Automatic merge from submit-queue (batch tested with PRs 50899, 62649). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Ensure webhook service routing resolves kubernetes.default.svc correctly

Going through the normal endpoint resolve path isn't correct in multi-master scenarios

The auth wrapper is pulling from LoopbackClientConfig, the service resolver should do the same

```release-note
Fixes the kubernetes.default.svc loopback service resolution to use a loopback configuration.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add test file for pkg/kubectl/cmd/rollout/rollout_pause.go file

new:   pkg/kubectl/cmd/rollout/rollout_pause_test.go
        modified: pkg/kubectl/cmd/rollout/BUILD


**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 62876, 62733, 62827). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix csi data race in csi_attacher_test.go

**What this PR does / why we need it**:
fix csi data race in csi_attacher_test.go#TestAttacherWaitForVolumeAttachment

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62630

**Special notes for your reviewer**:
run `stress -p 500 ./csi.test -v 5 -alsologtostderr` , There is another failure
I think we should fix it in another PR.
```
--- FAIL: TestAttacherMountDevice (0.07s)
        csi_attacher_test.go:495: Running test case: normal
        csi_attacher_test.go:534: test should not fail, but error occurred: mkdir path2: file exists
```

**Release note**:

```release-note
NONE
```

/sig storage

Automatic merge from submit-queue (batch tested with PRs 62876, 62733, 62827). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Set a default request timeout for discovery client

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1546117

Adds a default request timeout to requests made by the discovery client.
This prevents a command from hanging indefinitely due to one or multiple calls
to the apiserver taking longer than usual when when a --request-timeout flag value
has not been set.

/assign @deads2k @juanvallejo 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62876, 62733, 62827). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove discovery injection from factory

We added this shim when cached discovery was a contentious thing to give ourselves flexibility.  It is no longer contentious and this removes a layer of complexity we no longer need.

@kubernetes/sig-cli-maintainers 
@soltysh @juanvallejo 

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

aggregate objs before printing in apply cmd

**Release note**:
```release-note
NONE
```

Aggregates all objects into a list before printing 

Fixes https://github.com/kubernetes/kubernetes/issues/58834

cc @soltysh

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

deep copy fake client actions to avoid accidental mutation

I just got bit by this downstream.  Without a deep copy it is possible accidentally mutate the thing you created, thus invalidating your testing.  It's particularly nasty inside of a controller doing a loop on objects, making refs to them, and creating.  This works running in an actual process since we serialize and write, but fails unit tests since there is no serialization step.

@kubernetes/sig-api-machinery-bugs 

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

generated code should pass go vet for go1.10

**What this PR does / why we need it**:

Update code generator and the code it generates to pass `go vet`.

go1.10 runs `go vet` whenever `go test` is run. Because of this, generated code for CRDs needs to pass `go vet`.

**Release note**:

```release-note
Code generated for CRDs now passes `go vet`.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add statefulset scaling permission to admins, editors, and viewers

StatefulSets are missing scale permissions, so users can't scale them.


```release-note
fix permissions to allow statefulset scaling for admins, editors, and viewers
```

Automatic merge from submit-queue (batch tested with PRs 62857, 62707). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add support of standard LB to Azure vmss

**What this PR does / why we need it**:

Add support of standard LB to Azure vmss.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #60485

**Special notes for your reviewer**:

**Release note**:

```release-note
Add support of standard LB to Azure vmss
```

/sig azure

Automatic merge from submit-queue (batch tested with PRs 62857, 62707). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Export RBAC validation functions

This change exports the RBAC validation functions to allow types outside of the RBAC API group to embed a RBAC type and reuse this validation logic.  Note that only `ValidateRBACName`,
`ValidatePolicyRule` and `ValidateRoleBindingSubject` were exported.  The rest of the functions were already exported.
Signed-off-by: Monis Khan <mkhan@redhat.com>

**Release note**:

```release-note
NONE
```

@kubernetes/sig-auth-pr-reviews 
/assign @deads2k

Automatic merge from submit-queue (batch tested with PRs 62885, 62832). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

e2e test forwarding externalname dns lookup to upstream nameservers.

**What this PR does / why we need it**:
e2e test forwarding externalname dns lookup to upstream nameservers.

e2e test that goes through dnsmasq -> kubedns -> upstream servers path.

Updated e2e test for PTR record lookup, test for default upstreamservers from resolv.conf.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/dns/issues/226

**Special notes for your reviewer**:
/assign @MrHohn 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62885, 62832). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

GCE: Fix ILB issue updating backend services

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62878
`ensureInternalBackendServiceGroups` would sync the instance groups with the latest nodes, and update the backend service's list of backends if necessary. However, the list of backends on the backend service was not set before calling the GCP API.

`updateInternalLoadBalancerNodes` does very little above `ensureInternalBackendServiceGroups`, so I'm just combining the unit tests into one.

**Special notes for your reviewer**:
/assign MrHohn
cc @agau4779 

**Release note**:
```release-note
GCE: Fix for internal load balancer management resulting in backend services with outdated instance group links.
```

Automatic merge from submit-queue (batch tested with PRs 61962, 58972, 62509, 62606). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Allow a test suite reusing framework to register namespaces to delete

If the suite bypasses CreateNamespace (because it wants to create more
specialized namespaces) it has no way to register deletes.

@liggitt this was something that came up in an older rebase and was missed (for things creating projects)

Automatic merge from submit-queue (batch tested with PRs 61962, 58972, 62509, 62606). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubelet: move QOSReserved from experimental to alpha feature gate

Fixes https://github.com/kubernetes/kubernetes/issues/61665

**Release note**:
```release-note
The --experimental-qos-reserve kubelet flags is replaced by the alpha level --qos-reserved flag or QOSReserved field in the kubeletconfig and requires the QOSReserved feature gate to be enabled.
```

/sig node
/assign  @derekwaynecarr 
/cc @mtaufen

Automatic merge from submit-queue (batch tested with PRs 61962, 58972, 62509, 62606). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix job's backoff limit for restart policy OnFailure

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #54870

**Release note**:
```release-note
NONE
```

/assign janetkuo

Automatic merge from submit-queue (batch tested with PRs 61962, 58972, 62509, 62606). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Avoid data races in unit tests

Setting global flags in unit tests leads to data races like this:

```
==================
WARNING: DATA RACE
Write at 0x0000028f5241 by goroutine 47:
  flag.(*boolValue).Set()
      /home/jliggitt/.gvm/gos/go1.9.5/src/flag/flag.go:91 +0x7b
  flag.(*FlagSet).Set()
      /home/jliggitt/.gvm/gos/go1.9.5/src/flag/flag.go:366 +0x10c
  flag.Set()
      /home/jliggitt/.gvm/gos/go1.9.5/src/flag/flag.go:379 +0x76
  k8s.io/kubernetes/pkg/kubelet/cm/devicemanager.TestPodContainerDeviceAllocation()
      /home/jliggitt/go/src/k8s.io/kubernetes/pkg/kubelet/cm/devicemanager/manager_test.go:549 +0x126
  testing.tRunner()
      /home/jliggitt/.gvm/gos/go1.9.5/src/testing/testing.go:746 +0x16c

Previous read at 0x0000028f5241 by goroutine 34:
  k8s.io/kubernetes/vendor/github.com/golang/glog.(*loggingT).output()
      /home/jliggitt/go/src/k8s.io/kubernetes/vendor/github.com/golang/glog/glog.go:682 +0x730
  k8s.io/kubernetes/vendor/github.com/golang/glog.(*loggingT).printf()
      /home/jliggitt/go/src/k8s.io/kubernetes/vendor/github.com/golang/glog/glog.go:655 +0x259
  k8s.io/kubernetes/vendor/github.com/golang/glog.Errorf()
      /home/jliggitt/go/src/k8s.io/kubernetes/vendor/github.com/golang/glog/glog.go:1118 +0x74
  k8s.io/kubernetes/pkg/kubelet/cm/devicemanager.(*endpointImpl).run()
      /home/jliggitt/go/src/k8s.io/kubernetes/pkg/kubelet/cm/devicemanager/endpoint.go:132 +0x1c7e
  k8s.io/kubernetes/pkg/kubelet/cm/devicemanager.(*ManagerImpl).addEndpoint.func1()
      /home/jliggitt/go/src/k8s.io/kubernetes/pkg/kubelet/cm/devicemanager/manager.go:378 +0x3f

Goroutine 47 (running) created at:
  testing.(*T).Run()
      /home/jliggitt/.gvm/gos/go1.9.5/src/testing/testing.go:789 +0x568
  testing.runTests.func1()
      /home/jliggitt/.gvm/gos/go1.9.5/src/testing/testing.go:1004 +0xa7
  testing.tRunner()
      /home/jliggitt/.gvm/gos/go1.9.5/src/testing/testing.go:746 +0x16c
  testing.runTests()
      /home/jliggitt/.gvm/gos/go1.9.5/src/testing/testing.go:1002 +0x521
  testing.(*M).Run()
      /home/jliggitt/.gvm/gos/go1.9.5/src/testing/testing.go:921 +0x206
  main.main()
      k8s.io/kubernetes/pkg/kubelet/cm/devicemanager/_test/_testmain.go:68 +0x1d3

Goroutine 34 (finished) created at:
  k8s.io/kubernetes/pkg/kubelet/cm/devicemanager.(*ManagerImpl).addEndpoint()
      /home/jliggitt/go/src/k8s.io/kubernetes/pkg/kubelet/cm/devicemanager/manager.go:377 +0x9d6
==================
--- FAIL: TestPodContainerDeviceAllocation (0.00s)
	testing.go:699: race detected during execution of test
FAIL
FAIL	k8s.io/kubernetes/pkg/kubelet/cm/devicemanager	0.124s

```

Automatic merge from submit-queue (batch tested with PRs 62642, 62855, 62487, 62858, 62873). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

build/rpms: fix kubeadm rpm

**What this PR does / why we need it**:

Change #61633 doesn't seem quite correct, and breaks bazel builds.
This patch makes sure that:
- there is no conflict between directory files and build targets
- rpm files are properly packaged after being installed

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

I'm not sure how the previous attempt passed CI, but the corollary is that the status for this one might be considered suspect as well.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62642, 62855, 62487, 62858, 62873). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 final record flag cleanup

This ties off the remainder of the record flag uses.  Trying to merge different types of patches is fraught, so I added a way to get a merge patch (not a strategic patch) back from the annotation update.

@kubernetes/sig-cli-maintainers 
/assign @soltysh 
/assign @juanvallejo 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62642, 62855, 62487, 62858, 62873). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

wire print flags through apply cmd

**Release note**:
```release-note
NONE
```

Depends on https://github.com/kubernetes/kubernetes/pull/62300
Adds PrintFlags to `apply` command.

cc @soltysh @deads2k

Automatic merge from submit-queue (batch tested with PRs 62642, 62855, 62487, 62858, 62873). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

simplify the client cache

We created the client cache back when we negotiated versions to create a config and a client.  Now we don't, so this is just debt.  This removes all the obvious places.  I'll open a separate WIP to try to kill the rest.

@kubernetes/sig-cli-maintainers 
@soltysh 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62642, 62855, 62487, 62858, 62873). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Make pod status to Running if some are Running and some are Completed

**What this PR does / why we need it**:
Make pod status to Running if some are Running and some are Completed

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62588

**Special notes for your reviewer**:
Only Set Pod status to Completed when no other reason, no Running container and only Completed containers.

Set status to Running if some are Running and some are Completed

**Release note**:

```release-note
Set pod status to "Running" if there is at least one container still reporting as "Running" status and others are "Completed".
```

Automatic merge from submit-queue (batch tested with PRs 59592, 62308, 62523, 62635, 62243). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Separate pod priority from preemption

**What this PR does / why we need it**:
Users request to split priority and preemption feature gate so they can use priority separately.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62068 

**Special notes for your reviewer**:

~~I kept use `ENABLE_POD_PRIORITY` as ENV name for gce cluster scripts for backward compatibility reason. Please let me know if other approach is preffered.~~

~~This is a potential **break change** as existing clusters will be affected, we may need to include this in 1.11 maybe?~~

TODO: update this doc https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/

[Update] Usage: in config file for scheduler:
```yaml
apiVersion: componentconfig/v1alpha1
kind: KubeSchedulerConfiguration
...
disablePreemption: true
```

**Release note**:

```release-note
Split PodPriority and PodPreemption feature gate
```

Automatic merge from submit-queue (batch tested with PRs 59592, 62308, 62523, 62635, 62243). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use shorter timeout when we expecting failure

**What this PR does / why we need it**:

Use shorter timeout when we wait pod to not be running or PVC to not be bound

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #55174

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 59592, 62308, 62523, 62635, 62243). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 update comments for local volume

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes # https://github.com/kubernetes/kubernetes/issues/62278

**Special notes for your reviewer**:
/assign @jsafrane @msau42 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 59592, 62308, 62523, 62635, 62243). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add support to resize Portworx volume
Signed-off-by: Harsh Desai <harsh@portworx.com>

**What this PR does / why we need it**:

This PR adds support in the Portworx volume plugin to expand an existing PVC.

**Which issue(s) this PR fixes**:

Closes #62305

**Release note**:

```release-note
Add support to resize Portworx volumes.
```

Automatic merge from submit-queue (batch tested with PRs 59592, 62308, 62523, 62635, 62243). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Roundtrip test helper for external types

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #54698

**Special notes for your reviewer**:
/assign @deads2k @sttts 
Since you've asked for it in the original issue. The FIXME I've pointed out to is worth addressing, but I'd prefer to do it afterwards. Do we want to implement appropriate test for all the api groups from `k8s.io/api` ?

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add ut for kuberuntime-gc

**What this PR does / why we need it**:
Add ut for kuberuntime-gc to cover more situations:
1) Add two uncovered cases to test sandbox-gc 
(1)  When there are more than one exited sandboxes,the older exited sandboxes without containers for existing pods should be garbage collected;
(2)  Even though there are more than one exited sandboxes,the older exited sandboxes with containers for existing pods should not be garbage collected. 
2) Add one uncovered case to test container-gc
(1)  To cover the situation when allSourcesReady is set false;

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
 "NONE"
```