Automatic merge from submit-queue (batch tested with PRs 45571, 45657, 45638, 45663, 45622)

Use real proxier inside hollow-proxy but with mocked syscalls

Fixes https://github.com/kubernetes/kubernetes/issues/43701

This should make hollow-proxy better mimic the real kube-proxy in performance.
Maybe next we should have a more realistic implementation even for fake iptables (adding/updating/deleting rules/chains in an table, just not on the real one)? Though I'm not sure how important it is.

cc @kubernetes/sig-scalability-misc @kubernetes/sig-network-misc @wojtek-t @gmarek

Automatic merge from submit-queue (batch tested with PRs 45571, 45657, 45638, 45663, 45622)

rkt: Improve the Garbage Collection

**What this PR does / why we need it**:

This PR improve the garbage collection of files written inside the `/var/lib/kubelet/pods/<pod: id>`

It removes the` finished-<pod: id>` file touched during the `ExecStopPost` of the systemd unit.
It also removes the `/dev/termination-log` file mounted into containers .

The termination-log is used to produce a message from the container and collected by the kubelet when the Pod stops.
Especially for the termination-log, removing theses files will free the associated space used on the filesystem.


**Release note**:

`NONE`

Automatic merge from submit-queue (batch tested with PRs 45571, 45657, 45638, 45663, 45622)

Added indexer description for the API of NewIndexerInformer.

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 45571, 45657, 45638, 45663, 45622)

Print API latency metrics as perfdata

Automatic merge from submit-queue

Fix AssertCalls usage for kubelet fake runtimes unit tests

Despite its name, AssertCalls() does not assert anything. It returns an error that should be checked. This was causing false negatives for a handful of unit tests, which are also fixed here.

Tests for the image manager needed to be rearranged in order to accommodate a potentially different sequence of calls each tick because the image puller changes behavior based on prior errors.

**What this PR does / why we need it**: Fixes broken unit tests

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 

**Special notes for your reviewer**: 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

[federation][e2e] Distinguish local vars and global vars

None

Automatic merge from submit-queue

There is a rule in using go channel: never close a channel in the

receiver side.

fix https://github.com/kubernetes/kubernetes/issues/45215

Automatic merge from submit-queue

detach the volume when pod is terminated

When pods are terminated we should detach the volume. 

Fixes https://github.com/kubernetes/kubernetes/issues/45191

**Release note**:
```
Detach the volume when pods are terminated.  
```

Automatic merge from submit-queue

Add properties file for cos-docker-validation test job

**What this PR does / why we need it**: 
This is forked from test/e2e_node/jenkins/docker_validation/jenkins-validation.properties. It is used for COS docker validation test.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```NONE
```

Automatic merge from submit-queue

fix specialized verbs in create role

Improvement on Kubectl CheatSheet base64 examples

and lets make sure that controller respects it
and doesn't detaches mounted volumes.

Make sure volume is detached when pod is terminated because
of any reason and not deleted from api server.

Automatic merge from submit-queue

orphan when kubectl delete --cascade=false

The default for new objects is to propagate deletes (use GC) when no deleteoptions are passed.  In addition, the vast majority of kube objects use this default.  Only a few controllers resources (sts, rc, deploy, jobs, rs) orphan by default.  This means that when you do `kubectl delete sa/foo --cascade=false` you do *not* orphan.  That doesn't fulfill the intent of the command.  This explicitly orphans when `--cascade=false` so we don't use GC.

@fabianofranz 
@jwforres I liked this easter egg :)

@kubernetes/sig-cli-bugs we should backport this to 1.6

Automatic merge from submit-queue

plumb stopch to post start hook index since many of them are starting go funcs

Many post-start hooks require a stop channel to properly terminate their go funcs.

@p0lyn0mial I think you need this for https://github.com/kubernetes/kubernetes/pull/45355 ptal.
@ncdc per request
@sttts can you review too since Andy is out?

Automatic merge from submit-queue

Bump l7-lb-controller resource usage threshold in tests

Fix #45512

Automatic merge from submit-queue

HTML escape apiserver errors to avoid triggering vulnerability scanners.

Simple XSS scans might fetch /<script>alert('vulnerable')</script>, and
fail when the response body includes the script tag verbatim, despite
the headers directing the browser to interpret the response as text.

This isn't a real vulnerability, but it's easier to fix this here than
it is to fix the scanners.


**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

Improved code coverage for pkg/kubelet/types/labels

The test coverage improved from 0% to 100%.
This fixed part of #40780



**What this PR does / why we need it**:
Increase test coverage.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
release-note-none

**Release note**:

```NONE
```

Automatic merge from submit-queue

Remove mentioning insecure server (which is not supported anymore) from API server docs

**What this PR does / why we need it**:
Remove mentioning insecure serving from the docs, since only secure serving is supported now.

Automatic merge from submit-queue (batch tested with PRs 44626, 45641)

update token ttl description

Automatic merge from submit-queue (batch tested with PRs 44626, 45641)

Update Google Cloud DNS provider Rrset.Get(name) method to return a list and change the `Rrset.List()` implementation to perform a paged walk

Some federated service e2e tests and a few ingress tests would become flaky after a few hundred runs. @csbell spent quite a lot of time debugging this and found out that this flakiness was due to a bug in the federated service controller deletion logic. Deletion of a federated service object triggers a logic in the controller to update the DNS records corresponding to that object. This DNS record update logic would return an error in failed runs which would in-turn cause the controller to reschedule the operation. This led to an infinite retry-failure cycle that never gave the API server a chance to garbage collect the deleted service object.

A couple of days ago we started seeing a correlation between the number of resource records in a DNS managed zone and these test failures. If you look at the test runs before and after run 2900 in the test grid - https://k8s-testgrid.appspot.com/cluster-federation#gce, you will notice that the grid became super green at 2900. That's when I deleted all the dangling DNS records from the past runs.

After some investigation yesterday, we found that `ResourceRecordSet.Get()` interface and its implementation, and `ResourceRecordSet.List()` implementation at least for Google Cloud DNS were incorrect.

This PR makes minimal set of changes (read: least invasive) in Google Cloud DNS provider implementation to fix these problems:

1. Modifies DNS provider Rrset.Get(name) interface to return multiple records and updates federated service controller.

    There can be multiple DNS resource records for a given name. They can vary by type, ttl, rrdata and a number of various other parameters. It is incorrect to return a single resource record for a given name.

    This change updates the Get interface to return multiple records for a given name and uses this list in the federated service controller to perform DNS operations.

2. Update Google Cloud DNS List implementation to perform a paged walk of lists to aggregate all the DNS records.

    The current `List()` implementation just lists the DNS resorce records in a given managed zone once and retruns the list. It neither performs a paged walk nor does it consider the `page_token` in the returned response.

    This change walks all the pages and aggregates the records in the pages and returns the aggregated list. This is potentially dangerous as it can blow up memory if there are a huge number of records in the given managed zone. But this is the best we can do without changing the provider interface too much. 

    Next step is to define a new paged list interface and implement it.

**Release note**:
```release-note
NONE
```

/assign @csbell 

cc @justinsb @shashidharatd @quinton-hoole @kubernetes/sig-federation-pr-reviews

Automatic merge from submit-queue

apimachinery: NotRegisteredErr for known kinds not registered in target GV

Fixes the fall back to core v1 for *Options in the parameter encoder of the dynamic client.

The dynamic client uses NotRegisteredErr to fall back to core v1 if ListOptions is not known
in the given GV. This commit fixes the case that ListOptions is known in some group, but not
in the given one.

Automatic merge from submit-queue

small change to view more test info

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
small change to view more test info, think you very much

**Release note**:

```release-note
```

The dynamic client uses NotRegisteredErr to fall back to core v1 if ListOptions is not known
in the given GV. This commit fixes the case that ListOptions is known in some group, but not
in the given one.

When we fetch the dns records by name, we get a list of records that match
the given name. As an optimization we look up to see if the new record we
want to create is already in the returned list to avoid performing any updates.

However, when the new record we want to create isn't in the returned list, it
is hard to say if the returned list contains the list of records that we want
to retain. For example, we might get a list of A records and we want to create
a CNAME record. Creating a new CNAME record without removing the A records is
a DNS misconfiguration. So to play safe we just remove all the existing records
in the list and create the new desired record.

**Note**: This is the opposite of what I said here - https://reviewable.kubernetes.io/reviews/kubernetes/kubernetes/44626#-Ki9xQOzybryHvsxNrra.

Automatic merge from submit-queue (batch tested with PRs 45634, 45480)

Rename vars scheduledJob to cronJob in describe.go

**What this PR does / why we need it**:
Rename vars scheduledJob to cronJob in describe.go

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
There might still be some leftovers in other places.
@soltysh 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 45634, 45480)

Fix BY() format

**What this PR does / why we need it**:
i read other by(), just format, think you

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 45515, 45579)

Refactor functions in editoptions.go to use less arguments

Fixes https://github.com/kubernetes/kubernetes/issues/45521
/assign @mengqiy 
will rebase pr https://github.com/kubernetes/kubernetes/pull/42256 after this get merged

Automatic merge from submit-queue (batch tested with PRs 45515, 45579)

Ignore openrc cgroup

**What this PR does / why we need it**:
It is a work-around for the following: https://github.com/opencontainers/runc/issues/1440

**Special notes for your reviewer**:
I am open to a cleaner way to do this, but we have many developer users on Macs that ran containerized kubelets that are not able to run them right now due to the inclusion of openrc tripping up our existence checks.  Ideally, runc can give us a call to say "does this exist according to what runc knows about".  Or we could add a whitelist check.  Right now, this was the smallest hack pending more discussion.

Automatic merge from submit-queue (batch tested with PRs 45556, 45561, 45256)

[Federation] Replace the indexing lister with a regular store in the replicaset controller

This is part of the refactoring work to allow the replicaset controller to use the generic sync controller.

None of the other controllers use a lister, including the deployment controller

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 45556, 45561, 45256)

add defaulting for customresources

This adds the promised defaulting for customresources.  Namespaced by default, listkind=kind+List, singular=toLower(kind).

Automatic merge from submit-queue

add validation for customresourcedefintions

Add basic validation for customresource definitions.

@adohe if you had review bandwidth, this is a relatively small one.

Automatic merge from submit-queue (batch tested with PRs 45569, 45602, 45604, 45478, 45550)

Don't append :443 to registry domain in the kubernetes-worker layer registry action

**What this PR does / why we need it**: Fixes #45547

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #45547

**Special notes for your reviewer**:

**Release note**:

```
Fix #45547 - don't append :443 to juju created docker registry config
```