Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove Ephemeral Storage Allocatable Evictions

Issue #52336

Rationale and docs change: https://github.com/kubernetes/community/pull/1275

cc @kubernetes/sig-node-pr-reviews 
cc @derekwaynecarr @vishh 
/assign @jingxu97 
/assign @dchen1107

Automatic merge from submit-queue (batch tested with PRs 55112, 56029, 55740, 56095, 55845). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Updating vsphere cloud provider to support k8s cluster spread across multiple vCenters

**What this PR does / why we need it**:

vSphere cloud provider in Kubernetes 1.8 was designed to work only if all the nodes of the cluster are in one single datacenter folder. This is a hard restriction that makes the cluster not span across different folders/datacenter/vCenters. Users have use-cases to span the cluster across datacenters/vCenters.

**Which issue(s) this PR fixes** 
Fixes # https://github.com/vmware/kubernetes/issues/255

**Special notes for your reviewer**:
This is a change purely in vsphere cloud provider and no changes in kubernetes core are needed.

**Release note**:
```release-note
With this change
 - User should be able to create k8s cluster which spans across multiple ESXi clusters, datacenters or even vCenters.
 - vSphere cloud provider (VCP) uses OS hostname and not vSphere Inventory VM Name.
   That means, now  VCP can handle cases where user changes VM inventory name.
- VCP can handle cases where VM migrates to other ESXi cluster or datacenter or vCenter.

The only requirement is the shared storage. VCP needs shared storage on all Node VMs.
```

Internally tested and reviewed the code.

@tthole, @shaominchen, @abrarshivani

Automatic merge from submit-queue (batch tested with PRs 55112, 56029, 55740, 56095, 55845). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

rbac bootstrap policy: add selfsubjectrulesreviews to basic-user

cc @kubernetes/sig-auth-pr-reviews 

Extracted from #53324, which wont be merged for 1.9.

```release-note
The RBAC bootstrapping policy now allows authenticated users to create selfsubjectrulesreviews.
```

/assign @deads2k

Automatic merge from submit-queue (batch tested with PRs 55112, 56029, 55740, 56095, 55845). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[Azure] Load Balancer general fixes

**What this PR does / why we need it**:
Fixes Azure Load Balancer functions, documented in #55627 
1. Resolve leaking Azure resource issue
2. Enable Azure LB creation for every availability set
3. Auto assign service to LB based on service annotation
4. General improvement in testing
5. Consolidate NSG rules

Change made by @rjtsdl, @rite2nikhil, and @itowlson  

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #55627 #54961

**Special notes for your reviewer**:
Ready to review

**Release note**:

```release-note
      NONE
```
/sig azure

Automatic merge from submit-queue (batch tested with PRs 55112, 56029, 55740, 56095, 55845). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Improve kubeadm upgrade apply  error logging style

**What this PR does / why we need it**:

Improve kubeadm upgrade apply  error logging style

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes # https://github.com/kubernetes/kubeadm/issues/549

**Special notes for your reviewer**:

/assign @luxas 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 55112, 56029, 55740, 56095, 55845). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Block volume: Command line printer update

**What this PR does / why we need it**:

Add cmdline printer support changes.

**Which issue this PR fixes**: 
Based on this proposal (kubernetes/community#805 & kubernetes/community#1265) and this feature issue: kubernetes/features#351

**Special notes for your reviewer**:

There are another PRs related to this functionality.

(#50457) API Change
(#53385) VolumeMode PV-PVC Binding change
(#51494) Container runtime interface change, volumemanager changes, operationexecutor changes
(#55112) Block volume: Command line printer update
Plugins
(#51493) Block volumes Support: FC plugin update
(#54752) Block volumes Support: iSCSI plugin update

**Release note**:

```
NONE
```

/sig storage
/cc @msau42  @jsafrane @saad-ali  @erinboyd @screeley44 
@kubernetes/sig-storage-pr-reviews


- Command results
```
~/sample/storage/fc_loop/file % k get pv,pvc,pod                
NAME              CAPACITY   ACCESS MODES   VOLUME MODE   RECLAIM POLICY   STATUS    CLAIM                       STORAGECLASS   REASON    AGE
pv/block-pv0001   1Gi        RWO            Block         Retain           Bound     default/nginx-block-pvc01   slow                     2m
pv/file-pv0001    1Gi        RWO            Filesystem    Retain           Bound     default/nginx-file-pvc01    slow                     24s

NAME                    STATUS    VOLUME         CAPACITY   ACCESS MODES   VOLUME MODE   STORAGECLASS   AGE
pvc/nginx-block-pvc01   Bound     block-pv0001   1Gi        RWO            Block         slow           2m
pvc/nginx-file-pvc01    Bound     file-pv0001    1Gi        RWO            Filesystem    slow           25s

NAME                 READY     STATUS              RESTARTS   AGE
po/nginx-file-pod1   0/1       ContainerCreating   0          4s
po/nginx-pod1        1/1       Running             0          2m
 ~/sample/storage/fc_loop/file % k get pv,pvc,pod
NAME              CAPACITY   ACCESS MODES   VOLUME MODE   RECLAIM POLICY   STATUS    CLAIM                       STORAGECLASS   REASON    AGE
pv/block-pv0001   1Gi        RWO            Block         Retain           Bound     default/nginx-block-pvc01   slow                     2m
pv/file-pv0001    1Gi        RWO            Filesystem    Retain           Bound     default/nginx-file-pvc01    slow                     40s

NAME                    STATUS    VOLUME         CAPACITY   ACCESS MODES   VOLUME MODE   STORAGECLASS   AGE
pvc/nginx-block-pvc01   Bound     block-pv0001   1Gi        RWO            Block         slow           2m
pvc/nginx-file-pvc01    Bound     file-pv0001    1Gi        RWO            Filesystem    slow           40s

NAME                 READY     STATUS    RESTARTS   AGE
po/nginx-file-pod1   1/1       Running   0          19s
po/nginx-pod1        1/1       Running   0          2m

 ~/sample/storage/fc_loop/file % k describe pv/block-pv0001      
Name:            block-pv0001
Labels:          <none>
Annotations:     pv.kubernetes.io/bound-by-controller=yes
                 volume.beta.kubernetes.io/storage-class=slow
StorageClass:    slow
Status:          Bound
Claim:           default/nginx-block-pvc01
Reclaim Policy:  Retain
Access Modes:    RWO
VolumeMode:      Block
Capacity:        1Gi
Message:         
Source:
    Type:        FC (a Fibre Channel disk)
    TargetWWNs:  28000001ff0414e2
    LUN:         0
    FSType:      
    ReadOnly:    true
Events:          <none>

 ~/sample/storage/fc_loop/file % k describe pv/file-pv0001 
Name:            file-pv0001
Labels:          <none>
Annotations:     pv.kubernetes.io/bound-by-controller=yes
                 volume.beta.kubernetes.io/storage-class=slow
StorageClass:    slow
Status:          Bound
Claim:           default/nginx-file-pvc01
Reclaim Policy:  Retain
Access Modes:    RWO
VolumeMode:      Filesystem
Capacity:        1Gi
Message:         
Source:
    Type:        FC (a Fibre Channel disk)
    TargetWWNs:  28000001ff0414e2
    LUN:         0
    FSType:      
    ReadOnly:    true
Events:          <none>

 ~/sample/storage/fc_loop/file % k describe pvc/nginx-block-pvc01
Name:          nginx-block-pvc01
Namespace:     default
StorageClass:  slow
Status:        Bound
Volume:        block-pv0001
Labels:        <none>
Annotations:   pv.kubernetes.io/bind-completed=yes
               pv.kubernetes.io/bound-by-controller=yes
               volume.beta.kubernetes.io/storage-class=slow
Capacity:      1Gi
Access Modes:  RWO
VolumeMode:    Block
Events:        <none>
 ~/sample/storage/fc_loop/file % k describe pvc/nginx-file-pvc01 
Name:          nginx-file-pvc01
Namespace:     default
StorageClass:  slow
Status:        Bound
Volume:        file-pv0001
Labels:        <none>
Annotations:   pv.kubernetes.io/bind-completed=yes
               pv.kubernetes.io/bound-by-controller=yes
               volume.beta.kubernetes.io/storage-class=slow
Capacity:      1Gi
Access Modes:  RWO
VolumeMode:    Filesystem
Events:        <none>
```

Automatic merge from submit-queue (batch tested with PRs 54824, 55911, 55730, 55979, 55961). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add kubeletconfig round trip test

I noticed we were missing one of these.

fixes #55959

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54824, 55911, 55730, 55979, 55961). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add detail to flag help

**What this PR does / why we need it**:

The admission control flag is impossible to understand.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Ref #https://github.com/kubernetes/features/issues/492

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54824, 55911, 55730, 55979, 55961). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Device plugin API merge of handler and manager

**What this PR does / why we need it**: We are trying different approaches to make the device plugin implementation simpler and more robust. One option is to merge the notion of the `device_plugin_handler` into the `device_manager`. This is for several reasons:

1) Some calls go directly from handler to manager, adding little value.
2) The separation of concern is not clear between the two components. They have a 1:1 relationship.
3) The separation and abstractions needed are at a different level. Code that can be refactored will most likely live in abstractions which hide details around lock acquisition and check pointing.

In this PR, we will **just** merge the two interfaces. After this, there is several opportunities for simplifying and cleaning up the device plugin.

Fixes #55180

**Special notes for your reviewer**: This is a WIP. May very well get dropped, but keeping up for the sake of early sharing and showing the progress of the code move. 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54824, 55911, 55730, 55979, 55961). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add options for mounting SCSI or NVMe local SSD though Block or Filesystem and do all of that with UUID

Fixes: #51431
Fixed version of: #53466

Mount SCSI local SSD by UUID in /mnt/disks/by-uuid/, also allows for users to request and mount NVMe disks. Both types of disks will be accessible either through block or file-system.

I have confirmed that it is no longer crashing when nodes are initialized on GKE.

Automatic merge from submit-queue (batch tested with PRs 54824, 55911, 55730, 55979, 55961). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

convert testScaledRolloutDeployment e2e test to integration test

**What this PR does / why we need it**:
This PR convert a deployment e2e test named "testScaledRolloutDeployment" to integration test.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: xref #52113 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix cadvisor.New signature for cross build

**What this PR does / why we need it**: fixes the `pkg/kubelet/cadvisor.New` signature on non-linux platforms to match the new one on linux. This should fix the cross build

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #56002

**Special notes for your reviewer**: 

**Release note**:

```release-note
NONE
```

/sig release

Automatic merge from submit-queue (batch tested with PRs 55839, 54495, 55884, 55983, 56069). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add condition "len(cfg.DiscoveryToken) != 0" to ValidateArgSelection.

**What this PR does / why we need it**:
as per https://github.com/kubernetes/kubernetes/pull/54982#discussion_r149968848
>only when the conditions having len(cfg.DiscoveryToken) != 0 means "using token-based discovery" as is mentioned in the error message.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
ref: #54982

**Special notes for your reviewer**:
/cc @kubernetes/sig-cluster-lifecycle-pr-reviews 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 55839, 54495, 55884, 55983, 56069). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

seccomp is an alpha feature and not feature gated

Move SeccompProfileRoot to KubeletFlags and document flag as alpha.

wrt https://github.com/kubernetes/kubernetes/pull/53833#issuecomment-345396575, seccomp is an alpha feature, but this isn't clearly documented anywhere (the annotation just has the word "alpha" in it, and that's your signal that it's alpha). 

Since seccomp was around before feature gates, it doesn't have one.

Thus SeccompProfileRoot should not be part of KubeletConfiguration, and this PR moves it to KubeletFlags, and amends the help text to note the alpha state of the feature.

fixes: #56087

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 55839, 54495, 55884, 55983, 56069). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

deviceplugin: fix race when multiple plugins are registered

**What this PR does / why we need it**:
When registering multiple device plugins to Kubelet concurrently, there exists a race that crashes the Kubelet.

Consider two plugins: D1 and D2. The call order method is roughly

D1 -> manager.go:register -> endpoint.go:listAndWatch -> device_plugin_handler.go:(*D1).callback
D2 -> manager.go:register -> endpoint.go:listAndWatch -> device_plugin_handler.go:(*D2).callback

The callback function accesses HandlerImpl's allDevices map that maps (resourceName -> DeviceID). If both plugins reach these accesses at the same time, Kubelet crashes with "fatal error: concurrent map read and map write".

This can be solved by making sure handler is locked when allDevices are being updated. The functionality is needed to avoid Kubelet crashes when multiple device plugins are trying to register with Kubelet at the same moment. Occurs frequently when single binary tries to register itself as multiple plugins.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 55839, 54495, 55884, 55983, 56069). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

certs: start deprecation of signing asset default paths

Per https://github.com/kubernetes/kubernetes/pull/52334#issuecomment-331212749

```release-note
Defaulting of controller-manager options for --cluster-signing-cert-file and --cluster-signing-key-file is deprecated and will be removed in a later release.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add ExtendedResourceToleration admission controller.

/kind feature
/sig scheduling
/area hw-accelerators

There's elaborate discussion on this in #55080. In short, we would like to enable cluster operators and/or cloud providers to create dedicated nodes with extended resources (like GPUs, FPGAs etc.) that are reserved for pods requesting such resources. [Taints is the kubernetes concept to create dedicated nodes.](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/#example-use-cases) If the cluster operator or cloud provider wants to create dedicated node pools, they are expected to taint the nodes containing extended resources with the key equal to the name of the resource and effect equal to NoSchedule. If they do that, only pods that have a toleration for such a taint can be scheduled there. To make it easy for the user, this admission controller when enabled, automatically adds a toleration with key `example.com/device`, operator `Exists` and effect `NoSchedule` if an extended resource of name `example.com/device` is requested.

**Release note**:
```release-note
Add ExtendedResourceToleration admission controller. This facilitates creation of dedicated nodes with extended resources. If operators want to create dedicated nodes with extended resources (like GPUs, FPGAs etc.), they are expected to taint the node with extended resource name as the key. This admission controller, if enabled, automatically adds tolerations for such taints to pods requesting extended resources, so users don't have to manually add these tolerations. 
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Stop using VersionedObject in resource.Builder, use unstructured

Remove the need for kubectl callers to distinguish between unstructured and versioned / type aware builders.  The factory should create a single builder than can be set to return unstructured objects.  Callers can then use one of the new helpers on `resource.Info` to convert the objects into the desired form - `Internal()` for printers, `Typed()` for external versions, and `Unstructured()` to ensure the object is in the right state.  Leverages the new scheme support for unstructured conversion so that higher level callers can perform best effort conversion (get typed versions if you have them, otherwise use default behavior).  

`get.go` demonstrates this by removing the previous logic that depended on the underlying scheme.  Other commands are updated to be consistent.

Includes #55650 and #55647.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Move of unreachable taint key out of alpha

**What this PR does / why we need it**:

Move of unreachable taint key out of alpha, which already happened in community doc.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #54198

**Special notes for your reviewer**:
Please see #54198 for the context of this inconsistency.

**Release note**:

```release-note
Move unreachable taint key out of alpha. 
Please note the existing pods with the alpha toleration should be updated by user himself to tolerate the GA taint.
```

* Option to consolidate Azure NSG rules for services

* Fixed panic checking for service on other Azure LB