Automatic merge from submit-queue

Implement TLS bootstrap for kubelet using `--experimental-bootstrap-kubeconfig`  (2nd take)

Ref kubernetes/features#43 (comment)

cc @gtank @philips @mikedanese @aaronlevy @liggitt @deads2k @errordeveloper @justinsb 


Continue on the older PR https://github.com/kubernetes/kubernetes/pull/30094 as there are too many comments on that one and it's not loadable now.

Automatic merge from submit-queue

rkt: Support subPath volume mounts feature

So that at most one volume object will be created for every unique
host path. Also the volume's name is random generated UUID to avoid
collision since the mount point's name passed by kubelet is not
guaranteed to be unique when 'subpath' is specified.

Should partially fix https://github.com/kubernetes/kubernetes/issues/26986 
The non-existing host path creation issue is not touched here.

cc @kubernetes/sig-rktnetes 
also cc @kubernetes/sig-node for the Mount name comments I added.

Automatic merge from submit-queue

pkg/kubelet/rkt: skip empty lines in getOSReleaseInfo

Follow-up of #31022

Automatic merge from submit-queue

GlusterFS dynamic provisioner and deleter interface based on storageclass claims

This PR depends on PR#29006

Automatic merge from submit-queue

Return container command exit codes in kubectl run/exec

Fixes https://github.com/kubernetes/kubernetes/issues/26424
Based on https://github.com/kubernetes/kubernetes/pull/25273.

TODO:
- [x] add e2e tests
- [x] investigate `kubectl run` exit code for `--restart=Never` (compare issue #24533 and PR #25253)
- [x] document exit codes

Automatic merge from submit-queue

kubelet status manager: Fix nil in error message due to var shadowing

Variable shadowing can cause this log message to print a nil:

```go
glog.Warningf("Failed to update status for pod %q: %v", format.Pod(pod), err)
```

@kubernetes/rh-cluster-infra

Automatic merge from submit-queue

Load Balancer Health Check responder library for ESIPP

This is an independent component that is needed for the Load Balancer health traffic steering functionality (part of the 1.4 ESIPP work)

Automatic merge from submit-queue

Followup fixes for disruption controller.

Part of #12611.
- Record an event when a pod does not have exactly 1 controller.
- Add TODO comment suggesting we simplify the two cases: integer and percentage.

Automatic merge from submit-queue

ResourceNames() should prohibit unnamed arguments

Automatic merge from submit-queue

Add support for the standard objectmeta field selectors

certificates API was missing standard field selectors (noticed in https://github.com/kubernetes/kubernetes/pull/30922/files/4120179db5ce6c3fadc872a268347f5be038f98f#r75413160)

also silences client-side warnings when using field selectors that don't have a registered client-side transformation (no functional change, since we were already returning the original field/value). if we want to trend toward embedding less conversion logic in our clients, I don't see us fully duplicating field selector conversions client-side to make that warning disappear.

Automatic merge from submit-queue

Return the current kubeconfig as the starting config in ClientConfigGetter.

This fixes issue #30790.

cc @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Cluster autoscaler friendly scheduling algorithm

cc: @davidopp

Automatic merge from submit-queue

Adding a script to fetch swagger spec from federation apiserver

First step for https://github.com/kubernetes/kubernetes/issues/30541.
Next step is to generate docs like http://kubernetes.io/docs/api-reference/v1/definitions/ from this swagger spec.

cc @kubernetes/sig-cluster-federation @kubernetes/sig-api-machinery

Automatic merge from submit-queue

godeps: update go-restful

To pickup https://github.com/emicklei/go-restful/pull/311

@kubernetes/sig-api-machinery

Automatic merge from submit-queue

Fix kubectl describe to display a container's resource limit env vars as node allocatable when the limits are not set

Automatic merge from submit-queue

only compute delta on non-creating updates

If you're issuing an update that can cause a create, the quota admission charge should be based on the create cost, otherwise you always end up with zero.

@derekwaynecarr ptal, blocker bug.

Automatic merge from submit-queue

docs/devel: document the behavior of github UI for PRs

Documents the problem encountered in #30596

cc @bgrant0607 @thockin @roberthbailey

Automatic merge from submit-queue

Add spec.nodeName and spec.serviceAccountName to downward env var

The serviceAccountName is occasionally useful for clients running on
Kube that need to know who they are when talking to other components.

The nodeName is useful for PetSet or DaemonSet pods that need to make
calls back to the API to fetch info about their node.

Both fields are immutable, and cannot easily be retrieved in another
way.

@bprashanth @pmorie as relevant consumers / reviewers.



```release-note
The `valueFrom.fieldRef.name` field on environment variables in pods and objects with pod templates now allows two additional fields to be used:

* `spec.nodeName` will return the name of the node this pod is running on
* `spec.serviceAccountName` will return the name of the service account this pod is running under
```

Automatic merge from submit-queue

Node Conformance Test: Move namespace controller to services

For #30122, #30174.
Based on #30116, #30198.

**Please only review the 3rd PR.**

This PR is part of our roadmap to package node conformance test.
The 1st commit is from #30116, which started e2e services in a separate process.
The 2nd commit is from #30198, it statically linked etcd into the node e2e framework.

The 3rd commit is new, it moved namespace controller into e2e services.

@dchen1107 @vishh 
/cc @kubernetes/sig-node @kubernetes/sig-testing

Automatic merge from submit-queue

ImagePolicyWebhook Admission Controller

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**: This is an implementation of the [image provenance proposal](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/image-provenance.md). It also includes the API definitions by @Q-Lee from https://github.com/kubernetes/kubernetes/pull/30241

**Special notes for your reviewer**:
Please note that this is the first admission controller to make use of the admission controller config file (`--admission-controller-config-file`). I have defined a format for it but we may want to double check it's adequate for future use cases as well.

The format defined is:

```
{
  "imagePolicy": {
     "kubeConfigFile": "path/to/kubeconfig/for/backend",
     "allowTTL": 50,          # time in s to cache approval
     "denyTTL": 50,           # time in s to cache denial
     "retryBackoff": 500,      # time in ms to wait between retries
     "defaultAllow": true      # determines behavior if the webhook backend fails
  }
}
```

(or yaml)

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
Adding ImagePolicyWebhook admission controller.
```

Automatic merge from submit-queue

Fixes #31056

This PR fixes the issue described in https://github.com/kubernetes/kubernetes/issues/31056 - In https://github.com/kubernetes/kubernetes/blob/master/cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest#L82 there is a missing `+` after `" "`

result:
```
==> master: Summary
==> master: -------------
==> master: Succeeded: 52 (changed=43)
==> master: Failed:     0
==> master: -------------
==> master: Total states run:     52
```

The serviceAccountName is occasionally useful for clients running on
Kube that need to know who they are when talking to other components.

The nodeName is useful for PetSet or DaemonSet pods that need to make
calls back to the API to fetch info about their node.

Both fields are immutable, and cannot easily be retrieved in another
way.

Automatic merge from submit-queue

Validate involvedObject.Namespace matches event.Namespace

Fixes https://github.com/kubernetes/kubernetes/issues/16036

Automatic merge from submit-queue

Make labels, fields expose selectable requirements

What?
This is to change the labels/fields Selector interface and make them expose selectable requirements. We reuse labels.Requirement struct for label selector and add fields.Requirement for field selector.

Why?
In order to index labels/fields, we need them to tell us three things: index key (a field or a label), operator (greater, less, or equal), and value (string, int, etc.). By getting selectable requirements, we are able to pass them down and use them for indexing in storage layer.

Automatic merge from submit-queue

Basic scaler/reaper for petset

Currently scaling or upgrading a petset is more complicated than it should be. Would be nice if this made code freeze on friday. I'm planning on a follow up change with generation number and e2es post freeze.

Automatic merge from submit-queue

allow group impersonation

Adds an "Impersonate-Group" header that can be used to specify exactly which groups to use on an impersonation request.  

This also restructures the code to make it easier to add the scopes header next.  This closely parallels the "Impersonate-User" header, so I figured I'd start easy.

@kubernetes/sig-auth 
@ericchiang are you comfortable reviewing?

Automatic merge from submit-queue

Add possibility to run non-default etcd image in tests

Ref #20504

@lavalamp @hongchaodeng @timothysc - FYI

Automatic merge from submit-queue

Federation informer use kube clientset for target

This is to use kubernetes clientset as the federation informer target clientset as it's used to talking the k8s cluster.

#29939 #30669 #30207
@mwielgus @quinton-hoole @kshafiee @deepak-vij

Automatic merge from submit-queue

Disk eviction node e2e test

Please review d202816cfb4ae4dc38d0fe4f45cd11cc81e0e178 only.

#29800

Automatic merge from submit-queue

Update cAdvisor to 2ed7198

**What this PR does / why we need it**:

Update cAdvisor to 2ed7198 so that we get Prometheus metrics on CPU throttling when pod resource limits are configured. We're flying blind right now.

**Changes**:

* Add container_cpu_cfs_* metrics (CPU throttling due to limits)
* Add container_memory_swap metric
* Ensure minimum kernel version for thin_ls

Diff: https://github.com/google/cadvisor/compare/c6c06d4...2ed7198