Automatic merge from submit-queue (batch tested with PRs 46750, 47141)

Speed up volume integration test

Partly solves https://github.com/kubernetes/kubernetes/issues/47129 . 

On my local box:

before -  7m56.751s  
after - 5m53.132s  

So approx. 2m time saving. More saving will require refactoring of attach detach controller.

cc @mikedanese

Automatic merge from submit-queue

Remove e2e-rbac-bindings.

Replace todo-grabbag binding w/ more specific heapster roles/bindings.
Move kubelet binding.

**What this PR does / why we need it**:
The "e2e-rbac-bindings" held 2 leftovers from the 1.6 RBAC rollout process:
 - One is the "kubelet-binding" which grants the "system:node" role to kubelet. This is needed until we enable the node authorizer. I moved this to the folder w/ some other kubelet related bindings.
 - The other is the "todo-remove-grabbag-cluster-admin" binding, which grants the cluster-admin role to the default service account in the kube-system namespace. This appears to only be required for heapster. Heapster will instead use a "heapster" service account, bound to a "system:heapster" role on the cluster (no write perms), and a "system:pod-nanny" role in the kube-system namespace.

**Which issue this PR fixes**: Addresses part of #39990

**Release Note**: 
```release-note
New and upgraded 1.7 GCE/GKE clusters no longer have an RBAC ClusterRoleBinding that grants the `cluster-admin` ClusterRole to the `default` service account in the `kube-system` namespace.
If this permission is still desired, run the following command to explicitly grant it, either before or after upgrading to 1.7:
    kubectl create clusterrolebinding kube-system-default --serviceaccount=kube-system:default --clusterrole=cluster-admin
```

Automatic merge from submit-queue (batch tested with PRs 47144, 46699)

Update statefulset reaper use StatefulSetHasDesiredReplicas

**What this PR does / why we need it**:
StatefulSetHasDesiredReplicas condition should check ObservedGeneration and update statefulset reaper use StatefulSetHasDesiredReplicas
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #43325

**Special notes for your reviewer**:

**Release note**:
```
None
```

Automatic merge from submit-queue

Fix local capacity isolation test

Automatic merge from submit-queue (batch tested with PRs 36376, 47251)

client-go: GetOptions for dynamic client

Looks like `GetOptions` were forgotten in the dynamic client. Without them it's hard to write a dynamic initializer controller (useful for custom resources).

Automatic merge from submit-queue

test: set failure traps for all deployment e2e tests

@kubernetes/sig-apps-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 47113, 46665, 47189)

kube-apiserver: cleanup node proxy setup code

Follow-up of https://github.com/kubernetes/kubernetes/pull/46680, fixing #46679

- move `proxyTransport` from `New` func to config
- use self-explaining variable names
- remove redundant temporary var
- make `CreateNodeDialer` side-effect-free
- make imports follow conventions
- lower-case error messages

Automatic merge from submit-queue (batch tested with PRs 47113, 46665, 47189)

Improve the e2e node restart test

This commit includes the following two changes:
 * Move pre-test checks (pods/nodes ready) to BeforeEach() so that it's
   clear whether the test has run or not.
 * Dumping logs for unready pods.

Automatic merge from submit-queue

Kubelet: rename cri package name to pkg/kubelet/apis/cri/v1alpha1/runtime

**What this PR does / why we need it**:

We have moved CRI from api/v1alpha1/runtime to apis/cri/v1alpha1, which changed the package name of CRI. This would cause a significant problem: old-versioned runtime (based on CRI in v1.6) doesn't work with latest kubelet v1.7, and vice versa.

This PR renames cri package name to `pkg/kubelet/apis/cri/v1alpha1/runtime` for fixing the problem.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 

fixes #47012

**Special notes for your reviewer**:

Should be included in v1.7.

**Release note**:

```release-note
CRI has been moved to package `pkg/kubelet/apis/cri/v1alpha1/runtime`.
```

Automatic merge from submit-queue

Move the nvidia installer to the beginning.

When the installer runs for the first time, it disables loadpin and restarts
the node. So, it is better to run it in the beginning so that we can avoid
redoing the later steps. One of the later steps include downloading a tar file
and untarring it. Doing that only once saves around 1m30s in test runtime for
the gci image.

/sig node
/area node-e2e

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46835, 46856)

Made tests that create Horizontal Pod Autoscaler delete it after they are done.

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #46847

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46835, 46856)

Made WaitForReplicas and EnsureDesiredReplicas use PollImmediate and improved logging.

**What this PR does / why we need it**: Most importantly, this results in better logging: timeout is logged at the level of the caller, not the helper function, helping debugging.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 45575, 47218)

nodeidentifier: require nodes to have wellformed usernames

xref #46999

Split @mikedanese's identifier change out from the GCE/GKE enablement in https://github.com/kubernetes/kubernetes/pull/46796, so the authorization/admission behavior works as intended for kubeadm, which already has it enabled

Automatic merge from submit-queue

Make gcp auth provider not to override the Auth header if it's already exits

**What this PR does / why we need it**:
Make AuthProvider not wrap the transport if beartoken or basic auth is enabled
**Which issue this PR fixes** :
 fixes #44476 

**Special notes for your reviewer**:

**Release note**:
```
GCP auth plugin no longer overwrites existing Authorization headers.
```

Automatic merge from submit-queue

Allow pods to opt out of PodPreset mutation via an annotation on the pod

An annotation in the pod spec of the form:
podpreset.admission.kubernetes.io/PodPresetOptOut: "true"
Will cause the admission controller to skip manipulating the pod spec,
no matter the labelling.

This is an alternative implementation to pull #44163.

```release-note
Allow pods to opt out of PodPreset mutation via an annotation on the pod.
```

StatefulSetHasDesiredReplicas condition should check ObservedGeneration and update statefulset reaper use StatefulSetHasDesiredReplicas

Remove static content from docs/

Automatic merge from submit-queue

Add quinton-hoole to test/federation_e2e/OWNERS

Automatic merge from submit-queue

Run namespace deletion in background

Namespace deletion was not specifying a propagation policy when deleting a single item.

This could mean the request would be held while garbage collection orphaned dependents.

This switches to propagation policy and sets a policy for both deletecollection and delete calls.

helps https://github.com/kubernetes/kubernetes/issues/47135

Automatic merge from submit-queue (batch tested with PRs 46885, 47197)

Fix e2e ns deletion message for flake analysis

**What this PR does / why we need it**:
Let's us know when pods have a missing deletion timestamp.

**Special notes for your reviewer**:
helps https://github.com/kubernetes/kubernetes/issues/47135

Automatic merge from submit-queue (batch tested with PRs 46885, 47197)

Let COS docker validation node test against gci-next-canary

**What this PR does / why we need it**:
This is for COS docker validation node test. We plan to use family gci-next-canary in container-vm-image-staging for future Docker upgration and validation.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47134

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

DO TODO: remove this alias after 2017-05-22

Automatic merge from submit-queue (batch tested with PRs 47065, 47157, 47143)

Use actual hostname when creating network e2e test pod

**What this PR does / why we need it**:
This changes a e2e framework network test Pod use the actual hostname value to match the `kubernetes.io/hostname` label in it's `NodeSelector`. Currently it assumes the Node name will match that hostname label which is not true in all environments.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 
Fixes coreos/tectonic-installer#1018

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 47065, 47157, 47143)

Removed a race condition from ResourceConsumer

**What this PR does / why we need it**: Without this PR there is a race condition in ResourceConsumer that sometimes results in communication to pods that might not exist anymore.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47127

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

test header removal for impersonation

Fixes https://github.com/kubernetes/kubernetes/issues/37722

Adds a test that fails if the headers aren't removed.

@lavalamp per request

Automatic merge from submit-queue

Audit webhook config for GCE

Add a `ADVANCED_AUDIT_BACKEND` (comma delimited list) environment variable to the GCE cluster config to select the audit backend, and add configuration for the webhook backend.

~~Based on the first commit from https://github.com/kubernetes/kubernetes/pull/46557~~

For kubernetes/features#22

Since this is GCE-only configuration plumbing, I think this should be exempt from code-freeze.

Revert "add gzip compression to GET and LIST requests"

Automatic merge from submit-queue (batch tested with PRs 46559, 46970)

Add e2e test that ensures that CRDs work in kube-apiserver

part of https://github.com/kubernetes/kubernetes/issues/45511

Automatic merge from submit-queue

Add Traditional Chinese translation for kubectl

**What this PR does / why we need it**:
This PR provides first attempt to translate kubectl in Traditional Chinese (related to https://github.com/kubernetes/kubernetes/pull/40645, https://github.com/kubernetes/kubernetes/pull/45573, 
https://github.com/kubernetes/kubernetes/pull/45562, https://github.com/kubernetes/kubernetes/pull/40591).

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
No issues

**Special notes for your reviewer**:
This PR requires Chinese people to assist in the review, especially Chinese speaking Taiwanese or Cantonese, thanks!

This reverts commit fc650a54.

When the installer runs for the first time, it disables loadpin and restarts
the node. So, it is better to run it in the beginning so that we can avoid
redoing the later steps. One of the later steps include downloading a tar file
and untarring it. Doing that only once saves around 1m30s in test runtime for
the gci image.