Automatic merge from submit-queue

Fix goroutine leak in federation service controller

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**: Fixes a memory leak

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #33186

**Special notes for your reviewer**: Every second new goroutines are created and are getting blocked waiting for the lock in the event queue. only one worker will get a lock when there are some events to process, so all the goroutines which are created every second waits for the lock forever and causes the memory/goroutine leak.

As a fix the new worker will be created only when there is no worker exist. and only one worker per cluster either waits for the event or processes all the events and goes out of existence.

```release-note
Fixes memory/goroutine leak in Federation Service controller.
```

Automatic merge from submit-queue

'eg.' should be 'e.g.'

Automatic merge from submit-queue

Corrected timeout on Downward API volume

The tests for Downward API volume were apparently created before the
default sync-frequency was set to 1 minute. As the current
implementation of Pod gives us no guarantee that the changes will be
seen in Downward API before `sync-frequency` we need the tests to
reflect this.

Fixes: #29633

Automatic merge from submit-queue

Fix typo: rejcted -> rejected

Automatic merge from submit-queue

DNS Federation: Add ID to Zone interface

Automatic merge from submit-queue

simplify RC listers

Make the RC and SVC listers use the common list functions that more closely match client APIs, are consistent with other listers, and avoid unnecessary copies.

Run update-mungedocs.sh on release notes

Fix issue with CHANGELOG.md.  Remove broken links and links to docs n…

Automatic merge from submit-queue

CRI: add Message in ContainerStatus

Kubernetes expects a brief CamelCase string as "Reason" and a human-readable
string as "Message" in the conatiner status. It is difficult for kubelet to
derive the other one if the runtime only provides one of the two fields.
Augment the API by adding the "Message" field.

/cc @kubernetes/sig-node

draft release notes for kubernetes v1.4.0

Automatic merge from submit-queue

Switch k8s on GCE to use GCI by default

Automatic merge from submit-queue

kuberuntime: include container hash in backoff keys

We should reset the backoff if the content of the container has been updated.

Part of #33189

Automatic merge from submit-queue

Pass the real cluster scoped service object to cleanup functions instead of passing the federation scoped object.

cc @kubernetes/sig-cluster-federation 

Ref: Issue #31624

Automatic merge from submit-queue

Logging soak

Implements #24427 

Needs 

- #24471 so that it doesnt clog test outputs for scale
- builds on the utils function added in support of #22869 

cc @timothysc @kubernetes/sig-testing

/cc @pwittrock @foxish @matchstick @quinton-hoole

We should reset the backoff if the content of the container has been updated.

Kubernetes expects a brief CamelCase string as "Reason" and a human-readable
string as "Message" in the conatiner status. It is difficult for kubelet to
derive the other one if the runtime only provides one of the two fields.
Augment the API by adding the "Message" field.

Automatic merge from submit-queue

Fix API Installer to generate unique Operation IDs

OperationIDs generated by api_installer.go may not be unique and that causes long auto-generated function names in swagger generated clients. This is a step toward making those IDs unique.

Reference Issue kubernetes/features#53 and #13414

Automatic merge from submit-queue

Allow garbage collection to work against different API prefixes

The GC needs to build clients based only on Resource or Kind. Hoist the
restmapper out of the controller and the clientpool, support a new
ClientForGroupVersionKind and ClientForGroupVersionResource, and use the
appropriate one in both places.

Allows OpenShift to use the GC

Automatic merge from submit-queue

Remove hacks from ScheduledJobs cron spec parsing 

Previusly `github.com/robfig/cron` library did not allow passing cron spec without seconds. First commit updates the library, which has additional method ParseStandard which follows the standard cron spec, iow. minute, hour, day of month, month, day of week.

@janetkuo @erictune as promised in #30227 I've updated the library and now I'm updating it in k8s

Automatic merge from submit-queue

oidc authenticator: allow string value as groups claim

Allow the group claim to be a single string instead of an array of
strings. This means the following claim

    {
      "role": "admin"
    }

Will be mapped to the groups

    ["admin"]

cc @kubernetes/sig-auth @mlbiam

closes #33290

Automatic merge from submit-queue

Move HighWaterMark to the top of the struct in order to fix arm, second time

ref: #33117

Sorry for not fixing everyone at once, but I seriously wasn't prepared for that quick LGTM 😄, so here's the other half.

@lavalamp 

> lgtm, but seriously, this is terrible, we probably have this bug all over. And what if someone embeds the etcdWatcher struct in something else not at the top? We need the compiler to enforce things like this, it just can't be done manually. Can you file or link a golang issue for this?

I totally agree! There isn't currently a way of programmatically detecting this unfortunately.
I guess @davecheney or @minux can explain better to you why it's so hard.

This is noted in https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/multi-platform.md as a corner case indeed.

@pwittrock This should be cherrypicked toghether with #33117

Automatic merge from submit-queue

disallow user to update loadbalancerSourceRanges

buy myself some time to fix the root cause of #33033

Automatic merge from submit-queue

Fix race condition in setting node statusUpdateNeeded flag

This PR fixes the race condition in setting node statusUpdateNeeded flag
in master's attachdetach controller. This flag is used to indicate
whether a node status has been updated by the node_status_updater or
not. When updater finishes update a node status, it is set to false.
When the node status is changed such as volume is detached or new volume
is attached to the node, the flag is set to true so that updater can
update the status again. The previous workflow has a race condition as
follows
1. updater gets the currently attached volume list from the node which needs to be
updated.
2. A new volume A is attached to the same node right after 1 and set the
flag to TRUE
3. updater updates the node attached volume list (which does not include volume A) and then set the flag to FALSE.
The result is that volume A will be never added to the attached volume
list so at node side, this volume is never attached.

So in this PR, the flag is set to FALSE when updater tries to get the
attached volume list (as in an atomic operation). So in the above
example, after step 2, the flag will be TRUE again, in step 3, updater
does not set the flag if updates is sucessful. So after that, flag is
still TRUE and in next round of update, the node status will be updated.

Automatic merge from submit-queue

add resource filter handling before printing

**Release note**:
```release-note
release-note-none
```

Resources are currently filtered (in order to prevent printing) at print
time in their HumanReadablePrinter handlers. This design makes it not
possible to filter objects when they are printed using any other
printer, such as YAML, JSON, or the NamePrinter.

This patch removes any filters previously added at the printer level for
pods and adds a way to define resource-specific filters before they are
sent to a printer handler. A woking filter handler for pods has also been
implemented.

Filters affect resources being printed through the HumanReadablePrinter,
YAML, JSON, and `--template` printers.

cc @smarterclayton

Automatic merge from submit-queue

unify available api group versions in our scripts

There are currently many parallel lists of available group versions with slightly different syntaxes in each one.  This collapses them into a single list for us to maintain.  

Also caught spots where the lists didn't match before.

@sttts @ncdc

Automatic merge from submit-queue

Alpha JWS Discovery API for locating an apiserver securely

This PR contains an early alpha prototype of the JWS discovery API outlined in proposal #30707.

CA certificate, API endpoints, and the token to be used to authenticate to this discovery API are currently passed in as secrets. If the caller provides a valid token ID, a JWS signed blob of ClusterInfo containing the API endpoints and the CA cert to use will be returned to the caller. This is used by the alpha kubeadm to allow seamless, very quick cluster setup with simple commands well suited for copy paste.

Current TODO list:

- [x] Allow the use of arbitrary strings as token ID/token, we're currently treating them as raw keys.
- [x] Integrate the building of the pod container, move to cluster/images/kube-discovery.
  - [x] Build for: amd64, arm, arm64 and ppc64le. (just replace GOARCH=)
  - [x] Rename to gcr.io/google_containers/kube-discovery-ARCH:1.0
  - [x] Cleanup rogue files in discovery sub-dir.
  - [x] Move pkg/discovery/ to cmd/discovery/app.

There is additional pending work to return a kubeconfig rather than ClusterInfo, however I believe this is slated for post-alpha.