Automatic merge from submit-queue (batch tested with PRs 54081, 54271, 51783, 54600, 54594). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add go flags to go-to-protobuf

Reopened from code-generator repo.

cc: @sttts

Automatic merge from submit-queue (batch tested with PRs 54081, 54271, 51783, 54600, 54594). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update to latest kube-openapi and kazel

- update vendored kube-openapi to include https://github.com/kubernetes/kube-openapi/pull/14
 - update hash of repo infra used for bazel generation so kazel includes https://github.com/kubernetes/repo-infra/pull/48

This is the final step in enabling federation to generate openapi code for itself and vendored kube (#54335).

/sig multicluster testing

Automatic merge from submit-queue (batch tested with PRs 54081, 54271, 51783, 54600, 54594). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

move getMaxVols function to predicates.go and add some NewVolumeCount…

…Predicate funcs
Signed-off-by: zhangjie <zhangjie0619@yeah.net>



**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
move getMaxVols function to predicates.go and add some NewVolumeCountPredicate funcs
```

Automatic merge from submit-queue (batch tested with PRs 54081, 54271, 51783, 54600, 54594). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove redundant code of checking path

**What this PR does / why we need it**:
Remove redundant code of checking path
the checking is not necessary here,WrapperUnmounter#TearDownAt always do that


	func UnmountViaEmptyDir(dir string, host VolumeHost, volName string, volSpec Spec, podUID types.UID) error {
	    glog.V(3).Infof("Tearing down volume %v for pod %v at %v", volName, podUID, dir)

        if pathExists, pathErr := volutil.PathExists(dir); pathErr != nil {
	   	    return fmt.Errorf("Error checking if path exists: %v", pathErr)
	    } else if !pathExists {
		    glog.Warningf("Warning: Unmount skipped because path does not exist: %v", dir)
		    return nil
	    }

	    // Wrap EmptyDir, let it do the teardown.
	    wrapped, err := host.NewWrapperUnmounter(volName, volSpec, podUID)
	    if err != nil {
		    return err
	    }
	    return wrapped.TearDownAt(dir)
    }


**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
NONE

**Release note**:
NONE

Automatic merge from submit-queue (batch tested with PRs 54081, 54271, 51783, 54600, 54594). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add unit tests in /pkg/api/v1helper

**What this PR does / why we need it**:
add unit tests in /pkg/api/v1helper

**Which issue this PR fixes** : 
ref #49384

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54597, 54593, 54081, 54271, 54600). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubelet: check for illegal container state transition

supersedes https://github.com/kubernetes/kubernetes/pull/54530

Puts a state transition check in the kubelet status manager to detect and block illegal transitions; namely from terminated to non-terminated.

@smarterclayton @derekwaynecarr @dashpole @joelsmith @frobware

I confirmed that the reproducer in #54499 does not work with this check in place. The erroneous kubelet status update is rejected:

```
status_manager.go:301] Status update on pod default/test aborted: terminated container test-container attempted illegal transition to non-terminated state
```

After fix https://github.com/kubernetes/kubernetes/pull/54593, I do not see the message with the above mentioned reproducer.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add some indent in CHANGELOG-1.7

**What this PR does / why we need it**:
in changelogv1.7 there has some indent error and fixed it!
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 52717, 54568, 54452, 53997, 54237). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix bug in func OnError() of apimachinery in case time moves backwards for any reason

**What this PR does / why we need it**:
in func OnError() of ErrorHandlers in apimachinery
```
func (r *rudimentaryErrorBackoff) OnError(error) {
	r.lastErrorTimeLock.Lock()
	defer r.lastErrorTimeLock.Unlock()
	d := time.Since(r.lastErrorTime)
	if d < 0 {
		time.Sleep(r.minPeriod - d)
	}
	r.lastErrorTime = time.Now()
}
```
it is expected to go on sleep for some time if not meet the minPeriod. However, if time happens hops to the past in the process. `d := time.Since(r.lastErrorTime)` would be a negative number, thus, it may sleep a lot longer than we expected.

The period for sleep should be reseted if time hops

**Which issue this PR fixes**
 fixes #54236


**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 52717, 54568, 54452, 53997, 54237). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Copy api/OWNERS to docs/api-reference

So that API changes can be approved by API approvers. Also, create api-{approvers,reviewers} aliases.

Suggested by @cblecker in https://github.com/kubernetes/kubernetes/pull/53911#issuecomment-336612394

Automatic merge from submit-queue (batch tested with PRs 52717, 54568, 54452, 53997, 54237). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[examples.storage/minio] update deploy config version

**What this PR does / why we need it**:
update deploy config version
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```NONE
```

Automatic merge from submit-queue (batch tested with PRs 52717, 54568, 54452, 53997, 54237). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

import-verifier: use yaml for inline comments

For iterative cutting of dependencies, we will have temporary execeptions
in hack/import-restrictions.json. In order to document that, comments would
help a lot and using yaml is simple and gives us that.

Automatic merge from submit-queue (batch tested with PRs 52717, 54568, 54452, 53997, 54237). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[OpenStack]Remove the LbaasV1 of OpenStack cloud provider

The Neutron LbaasV1 has been declared obsolete, LbaasV2 is a
better choice.
So let's remove the codes of LbaasV1, only support LbaasV2.
xref: #52609
Reference OpenStack doc:
https://docs.openstack.org/mitaka/networking-guide/config-lbaas.html

**Special notes for your reviewer**:
/assign @dims 
/assign @anguslees 

**Release note**:
```release-note
Remove the LbaasV1 of OpenStack cloud provider, currently only support LbaasV2.
```

Automatic merge from submit-queue (batch tested with PRs 53946, 53993, 54315, 54143, 54532). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add scheduling.k8s.io to apiVersionPriorities

**What this PR does / why we need it**:

add scheduling.k8s.io to apiVersionPriorities

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #53392

**Special notes for your reviewer**:

/assign @bsalamat

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53946, 53993, 54315, 54143, 54532). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix typo in comment.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53946, 53993, 54315, 54143, 54532). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix kube-proxy panic on cleanup

**What this PR does / why we need it**:

Set the execer properly when we initialize ProxyServer or we will
end up with a panic.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
Fixes #54305

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53946, 53993, 54315, 54143, 54532). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

RBAC for Calico Typha Horizontal Autoscaler

**What this PR does / why we need it**:

On v1.8.0-gke.1 I noticed a number of RBAC failures for `default` in kube-system. Turns out the only container missing the serviceAccountName was the typha-horizontal-autoscaler.

**Special notes for your reviewer**:

cc @caseydavenport seems like this is up your alley 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53946, 53993, 54315, 54143, 54532). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update many misspelled word initializer

**What this PR does / why we need it**:

fix misspelled word initalizer

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

``` NONE
```

move getMaxVols function to predicates.go and change the params of NewMaxPDVolumeCountPredicate funcs
Signed-off-by: zhangjie <zhangjie0619@yeah.net>

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix unmatched bold marker in ISSUE_TEMPLATE.md

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

glusterfs service endpoint prefix should be `glusterfs-dynamic-`.

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
/sig storage

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Volunteer to help review examples

I would like to do some code review for examples about how to run real applications with Kubernetes



**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix some  brackets and N/A in CHANGELOG-1.8

**What this PR does / why we need it**:
in CHANGELOG-1.8 Cluster Lifecycle and OpenStack place have redundant brackets 
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53760, 48996, 51267, 54414). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

update admission webhook to handle multiple auth domains

Fixes https://github.com/kubernetes/kubernetes/issues/54404

Adds some wiring to have the admission plugin accept a config file for per-apiserver configuration.

@kubernetes/sig-auth-api-reviews @deads2k @ericchiang @liggitt in particular
@kubernetes/sig-api-machinery-pr-reviews @lavalamp @caesarxuchao @sttts @cheftako

```release-note
generic webhook admission now takes a config file which describes how to authenticate to webhook servers
```

Automatic merge from submit-queue (batch tested with PRs 53760, 48996, 51267, 54414). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix issue(#51245)1、kubectl printObj should not print header when occur…

… error. 2、kubectl get ns --all-namespaces should not have NAMESPACE column



**What this PR does / why we need it**:
closes #51245

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
now we will just get this.
```
admindeMacBook-Pro-2:kubectl admin$ ./kubectl get ns --all-namespaces
error: namespace is not namespaced
```

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53760, 48996, 51267, 54414). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Removed compatibality code for kubelet 1.2.

**What this PR does / why we need it**:
The next release is 1.8, it's time to remove the backward compatibility code for kubelet 1.2.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #48995 

**Release note**:
```release-note
The NodeController will not support kubelet 1.2.
```

Automatic merge from submit-queue (batch tested with PRs 53760, 48996, 51267, 54414). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix CI error for service session affinity

**What this PR does / why we need it**:

Fix CI error for service session affinity -- debug

**Which issue this PR fixes**: 

fixes #53741

**Special notes for your reviewer**:

I remove the [slow] tag so that these test cases can be run in PR request. We may need to add back the [slow] tag when this PR is ready to get in.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54336, 54470, 54334, 54175). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update fluentd-gcp DaemonSet

- Use a dedicated service account to run the fluentd-gcp DS
- Use the certificates in the prometheus-to-sd image rather than mounting the host certs

This PR lets us create a more targeted PodSecurityPolicy for fluentd. (See https://github.com/kubernetes/kubernetes/pull/52367#discussion_r145433354)

```release-note
- fluentd-gcp runs with a dedicated fluentd-gcp service account
- Stop mounting the host certificates into fluentd's prometheus-to-sd container
```

Automatic merge from submit-queue (batch tested with PRs 54336, 54470, 54334, 54175). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix azure disk mount failure on coreos and some other distros

**What this PR does / why we need it**:
azure disk mount failure on coreos due to `/dev/disk/azure` not populated on coreos, and also on some other distros.
After a long time back and forth discussion, I have decided to fix this issue on k8s side. Customers are leaving azure because of this udev issue, you could read details from #50150 . I have verifed the code works well on current coreos on azure.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 
fixes #50150: azure_dd: managed disks don't pass "FormatAndMount"
In coreos on azure and some old distros, one udev rule is not applied, which means `/dev/disk/azure` not populated, while current disk detection code logic relies on `/dev/disk/azure`, so it would lead to azure disk mount failure, for more details, pls refer to #50150

**Special notes for your reviewer**:
In v1.6, there is no such issue becuase it's not using /dev/azure/disk to detect the LUN of new disk, so I refer the code logic of v1.6:
https://github.com/kubernetes/kubernetes/blob/release-1.6/pkg/volume/azure_dd/vhd_util.go#L59-L66

while from v1.7, it's using /dev/azure/disk, the code logic does not apply to distro which does not have udev rules(/dev/azure/disk), see:
https://github.com/kubernetes/kubernetes/blob/release-1.7/pkg/volume/azure_dd/azure_common.go#L231-L236

**Release note**:

```
fix azure disk mount failure on coreos and some other distro due to udev rule not applied
```
/sig azure
@rootfs @brendanburns @colemickens 
@tlyng @karataliu @szarkos

Automatic merge from submit-queue (batch tested with PRs 54336, 54470, 54334, 54175). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update kubectl drain command to use policy V1Beta1 instead of unversioned API

**What this PR does / why we need it**:

Removes kubectl dependency on `k8s.io/kubernetes/pkg/apis/policy` by switching to `k8s.io/api/policy/v1beta1`. Part of https://github.com/kubernetes/kubectl/issues/83.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/kubernetes/kubectl/issues/90

**Special notes for your reviewer**:

/cc @kubernetes/sig-cli-pr-reviews

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54336, 54470, 54334, 54175). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update openapi bazel build to support vendored build

This is one part (see #54335) of enabling vendoring projects like federation to generate openapi code for k8s.io/kubernetes.

edit: These changes are necessary for a project to correctly generate ``vendor/k8s.io/kubernetes/pkg/generated/openapi/zz_generated.openapi.go`` for vendored ``k8s.io/kubernetes``.  Without the changes, the vendored output location for ``zz_generated.openapi.go`` would be ``k8s.io/kubernetes`` instead of ``vendor/k8s.io/kubernetes`` and the input files would similarly be from ``k8s.io/kubernetes`` instead of ``k8s.io/myproject``.

/sig testing
/release-note-none

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Move device plugin related code to pkg/kubelet/cm/deviceplugin/.

**What this PR does / why we need it**:
Move device plugin related code to pkg/kubelet/cm/deviceplugin/.
Inspired by PR 53258 proposed by @dolftax. The code structure looks much cleaner this way and it also makes future code refactoring easier.
While moving device_plugin_handler_test.go from pkg/kubelet/cm/ to pkg/kubelet/cm/deviceplugin/, we can no longer uses cm in its tests because that would cause a cycle dependency. To solve this problem, I moved the main cm GetResources functionality as well as part of the current device plugin handler Allocate functionality into a new device plugin handler function, GetDeviceRunContainerOptions(). This refactoring is also needed by another PR 51895 that moves device allocation into admission phase. Now device plugin handler Allocate() first checks whether there is cached device runtime state and only issues Allocate grpc call if there is no cached state available. The new GetDeviceRunContainerOptions() function simply returns device runtime config from the cached state. To support this change, extended the podDevices struct and checkpoint data structure with device runtime state.

We expect to clean up device plugin interface in follow up PRs. Currently both device plugin handler interface and manager interface are public. This is no longer necessary after this PR given that their code now live in the same package. We should clean up unnecessary public interfaces and functions, and/or consider to merge handler and manager code into a single layer.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
Part of https://github.com/kubernetes/kubernetes/issues/53170 but not fixes it.

**Release note**:

```release-note
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

sample-apiserver: add docs

For https://github.com/kubernetes/kubernetes/issues/54398.
Counter-part PR: https://github.com/kubernetes/sample-apiserver/pull/17.

**Release note**

```release-note
NONE
```

/assign @sttts

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove redundant call to StartLogging in service_controller. Fixes #5…

…4339



**What this PR does / why we need it**:
Removes redundant call to StartLogging introduced in 96b48d43#diff-1f7f903e25ab8bcbc514bb1e532e997e

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
#54339 

**Special notes for your reviewer**:

**Release note**:

```release-note
```

- Use a dedicated service account to run the fluentd-gcp DS
- Update prometheus-to-sd from v0.1.3 to v0.2.1
- Use the certificates in the prometheus-to-sd image rather than mounting the host certs