Automatic merge from submit-queue

Add package docs for pod security policy

Add some go package doc for this because I am an obsessive nerd.

cc @pweil-

Automatic merge from submit-queue

controller: update all rs annotations on a scaled rollout

Closes https://github.com/kubernetes/kubernetes/issues/28145

@kubernetes/deployment 

Automatic merge from submit-queue

make addition group RESTStorage registration easier

Starts factoring out `RESTStorage` creation to eventually allow for decoupled API group `RESTStorage` configuration.

Right now you can't add additional groups without modifying the main API Group registration in master.go.  Allows the `master.Config` to hold a function that can build a `RESTStorage` based on the `Master` struct.

@lavalamp @caesarxuchao @kubernetes/sig-api-machinery 
@liggitt @smarterclayton

Automatic merge from submit-queue

adding community docs,links etc.

<!--
Checklist for submitting a Pull Request

Please remove this comment block before submitting.

1. Please read our [contributor guidelines](https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md).
2. See our [developer guide](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md).
3. If you want this PR to automatically close an issue when it is merged,
   add `fixes #<issue number>` or `fixes #<issue number>, fixes #<issue number>`
   to close multiple issues (see: https://github.com/blog/1506-closing-issues-via-pull-requests).
4. Follow the instructions for [labeling and writing a release note for this PR](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes) in the block below.
-->

```release-note
* Use the release-note-* labels to set the release note state 
* Clear this block to use the PR title as the release note 
-OR-
* Enter your extended release note here
```
* Added new link for community documentation
* Added new website link for awesome k8s
* Edited resources section for a better look

Automatic merge from submit-queue

Validation logic applied to edited file

The file that is submitted via ``edit`` is now subject to validation
logic as any other file. The validation flags were added to the ``edit``
command.

Fixes:  #17542

Automatic merge from submit-queue

Add liveness probe to the flower rc in order to fix a flake

Fixes #27857 
@fejta @ixdy @timstclair @mwielgus 

Automatic merge from submit-queue

rkt: Fix /etc/hosts /etc/resolv.conf permissions

#29024 introduced copying /etc/hosts and /etc/resolv.conf before mounting them into rkt containers. However, the new files' permissions are set to 0640, which make these files unusable by any other users than root in the container as shown below. This small patch changes the permissions to 0644, as typically set.

```
# host rabbitmq
rabbitmq.default.svc.cluster.local has address 10.3.0.211
# ls -la /etc/resolv.conf
-rw-r-----. 1 root root 102 Jul 23 13:20 /etc/resolv.conf
# sudo -E -u foo bash
$ cat /etc/resolv.conf
cat: /etc/resolv.conf: Permission denied
$ host rabbitmq
;; connection timed out; no servers could be reached
# exit
# chmod 0644 /etc/resolv.conf /etc/hosts
# sudo -E -u foo host rabbitmq
rabbitmq.default.svc.cluster.local has address 10.3.0.211
```

cc @kubernetes/sig-rktnetes @yifan-gu @euank 

Automatic merge from submit-queue

Correctly document cloudprovider Instances contract

Automatic merge from submit-queue

change test-e2e-node.sh build service to true

Change build_service in test-e2e-node.sh to true @Random-Liu 

This enables any users on the container to resolve DNS, instead of only root.

Automatic merge from submit-queue

Fail Kubemark if tests fail with error.

Fix #29392

Automatic merge from submit-queue

To break the loop when object found in removeOrphanFinalizer()

To break the loop when object found in removeOrphanFinalizer()

Automatic merge from submit-queue

controller/volume: simplify sync logic in syncBoundClaim

Remove all unnecessary branchings.

Automatic merge from submit-queue

Eviction manager needs to start as runtime dependent module

To support disk eviction, the eviction manager needs to know if there is a dedicated device for the imagefs.  In order to know that information, we need to start the eviction manager after cadvisor.  This refactors the location eviction manager is started.

/cc @kubernetes/sig-node @kubernetes/rh-cluster-infra @vishh @ronnielai 

Automatic merge from submit-queue

Assume volume is detached if node doesn't exist

Automatic merge from submit-queue

export KUBE_USER to salt (support custom usernames) for vagrant, vsph…

GCE/GKE were handled in #29164, AWS was handled in #29428. This should cover the rest of the configurations that use ABAC.

Automatic merge from submit-queue

Allow PVs to specify supplemental GIDs

Retry of https://github.com/kubernetes/kubernetes/pull/28691 . Adds a Kubelet helper function for getting extra supplemental groups

Fixes #29358

Automatic merge from submit-queue

Add parsing code in kubelet for eviction-minimum-reclaim

The kubelet parses the eviction-minimum-reclaim flag and validates it for correctness.

The first two commits are from https://github.com/kubernetes/kubernetes/pull/29329 which has already achieved LGTM.

Automatic merge from submit-queue

kube-up: increase download timeout for kubernetes.tar.gz

Particularly on smaller instances on AWS, we were hitting the 80 second
timeout now that our image is well over the 1GB mark.

Increase the timeout from 80 seconds to 300 seconds.

Fix #29418

Automatic merge from submit-queue

Silence curl output

Removes the following from script output:
curl: (7) Failed to connect to 127.0.0.1 port 8080: Connection refused

The requirement that ExternalID returns InstanceNotFound when the
instance not found was incorrectly documented on InstanceID and
InstanceType.  This requirement arises from the node controller, which
is the only place that checks for the InstanceNotFound error.

Automatic merge from submit-queue

Update Libcontainer

This PR is linked to the upstream issue #27204 for introducing pod level cgroups into Kubernetes.

It just updates the Libcontainer dependency.

@vishh  PTAL

Automatic merge from submit-queue

Fix httpclient setup for gcp credential provider to have timeout

The default http client has no timeout.

This could cause problems when not on GCP environments.

This PR changes to use a 10s timeout, and ensures the transport has our normal defaults applied.

/cc @ncdc @liggitt 

Automatic merge from submit-queue

Include CNI for all architectures in the hyperkube image

Can some of you (@jfrazelle @mikedanese) quickly lgtm this?
I'd like it if we got it merged before v1.4.0-alpha.2

It's not a huge change, I'm just cross-compiling this CNI stuff while waiting for the v0.4.0 which likely will release binaries for all arches.

Automatic merge from submit-queue

Print two errors to log

The PR add two error info to log.

Automatic merge from submit-queue

add configz.InstallHandler in controllermanager.go

I think it should add configz.InstallHandler for Run function in controllermanager.go.

Automatic merge from submit-queue

Change SETUP_NODE to True for node e2e docker validation test.

The continuous node e2e docker validation test is failing because:
```
W0722 00:48:52.163940    1265 image_list.go:85] Could not pre-pull image gcr.io/google_containers/netexec:1.4 exit status 1 output:  Cannot connect to the Docker daemon. Is the docker daemon running on this host?
```
This is because jenkins is not added to docker user group.
For other images tested in node e2e, jenkins is added to docker user group when the images are initially created https://github.com/kubernetes/kubernetes/blob/master/test/e2e_node/environment/setup_host.sh#L102.

However, in node e2e docker validation test, we are using GCI image which doesn't do that.
So we should use the `SETUP_NODE` option to add user to docker group before test running https://github.com/kubernetes/kubernetes/blob/b6c87904f626395f63850c2f4e693859dffe558c/test/e2e_node/e2e_remote.go#L150-L159.

This is only one line change, could you help me review the PR? @wonderfly 
Thanks a lot! :)

Automatic merge from submit-queue

Expose Changesets (transactions) in dns provider

This makes the dnsprovider usable in more scenarios, and it also solves
some TODOs in the federation code.

WIP  - I'm going to test this to make sure this both works and is sufficient for use in my dns controller, but I wanted to put some code behind the talk in #28477.  cc @quinton-hoole 

Issue #28477

Automatic merge from submit-queue

AWS kube-up: fix MASTER_OS_DISTRIBUTION

On AWS we were defining KUBE_MASTER_OS_DISTRIBUTION, but the scripts
expect MASTER_OS_DISTRIBUTION.

Fixes #29422

Automatic merge from submit-queue

Enable endpoints in kubernetes service started by local-cluster-up.sh

--advertise_address should be set to 127.0.0.1, So let API server pick
the default if necessary.

Fixes #29374

Automatic merge from submit-queue

API types for FederatedReplicaSetPreferences

Currently only internal types just to unblock the work on scheduling part of Federated Replica Set Controller. 

Automatic merge from submit-queue

Clarify newline formatting for release note blocks.

Fixes https://github.com/kubernetes/release/issues/26

Automatic merge from submit-queue

Allow multiple APIs to register for the same API Group

Fixes https://github.com/kubernetes/kubernetes/issues/23831

@kubernetes/sig-api-machinery 

[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()