Automatic merge from submit-queue (batch tested with PRs 53866, 54852, 55178, 55185, 55130). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm mount path '/lib/modules'

**What this PR does / why we need it**:
Kube-proxy need mount path '/lib/modules' to load kernel modules automatically inside the pod.

We already have this pr: #52003, for 'cluster/addons' and `saltbase'.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53866, 54852, 55178, 55185, 55130). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add extra-args configs for scheduler and controller-manager to kubernetes-master charm

**What this PR does / why we need it**:

This adds `controller-manager-extra-args` and `scheduler-extra-args` config options to the kubernetes-master charm.

These allow operators of Juju-based Kubernetes clusters to pass arbitrary arguments to kube-controller-manager and kube-scheduler as needed.

**Release note**:

```release-note
Add extra-args configs for scheduler and controller-manager to kubernetes-master charm
```

Automatic merge from submit-queue (batch tested with PRs 53866, 54852, 55178, 55185, 55130). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Set the NON_MASQUERADE_CIDR to 0/0 by default in GCE/GKE

This disables masquerade rules setup by the kubelet.  Additionally this adds masquerade rules based on NON_MASQUERADE_CIDR being set to 0/0.



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Add masquerading rules by default to GCE/GKE
```

Automatic merge from submit-queue (batch tested with PRs 53866, 54852, 55178, 55185, 55130). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Adjust resources for Metrics Server

**What this PR does / why we need it**:
This PR adjusts resources set for Metrics Server by Pod Nanny to reduce resources usage by core Kubernetes components when enabling Metrics Server. In Kubernetes 1.8 Metrics Server is used only by HPAv2, other use-cases are covered by Heapster.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53866, 54852, 55178, 55185, 55130). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove duplicated Hairpin constant definition

**What this PR does / why we need it**:
Clean up the hairpin definition in conponent config since it has been remove to [kubelet config](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/kubeletconfig/types.go#L36)

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
no issue, just clean up the code

**Special notes for your reviewer**:
none

**Release note**:
none

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add windows kernel mode kubeproxy reviewers

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note

```

Automatic merge from submit-queue (batch tested with PRs 55093, 54966, 55047, 54971, 54786). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

vendor update: github.com/golang/protobuf

When I'm working on PR: https://github.com/kubernetes/kubernetes/pull/54782, I met a problem here: https://github.com/golang/protobuf/issues/372, which I think we need to update our vendor of protobuf
and I ask Dr. Stefan for suggestion, here is our coversation


shiywang [5:09 PM] 
hi, Dr. Stefan i'm sorry to bother, I have a simple question, I was working on a pr which need to use protobuf custom field, and I run into this problem here: https://github.com/golang/protobuf/issues/372  which I think is due to our codebase's protobuf vendor is too old `vendor/github.com/golang/protobuf`,  do you think I can update that vendor to lastest one ?  also I noticed there's also an extend package called `vendor/github.com/gogo/protobuf/proto` what's the releationship between those two ?  which one should I update ?

sttts
[5:11 PM] 
hi

[5:11] 
don't know much about the proto internals either, @claytonc is probably the only one

[5:12] 
create a vendor/github.com/golang/protobuf bump PR and assign it to him

shiywang [5:12 PM] 
sounds good, thank you sir

so 
/assign @smarterclayton 
for suggestion, thanks

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 55093, 54966, 55047, 54971, 54786). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Upgrade Azure SDK to v11.1.1

**What this PR does / why we need it**: This fixes various Azure SDK bugs per the Azure SDK for Go changelogs:

* Fixed bug in which blob types were unmarshaled incorrectly
* Fixed various package names
* Miscellaneous unspecified storage bug fixes

This is also a prerequisite for a bug fix for running out of firewall rules when exposing large numbers of services from an Azure cluster.

**Which issue(s) this PR fixes**: None

**Special notes for your reviewer**:

1. I inadvertently committed a compatibility fix along with the dependency upgrade (which the guidelines say should have been two separate commits).  The offending file is `pkg/cloudprovider/providers/azure.go`.

2. We require an urgent bug fix for the firewall rules limit so it would be great if we could get this agreed quickly.  I have struggled with the dependency upgrade process a bit so if it looks wrong, please let me know as soon as you can!  Thanks!

**Release note**:

```release-note
Upgraded Azure SDK to v11.1.1.
```

Automatic merge from submit-queue (batch tested with PRs 55093, 54966, 55047, 54971, 54786). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Adding an e2e test for gce multi cluster ingress

Basic test that verifies that multi cluster ingress gets the instance groups annotation.

Ref https://github.com/kubernetes/ingress-gce/issues/71

cc @csbell @G-Harmon @nicksardo @bowei 

```release-note
NONE```

Automatic merge from submit-queue (batch tested with PRs 55093, 54966, 55047, 54971, 54786). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Don't panic on unexpected group version for mutated selector

**What this PR does / why we need it**: 
`panic` on unknown group version will crash the whole apiserver (even when selector isn't mutated), have a single resource affect the whole cluster, and make debugging harder. ~Return an internal error (i.e. not user error) instead.~ Make "selector immutability" the default behavior instead. 

**Which issue(s) this PR fixes**:
ref #54575

**Special notes for your reviewer**: @kubernetes/sig-apps-bugs @liggitt 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Clean up redundant DNS related codes

**What this PR does / why we need it**:
As https://github.com/kubernetes/kubernetes/pull/54773#discussion_r148904955 described, resolv.conf setup for pod is handled by `generatePodSandboxConfig()`, though we have some redundant DNS related codes in `GenerateRunContainerOptions()` which seems to have no effect.

This PR cleans up the ineffective codes and rearranges the cluster DNS unit test and hopefully it would be less confusing.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #55201

**Special notes for your reviewer**:
cc @Random-Liu @phsiao 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fixing 'targetport' to service 'port' mapping

Looks like the order should be reversed for this to work.



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #54968 

**Special notes for your reviewer**:

**Release note**:

```release-note

```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

update the wrong format of string TargetPort

**What this PR does / why we need it**:

update the wrong format of string TargetPort

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #54546 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51001, 55181). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Added logic for custom kube proxy yaml for GKE

Added yaml-replacement logic for custom kube-proxy daemon set on GKE. 

Release Note: 
```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 51001, 55181). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update vendored package heredoc

**What this PR does / why we need it**:

This PR updates vendored package `github.com/MakeNowJust/heredoc`. This package is used by `kubectl`. The upstream updates do not effect program logic. Upstream changes consist of some refactoring commits and updates to README and LICENSE. The refactoring was carried out while bug hunting in `kubectl` and is the primary reason for merging the upstream changes. No bugs were found, this PR aims to save the next developer some time if/when they go bug hunting again in `heredoc`.

**Special notes for your reviewer**:

First effort at updating `vendor/`. I used `godep update` even though the [community docs](https://github.com/kubernetes/community/blob/master/contributors/devel/godep.md) state that no one has this working, the command appears to work.
```release-note
NONE
```

sig /cli
kind /cleanup

Automatic merge from submit-queue (batch tested with PRs 53645, 54734, 54586, 55015, 54688). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

e2e-node:the value of bestEffortCgroup is wrong
Signed-off-by: yanxuean <yan.xuean@zte.com.cn>

**What this PR does / why we need it**:
The value of bestEffortCgroup is wrong in e2e-node. The test case is invalid actually.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53645, 54734, 54586, 55015, 54688). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Disable the grace termination period for the calico/node pod

**What this PR does / why we need it**:

Disable the termination grace period for the calico/node add-on DaemonSet.  The grace period is unnecessary for calico/node and it delays restart of a new calico/node pod to take over routing and policy updates.

Setting the grace period to 0 has the special meaning of doing a force deletion, which avoids a slow round-trip through the kubelet and API server.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:

Fixes #55013

**Special notes for your reviewer**:

**Release note**:

```release-note
Disable the termination grace period for the calico/node add-on DaemonSet to reduce downtime during a rolling upgrade or deletion.
```

Automatic merge from submit-queue (batch tested with PRs 53645, 54734, 54586, 55015, 54688). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix Incorrect Scale Subresources and HPA e2e ScaleTargetRefs

The HPA e2es failed to actually set `apiVersion` on the created HPAs, which previous was ignored.  Since the polymorphic scale client was merged, this behavior is no longer tolerated (it was never correct to begin with, but it accidentally worked).

Additionally, the `apps` resources have their own version of scale.  Until `apps/v1beta1` and `apps/v1beta2` go away, we need to support those versions in the scale client.

Together, these broke some of the HPA e2es.

Fixes #54574

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53645, 54734, 54586, 55015, 54688). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Improve webhook error message

**What this PR does / why we need it**:
Currently, apiserver only prints message of review status returned by a rejecting webhook controller. If the message is empty, users will see this in event message: 
`create Pod <pod-name> failed error:<empty-string>`. Hook name should be included in the error message as well.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 

**Special notes for your reviewer**: @kubernetes/sig-api-machinery-bugs 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

move KubeProxyConfiguration out of componentconfig API group

**What this PR does / why we need it**:
move KubeProxyConfiguration out of componentconfig API group

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #53577

**Special notes for your reviewer**:
/cc @thockin @ncdc 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove Google Cloud KMS's in-tree integration

Removes the following introduced by #48574 and others:
* `kms.go` which contained the cloudkms-specific code for Google Cloud KMS service.
* Registering the Google Cloud KMS in the KMS plugin registry.
* Google's `cloudkms` API package from `vendor` folder. 

The following changes are upcoming:
* Removal of KMSPluginRegistry. This would not be needed anymore, since KMS providers will be out-of-tree from now on (so no need of registering them, an address of the process would be enough).
* A service which allows encrypt/decrypt functionality (satisfies `envelope.Service` interface) if initialized with an IP/Port of an out-of-tree process serving KMS requests. Will tentatively use gRPC requests to talk to this external service.

Reference: https://github.com/kubernetes/kubernetes/pull/54439#issuecomment-340062801 and https://github.com/kubernetes/kubernetes/issues/51965#issuecomment-339333937.

```release-note
Google KMS integration was removed from in-tree in favor of a out-of-process extension point that will be used for all KMS providers.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Describe NetworkPolicyEgressRule and IPBlock

**What this PR does / why we need it**:
- Describe IPBlock for NetworkPolicyIngressRule.
- Describe NetworkPolicyEgressRule
- Add test case for NetworkPolicyEgressRule
- Describe PolicyTypes

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
/cc @thockin @caseydavenport @cmluciano 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 55034, 55068). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Clarify what each "version" means.

Some folks were getting confused by this output.

Fixes #54821 

```release-note
NONE
```

/area conformance
/sig architecture
/assign @timothysc @WilliamDenniss

Automatic merge from submit-queue (batch tested with PRs 55034, 55068). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Close the file before renaming in FileStore

Also change the unit test to use a real file system to detect errors
like this.

Looks like the order should be reversed for this to work.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Cluster Autoscaler 1.0.2

Almost the same as 1.0.2-beta1. Provides mainly Node Autoprovisioning fixes.

masquerade rules setup by the kubelet.  Add masquerade rules based
on NON_MASQUERADE_CIDR being set to 0/0.

Automatic merge from submit-queue (batch tested with PRs 55169, 54990). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Retry pod listing call in load test if possible instead of failing

The latest run of 5k-node performance test failed due to this (https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/logs/ci-kubernetes-e2e-gce-scale-performance/57):

```
listing pods from rc load-small-10363
Expected error:
    ...
    Get https://35.196.185.248/api/v1/namespaces/e2e-tests-load-30-nodepods-14-f9gcv/pods?labelSelector=name%3Dload-small-10363&resourceVersion=0: read tcp 172.17.0.5:40524->35.196.185.248:443: read: connection reset by peer
not to have occurred
```

/cc @wojtek-t @porridge

Automatic merge from submit-queue (batch tested with PRs 55169, 54990). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiserver: fix Cacher.Stop() race

Automatic merge from submit-queue (batch tested with PRs 54535, 54950, 55081). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Bug/departing

**What this PR does / why we need it**: With this PR we fix the bugs we had with multiple masters setup with juju.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/422

**Special notes for your reviewer**: Related PR: https://github.com/juju-solutions/interface-kube-control/pull/15

**Release note**:

```NONE

```

Automatic merge from submit-queue (batch tested with PRs 54535, 54950, 55081). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

code-gen: add +groupGoName to allow unique Go identifiers in clientsets and informers

We use the first segement of the GroupName as Go name. Hence, a GroupName
"policy.k8s.io" and "policy.authorization.k8s.io" could not live in the
same clientset or shared informer factory. This PR add another tag:

```
  // +groupGoName=AuthorizationPolicy
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiextensions/examples: add typed client

It was discussed in https://github.com/kubernetes/kubernetes/pull/52753#issuecomment-337840762 to add a typed client example to apiextensions-apiserver and remove the controller part.

For an example controller, we have [`k8s.io/sample-controller`](https://github.com/kubernetes/kubernetes/tree/master/staging/src/k8s.io/sample-controller) now.

**Release note**:

```release-note
NONE
```