Automatic merge from submit-queue

genericapiserver: update OWNERS

- adding myself to approvers
- add OWNERS file to staging/src/k8s.io/apiserver

Automatic merge from submit-queue

Revert "update kubectl approvers"

Reverts kubernetes/kubernetes#40359

Automatic merge from submit-queue (batch tested with PRs 38739, 40480, 40495, 40172, 40393)

Rename controller pkg/registry/core/controller to pkg/registry/core/r…

…eplicationcontroller



**What this PR does / why we need it**:

Rename controller pkg/registry/core/controller to pkg/registry/core/replicationcontroller
This will clarify the purpose of the controller since intent is replicationcontroller

Please refer to 
https://github.com/kubernetes/kubernetes/issues/17648

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
NONE
**Release note**:

```NONE
```

Automatic merge from submit-queue (batch tested with PRs 38739, 40480, 40495, 40172, 40393)

Use existing ABAC policy file when upgrading GCE cluster

When upgrading, continue loading an existing ABAC policy file so that existing system components continue working as-is

```
When upgrading an existing 1.5 GCE cluster using `cluster/gce/upgrade.sh`, an existing ABAC policy file located at /etc/srv/kubernetes/abac-authz-policy.jsonl (the default location in 1.5) will enable the ABAC authorizer in addition to the RBAC authorizer. To switch an upgraded 1.5 cluster completely to RBAC, ensure the control plane components and your superuser have been granted sufficient RBAC permissions, move the legacy ABAC policy file to a backup location, and restart the apiserver.
```

Automatic merge from submit-queue (batch tested with PRs 38739, 40480, 40495, 40172, 40393)

Use fnv hash in the CRI implementation

fnv is more stable than adler. This PR changes CRI implementation to
use fnv for generating container hashes, but leaving the old
implementation (dockertools/rkt). This is because hash is what kubelet
uses to identify a container -- changes to the hash will cause kubelet
to restart existing containers. This is ok for CRI implementation (which
requires a disruptive upgrade already), but not for older implementations.

#40140

Automatic merge from submit-queue (batch tested with PRs 38739, 40480, 40495, 40172, 40393)

Don't build //build/... with "make bazel-build".

This makes "make bazel-build" no longer build docker images and
release tars, which are the slowest and least incremental parts. They
will still be built in CI since we run //:ci-artifacts.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

Object r repeat close

**What this PR does / why we need it**:

Object r repeat close. 
each end of the for loop, the object r has been closed. so omitting defer r.close(), to avoid repeat close.

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

Prep node_e2e for GCI to COS name change

GCI will soon change name in etc/os-release from "gci" to "cos".

This prepares the node_e2e tests to deal with that change and also updates some comments/log messages/var names in anticipation.

Automatic merge from submit-queue

Add support of Keystone v3 'domain-name' to 'openstack-heat' cluster setup

**What this PR does / why we need it**:
Keystone v3 authentication by user name [requires the domain (name or ID)](http://developer.openstack.org/api-ref/identity/v3/index.html?expanded=password-authentication-with-scoped-authorization-detail). If `domain-name` is not provided kubelet fails as seen below:
  
```
kubelet: error: failed to run Kubelet: could not init cloud provider "openstack": You must provide exactly one of DomainID or DomainName to authenticate by Username
systemd: kubelet.service: main process exited, code=exited, status=1/FAILURE
systemd: Unit kubelet.service entered failed state.
systemd: kubelet.service failed.
```

To solve this I pass a new`OS_USER_DOMAIN_NAME` environment variable through openstack-heat's heat-templates to write it as `domain-name` in `/srv/kubernetes/openstack.conf`. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #39783

**Special notes for your reviewer**:

**Release note**:

```
domain-name support for Keystone v3 added to openstack-heat cluster setup
```

Automatic merge from submit-queue

Propose adding quinton-hoole to federation/OWNERS

Automatic merge from submit-queue (batch tested with PRs 39538, 40188, 40357, 38214, 40195)

Use SecretManager when getting secrets for EnvFrom

Merges crossed in the night which missed this needed change.

Automatic merge from submit-queue (batch tested with PRs 39538, 40188, 40357, 38214, 40195)

test for host cleanup in unfavorable pod deletes

addresses issue #31272 with a new e2e test in _kubelet.go_
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 39538, 40188, 40357, 38214, 40195)

genericapiserver: cut off more dependencies – episode 2

Compare commit subjects.

approved based on #40363

Automatic merge from submit-queue (batch tested with PRs 39538, 40188, 40357, 38214, 40195)

Decoupling scheduler creation from creation of scheduler.Config struc…

**What this PR does / why we need it**:

Adds functionality to the scheduler to initialize from an Configurator interface, rather then via a Config struct.

**Which issue this PR fixes** 

Reduces coupling to `scheduler.Config` data structure format so that we can proliferate more interface driven composition of scheduler components.

Automatic merge from submit-queue

Add Microsoft OMS (Operations Management Suite) monitoring DaemonSet example

Adds example to deploy Microsoft OMS monitoring agents using Daemon Sets.

Automatic merge from submit-queue

Able to quick create a HA cluster by kube-up.sh centos provider

Make `kube-up.sh` `centos provider` support quick create a HA cluster, as I said above [#39430](https://github.com/kubernetes/kubernetes/issues/39430), it's more flexible than `kops` or `kubeadm` for some people in a limited network region.

I'm new to k8s dev, so if this pull request need to change, please let me know.

```release-note
Added support for creating HA clusters for centos using kube-up.sh.
```

Automatic merge from submit-queue

[OpenStack-Heat] Add link to the OpenStack CLI install documentation

**What this PR does / why we need it**:

More helpful diagnostic text 

**Special notes for your reviewer**:

Trivial patch

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Add serviceaccount owners files

Poor @derekwaynecarr is the sole approver/reviewer for the entire admission package.

This adds OWNERS files for service account controller and admission packages

Automatic merge from submit-queue

fix rbd storage class indent

Release note
```release-note
NONE
```

Automatic merge from submit-queue

dnsprovider: Add IsEmpty method

When batching changes, it is often handy to know whether a changeset
IsEmpty, and thus does not need to be Apply-ed.

```release-note
NONE
```

Leave the old implementation (dockertools/rkt) untouched so that
containers will not be restarted during kubelet upgrade. For CRI
implementation (kuberuntime), container restart is required for kubelet
upgrade.

Automatic merge from submit-queue (batch tested with PRs 40429, 40436)

plugin/pkg/admission/serviceaccount: prefer first referenced secret

When a pod uses a service account that references multiple secrets,
prefer the secrets in the order they're listed.

Without this change, the added test fails:

    --- FAIL: TestMultipleReferencedSecrets (0.00s)
            admission_test.go:832: expected first referenced secret to be mounted, got "token2"

Closes #40411

cc @kubernetes/sig-auth-pr-reviews

Automatic merge from submit-queue

Wait for the self-hosted control plane during kubeadm init.

**What this PR does / why we need it**:

Currently we are completing kubeadm init while the scheduler and
controller manager are likely still not yet up. In some cases if they
will fail, they won't ever come up.

Instead wait until each pod enters running state before exiting kubeadm.

**Release note**:

```release-note
NONE
```

This makes "make bazel-build" no longer build docker images and
release tars, which are the slowest and least incremental parts. They
will still be built in CI since we run //:ci-artifacts.

Automatic merge from submit-queue (batch tested with PRs 40428, 40176)

Cleaup Affinity post conversion from annotations to fields

**What this PR does / why we need it**:
Cleans up leftover work from the conversion of affinity from annotations to fields.

fixes #40016 
related #25319 

**Special notes for your reviewer**:
There are some TODO items left for @luxas or @errordeveloper b/c they were trying to use affinity in a way that is not possible.  

**Release note**:

```release-note
NONE
```

/cc @kubernetes/sig-scheduling-misc @rrati

Automatic merge from submit-queue (batch tested with PRs 40428, 40176)

Re-enable test-cmd.sh tests

Wrapping `runTests` in a subshell was masking return code failures
Moved init to top-level to properly install stack traces on exit

Fixes https://github.com/kubernetes/kubernetes/issues/39168

When a pod uses a service account that references multiple secrets,
prefer the secrets in the order they're listed.

Without this change, the added test fails:

    --- FAIL: TestMultipleReferencedSecrets (0.00s)
            admission_test.go:832: expected first referenced secret to be mounted, got "token2"

Re-enabling tracked in https://github.com/kubernetes/kubernetes/issues/40433