Automatic merge from submit-queue

update kubectl help output for better organization

## Pull Request Guidelines

1. Please read our [contributor guidelines](https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md).
1. See our [developer guide](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md).
1. Follow the instructions for [labeling and writing a release note for this PR](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes) in the block below.

```release-note
* Use the release-note-* labels to set the release note state 
* Clear this block to use the PR title as the release note 
-OR-
* Enter your extended release note here
```


[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()

Automatic merge from submit-queue

Add benchmark to jenkins

This PR contains the following changes:

1. Add more tests in density benchmark test;
2. Add the peak value (100%) in latency and CPU usage statistic data;
3. Move the Ginkgo focus flag from e2e_remote.go to run_e2e.go;
4. Support running benchmark in run_e2e.go. The benchmark configuration file is an extension of image configuration. Each item requires additional GCE machine type (e.g. n1-standard-1, default value will be used if empty) and test names (Ginkgo focus regex strings). A test item is regarded as benchmark if the tests field is non-empty.

Automatic merge from submit-queue

Node Conformance Test: Statically link apiserver

For #30122, #30174.
Based on #30116, #30198, #30200.

**Please only review the 4th PR.**

This PR is part of our roadmap to package node conformance test.
The 1st commit is from #30116, which started e2e services in a separate process.
The 2nd commit is from #30198, it statically linked etcd into the node e2e framework.
The 3rd commit is from #30200, it moved namespace controller into e2e services.

The 4th commit is new, it statically linked apiserver into the node e2e framework.

@dchen1107 @vishh 
/cc @kubernetes/sig-node @kubernetes/sig-testing

Automatic merge from submit-queue

Kubelet rkt CRI stubs & fakes

Adds stubs for CRI interfaces and creates a fake for `ContainerRuntime` interface

Automatic merge from submit-queue

daemonset controller should respect taints

cc @dchen1107 @davidopp

Automatic merge from submit-queue

Move init-container feature from alpha to beta.

```release-note
Moved init-container feature from alpha to beta.

In 1.3, an init container is specified with this annotation key
on the pod or pod template: `pods.alpha.kubernetes.io/init-containers`.

In 1.4, either that key or this key: pods.beta.kubernetes.io/init-containers`,
can be used.

When you GET an object, you will see both annotation keys with the same values.

You can safely roll back from 1.4 to 1.3, and things with init-containers
will still work (pods, deployments, etc).

If you are running 1.3, only use the alpha annotation, or it may be lost when
rolling forward.

The status has moved from annotation key
`pods.beta.kubernetes.io/init-container-statuses` to
`pods.beta.kubernetes.io/init-container-statuses`.
Any code that inspects this annotation should be changed to use the new key.

State of Initialization will continue to be reported in both pods.alpha.kubernetes.io/initialized
and in `podStatus.conditions.{status: "True", type: Initialized}`
```

Mini-design for this change:

Goals:
1. A user can create an object with the beta annotation
  on 1.4, and it works.  The fact that the annotation has beta
  in it communicates to the user that the feature is beta,
  and so the user should have confidence in using it.  Preferably,
  when the user gets the annotation back, he see the beta
  annotation.
1) If someone had an existing alpha object in their apiserver,
  such as a RS with a pod template with an init-containers
  annotation on it, it should continue to work (init containers
  run) when stack upgraded to 1.4.
2) If someone is using a chart or blog post that has alpha
  annotation on it and they create it on a 1.4 cluster, it should
  work.
3) If someone had something with an init container in 1.4
  and they roll back stack to 1.3, it should not silently stop
  working (init containers don't run anymore).

To meet all these, we mirror an absent beta label from the alpha
key and vice versa.  If they are out of sync, we use the alpha
one. We do this in conversion since there was already logic there.

In 1.3 code, all annotations are preserved across a round trip
(v1 -> api -> v1), and the alpha annotation turns into the internal
field that kubelet uses.

In 1.4 code, the alpha annotation is always preserved across
a round trip, and a beta annotation is always set equal to
the alpha one, after a round trip.

Currently, the kubelet always sees the object after a round trip
when it GETs it.  But, we don't want to rely on that behavior,
since it will break when fastpath is implemented.

So, we rely on this:
all objects either are created with an alpha annotation (1.3 or 1.4
code) or are created with a beta annotation under 1.4.  In the later
case, they are round tripped at creation time, and so get both
annotations.  So all subsequent GETs see both labels.

Automatic merge from submit-queue

godep: bump etcd to 3.0.6

What?
Bump etcd godep dependency to v3.0.6

Why?
ref: #30843, https://github.com/coreos/etcd/pull/6222 
We have some fix to do secure client connection in unit tests.

Automatic merge from submit-queue

Implement TLS bootstrap for kubelet using `--experimental-bootstrap-kubeconfig`  (2nd take)

Ref kubernetes/features#43 (comment)

cc @gtank @philips @mikedanese @aaronlevy @liggitt @deads2k @errordeveloper @justinsb 


Continue on the older PR https://github.com/kubernetes/kubernetes/pull/30094 as there are too many comments on that one and it's not loadable now.

Automatic merge from submit-queue

rkt: Support subPath volume mounts feature

So that at most one volume object will be created for every unique
host path. Also the volume's name is random generated UUID to avoid
collision since the mount point's name passed by kubelet is not
guaranteed to be unique when 'subpath' is specified.

Should partially fix https://github.com/kubernetes/kubernetes/issues/26986 
The non-existing host path creation issue is not touched here.

cc @kubernetes/sig-rktnetes 
also cc @kubernetes/sig-node for the Mount name comments I added.

Automatic merge from submit-queue

pkg/kubelet/rkt: skip empty lines in getOSReleaseInfo

Follow-up of #31022

Automatic merge from submit-queue

GlusterFS dynamic provisioner and deleter interface based on storageclass claims

This PR depends on PR#29006

Automatic merge from submit-queue

Return container command exit codes in kubectl run/exec

Fixes https://github.com/kubernetes/kubernetes/issues/26424
Based on https://github.com/kubernetes/kubernetes/pull/25273.

TODO:
- [x] add e2e tests
- [x] investigate `kubectl run` exit code for `--restart=Never` (compare issue #24533 and PR #25253)
- [x] document exit codes

Automatic merge from submit-queue

kubelet status manager: Fix nil in error message due to var shadowing

Variable shadowing can cause this log message to print a nil:

```go
glog.Warningf("Failed to update status for pod %q: %v", format.Pod(pod), err)
```

@kubernetes/rh-cluster-infra

Automatic merge from submit-queue

Load Balancer Health Check responder library for ESIPP

This is an independent component that is needed for the Load Balancer health traffic steering functionality (part of the 1.4 ESIPP work)

Automatic merge from submit-queue

Followup fixes for disruption controller.

Part of #12611.
- Record an event when a pod does not have exactly 1 controller.
- Add TODO comment suggesting we simplify the two cases: integer and percentage.

Automatic merge from submit-queue

ResourceNames() should prohibit unnamed arguments

Automatic merge from submit-queue

Add support for the standard objectmeta field selectors

certificates API was missing standard field selectors (noticed in https://github.com/kubernetes/kubernetes/pull/30922/files/4120179db5ce6c3fadc872a268347f5be038f98f#r75413160)

also silences client-side warnings when using field selectors that don't have a registered client-side transformation (no functional change, since we were already returning the original field/value). if we want to trend toward embedding less conversion logic in our clients, I don't see us fully duplicating field selector conversions client-side to make that warning disappear.

Automatic merge from submit-queue

Return the current kubeconfig as the starting config in ClientConfigGetter.

This fixes issue #30790.

cc @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Cluster autoscaler friendly scheduling algorithm

cc: @davidopp

Automatic merge from submit-queue

Adding a script to fetch swagger spec from federation apiserver

First step for https://github.com/kubernetes/kubernetes/issues/30541.
Next step is to generate docs like http://kubernetes.io/docs/api-reference/v1/definitions/ from this swagger spec.

cc @kubernetes/sig-cluster-federation @kubernetes/sig-api-machinery

Automatic merge from submit-queue

godeps: update go-restful

To pickup https://github.com/emicklei/go-restful/pull/311

@kubernetes/sig-api-machinery

Automatic merge from submit-queue

Fix kubectl describe to display a container's resource limit env vars as node allocatable when the limits are not set

Automatic merge from submit-queue

only compute delta on non-creating updates

If you're issuing an update that can cause a create, the quota admission charge should be based on the create cost, otherwise you always end up with zero.

@derekwaynecarr ptal, blocker bug.

Automatic merge from submit-queue

docs/devel: document the behavior of github UI for PRs

Documents the problem encountered in #30596

cc @bgrant0607 @thockin @roberthbailey

Automatic merge from submit-queue

Add spec.nodeName and spec.serviceAccountName to downward env var

The serviceAccountName is occasionally useful for clients running on
Kube that need to know who they are when talking to other components.

The nodeName is useful for PetSet or DaemonSet pods that need to make
calls back to the API to fetch info about their node.

Both fields are immutable, and cannot easily be retrieved in another
way.

@bprashanth @pmorie as relevant consumers / reviewers.



```release-note
The `valueFrom.fieldRef.name` field on environment variables in pods and objects with pod templates now allows two additional fields to be used:

* `spec.nodeName` will return the name of the node this pod is running on
* `spec.serviceAccountName` will return the name of the service account this pod is running under
```

Automatic merge from submit-queue

Node Conformance Test: Move namespace controller to services

For #30122, #30174.
Based on #30116, #30198.

**Please only review the 3rd PR.**

This PR is part of our roadmap to package node conformance test.
The 1st commit is from #30116, which started e2e services in a separate process.
The 2nd commit is from #30198, it statically linked etcd into the node e2e framework.

The 3rd commit is new, it moved namespace controller into e2e services.

@dchen1107 @vishh 
/cc @kubernetes/sig-node @kubernetes/sig-testing

Automatic merge from submit-queue

ImagePolicyWebhook Admission Controller

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**: This is an implementation of the [image provenance proposal](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/image-provenance.md). It also includes the API definitions by @Q-Lee from https://github.com/kubernetes/kubernetes/pull/30241

**Special notes for your reviewer**:
Please note that this is the first admission controller to make use of the admission controller config file (`--admission-controller-config-file`). I have defined a format for it but we may want to double check it's adequate for future use cases as well.

The format defined is:

```
{
  "imagePolicy": {
     "kubeConfigFile": "path/to/kubeconfig/for/backend",
     "allowTTL": 50,          # time in s to cache approval
     "denyTTL": 50,           # time in s to cache denial
     "retryBackoff": 500,      # time in ms to wait between retries
     "defaultAllow": true      # determines behavior if the webhook backend fails
  }
}
```

(or yaml)

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
Adding ImagePolicyWebhook admission controller.
```

Automatic merge from submit-queue

Fixes #31056

This PR fixes the issue described in https://github.com/kubernetes/kubernetes/issues/31056 - In https://github.com/kubernetes/kubernetes/blob/master/cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest#L82 there is a missing `+` after `" "`

result:
```
==> master: Summary
==> master: -------------
==> master: Succeeded: 52 (changed=43)
==> master: Failed:     0
==> master: -------------
==> master: Total states run:     52
```

The serviceAccountName is occasionally useful for clients running on
Kube that need to know who they are when talking to other components.

The nodeName is useful for PetSet or DaemonSet pods that need to make
calls back to the API to fetch info about their node.

Both fields are immutable, and cannot easily be retrieved in another
way.

Automatic merge from submit-queue

Validate involvedObject.Namespace matches event.Namespace

Fixes https://github.com/kubernetes/kubernetes/issues/16036

Automatic merge from submit-queue

Make labels, fields expose selectable requirements

What?
This is to change the labels/fields Selector interface and make them expose selectable requirements. We reuse labels.Requirement struct for label selector and add fields.Requirement for field selector.

Why?
In order to index labels/fields, we need them to tell us three things: index key (a field or a label), operator (greater, less, or equal), and value (string, int, etc.). By getting selectable requirements, we are able to pass them down and use them for indexing in storage layer.

Automatic merge from submit-queue

Basic scaler/reaper for petset

Currently scaling or upgrading a petset is more complicated than it should be. Would be nice if this made code freeze on friday. I'm planning on a follow up change with generation number and e2es post freeze.