Automatic merge from submit-queue

[Federation] Remove FEDERATIONS_DOMAIN_MAP references

Remove all references to FEDERATIONS_DOMAIN_MAP as this method is no longer is used and is replaced by adding federation domain map to kube-dns configmap.

cc @madhusudancs @kubernetes/sig-federation-pr-reviews 

**Release note**:
```
[Federation] Mechanism of adding `federation domain maps` to kube-dns deployment via `--federations` flag is superseded by adding/updating `federations` key in `kube-system/kube-dns` configmap. If user is using kubefed tool to join cluster federation, adding federation domain maps to kube-dns is already taken care by `kubefed join` and does not need further action.
```

Automatic merge from submit-queue

[Federation] Use cascading deletion when deleting resources in underlying clusters

The Federation control plane issues a delete command unless it wants to orphan the underlying per-cluster resource. When issuing that command, always set the orphanDependents to false.

/release-note-none
/sig-federation

Automatic merge from submit-queue

kube-proxy: filter INPUT as well as OUTPUT

We need to apply filter rules on the way in (nodeports) and out (cluster
IPs).  Testing here is insufficient to have caught this - will come back
for that.

Fixes #43969

@justinsb since you have the best repro, can you test?  It passes what I think is repro.

@ethernetdan we will want this in 1.6.x

```release-note
Fix bug with service nodeports that have no backends not being rejected, when they should be.  This is not a regression vs v1.5 - it's a fix that didn't quite fix hard enough.
```

Automatic merge from submit-queue (batch tested with PRs 42141, 43447)

Fix AddPodToVolume: Change arg to volumeGidValue instead of devicePath

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 42141, 43447)

fix typo

retries and hierarchy  typo error

Automatic merge from submit-queue

cleanup: remove TODO(resolved) and var(unused)

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 44084, 42964)

Updated AddOrUpdateTolerationInPod to return bool only.

Updated AddOrUpdateTolerationInPod to return bool only, as there's no case to generate error (the error was used for annotation, it'll not return error after moving to field); and also update admission & daemonset accordingly.

Automatic merge from submit-queue (batch tested with PRs 44084, 42964)

Removing both finalizers in federation controllers in a single update

Fixes https://github.com/kubernetes/kubernetes/issues/43828

There is a bug right now where the controller fails to delete the object if one finalizer is removed and the second isnt.
This updates the code so that both the finalizers are removed in a single API call. Kept the code changes minimum to enable cherrypick in 1.6.x

cc @csbell @kubernetes/sig-federation-bugs

Automatic merge from submit-queue (batch tested with PRs 44104, 43903, 44109)

Update gen_api_ref_docs to use same diff method as verify

**What this PR does / why we need it**:
Fixes an issue where there is a discrepancy between the update and verify diff methods for the api-reference-docs. This can create a situation where verify will see changes, but update won't fix them.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #31129

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 44104, 43903, 44109)

use StringArray in create rolebindings

@liggitt I think maybe you like this.

```release-note
`kubectl create rolebinding` and `kubectl create clusterrolebinding` no longer allow specifying multiple subjects as comma-separated arguments. Use repeated `--user`, `--group`, or `--serviceaccount` arguments to specify multiple subjects. 
```

Automatic merge from submit-queue (batch tested with PRs 44104, 43903, 44109)

Make sure Teardown is called.

This will ensure that tests get a chance to clean up resources even if
setup failed part way through.

Automatic merge from submit-queue (batch tested with PRs 44097, 42772, 43880, 44031, 44066)

[Federation] Improve e2e test setup

This PR improves federation e2e test setup:

 - reuses e2e framework setup (``NewDefaultFramework``) instead of duplicating it
 - ensures ``FederationAfterEach`` is called if an error occurs in ``FederationBeforeEach`` (as per the [example](https://github.com/kubernetes/kubernetes/blob/master/test/e2e/framework/framework.go#L161) of the e2e framework)
 - skips creation of a test namespace in the hosting cluster (not used for a federation e2e test)

cc: @kubernetes/sig-federation-pr-reviews @kubernetes/sig-testing-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 44097, 42772, 43880, 44031, 44066)

kubeadm: Wait for node before updating labels and taints

**What this PR does / why we need it**:
Adds again (removed in #43881) waiting for at last single node appearance during kubeadm attempt to update master role labels and taints.

**Which issue this PR fixes**:
fixes kubernetes/kubeadm#221

**Release note**:
```NONE
```

Automatic merge from submit-queue (batch tested with PRs 44097, 42772, 43880, 44031, 44066)

Refactor Strategic Merge Patch

Refactor Strategic Merge Patch

```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 44097, 42772, 43880, 44031, 44066)

fix some typo

fix some typo

**Release note**:

```NONE
```

Automatic merge from submit-queue

Fix container hostPid settings

**What this PR does / why we need it**:

HostPid is not set correctly for containers.

**Which issue this PR fixes**

Fixes #44041.

**Special notes for your reviewer**:

Should be cherry-picked into v1.6 branch.

**Release note**:

```release-note
Fix container hostPid settings.
```


cc @yujuhong @derekwaynecarr @unclejack @kubernetes/sig-node-pr-reviews

Automatic merge from submit-queue

fix satisfy typo

Automatic merge from submit-queue

fix misspell "underlying" in request.go

Automatic merge from submit-queue

fix across typo

fix across typo


NONE

The Federation control plane issues a delete command unless it wants to orphan the underlying per-cluster resource. When issuing that command, always set the orphanDependents to false.

Automatic merge from submit-queue

serviceaccount admission: return correct tokens

Fix a bug in serviceaccount admission introduced when we switched
everything to use shared informers. That change accidentally reused the
list of secrets instead of creating a new one, resulting in all secrets
in the namespace being returned as possible service account tokens,
instead of limiting it only to the actual service account tokens, as it
did before the shared informer conversion. This also adds a unit test to
ensure there is no future regression here.

This will need to be cherry-picked to 1.6.



**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Fixed an issue mounting the wrong secret into pods as a service account token
```

cc @smarterclayton @liggitt @sttts @derekwaynecarr @calebamiles @ethernetdan @eparis

fixes kubernetes/kubeadm#221

Automatic merge from submit-queue

make kubeadm default to stable-1.6

This will ensure that tests get a chance to clean up resources even if
setup failed part way through.

Fix a bug in serviceaccount admission introduced when we switched
everything to use shared informers. That change accidentally reused the
list of secrets instead of creating a new one, resulting in all secrets
in the namespace being returned as possible service account tokens,
instead of limiting it only to the actual service account tokens, as it
did before the shared informer conversion. This also adds a unit test to
ensure there is no future regression here.

Automatic merge from submit-queue

relocate FC multipath readme to examples from pkg/volume
Signed-off-by: rootfs <hchen@redhat.com>



**What this PR does / why we need it**:
`pkg/volume/README.md` is not a good place for Fiber Channel specific doc. Move the block into FC README.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Cluster-Autoscaler e2e to catch unnecessary scale-ups

This e2e catches the bug in 0.5.0 CA with reasonable probability.
```release-note
```

Automatic merge from submit-queue

Use shared informers for proxy endpoints and service configs

Use shared informers instead of creating local controllers/reflectors
for the proxy's endpoints and service configs. This allows downstream
integrators to pass in preexisting shared informers to save on memory &
cpu usage.

This also enables the cache mutation detector for kube-proxy for those
presubmit jobs that already turn it on.

Follow-up to #43295 cc @wojtek-t 

Will race with #43937 for conflicting changes 😄 cc @thockin 

cc @smarterclayton @sttts @liggitt @deads2k @derekwaynecarr @eparis @kubernetes/rh-cluster-infra

This fails (with large probability, as issue is not 100% deterministic)
on 0.5.0, catching the bug in this version.

Automatic merge from submit-queue

Remove toleration from fluentd-elasticsearch

Fix https://github.com/kubernetes/kubernetes/issues/43795
Address comments from https://github.com/kubernetes/kubernetes/issues/42983

Fluentd-es doesn't work on master anyway, because it has no access to k8s services

Automatic merge from submit-queue

e2e for cluster-autoscaler unhealthy cluster handling

Add e2e test for cluster-autoscaler handling of unhealthy cluster. 

~~This only passes reliably with https://github.com/kubernetes/contrib/pull/2488 and should not be merged before it.~~ (included in current CA image)

**Release note**:
```release-note
```