Automatic merge from submit-queue

Add PriorityClass API object under new "scheduling" API group

**What this PR does / why we need it**: This PR is a part of a series of PRs to add pod priority to Kubernetes. This PR adds a new API group called "scheduling" with a new API object called "PriorityClass". PriorityClass maps the string value of priority to its integer value.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**: Given the size of this PR, I will add the admission controller for the PriorityClass in a separate PR.

**Release note**:

```release-note
Add PriorityClass API object under new "scheduling" API group
```

ref/ #47604
ref/ #48646

Automatic merge from submit-queue (batch tested with PRs 47509, 46821, 45319, 49121, 49125)

Tolerate a missing MasterName (for GKE)

When testing, GKE created clusters don't provide a `MasterName`, so don't throw a warning and give up when that happens.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 47509, 46821, 45319, 49121, 49125)

gce: don't add kubelet bearer token to known tokens

Automatic merge from submit-queue (batch tested with PRs 47509, 46821, 45319, 49121, 49125)

api types: fix protobuf names that are different from JSON name

This PR fixes the naming of protobuf fields that are mismatched when compared to the JSON names. Because protobuf names aren't actually used during serialization, just the index, I think we can update these safely without changing the over the wire encoding (note that generated.pb.go doesn't change).

Can someone verify that fixing the name won't impact backward compatibility?

cc @kubernetes/sig-api-machinery-pr-reviews 

Fixes https://github.com/kubernetes/kubernetes/issues/45183

```release-notes
None
```

Automatic merge from submit-queue (batch tested with PRs 47509, 46821, 45319, 49121, 49125)

volume i/o tests for storage plugins

**What this PR does / why we need it**:
Addresses issues [25268](https://github.com/kubernetes/kubernetes/issues/25268) and [28367](https://github.com/kubernetes/kubernetes/issues/28367), though it may be weak re. the streaming i/o issue. @matchstick 

**Special notes for your reviewer**:
This is a new file. Plugins other than NFS, GlusterFS, iSCSI, and Ceph-RBD code will need to be supported in a separate PR.

```release-note
NONE
```

Automatic merge from submit-queue

Bump e2e mounttest image version to 0.8

Reduce the number of image files required for e2e test run
```release-note
NONE
```

Automatic merge from submit-queue

test/OWNERS: add zmerlynn

```release-note
NONE
```

Automatic merge from submit-queue

Switch from gazel to kazel

**What this PR does / why we need it**: switches to `kazel`, where all new development will be focused. Part of the effort for switching from `gazel` to `gazelle`.

I'm imagining that we'll use `kube::util::go_install_from_commit` to version `gazelle` as well.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: x-ref #47558

**Release note**:

```release-note
NONE
```

/release-note-none
/assign @mikedanese @spxtr

Automatic merge from submit-queue

add owners for shell2junit pkg

Per https://github.com/kubernetes/kubernetes/pull/47614#issuecomment-308888690
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49143, 49211)

Add more logging to PD node delete test

**What this PR does / why we need it**: Adds more logging to `Pod Disks should be able to detach from a node which was deleted` test which started failing because `gcloud compute instances list` is failing with `exit status 1`.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: https://github.com/kubernetes/kubernetes/issues/49185

**Special notes for your reviewer**:

**Release note**: none

Automatic merge from submit-queue (batch tested with PRs 49143, 49211)

update cli owner

Update my GH handle from @ymqytw to @mengqiy
And remove @pwittrock from reviewer list, but he is still in the approver list.

/assign @pwittrock 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 48981, 47316, 49180)

Add seccomp profile in sandbox security context

**What this PR does / why we need it**:

PR  #46332 adds seccomp profile to container security context, but not sandbox. This PR adds seccomp profile in sandbox security context. Without this, we couldn't honour "seccomp.security.alpha.kubernetes.io/pod" for sandbox.

**Which issue this PR fixes**

fixes #49179.

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/cc @yujuhong

Automatic merge from submit-queue (batch tested with PRs 48981, 47316, 49180)

Added golint check for pkg/kubelet.

**What this PR does / why we need it**:
Added golint check for pkg/kubelet, and make golint happy.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47315 

**Release note**:
```release-note-none
```

Automatic merge from submit-queue (batch tested with PRs 48981, 47316, 49180)

azure: acr: support MSI with preview ACR with AAD auth

**What this PR does / why we need it**:

The recently added support for Managed Identity in Azure (#48854) was incompatible with automatic ACR docker credential integration (#48980).

This PR resolves that, by leveraging a feature available in Preview regions, on new managed clusters with support for AAD `access_token` authentication.

Notes:
* This includes code copied from [Azure/acr-docker-credential-helper](https://github.com/Azure/acr-docker-credential-helper). I copied the MIT license from that project and added a copyright line for Microsoft on it. (but one of the hack/verify-* scripts requires the Kubernetes copyright header. So there are two copyright headers in the file now...)
* Eventually this should vendor  [Azure/acr-docker-credential-helper](https://github.com/Azure/acr-docker-credential-helper) when it exposes the right functionality.
* This includes a small, non-function-impacting workaround for a temporary service-side bug.


**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #48980

**Special notes for your reviewer**:
Please don't LGTM it without reviewing the `azure_acr_helper.go` file's license header...

**Release note**:
```release-note
azure: acr: support MSI with preview ACR with AAD auth
```

Automatic merge from submit-queue (batch tested with PRs 49058, 49072, 49137, 49182, 49045)

*: remove --insecure-allow-any-token option

~Since the authenticator is still used in e2e tests, don't remove
the actual package. Maybe a follow up?~

edit: e2e and integration tests have been switched over to the tokenfile
authenticator instead.

```release-note
The --insecure-allow-any-token flag has been removed from kube-apiserver. Users of the flag should use impersonation headers instead for debugging.
```

closes #49031

cc @kubernetes/sig-auth-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 49058, 49072, 49137, 49182, 49045)

Set default CIDR to /16 for Juju deployments

**What this PR does / why we need it**: Increase the number of IPs on a deployment

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/272

**Special notes for your reviewer**:

**Release note**:

```Set default CIDR to /16 for Juju deployments
```

Automatic merge from submit-queue (batch tested with PRs 49058, 49072, 49137, 49182, 49045)

check for nil value in interface for proxier health

golang allows for a non-nil interface to have a nil value (not type).  This results in an NPE at runtime.

@sttts remember that bit about go?  Trivia becomes real :(

Automatic merge from submit-queue (batch tested with PRs 49058, 49072, 49137, 49182, 49045)

use https to check healthz in hack/local-up-cluster.sh

**What this PR does / why we need it**:
```
# PSP_ADMISSION=true ALLOW_PRIVILEGED=true ALLOW_SECURITY_CONTEXT=true ALLOW_ANY_TOKEN=true ENABLE_RBAC=true RUNTIME_CONFIG="extensions/v1beta1=true,extensions/v1beta1/podsecuritypolicy=true" hack/local-up-cluster.sh
...
Waiting for apiserver to come up
+++ [0718 09:34:38] On try 5, apiserver: : 
Cluster "local-up-cluster" set.
use 'kubectl --kubeconfig=/var/run/kubernetes/admin-kube-aggregator.kubeconfig' to use the aggregated API server
Creating kube-system namespace
clusterrolebinding "system:kube-dns" created
serviceaccount "kube-dns" created
configmap "kube-dns" created
error: unable to recognize "kubedns-deployment.yaml": no matches for extensions/, Kind=Deployment
service "kube-dns" created
Kube-dns deployment and service successfully deployed.
kubelet ( 10952 ) is running.
Create podsecuritypolicy policies for RBAC.
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/policies.yaml": no matches for extensions/, Kind=PodSecurityPolicy
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/policies.yaml": no matches for extensions/, Kind=PodSecurityPolicy
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/roles.yaml": no matches for rbac.authorization.k8s.io/, Kind=ClusterRole
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/roles.yaml": no matches for rbac.authorization.k8s.io/, Kind=ClusterRole
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/bindings.yaml": no matches for rbac.authorization.k8s.io/, Kind=ClusterRoleBinding
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/bindings.yaml": no matches for rbac.authorization.k8s.io/, Kind=ClusterRoleBinding
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/bindings.yaml": no matches for rbac.authorization.k8s.io/, Kind=ClusterRoleBinding
Create default storage class for 
error: unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/cluster/addons/storage-class/local/default.yaml": no matches for storage.k8s.io/, Kind=StorageClass
Local Kubernetes cluster is running. Press Ctrl-C to shut it down.

Logs:
  /tmp/kube-apiserver.log
  /tmp/kube-controller-manager.log
  /tmp/kube-proxy.log
  /tmp/kube-scheduler.log
  /tmp/kubelet.log
...
```

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47739

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Pass logexporter config through e2e framework

Ref https://github.com/kubernetes/kubernetes/issues/48513

/cc @wojtek-t @fejta

Automatic merge from submit-queue

fix leader-elect-resource-lock's description

**What this PR does / why we need it**:
    The leader-elect-resource-lock description miss a space in pkg/client/leaderelectionconfig/config.go. It will effect other component's help document which use leader election.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
    I think it's is needless to open a issue.
**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

Remove service on termination when exec 'kubectl run' command with flags "--rm" and "--expose"

**What this PR does / why we need it**:
As the title says and issue #40504 mentioned.
cc @tanapoln

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #40504 

**Special notes for your reviewer**:
Related to: #44915

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Improve the warning message if the rbd command is not found.

**What this PR does / why we need it**:
The previous warning msg is not correct if there is no rbd cmd.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #


**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

k8s.io/metrics: restrict k8s.io/metrics imports

Automatic merge from submit-queue

Restore cAdvisor prometheus metrics to the main port

But under a new path - `/metrics/cadvisor`. This ensures a secure port still exists for metrics while getting the benefit of separating out container metrics from the kubelet's metrics as recommended in the linked issue.

Fixes #48483

```release-note-action-required
Restored cAdvisor prometheus metrics to the main port -- a regression that existed in v1.7.0-v1.7.2
cAdvisor metrics can now be scraped from `/metrics/cadvisor` on the kubelet ports.
Note that you have to update your scraping jobs to get kubelet-only metrics from `/metrics` and `container_*` metrics from `/metrics/cadvisor`
```

Automatic merge from submit-queue (batch tested with PRs 49116, 49095)

update-staging-godeps: do not exclude k8s.io/metrics

Counterpart to https://github.com/kubernetes/test-infra/pull/3560

Automatic merge from submit-queue (batch tested with PRs 49116, 49095)

Move pkg/api/v1/ref -> client-go/tools/reference

`pkg/api/v1/ref` is the only remaining package copied from pkg/api/v1 to client-go via staging/copy.sh.

Automatic merge from submit-queue (batch tested with PRs 48043, 48200, 49139, 36238, 49130)

expose RegisterAllAdmissionPlugins so that admission chains can be reused

Exposes the admission plugin registration functions so that sets of plugins can be re-used.

@sttts @p0lyn0mial

Automatic merge from submit-queue (batch tested with PRs 48043, 48200, 49139, 36238, 49130)

Implement equivalence cache by caching and re-using predicate result

The last part of #30844, I opened a new PR instead of overwrite the old one because we changed some basic assumption by allowing invalidating equivalence cache item by individual predicate.

The idea of this PR is based on discussion in https://github.com/kubernetes/kubernetes/issues/32024

- [x]  Pods belong to same controllerRef considered to be equivalent
- [x] ` podFitsOnNode` will use cached predicate result if it's available
- [x] Equivalence cache will be updated when if a fresh new predicate is done
- [x] `factory.go` will invalid specific predicate cache(s) based on the object change
- [x] Since `schedule` and `bind` are async, we need to optimistically invalid affected cache(s) before `bind`
- [x] Fully unit test of affected files
- [x] e2e test to verify cache update/invalid workflow
- [x] performance test results

- [x] Some nits fixes related but expected to result in `needs-rebase` so they are split to: #36060 #35968 #37512

cc @wojtek-t @davidopp

Automatic merge from submit-queue (batch tested with PRs 48043, 48200, 49139, 36238, 49130)

expose method to allow externally setting defaults on an external type

The options are an exposed type.  This allows you to set the defaults on them.

@derekwaynecarr who normally owns this bit?

Automatic merge from submit-queue (batch tested with PRs 48043, 48200, 49139, 36238, 49130)

[Federation] Make arguments to scheduling type adapter methods generic

This is in the process of trying to rebase https://github.com/kubernetes/kubernetes/pull/45993 on latest.
cc @marun @perotinus 
@kubernetes/sig-federation-misc 
Hoping I get some attention to this and later PRs soon.

Associated issue https://github.com/kubernetes/kubernetes/issues/49181

**Release note**:

```NONE
```

Automatic merge from submit-queue (batch tested with PRs 48043, 48200, 49139, 36238, 49130)

Validate --storage-backend type.

**What this PR does / why we need it**:
Validate --storage-backend type as early as possible.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47517
This PR is as per https://github.com/kubernetes/kubernetes/pull/47517/files#r121975646

**Special notes for your reviewer**:
/cc @justinsb 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49120, 46755, 49157, 49165, 48950)

kubectl: deduplicate deployment generators

**What this PR does / why we need it**: See the description on https://github.com/kubernetes/kubectl/issues/44

**Which issue this PR fixes**: fixes https://github.com/kubernetes/kubectl/issues/44

**Special notes for your reviewer**: Yes, the lines added and removed are about the same. This is because I added 20+ lines of docstrings. Check the diff. You'll see I deleted a lot of duplicated logic :)

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49120, 46755, 49157, 49165, 48950)

gce: don't print every file in mounter to stdout

This is printing ~3000 lines.

Automatic merge from submit-queue (batch tested with PRs 49120, 46755, 49157, 49165, 48950)

gce: make some global variables local

/approve no-issue

Automatic merge from submit-queue (batch tested with PRs 49120, 46755, 49157, 49165, 48950)

add cmd test for kubectl auth can-i

**Release note**:

```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49120, 46755, 49157, 49165, 48950)

Modify podpreset lister to use correct namespace

Previously a pod with an empty namespace field submitted to a given namespace
was incorrectly matching preset labels in a different namespace.

Fixes https://github.com/kubernetes/kubernetes/issues/49141

Release note:
```release-note
Fix pod preset to ignore input pod namespace in favor of request namespace
```