Automatic merge from submit-queue

hack/verify-staging-client-go.sh: use git-archive to survive dirty working tree

We used rsync before and copied over the checkout. If some other script, created or changed files, godep refused to run.

Now the script uses git-archive against HEAD instead.

Automatic merge from submit-queue

move kube-dns to a separate service account

Switches the kubedns addon to run as a separate service account so that we can subdivide RBAC permission for it.  The RBAC permissions will need a little more refinement which I'm expecting to find in https://github.com/kubernetes/kubernetes/pull/38626 .

@cjcullen @kubernetes/sig-auth since this is directly related to enabling RBAC with subdivided permissions
 @thockin @kubernetes/sig-network since this directly affects now kubedns is added.  


```release-note
`kube-dns` now runs using a separate `system:serviceaccount:kube-system:kube-dns` service account which is automatically bound to the correct RBAC permissions.
```

Automatic merge from submit-queue

add deads2k and sttts to kubeapiserver owners

Adds @deads2k and @sttts to packages we authored or significantly modified.

@lavalamp @smarterclayton

Automatic merge from submit-queue (batch tested with PRs 39855, 41433, 41567, 41887, 41652)

Switch namespace controller to shared informer

@smarterclayton @derekwaynecarr @gmarek @wojtek-t @deads2k @sttts @liggitt @kubernetes/sig-scalability-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 39855, 41433, 41567, 41887, 41652)

Use watch param instead of deprecated /watch/ prefix

Reopen of https://github.com/kubernetes/kubernetes/pull/41722 after reverted in https://github.com/kubernetes/kubernetes/pull/41774

Required https://github.com/kubernetes/kubernetes/pull/41797 to merge first

cc @deads2k @wojtek-t

Automatic merge from submit-queue (batch tested with PRs 39855, 41433, 41567, 41887, 41652)

Add fluentd monitoring to fluentd-gcp image

Right now we are not able to monitor the state of fluentd in cluster, which may result in logging subsystem quietly failing. This PR tries to address that problem by introducing the fluentd container monitoring:

* fluentd internal metrics, like number of buffers and number of data in buffers
* `logging_line_count`, number of lines, read by fluentd from application containers' logs
    * Has `tag` label, corresponding to the fluentd tag of the entry
* `logging_entry_count`, number of entries, emitted to the output plugin
    * With label `component` set to `container`, generated by application containers
    * With label `component` set to `system`, generated by system components like kubelet, docker, scheduler, etc.
    * Has `tag` label, corresponding to the fluentd tag of the entry

CC @fabxc @igorpeshansky @edsiper

Automatic merge from submit-queue (batch tested with PRs 39855, 41433, 41567, 41887, 41652)

add --ignore-not-found option

Related downstream issue https://github.com/openshift/origin/issues/12867#event-961812896

Adds `--ignore-not-found` option that works similarly to the one found in [delete](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubectl/cmd/delete.go#L154).

Allows for scripts to request specific resources that might not exist, without dealing with ambiguous exit code `1`.

**Release note**:
```release-note
NONE
```

cc @smarterclayton @jupierce @fabianofranz

Automatic merge from submit-queue

route53: configure verbose authentication errors

Otherwise we get an error message which is confusingly written on
authentication failures.

Probably blocked on #39854

Automatic merge from submit-queue (batch tested with PRs 38702, 41810, 41778, 41858, 41872)

Remove changes that accidentally sneaked in during a rebase.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 38702, 41810, 41778, 41858, 41872)

[Kubemark] Fixed hollow-npd container command to log to file

Fixes #41802 

cc @wojtek-t @gmarek @Random-Liu

Automatic merge from submit-queue (batch tested with PRs 38702, 41810, 41778, 41858, 41872)

fix some typos and var style

**Release note**:

```NONE
```

Automatic merge from submit-queue (batch tested with PRs 38702, 41810, 41778, 41858, 41872)

Always enable RBAC in kubeadm and make a pkg with authorization constants

**What this PR does / why we need it**:

This PR:
 - Splits the authz constants out into a dedicated package, so consumers don't have to import lots of other things (informers, etc...)
 - Makes a `IsValidAuthorizationMode` function for easy checking
 - Hooks up kubeadm against the new constant package, for example using the validation method when validating the kubeadm API obj
 - Always enables RBAC in kubeadm as discussed with @liggitt and @jbeda 
   - This because we have to grant some rules in all cases for kubeadm (for instance, making the cluster-info configmap public) 
 - Adds more unit tests

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@liggitt @jbeda @errordeveloper @dmmcquay @pires @deads2k

Automatic merge from submit-queue (batch tested with PRs 38702, 41810, 41778, 41858, 41872)

gce: Reuse unsuccessfully provisioned volumes.

GCE PD names generated by Kubernetes are guaranteed to be unique - they
contain name of the cluster and UID of the PVC that is behind it.
Presence of a GCE PD that has the same name as we want to provision
indicates that previous provisioning did not go well and most probably
the controller manager process was restarted in the meantime.

Kubernetes should reuse this volume and not provision a new one.

Fixes #38681

Automatic merge from submit-queue

Add ClassName attributes to PV and PVC

This just adds new attributes to PV/PVC. Real code that uses the attributes instead of beta annotations will follow when we agree on the attribute names / style.

Automatic merge from submit-queue (batch tested with PRs 41540, 41808, 41710, 41838, 41840)

Make make quick-release quick again

**What this PR does / why we need it**: fix bug in #39257 which was causing `make quick-release` to build for all platforms.

It seems like the `make` target variable line was setting `KUBE_RELEASE_RUN_TESTS` to `n KUBE_FASTBUILD = true`, rather than setting both variables.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 41540, 41808, 41710, 41838, 41840)

kubeadm: update token to use '.' in discovery pkg

**What this PR does / why we need it**: While working on getting https://github.com/kubernetes/community/pull/381 implemented, I noticed the kubeadm discovery pkg was printing out tokens incorrectly. Corrected and fixed up corresponding test. 

**Special notes for your reviewer**: /cc @luxas @jbeda 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 41540, 41808, 41710, 41838, 41840)

kubeadm: Remove the --cloud-provider flag for beta init UX

**What this PR does / why we need it**:

We decided the `--cloud-provider` flag promises way too much compared to what it really does. There is a lot you have to do as an user in order to make the current cloud provider integrations to work. And since we're promising to support the `kubeadm init` UX on a beta level in v1.6, we can't have this flag in the UX. A lot is gonna change here... see proposal: https://github.com/kubernetes/community/pull/128

Once we find a cloudprovider solution we can support (probably using the new flow), we'll just add it.
For now, we'll just document how to do cloudprovider integrations by hand instead. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
kubeadm: Remove the --cloud-provider flag for beta init UX
```
@jbeda @dmmcquay @mikedanese @roberthbailey @pires @errordeveloper

Automatic merge from submit-queue (batch tested with PRs 41540, 41808, 41710, 41838, 41840)

Add randomized load test

Automatic merge from submit-queue (batch tested with PRs 41540, 41808, 41710, 41838, 41840)

Update etcd Godeps to 3.0.17

Automatic merge from submit-queue

Include all user.Info data in CSR object

In order to use authorization checks to auto-approve CSRs in the future, we need all the info from the user.Info interface.

This mirrors the API fields in the TokenReview API used to return user info, and in the SubjectAccessReview API we use to check authorization.

```release-note
The CertificateSigningRequest API added the `extra` field to persist all information about the requesting user. This mirrors the fields in the SubjectAccessReview API used to check authorization.
```

Automatic merge from submit-queue

Fix flake in quota integration test

Fixes https://github.com/kubernetes/kubernetes/issues/41885

Automatic merge from submit-queue (batch tested with PRs 41812, 41665, 40007, 41281, 41771)

Bump golang versions to 1.7.5

**What this PR does / why we need it**: While #41636 might not make it in until 1.7, this would bump current golang versions from 1.7.4 to 1.7.5 to integrate the fixes from that patch version. This would include, among other things, a fix to ensure cross-built binaries for darwin don't have certificate validation errors (golang/go#18688)

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: none

**Special notes for your reviewer**:

**Release note**:

```release-note
Upgrade golang versions to 1.7.5
```

Automatic merge from submit-queue (batch tested with PRs 41812, 41665, 40007, 41281, 41771)

kube-apiserver: add a bootstrap token authenticator for TLS bootstrapping

Follows up on https://github.com/kubernetes/kubernetes/pull/36101

Still needs:

* More tests.
* To be hooked up to the API server.
  - Do I have to do that in a separate PR after k8s.io/apiserver is synced?
* Docs (kubernetes.io PR).
* Figure out caching strategy.
* Release notes.

cc @kubernetes/sig-auth-api-reviews @liggitt @luxas @jbeda

```release-notes
Added a new secret type "bootstrap.kubernetes.io/token" for dynamically creating TLS bootstrapping bearer tokens.
```

Automatic merge from submit-queue (batch tested with PRs 41812, 41665, 40007, 41281, 41771)

Kubelet-rkt: Add useful informations for Ops on the Kubelet Host

Create a Systemd SyslogIdentifier inside the [Service]
Create a Systemd Description inside the [Unit]

**What this PR does / why we need it**:

#### Overview
Logged against the host, it's difficult to identify who's who.
This PR add useful information to quickly get straight to the point with the **DESCRIPTION** field:

```
systemctl list-units "k8s*"
UNIT                                             LOAD   ACTIVE SUB     DESCRIPTION
k8s_b5a9bdf7-e396-4989-8df0-30a5fda7f94c.service loaded active running kube-controller-manager-172.20.0.206
k8s_bec0d8a1-dc15-4b47-a850-e09cf098646a.service loaded active running nginx-daemonset-gxm4s
k8s_d2981e9c-2845-4aa2-a0de-46e828f0c91b.service loaded active running kube-apiserver-172.20.0.206
k8s_fde4b0ab-87f8-4fd1-b5d2-3154918f6c89.service loaded active running kube-scheduler-172.20.0.206

```

#### Overview and Journal

Always on the host, to easily retrieve the pods logs, this PR add a SyslogIdentifier named as the PodBaseName.


```
# A DaemonSet prometheus-node-exporter is running on the Kubernetes Cluster
systemctl list-units "k8s*" | grep prometheus-node-exporter
k8s_c60a4b1a-387d-4fce-afa1-642d6f5716c1.service loaded active running prometheus-node-exporter-85cpp

# Get the logs from the prometheus-node-exporter DaemonSet 
journalctl -t prometheus-node-exporter | wc -l
278
```

Sadly the `journalctl` flag `-t` / `--identifier` doesn't allow a pattern to catch the logs.

Also this field improve any queries made by any tools who exports the Journal (E.g: ES, Kibana):
```
{
	"__CURSOR" : "s=86fd390d123b47af89bb15f41feb9863;i=164b2c27;b=7709deb3400841009e0acc2fec1ebe0e;m=1fe822ca4;t=54635e6a62285;x=b2d321019d70f36f",
	"__REALTIME_TIMESTAMP" : "1484572200411781",
	"__MONOTONIC_TIMESTAMP" : "8564911268",
	"_BOOT_ID" : "7709deb3400841009e0acc2fec1ebe0e",
	"PRIORITY" : "6",
	"_UID" : "0",
	"_GID" : "0",
	"_SYSTEMD_SLICE" : "system.slice",
	"_SELINUX_CONTEXT" : "system_u:system_r:kernel_t:s0",
	"_MACHINE_ID" : "7bbb4401667243da81671e23fd8a2246",
	"_HOSTNAME" : "Kubelet-Host",
	"_TRANSPORT" : "stdout",
	"SYSLOG_FACILITY" : "3",
	"_COMM" : "ld-linux-x86-64",
	"_CAP_EFFECTIVE" : "3fffffffff",
	"SYSLOG_IDENTIFIER" : "prometheus-node-exporter",
	"_PID" : "88827",
	"_EXE" : "/var/lib/rkt/pods/run/c60a4b1a-387d-4fce-afa1-642d6f5716c1/stage1/rootfs/usr/lib64/ld-2.21.so",
	"_CMDLINE" : "stage1/rootfs/usr/lib/ld-linux-x86-64.so.2 stage1/rootfs/usr/bin/systemd-nspawn [....]",
	"_SYSTEMD_CGROUP" : "/system.slice/k8s_c60a4b1a-387d-4fce-afa1-642d6f5716c1.service",
	"_SYSTEMD_UNIT" : "k8s_c60a4b1a-387d-4fce-afa1-642d6f5716c1.service",
	"MESSAGE" : "[ 8564.909237] prometheus-node-exporter[115]: time=\"2017-01-16T13:10:00Z\" level=info msg=\" - time\" source=\"node_exporter.go:157\""
}
```

Automatic merge from submit-queue (batch tested with PRs 41812, 41665, 40007, 41281, 41771)

initialize directory while creating checkpoint file store

fixes: #41616 
ref: https://github.com/kubernetes/kubernetes/issues/41225

Automatic merge from submit-queue (batch tested with PRs 41812, 41665, 40007, 41281, 41771)

Updated auto generated codes.

Fixes missed generated codes.

Generated by `./hack/update-federation-api-reference-docs.sh`, `./hack/update-generated-swagger-docs.sh`
, `./hack/update-federation-generated-swagger-docs.sh`, `./hack/update-federation-swagger-spec.sh`

Add ability to disable dumping logs

Automatic merge from submit-queue (batch tested with PRs 41797, 41793, 41795, 41807, 41781)

Don't use base64 encoding with etcd v3

In https://github.com/kubernetes/kubernetes/pull/36229 we changed the default storage to etcd v3.

This in fact is a fix to that PR.

With etcd v3, the base64-encoding is no longer needed - so we use it only if etcd v2 is explicitly requested as storage format.

@lavalamp

Automatic merge from submit-queue (batch tested with PRs 41797, 41793, 41795, 41807, 41781)

Remove unnecessary metrics (http/process/go) from being exposed by etcd-version-monitor

Unregister metrics we do not want from the etcd version metrics handler.

cc @wojtek-t @piosz