Automatic merge from submit-queue

Version gates the ephemeral storage e2e test

Version gates the ephemeral storage e2e test.

**Release note**:
```
NONE
```

@kubernetes/sig-testing-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 52339, 52343, 52125, 52360, 52301)

'*' is valid for allowed seccomp profiles

**What this PR does / why we need it**:
This should be valid on a PodSecurityPolicy, but is currently rejected:
```
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
```

**Which issue this PR fixes**: fixes #52300

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 52339, 52343, 52125, 52360, 52301)

Make log-dump use 'gcloud ssh' for GKE also

Fixes https://github.com/kubernetes/test-infra/issues/4323

I tested it locally (with some hacking for mimicking gke's DumpClusterLogs function in kubetest) and it worked.

cc @ericchiang

Automatic merge from submit-queue (batch tested with PRs 52339, 52343, 52125, 52360, 52301)

dockershim: check if f.Sync() returns an error and surface it

```release-note
dockershim: check the error when syncing the checkpoint.
```

Automatic merge from submit-queue (batch tested with PRs 52339, 52343, 52125, 52360, 52301)

Switch default audit policy to beta and omit RequestReceived stage

Related to https://github.com/kubernetes/kubernetes/issues/52265

```release-note
By default, clusters on GCE no longer sends RequestReceived audit event, if advanced audit is configured.
```

Automatic merge from submit-queue (batch tested with PRs 52339, 52343, 52125, 52360, 52301)

Prevent enabling alpha APIs by default

related to #47691
This is a follow up to #51839 to add a check that we do not enable alpha APIs by default

Automatic merge from submit-queue (batch tested with PRs 48226, 52046, 52231, 52344, 52352)

StatefulSet: Deflake e2e RunHostCmd more.

It turns out that at some points while the Node is recovering from a reboot, we get a different kind of error ("unable to upgrade connection"). Since we can't distinguish these transient errors from an error encountered after successfully executing the remote command, let's just retry all errors for 5min. If this doesn't work, I'm gonna blame it on sig-node.

ref #48031

Automatic merge from submit-queue (batch tested with PRs 48226, 52046, 52231, 52344, 52352)

Log at higher verbosity levels some common SyncPod errors

This log message was 90% of all glog.Errorf level statements reported on a production cluster, hiding other more impactful errors. We already log it in start container, but for extra caution we continue to log it at v(3) here (the downside of not logging a start container error is worse than some log spam at higher levels).

HandleError() is intended only for unknown and unexpected errors.

```release-note
NONE
```

@derekwaynecarr @sjenning

Automatic merge from submit-queue (batch tested with PRs 48226, 52046, 52231, 52344, 52352)

Port Guestbook tests to mutiarch

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #52232 

**Special notes for your reviewer**:

**Release note**:

```NONE
NONE
```

Automatic merge from submit-queue (batch tested with PRs 48226, 52046, 52231, 52344, 52352)

[BugFix] Soft Eviction timer works correctly

fixes #51516

thresholdsMet should not exclude previously met thresholds when we do not have new stats for a threshold.

/assign @vishh @derekwaynecarr 
cc @kubernetes/sig-node-bugs

Automatic merge from submit-queue (batch tested with PRs 48226, 52046, 52231, 52344, 52352)

Log get PVC/PV errors in MaxPD predicate only at high verbosity

The error is effectively ignored since even if a PVC/PV doesn't exist it gets counted, and it's rarely actionable either so let's reduce the verbosity.

Basically a user somewhere on the cluster will have to have done something "wrong" for this error to occur, e.g. if *,while the pod is running, pod's PVC is deleted or pods' PVC's PV is deleted. And from that point forward the logs will be spammed every time the predicate is evaluated on a node where that "wrong" pod exists

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

fix kubectl set env --list description

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
none
```

Automatic merge from submit-queue

Azuredisk mount on windows node

**What this PR does / why we need it**:
This PR will enable azure disk on windows node, customer could create a pod mounted with azure disk on windows node. 
There are a few pending items still left:
1) Current fstype would be forced as NTFS, will change if there is such requirement
2) GetDeviceNameFromMount function is not implemented(empty) because in Linux, we could use "cat /proc/mounts" to read all mounting points in OS easily, but in Windows, there is no such place, I am still figuring out. The empty function would cause a few warning logging, but it will not affect the main logic now.

**Special notes for your reviewer**:
1. This PR depends on https://github.com/kubernetes/kubernetes/pull/51240, which allow windows mount path in config validation
2. There is a bug in docker on windows(https://github.com/moby/moby/issues/34729), the ContainerPath could only be a drive letter now(e.g. D:), dir path would fail in the end.

The example pod with mount path is like below:

```
kind: Pod
apiVersion: v1
metadata:
  name: pod-uses-shared-hdd-5g
  labels:
    name: storage
spec:
  containers:
  - image: microsoft/iis
    name: az-c-01
    volumeMounts:
    - name: blobdisk01
      mountPath: 'F:'
  nodeSelector:
    beta.kubernetes.io/os: windows
  volumes:
  - name: blobdisk01
    persistentVolumeClaim:
      claimName: pv-dd-shared-hdd-5
```

**Release note**:

```release-note

Automatic merge from submit-queue

[GCE kube-up] Add a warning for kube-proxy DaemonSet option

**What this PR does / why we need it**:
Add a warning for kube-proxy DaemonSet option for GCE kube-up so that user will be aware of the risks.

Ref: https://github.com/kubernetes/kubernetes/issues/23225

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #NONE 

**Special notes for your reviewer**:
/assign @bowei 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Add OWNERS for build/debs

**What this PR does / why we need it**:

Makes this directory reflect the actual ownership over this file.
@mikedanese, @pipejakob and myself have worked on the kubeadm e2e CI and the building of debs using bazel, which this folder is responsible for.

@jbeda is already implicitely an owner here

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews

Automatic merge from submit-queue

Update set image description to remove job from resources that can update container image

**What this PR does / why we need it**:
This addressed the comment raised in https://github.com/kubernetes/kubernetes/issues/48388#issuecomment-322500960 by @harrissAvalon

**Special notes for your reviewer**:

**Release note**:

```release-note
none
```

Automatic merge from submit-queue (batch tested with PRs 51041, 52297, 52296, 52335, 52338)

Fix pagesize mount option name

**What this PR does / why we need it**:
Fixes #52337  .

Automatic merge from submit-queue (batch tested with PRs 51041, 52297, 52296, 52335, 52338)

[fluentd-gcp addon] Restore the metric for the number of read log entries

This metric, previously removed, will allow to monitor the number of log entries, that were read, but weren't sent by the output plugin because of liveness probe removing the data.

Automatic merge from submit-queue (batch tested with PRs 51041, 52297, 52296, 52335, 52338)

Glusterfs expands in units of GB not GiB

When expanding glusterfs volumes, we should use GB units not GiB.  More information - https://github.com/heketi/heketi/wiki/API

Fixes https://github.com/kubernetes/kubernetes/issues/52298 

```release-note
Fixes Glusterfs storage allocation units
```

Automatic merge from submit-queue (batch tested with PRs 51041, 52297, 52296, 52335, 52338)

Use cAdvisor constant for crio imagefs

**What this PR does / why we need it**:
code hygiene to use a constant from cAdvisor

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

Node e2e tests for the CPU Manager. 

**What this PR does / why we need it**:
- Adds node e2e tests for the CPU Manager implementation in https://github.com/kubernetes/kubernetes/pull/49186.

**Special notes for your reviewer**: 
- Previous PR in this series: #51180
- Only `test/e2e_node/cpu_manager_test.go` must be reviewed as a part of this PR (i.e., the last commit). Rest of the comments belong in #51357 and #51180.
- The tests have been on run on `n1-standard-n4` and `n1-standard-n2` instances on GCE. 

To run this node e2e test, use the following command:
```sh
make test-e2e-node TEST_ARGS='--feature-gates=DynamicKubeletConfig=true' FOCUS="CPU Manager" SKIP="" PARALLELISM=1
```

CC @ConnorDoyle @sjenning

It turns out that at some points while the Node is recovering from a
reboot, we get a different kind of error ("unable to upgrade
connection"). Since we can't distinguish these transient errors from an
error encountered after successfully executing the remote command,
let's just retry all errors for 5min. If this doesn't work, I'm gonna
blame it on sig-node.

Automatic merge from submit-queue (batch tested with PRs 52007, 52196, 52169, 52263, 52291)

Summary tests should expect rss usage now

**What this PR does / why we need it**:
Fixes summary test to expect rss usage now.

Previously, cAdvisor reported rss and not total_rss, but that has now been fixed in most recent version of cAdvisor now in the project.

See: https://github.com/kubernetes/kubernetes/pull/43399#issuecomment-287858599

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 52007, 52196, 52169, 52263, 52291)

[fluentd-gcp addon] Update event-exporter to address metrics problem

Follow-up of https://github.com/GoogleCloudPlatform/k8s-stackdriver/pull/37:

```
In the clusters with CA, the number of metric streams will continuously grow if the host is included.
```

Name is updated b/c otherwise addon manager will not be able to pick up the change.

Automatic merge from submit-queue (batch tested with PRs 52007, 52196, 52169, 52263, 52291)

Remove links to GCE/AWS cloud providers from PersistentVolumeCo…

…ntroller




**What this PR does / why we need it**:

We should be able to build a cloud-controller-manager without having to
pull in code specific to GCE and AWS clouds. Note that this is a tactical
fix for now, we should have allow PVLabeler to be passed into the
PersistentVolumeController, maybe come up with better interfaces etc. Since
it is too late to do all that for 1.8, we just move cloud specific code
to where they belong and we check for PVLabeler method and use it where
needed.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Fixes #51629

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 52007, 52196, 52169, 52263, 52291)

kubeadm: Enable certificate rotation

**What this PR does / why we need it**:

Enables cert rotation as planned for the v1.8 cycle in https://github.com/kubernetes/kubeadm/issues/386
Can now be done as everything's in place in the code now that beta.1 is released with all the necessary features (Kubelet clientcert rotation now beta, woot!)

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

fixes: https://github.com/kubernetes/kubeadm/issues/386

**Special notes for your reviewer**:

This file does _ONLY_ affect the kubeadm e2e CI.
What will actually end up in the debs/rpms is going into kubernetes/release right before v1.8 is released (due to how those scripts work, not optimal :/ )

**Release note**:

```release-note
kubeadm: Enable kubelet client certificate rotation
```
@kubernetes/sig-cluster-lifecycle-pr-reviews @kubernetes/sig-auth-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 52007, 52196, 52169, 52263, 52291)

Fixed CCM service controller start jitter

**What this PR does / why we need it**: The start jitter for the service controller was running regardless if the service controller was being ran. This should help startup time for CCM's without the service controller implementation. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/cc @wlan0 @andrewsykim @luxas @jhorwit2

/area cloudprovider
/sig cluster-lifecycle

Automatic merge from submit-queue (batch tested with PRs 52119, 52306)

kubeadm: Mark self-hosting alpha in v1.8

**What this PR does / why we need it**:

Self-hosting is alpha in v1.8, not beta. We targeted it to be beta, hence the initial add of this feature gates' value, but now changing back to alpha.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews

Automatic merge from submit-queue

fsync config checkpoint files after writing

@yujuhong brought up that it's possible for a hard reboot to result in empty checkpoint files, if they haven't been synced to disk yet. This PR ensures that Kubelet configuration checkpoints are synced after writing to avoid this issue.

fixes #52222

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

Note equivalence class for dev and other fix

**What this PR does / why we need it**:
1. Add a note for predicate developers to respect equivalence class design
2. Add comments and re-ordered the related data structure, ref https://github.com/kubernetes/community/pull/1031
3. Fix some nits (typo, code length etc)


**Special notes for your reviewer**:

**Release note**:

```release-note
Scheduler predicate developer should respect equivalence class cache
```

Automatic merge from submit-queue (batch tested with PRs 50289, 52106)

Fix AppArmor test at scale

**What this PR does / why we need it**:

The AppArmor test only runs on a single node, but previously was loading the necessary profiles to every node. This caused unnecessary churn in very large clusters, so this PR updates the test to only load the profiles to a single node, and ensure the test pod is run on that node (using pod affinity).

**Which issue this PR fixes**: fixes #51791

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 50289, 52106)

Honor --use-service-account-credentials in cloud-controller-manager

If --use-service-account-credentials is specified, the cloud controller manager should honor it

The distinction between the rootclientbuilder and the clientbuilder came from kube-controller-manager, which is responsible for running the very controllers that enable service accounts. That two-layer approach is not needed in the cloud-controller-manager.

```release-note
The `kube-cloud-controller-manager` flag `--service-account-private-key-file` was non-functional and is now deprecated.
The `kube-cloud-controller-manager` flag `--use-service-account-credentials` is now honored consistently, regardless of whether `--service-account-private-key-file` was specified.
```

Automatic merge from submit-queue (batch tested with PRs 52264, 51870)

Use credentials from providers for docker sandbox image

**What this PR does / why we need it**:

Sandbox image lookup uses creds from docker config only; other credential providers are ignored. This is a regression introduced in dockershim.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #51293

**Special notes for your reviewer**:

Should also cherry-pick this to release-1.6 and release-1.7.

**Release note**:

```release-note
Fix credentials providers for docker sandbox image.
```

Automatic merge from submit-queue (batch tested with PRs 52264, 51870)

fix condition-taint labels

Ref. #51246