Automatic merge from submit-queue (batch tested with PRs 43505, 45168, 46439, 46677, 46623)

Add TPR to CRD migration helper.

This is a helper for migrating TPR data to CustomResource. It's rather hacky because it requires crossing apiserver boundaries, but doing it this way keeps the mess contained to the TPR code, which is scheduled for deletion anyway.

It's also not completely hands-free because making it resilient enough to be completely automated is too involved to be worth it for an alpha-to-beta migration, and would require investing significant effort to fix up soon-to-be-deleted TPR code. Instead, this feature will be documented as a best-effort helper whose results should be verified by hand.

The intended benefit of this over a totally manual process is that it should be possible to copy TPR data into a CRD without having to tear everything down in the middle. The process would look like this:

1. Upgrade to k8s 1.7. Nothing happens to your TPRs.
1. Create CRD with group/version and resource names that match the TPR. Still nothing happens to your TPRs, as the CRD is hidden by the overlapping TPR.
1. Delete the TPR. The TPR data is converted to CustomResource data, and the CRD begins serving at the same REST path.

Note that the old TPR data is left behind by this process, so watchers should not receive DELETE events. This also means the user can revert to the pre-migration state by recreating the TPR definition.

Ref. https://github.com/kubernetes/kubernetes/issues/45728

Automatic merge from submit-queue (batch tested with PRs 43505, 45168, 46439, 46677, 46623)

Test finalization for CRs

**What this PR does / why we need it**:
Updates #45511 with a test for finalizers for CRDs.

**Release note**:
```release-note
NONE
```
@deads2k

Automatic merge from submit-queue (batch tested with PRs 43505, 45168, 46439, 46677, 46623)

fix AWS tagging to add missing tags only

It seems that intention of original code was to build map of missing
tags and call AWS API to add just them, but due to typo full
set of tags was always (re)added

```release-note
NONE
```

Automatic merge from submit-queue

unit test for kubectl config set-cluster

**What this PR does / why we need it**:
unit test for create cluster

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
i want test secure mode,but CA path how set?

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Performance tests also cover configmaps now

Similar to secrets.
We should be able to get this in once https://github.com/kubernetes/kubernetes/pull/46470 is merged.

/cc @wojtek-t @gmarek

Automatic merge from submit-queue (batch tested with PRs 46686, 45049, 46323, 45708, 46487)

set LANG to 'C' in Makefile

Now we support multi-languages:
https://github.com/kubernetes/kubernetes/tree/master/translations

But some tests support only English. This test fails when LANG is set to zh_CN.UTF-8:
https://github.com/kubernetes/kubernetes/blob/master/hack/make-rules/test-cmd-util.sh#L2838
The expected err string is translated to Chinese:
https://github.com/kubernetes/kubernetes/blob/master/translations/kubectl/zh_CN/LC_MESSAGES/k8s.po#L82

**Release note**:

```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46686, 45049, 46323, 45708, 46487)

add some full stop and change some format

Automatic merge from submit-queue (batch tested with PRs 46686, 45049, 46323, 45708, 46487)

[Federation][kubefed]: Use StorageClassName for etcd pvc

This PR updates kubefed to use the StorageClassName field [added in 1.6](http://blog.kubernetes.io/2017/03/dynamic-provisioning-and-storage-classes-kubernetes.html
) for etcd's pvc to allow the user to specify which storage class they want to use.  If no value is provided to ``kubefed init``, the field will not be set, and initialization of the pvc may fail on a cluster without a default storage class configured.

The alpha annotation that was previously used (``volume.alpha.kubernetes.io/storage-class``) was deprecated as of 1.4 according to the following blog post:

http://blog.kubernetes.io/2016/10/dynamic-provisioning-and-storage-in-kubernetes.html

**Release note**:

```
'kubefed init' has been updated to support specification of the storage class (via --etcd-pv-storage-class) for the Persistent Volume Claim (PVC) used for etcd storage.  If --etcd-pv-storage-class is not specified, the default storage class configured for the cluster will be used.
```

cc: @kubernetes/sig-federation-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 46686, 45049, 46323, 45708, 46487)

Log an EBS vol's instance when attaching fails because VolumeInUse

Messages now look something like this:
E0427 15:44:37.617134   16932 attacher.go:73] Error attaching volume "vol-00095ddceae1a96ed": Error attaching EBS volume "vol-00095ddceae1a96ed" to instance "i-245203b7": VolumeInUse: vol-00095ddceae1a96ed is already attached to an instance
        status code: 400, request id: f510c439-64fe-43ea-b3ef-f496a5cd0577. The volume is currently attached to instance "i-072d9328131bcd9cd"
weird that AWS doesn't bother to put that information in there for us (it does when you try to delete a vol that's in use)
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46686, 45049, 46323, 45708, 46487)

Update deprecated flags for "make test-cmd"

**Release note**:

```
NONE
```

Automatic merge from submit-queue

Migrate kubelet to ConfigMapManager interface and use TTL-based caching manager

Fixes #41379
Sometime ago we moved to a secret manager interface for kubelet to manage secrets.
This PR's first commit moves config map management also to a similar interface.
The second commit adds TTL-based CachingConfigMapManager (similar to CachingSecretManager) and makes kubelet use it.

/cc @kubernetes/sig-node-pr-reviews @kubernetes/sig-scalability-misc @wojtek-t @dchen1107

Updates #45511

Automatic merge from submit-queue

hack/update-swagger-spec.sh: use posix regex syntax

`\s` is a GNU extension, breaking builds with BSD sed.

Automatic merge from submit-queue

Check volume's status before detaching volume

When volume's status is 'detaching', controllermanager will detach
it again and return err. It is necessary to check volume's status
before detaching volume.

same issue: #44536

Automatic merge from submit-queue

clientgo/examples: Add CRUD Deployment sample

Automatic merge from submit-queue (batch tested with PRs 46661, 46562, 46657, 46655, 46640)

Improve validation of active deadline seconds

**What this PR does / why we need it**:
Improve validation of active deadline seconds to not allow it to be larger than max uint32.

If users choose a value that is too large, the conversion of that value to a duration in seconds can cause an overflow.  I see no practical benefit of having a value larger than uint32 at this time.

xref: https://bugzilla.redhat.com/show_bug.cgi?id=1456156

**Release note**:
```release-note
Restrict active deadline seconds max allowed value to be maximum uint32
```

Automatic merge from submit-queue (batch tested with PRs 46661, 46562, 46657, 46655, 46640)

Implement kubectl get controllerrevisions

Before:
```console
$ kubectl get controllerrevisions 
error: unknown type &apps.ControllerRevision{TypeMeta:v1.TypeMeta{Kind:"", APIVersion:""}, ObjectMeta:v1.ObjectMeta{....}...}
```
After:
```console
$ kubectl get controllerrevisions 
NAME          CONTROLLER       REVISION   AGE
foo-2312378   DaemonSet/foo    1          2d
```

**Release note**:

```release-note
```

@kubernetes/sig-apps-pr-reviews @kubernetes/sig-cli-maintainers

Automatic merge from submit-queue (batch tested with PRs 46661, 46562, 46657, 46655, 46640)

remove openvpn and nginx from salt

only used in azure which doesn't exist.

Automatic merge from submit-queue (batch tested with PRs 46661, 46562, 46657, 46655, 46640)

remove redundant carriage return for readable

**What this PR does / why we need it**:

remove redundant carriage to make it more readable.

Automatic merge from submit-queue

Plumb through the ENABLE_LEGACY_ABAC flag for GKE kube-up.

**What this PR does / why we need it**:
Makes the "gke" provider in `cluster/` respect the `ENABLE_LEGACY_ABAC` env var by plumbing it through to the `--enable-legacy-authorization` gcloud flag.

Automatic merge from submit-queue (batch tested with PRs 46394, 46650, 46436, 46673, 46212)

Remove deprecated variable RBACSuperUser

authorization-rbac-super-user is deprecated now. So we can remove
the vaiable. Further more the comment about this variable is wrong.
Remove them also.

**Release note**:
```NONE
```

Automatic merge from submit-queue (batch tested with PRs 46394, 46650, 46436, 46673, 46212)

fix typos in pkg/apis/componentconfig/types.go

**What this PR does / why we need it**:

fix several typos in `pkg/apis/componentconfig/types.go`

Automatic merge from submit-queue (batch tested with PRs 46394, 46650, 46436, 46673, 46212)

refactor and export openstack service clients

**What this PR does / why we need it**:
Refactor and export openstack service client.
Exporting OpenStack client so other projects can use the them to call functions that are not implemented in openstack cloud providers yet.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46394, 46650, 46436, 46673, 46212)

Update ip-masq-agent addon with latest image.

https://github.com/kubernetes-incubator/ip-masq-agent/releases

Automatic merge from submit-queue (batch tested with PRs 46394, 46650, 46436, 46673, 46212)

Write "kubectl options" help message to stdout, not stderr

Fix a very minor issue causing `kubectl` to write its help messages to `stderr` instead of `stdout`.

Try this:

`kubectl options | grep log`

It should print only the options related to logging, but right now it prints the entire help menu (since it's printing to stderr).

This patch brings us closer to unix convention and reduces user friction.

~~Another use case (if a user can't remember whether it's `-r` or `-R` for recursion):~~

~~`kubectl patch -h | grep recursive`~~

Update: this patch only affects `kubectl options`. The other commands are working as intended.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46076, 43879, 44897, 46556, 46654)

kubelet status manager: short-circut the evaluation if possible

This avoids redundant checks in the `PodResourcesAreReclaimed`, which
also logs misleading "Pod is terminated" messages on every check

/cc @kubernetes/sig-node-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 46076, 43879, 44897, 46556, 46654)

Use meta.v1 GroupVersionKind with json tags to generate OpenAPI spec

We are using two different GVK struct in generation of OpenAPI extensions. This PR unify that and also add json tags to meta.v1 GVK to comply with json naming system in other serializations. Also the value of Action extension is now lowercase.

ref: https://github.com/kubernetes/kubernetes/pull/46388

Automatic merge from submit-queue (batch tested with PRs 46076, 43879, 44897, 46556, 46654)

Local storage plugin

**What this PR does / why we need it**:
Volume plugin implementation for local persistent volumes.  Scheduler predicate will direct already-bound PVCs to the node that the local PV is at.  PVC binding still happens independently.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 
Part of #43640

**Release note**:

```
Alpha feature: Local volume plugin allows local directories to be created and consumed as a Persistent Volume.  These volumes have node affinity and pods will only be scheduled to the node that the volume is at.
```

Automatic merge from submit-queue (batch tested with PRs 46076, 43879, 44897, 46556, 46654)

kubelet/network: report but tolerate errors returned from GetNetNS()

Runtimes should never return "" and nil errors, since network plugin
drivers need to treat netns differently in different cases.  So return
errors when we can't get the netns, and fix up the plugins to do the
right thing.

Namely, we don't need a NetNS on pod network teardown.  We do need
a netns for pod Status checks and for network setup.

@kubernetes/rh-networking @kubernetes/sig-network-bugs @DirectXMan12

Now we support multi-languages:
https://github.com/kubernetes/kubernetes/tree/master/translations

But some tests support only English. This test fails when LANG is set to zh_CN.UTF-8:
https://github.com/kubernetes/kubernetes/blob/master/hack/make-rules/test-cmd-util.sh#L2838
The expected err string is translated to Chinese:
https://github.com/kubernetes/kubernetes/blob/master/translations/kubectl/zh_CN/LC_MESSAGES/k8s.po#L82

Automatic merge from submit-queue

Node authorizer

This PR implements the authorization portion of https://github.com/kubernetes/community/blob/master/contributors/design-proposals/kubelet-authorizer.md and kubernetes/features#279:
* Adds a new authorization mode (`Node`) that authorizes requests from nodes based on a graph of related pods,secrets,configmaps,pvcs, and pvs:
  * Watches pods, adds edges (secret -> pod, configmap -> pod, pvc -> pod, pod -> node)
  * Watches pvs, adds edges (secret -> pv, pv -> pvc)
  * When both Node and RBAC authorization modes are enabled, the default RBAC binding that grants the `system:node` role to the `system:nodes` group is not automatically created.
* Tightens the `NodeRestriction` admission plugin to require identifiable nodes for requests from users in the `system:nodes` group.

This authorization mode is intended to be used in combination with the `NodeRestriction` admission plugin, which limits the pods and nodes a node may modify. To enable in combination with RBAC authorization and the NodeRestriction admission plugin:
* start the API server with `--authorization-mode=Node,RBAC --admission-control=...,NodeRestriction,...`
* start kubelets with TLS boostrapping or with client credentials that place them in the `system:nodes` group with a username of `system:node:<nodeName>`

```release-note
kube-apiserver: a new authorization mode (`--authorization-mode=Node`) authorizes nodes to access secrets, configmaps, persistent volume claims and persistent volumes related to their pods.
* Nodes must use client credentials that place them in the `system:nodes` group with a username of `system:node:<nodeName>` in order to be authorized by the node authorizer (the credentials obtained by the kubelet via TLS bootstrapping satisfy these requirements)
* When used in combination with the `RBAC` authorization mode (`--authorization-mode=Node,RBAC`), the `system:node` role is no longer automatically granted to the `system:nodes` group.
```

```release-note
RBAC: the automatic binding of the `system:node` role to the `system:nodes` group is deprecated and will not be created in future releases. It is recommended that nodes be authorized using the new `Node` authorization mode instead. Installations that wish to continue giving all members of the `system:nodes` group the `system:node` role (which grants broad read access, including all secrets and configmaps) must create an installation-specific ClusterRoleBinding.
```

Follow-up:
- [ ] enable e2e CI environment with admission and authorizer enabled (blocked by kubelet TLS bootstrapping enablement in https://github.com/kubernetes/kubernetes/pull/40760)
- [ ] optionally enable this authorizer and admission plugin in kubeadm
- [ ] optionally enable this authorizer and admission plugin in kube-up

Automatic merge from submit-queue

Fix Cross-Build, and reduce test to 1 restart to reduce flakyness

In response to https://github.com/kubernetes/kubernetes/pull/46308#issuecomment-304248450

This fixes the error: `test/e2e_node/summary_test.go:138: constant 100000000000 overflows int` from the cross build.

This [recent flake](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/logs/ci-kubernetes-node-kubelet/4179) was because the container restarted during the period where the test expected to Continually see the container in the Summary API.

/assign @dchen1107 
cc @gmarek @luxas 

/release-note-none

Automatic merge from submit-queue

Update 'fluentd-elasticsearch' image.

**What this PR does / why we need it**:

Plugins updated for `fluentd-elasticsearch`:
 - fluent-plugin-elasticsearch 1.5.0 -> 1.9.5
 - fluent-plugin-kubernetes_metadata 0.24.0 -> 0.27.0

**Release note**:

```release-note
NONE
```