Automatic merge from submit-queue (batch tested with PRs 40971, 41027, 40709, 40903, 39369)

Set docker opt separator correctly for SELinux options

This is based on @pmorie's commit from #40179

Automatic merge from submit-queue (batch tested with PRs 40971, 41027, 40709, 40903, 39369)

Promote SubjectAccessReview to v1

We have multiple features that depend on this API:

SubjectAccessReview
- [webhook authorization](https://kubernetes.io/docs/admin/authorization/#webhook-mode)
- [kubelet delegated authorization](https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authorization)
- add-on API server delegated authorization

The API has been in use since 1.3 in beta status (v1beta1) with negligible changes:
- Added a status field for reporting errors evaluating access
- A typo was discovered in the SubjectAccessReviewSpec Groups field name

This PR promotes the existing v1beta1 API to v1, with the only change being the typo fix to the groups field. (fixes https://github.com/kubernetes/kubernetes/issues/32709)

Because the API does not persist data (it is a query/response-style API), there are no data migration concerns.

This positions us to promote the features that depend on this API to stable in 1.7

cc @kubernetes/sig-auth-api-reviews @kubernetes/sig-auth-misc

```release-note
The authorization.k8s.io API group was promoted to v1
```

Automatic merge from submit-queue (batch tested with PRs 40971, 41027, 40709, 40903, 39369)

Bump GCI to gci-beta-56-9000-80-0

cc/ @Random-Liu @adityakali 

Changelogs since gci-dev-56-8977-0-0 (currently used in Kubernetes):
 - "net.ipv4.conf.eth0.forwarding" and "net.ipv4.ip_forward" may get reset to 0
 - Track CVE-2016-9962 in Docker in GCI
 - Linux kernel CVE-2016-7097
 - Linux kernel CVE-2015-8964
 - Linux kernel CVE-2016-6828
 - Linux kernel CVE-2016-7917
 - Linux kernel CVE-2016-7042
 - Linux kernel CVE-2016-9793
 - Linux kernel CVE-2016-7039 and CVE-2016-8666
 - Linux kernel CVE-2016-8655
 - Toolbox: allow docker image to be loaded from local tarball
 - Update compute-image-package in GCI 
 - Change the product name on /etc/os-release (to COS)
 - Remove 'dogfood' from HWID_OVERRIDE in /etc/lsb-release
 - Include Google NVME extensions to optimize LocalSSD performance.
 - /proc/<pid>/io missing on GCI (enables process stats accounting)
 - Enable BLK_DEV_THROTTLING

cc/ @roberthbailey @fabioy for GKE cluster update

Automatic merge from submit-queue (batch tested with PRs 40971, 41027, 40709, 40903, 39369)

test: bump deployment condition timeout

@fejta @spxtr ptal

Fixes https://github.com/kubernetes/kubernetes/issues/39785

Automatic merge from submit-queue

federation: Refactoring namespaced resources deletion code from kube ns controller and sharing it with fed ns controller

Ref https://github.com/kubernetes/kubernetes/issues/33612

Refactoring code in kube namespace controller to delete all resources in a namespace when the namespace is deleted. Refactored this code into a separate NamespacedResourcesDeleter class and calling it from federation namespace controller.
This is required for enabling cascading deletion of namespaced resources in federation apiserver.
Before this PR, we were directly deleting the namespaced resources and assuming that they go away immediately. With cascading deletion, we will have to wait for the corresponding controllers to first delete the resources from underlying clusters and then delete the resource from federation control plane. NamespacedResourcesDeleter has this waiting logic.

cc @kubernetes/sig-federation-misc @caesarxuchao @derekwaynecarr @mwielgus

Automatic merge from submit-queue (batch tested with PRs 40385, 40786, 40999, 41026, 40996)

optimize duplicate openstack serverList judgement

if len(serverList) > 1, we will return err in pager.EachPage() function,so here we do not need to judge again

Automatic merge from submit-queue (batch tested with PRs 40385, 40786, 40999, 41026, 40996)

kubeadm: change os.Remove to os.RemoveAll

**What this PR does / why we need it**: This would not correctly clean out the tmp dir, since os.Remove doesn't recursively remove dirs, which could exist in the tmp dir.

Unit tests are a WIP from #34136

**Special notes for your reviewer**: /cc @luxas @pires 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 40385, 40786, 40999, 41026, 40996)

Fixed a tiny bug on using RoleBindingGenerator

Fixed a typo bug while using RoleBindingGenerator, this
bug causes error when binding role to service accounts
through "kubectl create rolebinding" command.

Automatic merge from submit-queue (batch tested with PRs 40385, 40786, 40999, 41026, 40996)

Refactor federated services tests a bit to move a test that requires no cluster creation to a separate block.

Follow up to PR #40769.

cc @kubernetes/sig-federation-pr-reviews

Automatic merge from submit-queue

Replace hand-written informers with generated ones

Replace existing uses of hand-written informers with generated ones.
Follow-up commits will switch the use of one-off informers to shared
informers.

This is a precursor to #40097. That PR will switch one-off informers to shared informers for the majority of the code base (but not quite all of it...).

NOTE: this does create a second set of shared informers in the kube-controller-manager. This will be resolved back down to a single factory once #40097 is reviewed and merged.

There are a couple of places where I expanded the # of caches we wait for in the calls to `WaitForCacheSync` - please pay attention to those. I also added in a commented-out wait in the attach/detach controller. If @kubernetes/sig-storage-pr-reviews is ok with enabling the waiting, I'll do it (I'll just need to tweak an integration test slightly).

@deads2k @sttts @smarterclayton @liggitt @soltysh @timothysc @lavalamp @wojtek-t @gmarek @sjenning @derekwaynecarr @kubernetes/sig-scalability-pr-reviews

Automatic merge from submit-queue

Make client-admin.key of local-up-cluster.sh readable by kubectl

Follow-up of https://github.com/kubernetes/kubernetes/pull/40922

Automatic merge from submit-queue

local-up-cluster: fix instructions for set-credentials

After launching the services, local-up-cluster.sh tells the
user how to configure kubectl to access it. The instructions
for 'set-credentials' enable plain password auth, but the
services are configured to mandate client certificate auth.
As a result it is not possible to access the cluster with
the instructions printed.

The use of client certs by default was added in

  commit a1b17db4
  Author: Dr. Stefan Schimanski <sttts@redhat.com>
  Date:   Sat Nov 12 23:09:04 2016 +0100

    Configure client certs in local-cluster-up.sh

and the instructions were correctly updated to refer to
client certificates.

The changed instructions were (mistakenly) reverted though
when the following commit was merged:

  commit 72e0e91b
  Author: xilabao <chenr.fnst@cn.fujitsu.com>
  Date:   Fri Dec 2 11:04:25 2016 +0800

    change prompt for enabling RBAC on local-up-cluster

Fixes: #40192
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

Automatic merge from submit-queue

add deads2k to registry package owners

I established the package layout and wrote a lot of the non-boilerplate code in this package.

Use specific v1beta1 Authorization client

Add client expansions

Automatic merge from submit-queue (batch tested with PRs 40930, 40951)

Fix CRI port forwarding

Websocket support was introduced #33684, which broke the CRI
implementation. This change fixes it.

Automatic merge from submit-queue (batch tested with PRs 40930, 40951)

update negotiation to reflect current kubectl state

Very few things actually require negotiation, but the client-cache attempts it all the time.  If you've explicitly requested one, you still fail.  If you haven't requested one and the server doesn't have one, you still get the client behavior.  After this, if you haven't requested one and the client and server don't have one, you simply get an empty you can interpret how you choose.

@lavalamp without this, you're unable to use `kubectl` against arbitrary servers.

Automatic merge from submit-queue (batch tested with PRs 40943, 40967)

Switch kubectl version and api-versions to create a discovery client …

…directly.

The clientset will throw an error for aggregated apiservers because the
clientset looks for specific versions of apis that are compiled into
the client.  These will be missing from aggregated apiservers.
The discoveryclient is fully dynamic and does not rely on compiled
in apiversions.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 40943, 40967)

switch admission serialized config to an apiserver type

Switches the kube admission config from componentconfig to the new `apiserver.k8s.io` group so that all API servers can use the shared configuration.  This switch external serialization, but it does not move the code that reads the config.  I'd like to do that as a follow-on.

@kubernetes/sig-api-machinery-misc @kubernetes/api-reviewers @smarterclayton 
@derekwaynecarr ptal
@sttts

Updating federation namespace controller to share namespaced resources deletion code with kube namespace controller

 Replace existing uses of hand-written informers with generated ones.
 Follow-up commits will switch the use of one-off informers to shared
 informers.

Automatic merge from submit-queue (batch tested with PRs 39681, 39321, 41018, 40883)

kubeadm: app/util/template.go has unit tests

**What this PR does / why we need it**: There was a TODO tag about adding unit tests, but unit tests have been added and the coverage for that file is ~90%.  Tag should be removed. 

Adding unit tests is a WIP from #34136

**Special notes for your reviewer**: /cc @luxas @pires 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 39681, 39321, 41018, 40883)

Revert "Avoid unnecessary copies in cacher"

Reverts kubernetes/kubernetes#40735

Ref #41013

[I don't think it's related, but just in case it is...]

Automatic merge from submit-queue (batch tested with PRs 39681, 39321, 41018, 40883)

remove never used var

Automatic merge from submit-queue (batch tested with PRs 39681, 39321, 41018, 40883)

Avoid closing over range variables

Similar to #31053.

@justinsb since you authored the original one, ptal

This would not correctly clean out the tmp dir, since os.Remove doesn't
recursively remove dirs, which could exist in the tmp dir.

Automatic merge from submit-queue

Discovery typo fix.

Simple typo fix.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

add liggitt to apimachinery/apiserver packages

Add @liggitt to apimachinery and apiserver packages.

Automatic merge from submit-queue (batch tested with PRs 40978, 40994, 41008, 40622)

Refactored kubemark code into provider-specific and provider-independent parts [Part-2]

Applying part of the changes of PR https://github.com/kubernetes/kubernetes/pull/39033 (which refactored kubemark code completely). The changes included in this PR are:

- Added test/kubemark/skeleton/util.sh which defines a well-commented interface that any cloud-provider should implement to run kubemark.
  This includes functions like creating the master machine instance along with its resources, remotely executing a given command on the master (like ssh), scp, deleting the master instance and its resources.
  All these functions have to be over-ridden by each cloud provider inside the file /test/kubemark/$CLOUD_PROVIDER/util.sh
- Implemented the above mentioned interface for gce in /test/kubemark/$CLOUD_PROVIDER/util.sh
- Made start- and stop- kubemark scripts (almost) provider independent by making them source the interface based on cloud provider.

@kubernetes/sig-scalability-misc @wojtek-t @gmarek