Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Refactor the kube-controller-manager ComponentConfig structs

**What this PR does / why we need it**:

This PR cleans up the kube-controller-manager structs in the componentconfig package and fixes various structural issues in the current code, in order to make it possible to later move the code out to external API groups (as a starting point `GenericControllerManagerConfiguration` to `k8s.io/controller-manager`).

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
ref: https://github.com/kubernetes/community/pull/2354

This PR depends on:
 - [x] https://github.com/kubernetes/kubernetes/pull/67149
 - [x] https://github.com/kubernetes/kubernetes/pull/67090
 - [x] https://github.com/kubernetes/kubernetes/pull/67159
 - [x] https://github.com/kubernetes/kubernetes/pull/67207
 - [x] https://github.com/kubernetes/kubernetes/pull/66722

**Special notes for your reviewer**:

Please only review the following commits:
 - **Refactor the k-c-m ComponentConfig structs to they can be moved out**
 - **Fixup cmd/kube-controller-manager code after struct changes.**

**Release note**:

```release-note
NONE
```
/assign @sttts @stewart-yu @liggitt @thockin

Automatic merge from submit-queue (batch tested with PRs 67864, 68158). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Update echoserver version used to 2.2

Change-Id: Ic1dcb2c64ac682ca601ab2589fd6af70d4e09620



**What this PR does / why we need it**:
In https://github.com/kubernetes/kubernetes/pull/67578 we updated the image. Let's please switch to the new image

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Taint node in paralle.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #67823 

**Release note**:
```release-note
None
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

client: periodically reload InClusterConfig token

/sig auth
/sig api-machinery

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63437, 68081). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Enable ImageLocalityPriority by default with integration tests

**What this PR does / why we need it**:

This PR is a follow-up to [#63842](https://github.com/kubernetes/kubernetes/issues/63842). It moves the ImageLocalityPriority function to default priority functions of the default algorithm provider and adds integration tests for the updated scheduling policy.

- Compared to [#64662](https://github.com/kubernetes/kubernetes/pull/64662), this PR does note provide e2e test due to concerns about a large image may add too much overhead to the testing infrastructure and pipeline. We should add e2e tests in the future with the use of large enough image(s) in following PRs. 

- Compared to [#64662](https://github.com/kubernetes/kubernetes/pull/64662), this PR simplifies the code changes and keeps code changes under test/integration/scheduler/.

- The PR contains a bug fix for [#65745](https://github.com/kubernetes/kubernetes/pull/65745) - caught by the integration test - where the image states are not properly cloned to the scheduler's cachedNodeInfoMap. We might split this fix into a separate PR.

The integration test covers what follows: a pod requiring a large image (~= 3GB) is submitted to the cluster and there is a single node in the cluster has the same large image; the pod should get scheduled to that node. We might also consider whether more scenarios are desired.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

Kindly ping @resouer and @bsalamat 

**Release note**:

```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 63437, 68081). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

fix #51135 make CFS quota period configurable

**What this PR does / why we need it**:

This PR makes it possible for users to change CFS quota period from the default 100ms to some other value between 1µs and 1s.
#51135 shows that multiple production users have serious issues running reasonable workloads in kubernetes. The latency added by the 100ms CFS quota period is adding way too much time.

**Which issue(s) this PR fixes**:
Fixes #51135 

**Special notes for your reviewer**:
- 5ms is used by user experience https://github.com/kubernetes/kubernetes/issues/51135#issuecomment-384908627
- Latency added caused by CFS 100ms is shown at https://github.com/kubernetes/kubernetes/issues/51135#issuecomment-373454012
- explanation why we should not disable limits https://github.com/kubernetes/kubernetes/issues/51135#issuecomment-385346661
- agreement found at kubecon EU 2018: https://github.com/kubernetes/kubernetes/issues/51135#issuecomment-386623964

**Release note**:
```release-note
Adds a kubelet parameter and config option to change CFS quota period from the default 100ms to some other value between 1µs and 1s. This was done to improve response latencies for workloads running in clusters with guaranteed and burstable QoS classes.  
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Hide & warn on GA & deprecated feature gates

**What this PR does / why we need it**:

1. Hide GA & deprecated feature gates from the help text
2. Print a warning when GA & deprecated feature gates are explicitly set

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
For #46404

**Special notes for your reviewer**:

I need to add to my list of things I dislike about glog that it is impossible to test.

**Release note**:
```release-note
NONE
```

/kind cleanup

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

cloud-ctrl-mgr: enable secure port 10258

This PR enables authn+authz (delegated to the kube-apiserver) and the secure port 10258 for the cloud-controller-manager. In addition, the insecure port is disabled.

This is the counterpart PR to https://github.com/kubernetes/kubernetes/pull/64149.

Moreover, it adds integration test coverage for the `--port` and `--secure-port` flags, plus the testserver infrastructure to tests flags in general inside integration tests.

```release-note
Enable secure serving on port 10258 to cloud-controller-manager (configurable via `--secure-port`). Delegated authentication and authorization have to be configured like for aggregated API servers.
```

fix #51135 make CFS quota period configurable, adds a cli flag and config option to kubelet to be able to set cpu.cfs_period and defaults to 100ms as before.
It requires to enable feature gate CustomCPUCFSQuotaPeriod.
Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

Automatic merge from submit-queue (batch tested with PRs 67578, 68154, 68162, 65545). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

fix usage string for the kubectl logs command

Even though the use of an inline [CONTAINER] name is still accepted for,
legacy purpose the error message does not match what the documentation
or man page says. This commit aligns the usage string that is displayed
when the `kubectl logs` command is called with more than one container
name (with the use of the -c flag or not).

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 67578, 68154, 68162, 65545). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Add RuntimeClass read permission for nodes

**What this PR does / why we need it**:
Add the necessary permissions for nodes to read RuntimeClasses when the feature gate is enabled.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
For kubernetes/features#585

**Release note**:
Covered by #67737
```release-note
NONE
```

/sig node
/sig auth
/kind feature
/priority important-soon
/milestone v1.12

Automatic merge from submit-queue (batch tested with PRs 67578, 68154, 68162, 65545). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

make deps-approvers the approvers of sample-cli-plugin/Godeps

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 67578, 68154, 68162, 65545). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Fixes #67561 Multiple same headers got wrong result on gcr.io/google-containers/echoserver:1.10

**What this PR does / why we need it**:
Fix a bug of echoserver

**Which issue(s) this PR fixes**:
Fixes #67561

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Add ability to build with runtime coverage instrumentation

**What this PR does / why we need it**:

This PR adds the ability to instrument a subset of kubernetes binaries to report code coverage information. The specific use-case is to help determine coverage of our end-to-end Conformance tests, as well as provide data that can be used to help determine where to focus. This PR focuses on making it possible to build with instrumentation; collecting and using the generated coverage data will be done in later PRs. For more details as to the intent, see the [design doc](https://docs.google.com/document/d/1FKMBFxz7vtA-6ZgUkA47F8m6yR00fwqLcXMVJqsHt0g/edit?usp=sharing) (google doc; requires kubernetes-dev membership).

Specifically, this PR adds a new `KUBE_BUILD_WITH_COVERAGE` make variable, which when set will cause `kube-apiserver`, `kube-controller-manager`, `kube-scheduler`, `kube-proxy` and `kubelet` to be built with coverage instrumentation. These coverage-instrumented binaries will flush coverage information to disk every five seconds, defaulting to a temporary directory unless the `KUBE_COVERAGE_FILE` environment variable is set at launch, in which case it will write to that file instead.

The mechanism used to achieve coverage instrumentation is to build the targeted binaries as "unit tests" with coverage enabled, and then rigging the unit tests to just execute the binary's usual entry point. This is implemented only for the bash build system.

/sig testing

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Reduce the minwidth of the cli table printer

For a few columns we want to have a smaller width and 10 is excessive. The example is CPU and memory for nodes.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Add spiffxp to OWNERS files in bash-heavy dirs

I'm comfortable approving changes in hack/, I think I still need
to build up a corpus of reviews in build/ and cluster/ before I'm
comfortable asking for those rights. I'm willing to be voluntold
otherwise if existing approvers feel differently.

Approvers, WDYT?

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Support extra prune resources in kube-addon-manager.

The default prune whitelist resources in https://github.com/kubernetes/kubernetes/blob/master/pkg/kubectl/cmd/apply.go#L531 are sometimes not enough.

One example is that when we remove an admission webhook running as an addon pod, after we remove the addon yaml file, the admission webhook pod will be pruned, but the `MutatingWebhookConfiguration`/`ValidationWebhookConfiguration` won't... If the webhook failure policy is `Fail`, this will break the cluster, and users can't create new pods anymore.

It would be good to at least make this configurable, so that users and vendors can configure it based on their requirement.

This PR keeps the default prune resource list exactly the same with before, just makes it possible to add extra ones.

@dchen1107 @MrHohn @kubernetes/sig-cluster-lifecycle-pr-reviews  @kubernetes/sig-gcp-pr-reviews 
Signed-off-by: Lantao Liu <lantaol@google.com>

**Release note**:
```release-note
Support extra `--prune-whitelist` resources in kube-addon-manager.
```

Automatic merge from submit-queue (batch tested with PRs 67571, 67284, 66835, 68096, 68152). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

cluster: delete some push remanents

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 67571, 67284, 66835, 68096, 68152). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

add make targets for building server images

**What this PR does / why we need it**: Adds `make release-images` and `make quick-release-images`, which allow building the docker-wrapped images without building a full release. Without these you can either use `make {quick}-release` and build test tarballs etc, or hack around in the build system yourself. Using this can be considerably faster if you just want to build the binaries and images, and not the release tarballs etc.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/sig release

Automatic merge from submit-queue (batch tested with PRs 67571, 67284, 66835, 68096, 68152). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

cloudprovider: aws: return true on existence check for stopped instances

xref https://bugzilla.redhat.com/show_bug.cgi?id=1559271
xref https://github.com/openshift/origin/issues/19899

background https://github.com/kubernetes/kubernetes/pull/45986#issuecomment-386332055

Basically our customers are hitting this issue where the Node resource is deleted when the AWS instances stop (not terminate).  If the instances restart, the Nodes lose any labeling/taints.

Openstack cloudprovider already made this change https://github.com/kubernetes/kubernetes/pull/59931

fixes https://github.com/kubernetes/kubernetes/issues/45118 for AWS

**Reviewer note**: valid AWS instance states are `pending | running | shutting-down | terminated | stopping | stopped`.  There might be a case for returning `false` for instances in `pending` and/or `terminated` state.  Discuss!

`InstanceID()` changes from https://github.com/kubernetes/kubernetes/pull/45986 credit @rrati 

@derekwaynecarr @smarterclayton @liggitt @justinsb @jsafrane @countspongebob

Automatic merge from submit-queue (batch tested with PRs 67571, 67284, 66835, 68096, 68152). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

apiserver returns continue together with the 410 error

Implements https://github.com/kubernetes/kubernetes/issues/66981#issuecomment-410845134.

Closes #66981.

/sig api-machinery
/assign @lavalamp @liggitt @smarterclayton 

```release-note
Upon receiving a LIST request with expired continue token, the apiserver now returns a continue token together with the 410 "the from parameter is too old " error. If the client does not care about getting a list from a consistent snapshot, the client can use this token to continue listing from the next key, but the returned chunk will be from the latest snapshot.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Transitioning container-runtime e2e_node test to e2e

**What this PR does / why we need it**:
This is a continuation of an existing PR #67258 to transition [few runtime NodeConformance tests](https://github.com/kubernetes/kubernetes/issues/67103#issuecomment-411483640) from e2e_node to e2e (e2e/common).

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #67103

**Special notes for your reviewer**:
In order to make simple clear naming of test, they are updated to 
> "_Container Runtime blackbox test when starting a container that exits should run with the expected status [NodeConformance]_" 
>"~~_Container Runtime Conformance Test container runtime conformance blackbox test when starting a container that exits it should run with the expected status [NodeConformance]_~~"

which requires updation of test names in test/test_owners.csv and test_owners.json file. Do we have any automated script to update these test_owners file or do we need to update them manually in both files?

Please feel free to comment incase we don't want to change test name.

Newly updated codebase includes following changes accomplishing all previously [mentioned](https://github.com/kubernetes/kubernetes/pull/67258#pullrequestreview-147294021) requested changes(reviews)
- [Test name](https://github.com/kubernetes/kubernetes/pull/67258/files#diff-0dc16dc0a015699e53bda03495adc49eR36) change.
- Container's [image name](https://github.com/kubernetes/kubernetes/pull/67258/files#diff-0dc16dc0a015699e53bda03495adc49eR144)
- [By()](https://github.com/kubernetes/kubernetes/pull/67258/files#diff-0dc16dc0a015699e53bda03495adc49eR109) statement
- [Removed test](https://github.com/kubernetes/kubernetes/pull/67258/files#diff-178a0a673bda44ea7a86bd94070df78cR137) from conformance golden list

This would close existing PR #67258
 
**Release note**:

```release-note
NONE
```
/area conformance
@kubernetes/sig-node-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 65251, 67255, 67224, 67297, 68105). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Cleanup PodSecurityPolicy AllowPrivEsc tests

**What this PR does / why we need it**:

Old tests were confusing and missing a lot of combinations. The new test is a simple table-driven test with all valid combinations.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes ##67387

**Special notes for your reviewer**:
Alternative to https://github.com/kubernetes/kubernetes/pull/67388

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 65251, 67255, 67224, 67297, 68105). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Sync peer-finder code from contrib repo

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/contrib/issues/2643

**Special notes for your reviewer**:
This is just an code sync up PR from https://github.com/kubernetes/contrib/pull/2644

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 65251, 67255, 67224, 67297, 68105). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Add namespace for (cluster)role(binding) cloud-provider.

**What this PR does / why we need it**:
Add namespace for (cluster)role(binding) cloud-provider.
Change the addonmanager mode to be from reconcile to EnsureExists.

Needs to be cherrypicked together with https://github.com/kubernetes/kubernetes/pull/59686.

**Special notes for your reviewer**:
/assign @bowei @tallclair 
/sig auth

**Release note**:

```release-note
Role, ClusterRole and their bindings for cloud-provider is put under system namespace. Their addonmanager mode switches to EnsureExists.
```

Manual tested. Cluster can be created succesfully using kube-up.sh with desired (cluster)role(binding)s.

Automatic merge from submit-queue (batch tested with PRs 65251, 67255, 67224, 67297, 68105). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Promote mount propagation to GA

**What this PR does / why we need it**:

This PR promotes mount propagation to GA.

Website PR: https://github.com/kubernetes/website/pull/9823

**Release note**:

```release-note
Mount propagation has promoted to GA. The `MountPropagation` feature gate is deprecated and will be removed in 1.13.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Add docker images for node perf testing workloads.

This PR adds docker images for the workloads used in node performance testing.
Partially fixes: https://github.com/kubernetes/kubernetes/pull/65249

CC @ConnorDoyle 

This PR has been tested in the following environment:
- n1-standard-16
- Ubuntu 16.04
- docker 17.03.2

Signed-off-by: Klaus Ma <klaus1982.cn@gmail.com>

Signed-off-by: Lantao Liu <lantaol@google.com>

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Update resource-consumer usage

**What this PR does / why we need it**:

The e2e tests are using version 1.3 of resource-consumer from
gcr.io/kubernetes-e2e-test-images since [1]. In addition, HPA
works fine for a deployment with --requrests flag.
So this updates the README.md for fitting current condition.

[1]: https://github.com/kubernetes/kubernetes/blob/master/test/utils/image/manifest.go#L86

**Release note**: NONE

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

svcacct: pass pod information in user.Info.Extra() when available

For https://github.com/kubernetes/kubernetes/issues/59670 but won't fix until we move to the new token volume source.

ref #58790

```release-note
UserInfo derived from service account tokens created from the TokenRequest API now include the pod name and UID in the Extra field.
```