Automatic merge from submit-queue (batch tested with PRs 60542, 60237). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Audit use buffered backend

This is the next step after https://github.com/kubernetes/kubernetes/pull/60076

This PR fixes https://github.com/kubernetes/kubernetes/issues/53020, to address https://github.com/kubernetes/kubernetes/issues/53006 later

In this PR buffered backend, introduced in https://github.com/kubernetes/kubernetes/pull/60076, is used to replace ad-hoc solution for webhook and add an ability to enable buffering for the log audit backend.

```release-note
Log audit backend can now be configured to perform batching before writing events to disk.
```

/cc @sttts @tallclair @ericchiang @CaoShuFeng

Automatic merge from submit-queue (batch tested with PRs 60542, 60237). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Allow update/patch of CRs while CRD is terminating

Fixes #60538

Update/patch need to be allowed so finalizers can act on custom resources for terminating CRDs

```release-note
Fixes potential deadlock when deleting CustomResourceDefinition for custom resources with finalizers
```

Automatic merge from submit-queue (batch tested with PRs 60623, 60625, 60520). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add retries to resource deletions in testing framework

Fix https://github.com/kubernetes/kubernetes/issues/55860
(last piece towards fixing it hopefully)

/cc @wojtek-t 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 60623, 60625, 60520). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix azure file plugin failure issue on Windows after node restart

**What this PR does / why we need it**:
azure file plugin on Windows does not work after node restart, this is due to New-SmbGlobalMapping powershell cmdlet has lost account name/key after reboot, we should remove the invalid link and do the mount again after kubelet restart.
add remount logic for azure file plugin in this PR

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #60624

**Special notes for your reviewer**:

**Release note**:

```
fix azure file plugin failure issue on Windows after node restart
```
/sig azure
/sig windows
/assign @karataliu 
@feiskyer  pls mark this PR as v1.10 milestone, thanks

Automatic merge from submit-queue (batch tested with PRs 60623, 60625, 60520). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Set default vmtype to standard if not set

**What this PR does / why we need it**:

When using IMDS, kubelet reports Failed to extract vmssVMName even when vmtype is not set:

```
E0301 05:30:57.515306    3124 azure_vmss_cache.go:52] Failed to extract vmssVMName "77890k8s9010"
E0301 05:30:57.515306    3124 kubelet_node_status.go:79] Unable to construct v1.Node object for kubelet: failed to get external ID from cloud provider: not a vmss instance
```

azure cloud provider shouldn't call vmss logic in this case. It should assume stardard vmtype if it is not set.


**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #60622

**Special notes for your reviewer**:

**Release note**:

```release-note
Set Azure vmType to standard if it is not set in azure cloud config.
```

Automatic merge from submit-queue (batch tested with PRs 60362, 60629, 60572). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

improve get description

ref: #60210

/assign @deads2k 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 60362, 60629, 60572). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix warning info format

Before this change:
```
$ kubectl exec -p nginx-aaaaaaaaaaaaa-67b58bf687-r68b9 ls
-p POD_NAME is DEPRECATED and will be removed in a future version. Use exec POD_NAME instead.bin
boot
dev
...

$ kubectl scale --replicas=2 job/pi
kubectl scale job is DEPRECATED and will be removed in a future version.job.batch "pi" scaled
```

After this change:
```
$ kubectl exec -p nginx-aaaaaaaaaaaaa-67b58bf687-r68b9 ls
-p POD_NAME is DEPRECATED and will be removed in a future version. Use exec POD_NAME instead.
bin
boot
dev
...

$ kubectl scale --replicas=2 job/pi
kubectl scale job is DEPRECATED and will be removed in a future version.
job.batch "pi" scaled
```



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 60362, 60629, 60572). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add TestUpdateStatus for horizontalpodautoscaler

**What this PR does / why we need it**:

add `TestUpdateStatus` for horizontalpodautoscaler， and remove the relevant `TODO TestUpdateStatus
`

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix todo:Get rid of this duplicate function IsRetryableAPIError in favour of the one in test/utils

**What this PR does / why we need it**:
fix todo:Get rid of this duplicate function IsRetryableAPIError in favour of the one in test/utils
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Signed-off-by: Mik Vyatskov <vmik@google.com>

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 Add missing table converters for server side printing 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #60488

/assign @smarterclayton @juanvallejo 
/kind bug

**Release note**:
```release-note
None
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Relax time tolerance on KMS test, limit to platforms with unix sockets available

Fixes #60613
Fixes #60614 

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm 710 Switch to a dedicated CA for kubeadm etcd identities

**What this PR does / why we need it**:
On `kubeadm init`/`kubeadm upgrade`, this PR generates an etcd specific CA for signing the following certs:
- etcd serving cert
- etcd peer cert
- apiserver etcd client cert

These certs were previously signed by the kubernetes CA.
The etcd static pod in `local.go` has also been updated to only mount the `/etcd` subdir of `cfg.CertificatesDir`.

New phase command:
```
kubeadm alpha phase certs etcd-ca
```

See the linked issue for details on why this change is an important security feature.

**Which issue(s) this PR fixes**
Fixes https://github.com/kubernetes/kubeadm/issues/710

**Special notes for your reviewer**:

#### on the master
this should still fail:
```bash
curl localhost:2379/v2/keys  # no output
curl --cacert /etc/kubernetes/pki/etcd/ca.crt https://localhost:2379/v2/keys  # handshake error
```
this should now fail: (previously would succeed)
```
cd /etc/kubernetes/pki
curl --cacert etcd/ca.crt --cert apiserver-kubelet-client.crt --key apiserver-kubelet-client.key https://localhost:2379/v2/keys
  # curl: (35) error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate
```
this should still succeed:
```
cd /etc/kubernetes/pki
curl --cacert etcd/ca.crt --cert apiserver-etcd-client.crt --key apiserver-etcd-client.key https://localhost:2379/v2/keys
```

**Release note**:
```release-note
On cluster provision or upgrade, kubeadm generates an etcd specific CA for all etcd related certificates.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Temporary fix for LeaderElect for kube-scheduler

**What this PR does / why we need it**:

kube-controller-manager defaults --leader-elect to true. We should
do the same for kube-scheduler. kube-scheduler used to have this
set to true, but it got lost during refactoring:

efb2bb71

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #59729

**Special notes for your reviewer**:

**Release note**:

```release-note
kube-scheduler: restores default leader election behavior. leader-elect command line parameter should "true"
```

Before this change:
```
$ kubectl exec -p nginx-aaaaaaaaaaaaa-67b58bf687-r68b9 ls
-p POD_NAME is DEPRECATED and will be removed in a future version. Use exec POD_NAME instead.bin
boot
dev
...

$ kubectl scale --replicas=2 job/pi
kubectl scale job is DEPRECATED and will be removed in a future version.job.batch "pi" scaled
```

After this change:
```
$ kubectl exec -p nginx-aaaaaaaaaaaaa-67b58bf687-r68b9 ls
-p POD_NAME is DEPRECATED and will be removed in a future version. Use exec POD_NAME instead.
bin
boot
dev
...

$ kubectl scale --replicas=2 job/pi
kubectl scale job is DEPRECATED and will be removed in a future version.
job.batch "pi" scaled
```

fix comments

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove spxtr from various OWNERS files.

I don't have the time to review PRs quickly anymore.

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Document k8s.gcr.io/etcd image upgrade/downgrade support

Fixes https://github.com/kubernetes/kubernetes/issues/59221

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 client-go: add an exec-based client auth provider

Updates https://github.com/kubernetes/features/issues/541
Implements https://github.com/kubernetes/community/pull/1503
Closes https://github.com/kubernetes/kubernetes/issues/57164

```release-note
client-go: alpha support for exec-based credential providers
```

/sig auth
/kind feature

I don't have the time to review PRs quickly anymore.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add unit test case for nodenames comparison

**What this PR does / why we need it**:
ref https://github.com/kubernetes/kubernetes/pull/60486

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
please merge it after https://github.com/kubernetes/kubernetes/pull/60486

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 58171, 58036, 60540). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Enable IPVS feature gateway by default since it's already beta

**What this PR does / why we need it**:

Per #60501, kubeadm init doesn't support the --feature-gates=SupportIPVSProxyMode=true flag anymore since IPVS is in beta and not alpha anymore. We should enable IPVS feature gateway by default to make kubeadm set up IPVS proxy properly.

**Which issue(s) this PR fixes**:
Fixes #60543

**Special notes for your reviewer**:

**Release note**:

```release-note
Enable IPVS feature gateway by default
```

Automatic merge from submit-queue (batch tested with PRs 58171, 58036, 60540). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

dockershim: Return Labels as Info in ImageStatus.

c6ddc749 added an Info field to
ImageStatusResponse when Verbose is true. This makes the image's
Labels available in that field, rather than unconditionally returning
an empty map.

**What this PR does / why we need it**:

This PR exposes an image's `Labels` through the CRI. In particular, I want this so I can write an `ImageService` wrapper that delegates all operations to a real `ImageService` but also, when the right `Labels`, ensures any needed [nix store](https://nixos.org/nix/) paths are present on the system when an image is pulled, enabling users to use nix for package distribution while still using containers for isolation and kubernetes for orchestration. In general, though, this should be useful for anything that wants to know about an image's `Labels`

**Special notes for your reviewer**:

I'd prefer to put this change into the `Image` protobuf type instead of putting it into `Info` (gated by `Verbose` or not, available in other requests like `ListImages` or not), but that would be a change to the protocol and it seems `Info` was introduced exactly for this purpose. If it's acceptable to put this into `Image`, I'll rework this.

If this change is acceptable, I will also do the work for `cri-o`, `rktlet`, `frakti`, and `cri-containerd` where applicable.

I have started the process for my employer to sign on to the CLA. I don't have reason to expect it to take long, but because there is more work to do if this change is desired I'd prefer if we can start review before that is completed.

**Release note**:

```release-note
dockershim now makes an Image's Labels available in the Info field of ImageStatusResponse
```

Automatic merge from submit-queue (batch tested with PRs 58171, 58036, 60540). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Changing Flexvolume plugin directory on COS in GCE to a durable directory

**What this PR does / why we need it**: The original `/etc/srv/...` directory is in an overlayfs over a path in /tmp, so Flexvolume drivers are erased across node restarts for any reason. Changing it to non-tmpfs location.

Also removing redundant Flexvolume path injection in `config-test.sh` because it's already in `cluster/common.sh`.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #57353

**Release note**:

```release-note
[action required] Default Flexvolume plugin directory for COS images on GCE is changed to `/home/kubernetes/flexvolume`.
```

/assign @roberthbailey @saad-ali 
/cc @chakri-nelluri @wongma7 
/sig storage

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix todo:Move function readinessCheck to util

**What this PR does / why we need it**:
fix todo:Move function readinessCheck to util in test/e2e_node/services
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 60475, 60514, 60506, 59903, 60319). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

E2E: add tests for PSP in the policy API Group

**What this PR does / why we need it**:
E2E tests were added for testing PSP from the "policy" API Group. They are similar to the tests for PSP from the "extensions" API Group.

**Which issue(s) this PR fixes**:
Addressed to: https://github.com/kubernetes/features/issues/5
Follow-up to: https://github.com/kubernetes/kubernetes/pull/54933 and https://github.com/kubernetes/kubernetes/pull/60145

Automatic merge from submit-queue (batch tested with PRs 60475, 60514, 60506, 59903, 60319). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[e2e ingress-gce] Add test for backside re-encryption

**What this PR does / why we need it**:
Add a basic e2e testcase for ingress backside re-encryption. echoheaders image with HTTPS support was added by https://github.com/kubernetes/ingress-nginx/pull/2091.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #NONE 

**Special notes for your reviewer**:
/assign @nicksardo @rramkumar1 
cc @nikhiljindal 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 60475, 60514, 60506, 59903, 60319). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

sh2ju.sh: suppress `which` command output when gdate not found in $PATH

**What this PR does / why we need it**:
`make quick-verify` (and probably some other commands) doesn't produce a lot of unrelated and useless information to a console now.

Here is the related PR in the upstream: https://github.com/manolo/shell2junit/pull/7

How it was before:
>SUCCESS  verify-pkg-names.sh	1s
>Verifying verify-readonly-packages.sh
>which: no gdate in (/usr/lib64/qt-3.3/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/home/coder/bin:/home/coder/git/bin:/opt/maven/bin:/opt/go1.9.2/bin:/home/coder/.cargo/bin:/home/coder/git/src/github.com/openshift/origin/_output/local/bin/linux/amd64:/home/coder/git/kubernetes/third_party/etcd:/opt/groovy-2.4.12/bin:/home/coder/bin:/home/coder/git/bin:/opt/maven/bin:/opt/go1.9.2/bin:/home/coder/.cargo/bin:/home/coder/git/src/github.com/openshift/origin/_output/local/bin/linux/amd64:/home/coder/git/kubernetes/third_party/etcd:/opt/groovy-2.4.12/bin)