Automatic merge from submit-queue

Allow NetworkPolicy.spec updates

ValidateNetworkPolicyUpdate currently prohibits changes to `spec` in an existing NetworkPolicy. We were going to fix this for 1.7 but I forgot to submit this PR after the main PR merged. Too late for 1.7? @thockin @caseydavenport @cmluciano 

This only changes networking.NetworkPolicy validation at the moment... Should I change extensions.NetworkPolicy validation too?

Fixes #35911

We should add a test to the e2e NetworkPolicy test for this too if this is going to merge.

**Release note**:
```release-note
As part of the NetworkPolicy "v1" changes, it is also now
possible to update the spec field of an existing
NetworkPolicy. (Previously you had to delete and recreate a
NetworkPolicy if you wanted to change it.)
```

Automatic merge from submit-queue (batch tested with PRs 48374, 48524, 48519, 42548, 48615)

godep-save.sh: add sanity checks

Might prevent https://github.com/kubernetes/kubernetes/issues/48593.

Automatic merge from submit-queue (batch tested with PRs 48374, 48524, 48519, 42548, 48615)

Use Secrets for files that self-hosted pods depend on

**What this PR does / why we need it**:
See https://github.com/kubernetes/kubeadm/issues/194

**Release note**:

```release-note
NONE
```

```
bash-4.2# kubectl --kubeconfig /etc/kubernetes/admin.conf get pods -n kube-system
NAME                                                   READY     STATUS    RESTARTS   AGE
dummy-1628042694-6ghbq                                 1/1       Running   0          42m
kube-dns-1853130399-4nzx4                              3/3       Running   0          9m
kube-flannel-ds-mnq10                                  2/2       Running   2          12m
kube-flannel-ds-n3tl8                                  2/2       Running   0          42m
kube-proxy-lqpcb                                       1/1       Running   0          42m
kube-proxy-pw0pw                                       1/1       Running   0          12m
self-hosted-kube-apiserver-fkkwd                       1/1       Running   1          42m
self-hosted-kube-controller-manager-1387498942-mzg41   1/1       Running   1          42m
self-hosted-kube-scheduler-2588609441-cwhqb            1/1       Running   1          42m
```

### API Server
```
bash-4.2# kubectl --kubeconfig /etc/kubernetes/admin.conf exec self-hosted-kube-apiserver-fkkwd -n kube-system -- ls /etc/pki
ca-trust
java
nssdb
rpm-gpg
tls
bash-4.2# kubectl --kubeconfig /etc/kubernetes/admin.conf exec self-hosted-kube-apiserver-fkkwd -n kube-system -- ls /etc/ssl
certs
bash-4.2# kubectl --kubeconfig /etc/kubernetes/admin.conf exec self-hosted-kube-apiserver-fkkwd -n kube-system -- ls /etc/kubernetes/
pki
bash-4.2# kubectl --kubeconfig /etc/kubernetes/admin.conf exec self-hosted-kube-apiserver-fkkwd -n kube-system -- ls /etc/kubernetes/pki/
apiserver-kubelet-client.crt
apiserver-kubelet-client.key
apiserver.crt
apiserver.key
ca.crt
front-proxy-ca.crt
sa.pub
```

### Scheduler
```
bash-4.2# kubectl --kubeconfig /etc/kubernetes/admin.conf exec self-hosted-kube-scheduler-2588609441-cwhqb -n kube-system -- ls /etc/kubernetes/
scheduler.conf
```

### Controller Manager
```
bash-4.2# kubectl --kubeconfig /etc/kubernetes/admin.conf exec self-hosted-kube-controller-manager-1387498942-mzg41 -n kube-system -- ls /etc/ssl
certs
bash-4.2# kubectl --kubeconfig /etc/kubernetes/admin.conf exec self-hosted-kube-controller-manager-1387498942-mzg41 -n kube-system -- ls /etc/pki
ca-trust
java
nssdb
rpm-gpg
tls
bash-4.2# kubectl --kubeconfig /etc/kubernetes/admin.conf exec self-hosted-kube-controller-manager-1387498942-mzg41 -n kube-system -- ls /etc/kubernetes/
controller-manager.conf
pki
bash-4.2# kubectl --kubeconfig /etc/kubernetes/admin.conf exec self-hosted-kube-controller-manager-1387498942-mzg41 -n kube-system -- ls /etc/kubernetes/pki/
ca.crt
ca.key
sa.key
```

/cc @luxas @liggitt @pires @timothysc

Automatic merge from submit-queue (batch tested with PRs 48374, 48524, 48519, 42548, 48615)

Kubelet run() should accept partial KubeletDeps

This is used by integrators that want to perform partial overrides of
key interfaces. Refactors the run() method to fit the existing style and
preserve the existing behavior, but allow (for instance) client
bootstrap and cert refresh even when some dependencies are injected.

@derekwaynecarr hit while reviewing client bootstrap code

Automatic merge from submit-queue (batch tested with PRs 48374, 48524, 48519, 42548, 48615)

flush conntrack for udp service when # of backend changes from 0

fixes: #48370

Automatic merge from submit-queue (batch tested with PRs 48374, 48524, 48519, 42548, 48615)

Add a node upgrade test for etcd statefulset with a PDB.

Tests for #38336

Automatic merge from submit-queue

Small fix for number of pods and nodes in test function

**What this PR does / why we need it**:
Small fix to have correct pods and nodes in test function.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
Scheduler perf, nodes and pods number fix for 100 nodes 3k pods.
**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Volunteer to help with OpenStack provider reviews

**What this PR does / why we need it**:

I'd like to help with keeping the OpenStack cloud provider up-to-date

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 48518, 48525, 48269)

Update comment for garbagecollector

Update comment for garbagecollector, update not exist func.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 48518, 48525, 48269)

Cleanup useless metrics.go for garbagecollector

The metrics of garbagecollector are already published with the
workqueue metrics, so metrics.go is useless, let's cleanup it.
See https://github.com/kubernetes/client-go/blob/master/util/workqueue/metrics.go.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 48518, 48525, 48269)

Move the kubelet certificate management code into a single package

Code is very similar and belongs together. Will allow future cert callers to potentially make this more generic, as well as to make it easier reuse code elsewhere.

Automatic merge from submit-queue (batch tested with PRs 47435, 46044)

IPv6 support for getting node IP

As part of ChooseHostInterface(), it will call a function to try to get the
global IP for the host, by looking at all the system interfaces and select
the first IP that is not a loopback, link-local, or point-to-point IP.

This commit does the following:

- Allows IPv6 non-local IPs to be selected.
- IPv4 takes priority (checks all interfaces for IPv4 addresses and
  then checks all interfaces for IPv6), for backward compatibility.
- Adds UTs for code coverage (was no coverage of underlying function),
  increasing from 62% to 85%.
- Improved logging and reporting for error conditions.
- Minor renaming of functions and variables for readability.



**What this PR does / why we need it**:
This will be part of several PRs to add IPv6 support in apimachinery area for use by Kubernetes. It partially fixes the issue.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: xref #44848

**Special notes for your reviewer**:
The intent is to break up the PR 45116 into multiple PRs to take on this change a piece at a time.

**Release note**:

```release-noteNONE
```

Automatic merge from submit-queue (batch tested with PRs 47435, 46044)

kubeadm: Make self-hosting work and split it out to a phase

**What this PR does / why we need it**:

 - Removes the old self-hosting code
 - Puts the new self-hosting code in `phases/selfhosting`
   - The new code reads manifests from disk (static pods)...
   - ...mutates the PodSpec as necessary...
   - ...and posts the DaemonSet to the API Server...
   - ...and waits for it to come up
 - Uses DaemonSets for all control plane components
 - Creates a `kubeadm alpha phase selfhosting` command that can be invoked against any kubeadm-cluster after install.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

fixes: https://github.com/kubernetes/kubeadm/issues/127
(large part of at least)

**Special notes for your reviewer**:

Please only review the fourth commit, based on https://github.com/kubernetes/kubernetes/pull/47345

**Release note**:

```release-note
kubeadm: Make self-hosting work by using DaemonSets and split it out to a phase that can be invoked via the CLI
```
@kubernetes/sig-cluster-lifecycle-pr-reviews @jbeda

This is used by integrators that want to perform partial overrides of
key interfaces. Refactors the run() method to fit the existing style and
preserve the existing behavior, but allow (for instance) client
bootstrap and cert refresh even when some dependencies are injected.

Automatic merge from submit-queue (batch tested with PRs 48538, 43674)

fix JSONPath parser will not filter strings containing parentheses

Fixes https://github.com/kubernetes/client-go/issues/158
@mtaufen  @daizuozhuo @caesarxuchao

Automatic merge from submit-queue

Add node-name flag to `join` phase

**What this PR does / why we need it**: Allow to specify a node-name instead of relaying in `os.Hostname()`
This is useful where kubelet use the name given by the cloud-provider to
register the node.


**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: partially fixes kubernetes/kubeadm#64

**Special notes for your reviewer**:

**Release note**:
```release-note
Added new flag to `kubeadm join`: --node-name, that lets you specify the name of the Node object that's gonna be created
```

Automatic merge from submit-queue

Add ownership for the future of scheduler_perf and kubemark

**What this PR does / why we need it**:

The scheduler_perf project is cross-cutting with the other goals of the performance and scale initiatives, so, I've put together a list of interested parties who have been running, using, and contributing to it.

cc @kubernetes/sig-scheduling-pr-reviews @ravisantoshgudimetla @sjug

Automatic merge from submit-queue

Fix some err message

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Fix invalid Content-Type for 403 error

https://github.com/kubernetes/kubernetes/pull/47384 makes 403 errors return Status Object. However the Content-Type is still "text/plain"
This change fixes it.

Before this change:
kubectl get pods --as=tom
Error from server (Forbidden): {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"pods \"\" is forbidden: User \"tom\" cannot list pods in the namespace \"default\".","reason":"Forbidden","details":{"kind":"pods"},"code":403} (get pods)

After this change:
$ kubectl get pods --as=tom
Error from server (Forbidden): pods "" is forbidden: User "tom" cannot list pods in the namespace "default".



**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```
NONE
```

I'd like to help with keeping the OpenStack cloud provider up-to-date

https://github.com/kubernetes/kubernetes/pull/47384 makes 403 errors
return Status Object. How the Content-Type is still "text/plain"
This change fix it.

Allow to specify a node-name instead of relaying in `os.Hostname()`
This is useful where kubelet use the name given by the cloud-provider to
register the node.

Partially fix: kubernetes/kubeadm#64

Automatic merge from submit-queue

Launch kubemark with an existing Kubemark master

In order to expand the use of kubemark, allow developers to use kubemark with a pre-existing Kubernetes cluster.

Ref issue  #44393

Automatic merge from submit-queue

Fix Audit-ID header key

Now http header key "Audit-ID" doesn't have effect, because golang
automaticly transforms "Audit-ID" into "Audit-Id". This change use
http.Header.Get() function to canonicalize "Audit-ID" to "Audit-Id".


**Release note**:

```
NONE
```

Now http header key "Audit-ID" doesn't have effect, because golang
automaticly transforms "Audit-ID" into "Audit-Id". This change use
http.Header.Get() function to canonicalize "Audit-ID" to "Audit-Id".

Automatic merge from submit-queue

fix cross build

Fix the issue introduced in #48299 which breaks cross-build (https://github.com/kubernetes/kubernetes/pull/48299#issuecomment-312846398).
move setsize.go and setsize_unsupported.go back to util/term for kubelet.
move unmark_windows.go as well.

```release-note
NONE
```

Automatic merge from submit-queue

Enable Service Affinity for OpenStack cloudprovider

Fix issue: #48500
Kubernetes's OpenStack cloudprovider can't set persistence to "SOURCE_IP"

**Release note**:
```release-note
NONE
```

The metrics of garbagecollector are already published with the
workqueue metrics, so metrics.go is useless, let's cleanup it.
See https://github.com/kubernetes/client-go/blob/master/util/workqueue/metrics.go.

Fix issue: #48500
Kubernetes's OpenStack cloudprovider can't set LB's persistence
to "SOURCE_IP".

Automatic merge from submit-queue (batch tested with PRs 48292, 48121)

Add Google cloudkms dependency, add cloudkms service to GCE cloud provider

Required to introduce a Google KMS based envelope encryption, which shall allow encrypting secrets at rest using KEK-DEK scheme.

The above requires KMS API to create/delete KeyRings and CryptoKeys, and Encrypt/Decrypt data.

Should target release 1.8

@jcbsmpsn 

Update: It appears that Godep only allows dependencies which are in use. We may have to modify this PR to include some Google KMS code.

Progresses #48522

Automatic merge from submit-queue (batch tested with PRs 48292, 48121)

Return a slightly more verbose error when "go get" fails.

Automatic merge from submit-queue (batch tested with PRs 48309, 48489)

Check if golint exists first in hack/verify-golint.sh

**What this PR does / why we need it**:
Check if golint exists first in hack/verify-golint.sh

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #48488

**Special notes for your reviewer**:
nope.

**Release note**:

```release-note
NONE
```