second, the after check might still be false(because the clock is too slow, and thus equals).

the change here helps to reduce flakes.

Automatic merge from submit-queue

certificates: add a signing profile to the internal types

Here is a strawman of a CertificateSigningProfile type which would be used by the certificates controller when configuring cfssl. Side question: what magnitude of change warrants a design proposal?

@liggitt @gtank

Automatic merge from submit-queue (batch tested with PRs 39486, 37288, 39477, 39455, 39542)

kubeadm: updated preflight to check for bridge-nf

Added a preflight check to determine if /proc/sys/net/bridge/bridge-nf-call-iptables is set to 1 (see  http://kubernetes.io/docs/admin/network-plugins/#network-plugin-requirements). 

Fixes https://github.com/kubernetes/kubeadm/issues/99

/cc @pires @luxas 

**Release note**:

`NONE`

Automatic merge from submit-queue (batch tested with PRs 39486, 37288, 39477, 39455, 39542)

Revert "Small improve for GetContainerOOMScoreAdjust"

Reverts kubernetes/kubernetes#39306

This does not help current code healthy, let's revert it to avoid further confusing.

Automatic merge from submit-queue (batch tested with PRs 39486, 37288, 39477, 39455, 39542)

Fix wc zombie goroutine issue in volume util

See [Cadvisor #1558](https://github.com/google/cadvisor/pull/1558).  This should solve problems for those using images that do not support "wc".
cc: @timstclair

Automatic merge from submit-queue (batch tested with PRs 39486, 37288, 39477, 39455, 39542)

Update quota scope descriptions

```release-note
release-note-none
```

This patch improves the help text descriptions for quota scopes.

@kubernetes/kubectl

Automatic merge from submit-queue (batch tested with PRs 39486, 37288, 39477, 39455, 39542)

Allow missing keys in templates by default

Switch to allowing missing keys in jsonpath templates by default.

Add support for allowing/disallowing missing keys in go templates
(default=allow).

Add --allow-missing-template-keys flag to control this behavior (default=true /
allow missing keys).

Fixes #37991

@kubernetes/sig-cli-misc @kubernetes/api-reviewers @smarterclayton @fabianofranz @liggitt @pwittrock

Automatic merge from submit-queue (batch tested with PRs 39648, 38167, 39591, 39415, 39612)

Add hack/verify-readonly-packages.sh

Create a `.readonly` file in a package. Any change between `$KUBE_VERIFY_GIT_BRANCH` and `HEAD` will lead to output like:

```shell
$ hack/verify-readonly-packages.sh
Readonly packages changed compared to "master" branch: pkg/generated
```

This is part of https://github.com/kubernetes/kubernetes/issues/39528

Automatic merge from submit-queue (batch tested with PRs 39648, 38167, 39591, 39415, 39612)

Add verbs to thirdparty resources in discovery

The namespace controller ignores thirdparty resources right now because verbs are not set. This PR sets a static list of verbs.

Moreover, integration tests are added for the discovery info of thirdparty resources.

/cc @zhouhaibing089

Automatic merge from submit-queue (batch tested with PRs 39648, 38167, 39591, 39415, 39612)

optimize RunKubelet variable style

Automatic merge from submit-queue (batch tested with PRs 39648, 38167, 39591, 39415, 39612)

oidc client auth provider: cache OpenID Connect clients to prevent reinitialization

Still need to add tests.

closes #37876

cc @kubernetes/sig-auth @liggitt @jsloyer @mlbiam @philips

Automatic merge from submit-queue

Deleting federation-util-14.go that is not being used anywhere

We have the same code in federation-util.go

cc @mwielgus @madhusudancs

Automatic merge from submit-queue (batch tested with PRs 39628, 39551, 38746, 38352, 39607)

fix e2e kubelet binding

Fixes #39543

This limits scope of the kubelet.  It was an oversight before.  Hopefully we won't end up chasing permissions again.

Automatic merge from submit-queue (batch tested with PRs 39628, 39551, 38746, 38352, 39607)

fix typos

fix typos.

Automatic merge from submit-queue (batch tested with PRs 39628, 39551, 38746, 38352, 39607)

AWS: recognize eu-west-2 region

Automatic merge from submit-queue (batch tested with PRs 39628, 39551, 38746, 38352, 39607)

Increasing times on reconciling volumes fixing impact to AWS.

#**What this PR does / why we need it**:

We are currently blocked by API timeouts with PV volumes.  See https://github.com/kubernetes/kubernetes/issues/39526.  This is a workaround, not a fix.

**Special notes for your reviewer**:

A second PR will be dropped with CLI cobra options in it, but we are starting with increasing the reconciliation periods.  I am dropping this without major testing and will test on our AWS account. Will be marked WIP until I run smoke tests.

**Release note**:

```release-note
Provide kubernetes-controller-manager flags to control volume attach/detach reconciler sync.  The duration of the syncs can be controlled, and the syncs can be shut off as well. 
```

Automatic merge from submit-queue (batch tested with PRs 39628, 39551, 38746, 38352, 39607)

fix throttling test

Fixes https://github.com/kubernetes/kubernetes/issues/39285.

The token bucket starts full, so getting 100 tokens doesn't take a full second, right?  Getting 101 tokens does take a full second.

@liggitt looks like your test.

Automatic merge from submit-queue

move tests which need to stay in k8s.io/kubernetes for API scheme

Preparatory for https://github.com/kubernetes/kubernetes/pull/39475 to keep from having modify packages that will become read-only.  It's a straight move of tests which have API scheme dependencies, but lived in the API machinery package.

Automatic merge from submit-queue

Added owners to monitoring and logging related directories

Automatic merge from submit-queue

switch webhook to clientgo

Switches the delegating authentication and authorization webhooks to use client-go.  The ripples go out aways, but I kept it as contained as I could.

@sttts

Disable TestValidOpenAPISpec when -race test flag exists

Fix verify godeps again

and the option to shut off reconciliation.

Automatic merge from submit-queue

Fix fluentd-gcp image config by avoiding processing its own logs

Section, discarding all records generated by fluentd itself from the pipeline was deleted by mistake in https://github.com/kubernetes/kubernetes/pull/37681. Returning it back and expanding the comment.

Not bumping image version for the later cumulative update.

CC @piosz