Automatic merge from submit-queue (batch tested with PRs 41420, 41500)

Set OrphanDependents=&falseVar so the GC will (or should) remove the dummy Pod

**What this PR does / why we need it**:

ref: https://github.com/kubernetes/kubeadm/issues/149

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

This doesn't remove the Pod yet, only the ReplicaSet, but once the GC is working as expected, it'll remove the Pod with this configuration

**Release note**:

```release-note
NONE
```
@errordeveloper @mikedanese @pires @caesarxuchao @krmayankk @kargakis

Automatic merge from submit-queue

Adds kube-public to the whitelist to not be deleted for e2e tests

We added the `kube-public` namespace but didn't add it to a whitelist of namespaces to not delete as part of e2e cleanup.

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 39373, 41585, 41617, 41707, 39958)

dnsprovider: Expose parent objects in interfaces

This will allow us to pass e.g. a ResourceRecordChangeset, rather than a
ResourceRecordChangeset, the parent ResourceRecordSets, and the
grandparent Zone.

Laying the groundwork for simplifying / optimizing the federation logic.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 39373, 41585, 41617, 41707, 39958)

[Federation][e2e] Remove ns creation in federated clusters

**What this PR does / why we need it**:
In federation e2e, framework creates a namespace for each test case. the same ns is supposed to be created in federated clusters. Due to issues in namespace controller, this was not working earlier. but now it is working.
so currently the namespace is created twice, once by namespace controller and another when we call `getRegisteredClusters`. depending on the timing of these 2 calls, some [test cases fails ](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/logs/ci-kubernetes-e2e-gce-federation/1199#k8sio-federation-secrets-featurefederation-secret-objects-should-not-be-deleted-from-underlying-clusters-when-orphandependents-is-true). So removing the creation of namespace when `getRegisteredClusters` which is unnecessary.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
Fixes flakes in federation e2e.

cc @madhusudancs @nikhiljindal @kubernetes/sig-federation-bugs

Automatic merge from submit-queue (batch tested with PRs 39373, 41585, 41617, 41707, 39958)

Feature-Gate affinity in annotations 

**What this PR does / why we need it**:
Adds back basic flaggated support for alpha Affinity annotations

**Special notes for your reviewer**:
Reconcile function is placed in the lowest common denominator, which in this case is schedulercache, because you can't place flag-gated functions in apimachinery. 

**Release note**:

```
NONE
```

/cc @davidopp

Automatic merge from submit-queue (batch tested with PRs 39373, 41585, 41617, 41707, 39958)

Owners file related changes for kubectl and docs contributors

- adding a command to kubectl updates the root .generated_docs file requiring root level approval: move .generated_docs under docs/
- run hack/update-generated-docs.sh so the docs are up to date
- add kubectl contributors to test/OWNERS and test/fixtures/pkg/kubectl/OWNERS so they can approve kubectl e2e test changes


```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 39373, 41585, 41617, 41707, 39958)

Fix ConfigMaps for Windows

**What this PR does / why we need it**: ConfigMaps were broken for Windows as the existing code used linux specific file paths. Updated the code in `kubelet_getters.go` to use `path/filepath` to get the directories. Also reverted back the code in `secret.go` as updating `kubelet_getters.go` to use `path/filepath` also fixes `secrets`

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/kubernetes/kubernetes/issues/39372

```release-note
Fix ConfigMap for Windows Containers.
```

cc: @pires

Revert the npd change in kubemark.

Automatic merge from submit-queue (batch tested with PRs 41043, 39058, 41021, 41603, 41414)

add defaultTolerationSeconds admission controller

**What this PR does / why we need it**:
Splited from #34825, add a new admission-controller that
1. adds toleration (with tolerationSeconds = 300) for taint `notReady:NoExecute` to every pod that does not already have a toleration for that taint, and
2. adds toleration (with tolerationSeconds = 300) for taint `unreachable:NoExecute` to every pod that does not already have a toleration for that taint.

**Which issue this PR fixes**: 
Related issue: #1574
Related PR: #34825

**Special notes for your reviewer**:

**Release note**:

```release-note
add defaultTolerationSeconds admission controller
```

Automatic merge from submit-queue (batch tested with PRs 41043, 39058, 41021, 41603, 41414)

kubeadm: Make a separate util package for kubeconfig logic

**What this PR does / why we need it**:

There are a lot of packages that need to consume kubeconfig logic, so it should be in a central place.
Having it in `kubeadmutil` is suboptimal, because then it get mixed with everything else.

This splits that logic out to a generic place so it then also can be consumed in https://github.com/kubernetes/kubernetes/pull/41417, from where it's broken out.

 - Move {admin,kubelet}.conf out as constants
 - Make a separate util package for kubeconfig logic

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 41043, 39058, 41021, 41603, 41414)

Rotate the kubelet certificate when about to expire.

Changes the kubelet so it doesn't use the cert/key files directly for
starting the TLS server. Instead the TLS server reads the cert/key from
the new CertificateManager component, which is responsible for
requesting new certificates from the Certificate Signing Request API on
the API Server.

Automatic merge from submit-queue (batch tested with PRs 41043, 39058, 41021, 41603, 41414)

Add cscope related files into .gitignore.

Automatic merge from submit-queue (batch tested with PRs 41043, 39058, 41021, 41603, 41414)

Allow setting replace patchStrategy for structs

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #20208

@liggitt and @ymqytw ptal, you were in the original issue

This will allow us to pass e.g. a ResourceRecordChangeset, rather than a
ResourceRecordChangeset, the parent ResourceRecordSets, and the
grandparent Zone.

Laying the groundwork for simplifying / optimizing the federation logic.

Fix kubemark hollow-npd.

Revert "Generate valid container id in fake docker client."

Automatic merge from submit-queue

Add standalone npd on GCI.

This PR added standalone NPD in GCE GCI cluster. I already verified the PR, and it should work.

/cc @dchen1107 @fabioy @andyxning @kubernetes/sig-node-misc

Automatic merge from submit-queue

nodeports usage should be part of LoadBalancer service type

Since a creation of Service of type LoadBalancer will allocate NodePorts as well, so it makes more sense to account for the NodePort usage in the LoadBalancer switch case.

check here: https://github.com/kubernetes/kubernetes/blob/master/pkg/registry/core/service/rest.go#L553 for the logic on whether it should assign a nodeport for the service.

Automatic merge from submit-queue (batch tested with PRs 41401, 41195, 41664, 41521, 41651)

[Federation][kubefed] Add label selector for etcd pvc

Currently, etcd pvc created for federation etcd does not have a label selector. without a label selector etcd pvc will bind to any pv created statically, this may be problematic in real environments comprising multiple pv's.

Also, verified that we can create a pv statically with labels as below
 ```
  labels:
    "app": "federated-cluster"
    "module": "federation-apiserver"
```
and federation etcd pvc will be bound to the pv matching label.
This is one of the side task, that we discussed in [here](https://github.com/kubernetes/kubernetes/issues/41127#issuecomment-278881319)

cc @madhusudancs @kubernetes/sig-federation-bugs

Automatic merge from submit-queue (batch tested with PRs 41401, 41195, 41664, 41521, 41651)

Allow `make test` to pass on OSX

**What this PR does / why we need it**: `make test` doesn't pass on my OSX setup (10.11.6, go1.7, docker 1.13.1) on `master`, `release-1.5`, nor `release-1.4`.  Our [docs on unit tests](https://github.com/kubernetes/community/blob/master/contributors/devel/testing.md#unit-tests) say they should always pass on OS X.  This PR allows them to pass.

**Release note**:
```release-note
NONE
```

ref: #24717 for the motivation behind dereferencing mount symlinks

/cc @kubernetes/sig-testing-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 41401, 41195, 41664, 41521, 41651)

Ignore bazel-* directories when looking for tests to run

**What this PR does / why we need it**: if you do a Bazel build and then try to run `make test` without `bazel clean`, the test script blows up. cc @cheftako

**Special notes for your reviewer**: there are probably other scripts (e.g. some of `hack/verify-*`) that mishandle the bazel-* convenience symlinks, but I'm not sure if it's worth the effort to fix those unless people complain.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 41401, 41195, 41664, 41521, 41651)

Remove default failure domains from anti-affinity feature

Removing it is necessary to make performance of this feature acceptable at some point.

With default failure domains (or in general when multiple topology keys are possible), we don't have transitivity between node belonging to a topology. And without this, it's pretty much impossible to solve this effectively.

@timothysc

Automatic merge from submit-queue (batch tested with PRs 41401, 41195, 41664, 41521, 41651)

Detect bad unstructured conversions

Ref https://github.com/kubernetes/kubernetes/issues/39017

This PR also speed up the conversion:
before:
```
BenchmarkToFromUnstructured-12           	    1000	   1201132 ns/op	   15335 B/op	     268 allocs/op
BenchmarkToFromUnstructuredViaJSON-12    	    1000	   2127384 ns/op	   29669 B/op	     457 allocs/op
```
after:
```
BenchmarkToFromUnstructured-12           	    2000	    911243 ns/op	   10472 B/op	     196 allocs/op
BenchmarkToFromUnstructuredViaJSON-12    	    1000	   2243216 ns/op	   29665 B/op	     457 allocs/op
```

Automatic merge from submit-queue

Generate valid container id in fake docker client.

Fixes https://github.com/kubernetes/kubernetes/issues/41488.

This PR generates valid container id by hashing container name. So that dockershim checkpoint won't report `checkpoint key XXX is not valid` error.

This PR also reverts #41460.

@yujuhong @freehan /cc @kubernetes/sig-node-pr-reviews

Changes the kubelet so it doesn't use the cert/key files directly for
starting the TLS server. Instead the TLS server reads the cert/key from
the new CertificateManager component, which is responsible for
requesting new certificates from the Certificate Signing Request API on
the API Server.

Automatic merge from submit-queue

Fix the output of health-mointor.sh

The script show prints the errors/response of the health check, but not
show the progress of `curl`.

Automatic merge from submit-queue (batch tested with PRs 41649, 41658, 41266, 41371, 41626)

Understand why kubelet cannot cleanup orphaned pod dirs

**What this PR does / why we need it**:
Understand if we are unable to clean up orphaned pod directories due to a failure to read the directory versus paths still existing to improve ability to debug error situations.

Automatic merge from submit-queue (batch tested with PRs 41649, 41658, 41266, 41371, 41626)

Split request node certificate

Split the `RequestNodeCertificate` function so the behavior can also be used by non-node callers.

Automatic merge from submit-queue (batch tested with PRs 41649, 41658, 41266, 41371, 41626)

Allow `build/run.sh make help` to run

**What this PR does / why we need it**: typo fix; `build/run.sh make help` doesn't work for me on OS X w/ docker 1.13.x, this PR fixes that

**Release note**:

```release-note
NONE
```
 /cc @spxtr

Automatic merge from submit-queue (batch tested with PRs 41649, 41658, 41266, 41371, 41626)

Fix cronjob controller panic on status update failure

#41655

@kubernetes/sig-apps-bugs @soltysh @erictune