Fix undefined KEEP_TMP in verify-godeps.sh

Automatic merge from submit-queue (batch tested with PRs 39275, 40327, 37264)

Fix invalid node name in openstack-heat provider

Cluster node name must follow name syntax in RFC 1123.
But currently, openstack-heat provider generate invalid
node name which contains upper-case characters.
This patch fixes it.

Automatic merge from submit-queue (batch tested with PRs 39275, 40327, 37264)

dockertools: remove some dead code

Remove `dockerRoot` that's not used anywhere.

Automatic merge from submit-queue

Fix bad time values in kubelet FakeRuntimeService

These values don't affect tests but they can be confusing
for developers looking at the code for reference.

Automatic merge from submit-queue

Make verify-godeps.sh easier to debug

This does 3 things:
    
1. env var to retain the /tmp/godep
2. env var to use a specified /tmp/godep
3. rework of preload-dep to support more non-github things, like go4.org

Automatic merge from submit-queue (batch tested with PRs 40299, 40311)

move authoritative client-go util out of pkg

Move `client-go/pkg/util` which are authoritative to `client-go/util` to make it easier to reason about what comes from where.

Automatic merge from submit-queue (batch tested with PRs 40299, 40311)

cluster: update default rkt version to 1.23.0

This updates cluster configurations to current stable rkt version.

Automatic merge from submit-queue

Adding rescan scsi controller for cinder

For lsilogic scsi controller, attached cinder volume does not
appear under /dev/ automatically unless do a rescan.
This approach was used in vSphere volume provider before PR #27496
dropped support for lsilogic scsi controller.

Revert "Refactored kubemark into cloud-provider independent code and GCE specific code"

Automatic merge from submit-queue (batch tested with PRs 40303, 40316)

kubeadm: Fix up the apiserver kubelet client cert

**What this PR does / why we need it**:

I didn't notice that the apiserver serving cert was _only_ a server cert, not both a server and client cert in https://github.com/kubernetes/kubernetes/pull/40292.

This PR fixes that misconception and generates a dedicated client cert for apiserver -> kubelet communication and harmonizes the `ca.crt` path to `/etc/kubernetes/pki/ca.crt` on both master and node.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

```console
$ systemctl cat kubelet
# /lib/systemd/system/kubelet.service
[Unit]
Description=kubelet: The Kubernetes Node Agent
Documentation=http://kubernetes.io/docs/

[Service]
ExecStart=/usr/bin/kubelet
Restart=always
StartLimitInterval=0
RestartSec=10

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
[Service]
Environment="KUBELET_KUBECONFIG_ARGS=--kubeconfig=/etc/kubernetes/kubelet.conf **--authorization-mode=Webhook --client-ca-file=/etc/kubernetes/pki/ca.crt** --require-kubeconfig=true"
Environment="KUBELET_SYSTEM_PODS_ARGS=--pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=true"
Environment="KUBELET_NETWORK_ARGS=--network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin"
Environment="KUBELET_DNS_ARGS=--cluster-dns=10.96.0.10 --cluster-domain=cluster.local"
ExecStart=
ExecStart=/usr/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_SYSTEM_PODS_ARGS $KUBELET_NETWORK_ARGS $KUBELET_DNS_ARGS $KUBELET_EXTRA_ARGS


$ curl -k https://localhost:10250/containerLogs/kube-system/weave-net-arm64-4t2xv/weave
Forbidden (user=system:anonymous, verb=get, resource=nodes, subresource=proxy)
$ curl --cert /etc/kubernetes/pki/apiserver-kubelet-client.crt --key /etc/kubernetes/pki/apiserver-kubelet-client.key -k https://localhost:10250/containerLogs/kube-system/weave-net-arm64-4t2xv/weave
[Works!!]
```

**Release note**:

```release-note
NONE
```

@liggitt @deads2k

Automatic merge from submit-queue (batch tested with PRs 40303, 40316)

Reactivate golint in staging

Run golint against staging with `staging/src/k8s.io/client-go/pkg` as the only exception. While doing this reset `hack/.linted_packages` which collected a lot of cruft. We now enforce that gone packages are removed.

Automatic merge from submit-queue

Allow fieldSelectors to match arbitrary values

Field selectors are intended to be able to match arbitrary data for specific field names. Because of how field selectors are parsed, data containing `,` characters is not possible to match today, and data containing leading `=` characters requires using the `==` operator to ensure the leading `=` is preserved.

This PR adds the ability to escape/unescape those special characters in field selector values so they can be parsed unambiguously

Process for escaping arbitrary data in field selector values (`fields.EscapeValue` helper provided):
1. Prefix literal `\` characters with a `\`
2. Prefix `,` characters with a `\`
3. Prefix `=` characters with a `\`

When unescaping a field selector value (`fields.UnescapeValue` helper provided), the following escape sequences are honored:
- `\\` -> `\`
- `\,` -> `,`
- `\=` -> `=`

Any other instances of `\` result in a parse error

Any unescaped instances of `,` and `=` in field selector values result in a parse error

Compatibility:
- `,` and `=` characters are currently unusable in fieldSelector values, so the `\,` and `\=` escape sequences have no compatibility impact
- `\\` changes from being interpreted as `\\` to `\`, and any other uses of `\` result in errors (this is mostly theoretical; I couldn't find any field-selector-enabled fields which is currently using field selectors to match `\` values)

```
Field selectors may now match values containing the characters `,` `=` or `\` by escaping them with a `\` character.
```

Automatic merge from submit-queue

Optional configmaps and secrets

Allow configmaps and secrets for environment variables and volume sources to be optional

Implements approved proposal https://github.com/kubernetes/community/commit/c9f881b7bbf5b2cf39de3ee9c082e1a881e34fe3

Release note:
```release-note
Volumes and environment variables populated from ConfigMap and Secret objects can now tolerate the named source object or specific keys being missing, by adding `optional: true` to the volume or environment variable source specifications.
```

Automatic merge from submit-queue (batch tested with PRs 40328, 40057)

Allows kubectl create -f to filter by selector.

From #32544.

The underlying `seletor` infrastructrue was implemented by #32599. The test is basically copy-paste of the corresponding test for `kubectl apply -f -l`.

```release-note
kubectl create now accepts the label selector flag for filtering objects to create
```

Automatic merge from submit-queue (batch tested with PRs 40328, 40057)

New Federation team.

cc @mml @irfanurrehman @shashidharatd @mwielgus

Automatic merge from submit-queue

Move ListOptions into meta

metav1.ListOptions is moving to k8s.io/apimachinery/pkg/apis/meta/v1.  The internal version will be reserved for server use (clients will use metav1), and all references changed.

Also, all references to the Namespace* constants are being moved to point to metav1.

- ConfigMaps and Secrets for Env or Volumes are allowed to be optional

Decouple ListOption parsing from the scheme - instead, it is a property
of the server (and clients should use metav1.ListOptions for now).