Automatic merge from submit-queue (batch tested with PRs 46801, 45184, 45930, 46192, 45563)

Tweak client-gen to support metrics API

This PR adds support to client-gen for readonly APIs as well as for customizing the resource name used for a given type.

This is required to support the clients generated for `k8s.io/metrics/pkg/apis/metrics`.

cc @caesarxuchao 

Currently based on #45180

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

[Flaky PR Test] Fix summary test

fixes issue: #46797 

As we can see in the [example failure build log](https://storage.googleapis.com/kubernetes-jenkins/logs/ci-kubernetes-node-kubelet/4319/build-log.txt), the summary containers are pinging google 100s of times a second.  This causes the summary container to be killed occasionally, and fail the test.  The summary containers are only supposed to ping every 10 seconds according to the current test.  As it turns out, we were missing a semicolon, and were not sleeping between pings.  For background, we ping google to generate network traffic, so that the summary test can validate network metrics.

This PR adds the semicolon to make the container sleep between calls, and decreases the sleep time from 10 seconds to 1 second, as 1 call / 10 seconds did not produce enough activity.

cc @kubernetes/kubernetes-build-cops @dchen1107

Automatic merge from submit-queue (batch tested with PRs 46648, 46500, 46238, 46668, 46557)

Add an e2e test for AdvancedAuditing

Enable a simple "advanced auditing" setup for e2e tests running on GCE, and add an e2e test that creates & deletes a pod, a secret, and verifies that they're audited.

Includes https://github.com/kubernetes/kubernetes/pull/46548

For https://github.com/kubernetes/features/issues/22

/cc @ericchiang @sttts @soltysh @ihmccreery

Automatic merge from submit-queue (batch tested with PRs 46648, 46500, 46238, 46668, 46557)

Admissionregistration nonnamespace

The two types are root scoped.

Just adding a couple of tags. Other code is generated.

Automatic merge from submit-queue (batch tested with PRs 46648, 46500, 46238, 46668, 46557)

Support validating package versions in node conformance test

**What this PR does / why we need it**:

This PR adds a package validator in node conformance test for checking whether the locally installed packages meet the image spec.

**Special notes for your reviewer**:

The image spec for GKE (which has the package spec) will be in a separate PR. Then we will publish a new node conformance test image for GKE whose name should use the convention in https://github.com/kubernetes/kubernetes/issues/45760 and have `gke` in it.


**Release note**:
```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46648, 46500, 46238, 46668, 46557)

Fix standardFinalizers - add missing metav1.FinalizerDeleteDependents

**What this PR does / why we need it**:
It adds [FinalizerDeleteDependents](https://github.com/kubernetes/kubernetes/blob/58167fcfa10551cc092ee7484e8b41082d0ac223/staging/src/k8s.io/apimachinery/pkg/apis/meta/v1/types.go#L77) to [standardFinalizers](https://github.com/kubernetes/kubernetes/blob/58167fcfa10551cc092ee7484e8b41082d0ac223/pkg/api/helper/helpers.go#L222) otherwise this finalizer is unusable because apiserver will fail validation because it is not fully qualified name - but it is a standard Kubernetes finalizer [used by garbage collector](https://github.com/kubernetes/kubernetes/blob/58167fcfa10551cc092ee7484e8b41082d0ac223/pkg/controller/garbagecollector/garbagecollector.go#L389) but it can't be set.

It's sibling [FinalizerOrphanDependents](https://github.com/kubernetes/kubernetes/blob/58167fcfa10551cc092ee7484e8b41082d0ac223/staging/src/k8s.io/apimachinery/pkg/apis/meta/v1/types.go#L76) is already [there](https://github.com/kubernetes/kubernetes/blob/58167fcfa10551cc092ee7484e8b41082d0ac223/pkg/api/helper/helpers.go#L224). I suppose this is a bug because otherwise `FinalizerDeleteDependents` is unusable.

Fixes https://github.com/openshift/origin/pull/14322
Might fix https://github.com/kubernetes/kubernetes/pull/45764

**Not for the reviewer:**
[This same definition is also in staging.](https://github.com/kubernetes/kubernetes/blob/58167fcfa10551cc092ee7484e8b41082d0ac223/staging/src/k8s.io/client-go/pkg/api/helper/helpers.go#L222) Does it get propagated to staging automatically? Editing the same file twice doesn't seem like the intended option.

Automatic merge from submit-queue (batch tested with PRs 46648, 46500, 46238, 46668, 46557)

Fix initializer_manager_test.go flake

Fixes https://github.com/kubernetes/kubernetes/issues/46631.

I reproduced the flake after 98 runs.

With the fix, it's not flaky in 1000 runs.

Automatic merge from submit-queue

remove exception in verify-no-vendor-cycles.sh

The exception is fixed by https://github.com/kubernetes/kubernetes/pull/45758.

Automatic merge from submit-queue (batch tested with PRs 46432, 46701, 46326, 40848, 46396)

Fix selfLinks of pods started from manifests

**What this PR does / why we need it**:
When running `curl http://localhost:10255/pods` the selfLink for pods started from manifests were incorrect. This PR fixes it.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #46357

**Special notes for your reviewer**:

@number101010

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46432, 46701, 46326, 40848, 46396)

Add a server side Get operation

Implement proposal kubernetes/community#363

```release-note
The Kubernetes API supports retrieving tabular output for API resources via a new mime-type `application/json;as=Table;v=v1alpha1;g=meta.k8s.io`.  The returned object (if the server supports it) will be of type `meta.k8s.io/v1alpha1` with `Table`, and contain column and row information related to the resource.  Each row will contain information about the resource - by default it will be the object metadata, but callers can add the `?includeObject=Object` query parameter and receive the full object.  In the future kubectl will use this to retrieve the results of `kubectl get`.
```

Automatic merge from submit-queue (batch tested with PRs 46432, 46701, 46326, 40848, 46396)

add role/clusterrole to describe.go

**What this PR does / why we need it**:
```
# ./cluster/kubectl.sh describe clusterrole system:kube-scheduler 
Name:		system:kube-scheduler
Labels:		kubernetes.io/bootstrapping=rbac-defaults
Annotations:	rbac.authorization.kubernetes.io/autoupdate=true
PolicyRule:
  Resources			Non-Resource URLs	Resource Names		Verbs
  ---------			-----------------	--------------		-----
  bindings			[]			[]			[create]
  endpoints			[]			[]			[create]
  endpoints			[]			[kube-scheduler]	[delete]
  endpoints			[]			[kube-scheduler]	[get]
  endpoints			[]			[kube-scheduler]	[patch]
  endpoints			[]			[kube-scheduler]	[update]
  events			[]			[]			[create patch update]
  nodes				[]			[]			[get list watch]
  persistentvolumeclaims	[]			[]			[get list watch]
  persistentvolumes		[]			[]			[get list watch]
  pods				[]			[]			[get list watch]
  pods/binding			[]			[]			[create]
  pods/status			[]			[]			[update]
  replicasets.extensions	[]			[]			[get list watch]
  replicationcontrollers	[]			[]			[get list watch]
  services			[]			[]			[get list watch]
  statefulsets.apps		[]			[]			[get list watch]

```
**Which issue this PR fixes**: 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46432, 46701, 46326, 40848, 46396)

add some unit tests for "kubectl create clusterrole"

#45809 adds support for non-resource-url to "kubectl create clusterrole"
This pr add some unit test for #45809 

**Release note**:

```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46432, 46701, 46326, 40848, 46396)

This change add nonResourceURL to kubectl auth cani

**Release note**:

```
support nonResourceURL to kubectl auth cani
```

Regenerate openapi for 1.8

Fix cross-build by having active deadline seconds use maxInt32

Automatic merge from submit-queue

fix comment error in function newVolumeMounterFromPlugins

**What this PR does / why we need it**:

Fix the comment error in function newVolumeMounterFromPlugins, which may cause confusion.

Automatic merge from submit-queue

try to deflake CR watches in tests

Fixes https://github.com/kubernetes/kubernetes/issues/46446

I've added a comment trying to explain the reasoning in the code.  Without being able to expose the RV of the cache, I can't think of a reliable way to do it.  Even if you tried experimenting with a watch, it essentially does this since you'd be waiting to not get an error.

Automatic merge from submit-queue

apiserver: add a webhook implementation of the audit backend

This builds off of #45315 and is intended to implement an interfaced defined in #45766.

TODO:

- [x] Rebase on top of API types PR.
- [x] Rebase on top of API types updates (#46065)
- [x] Rebase on top of feature flag (#46009)
- [x] Rebase on top of audit instrumentation.
- [x] Hook up API server flag or register plugin (depending on #45766)

Features issue https://github.com/kubernetes/features/issues/22

Design proposal https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auditing.md

```release-notes
Webhook added to the API server which omits structured audit log events.
```

/cc @soltysh @timstclair @soltysh @deads2k

Automatic merge from submit-queue

resolv.conf nameserver line has only one entry, ignore trailing garbage

**What this PR does / why we need it**:

Per the resolv.conf man page "name servers may be  listed,  one  per  keyword." Some tools such as udhcpc take advantage of this to append comments to nameserver entries. For example: `nameserver 8.8.8.8 # eth0`. This updates the resolv.conf parser to ignore trailing garbage on nameserver lines.

**Release note**:
NONE

Added API node ready check after PD test deleting a GCE instance.

Automatic merge from submit-queue

Set Kubelet Disk Defaults for the 1.7 release

The `--low-diskspace-threshold-mb` flag has been depreciated since 1.6.
This PR sets the default to `0`, and sets defaults for disk eviction based on the values used for our [e2e tests](https://github.com/kubernetes/kubernetes/blob/master/test/e2e_node/services/kubelet.go#L145).
This also removes the custom defaults for vagrant, as the new defaults should work for it as well.

/assign @derekwaynecarr 
cc @vishh 

```release-note
By default, --low-diskspace-threshold-mb is not set, and --eviction-hard includes "nodefs.available<10%,nodefs.inodesFree<5%"
```

Revert "kubelet/network: report but tolerate errors returned from GetNetNS()"

Automatic merge from submit-queue

Add Local Storage Capacity Isolation API

This PR adds the new APIs to support storage capacity isolation as
described in the proposal [https://github.com/kubernetes/community/pull/306](url)

1. Add SizeLimit for emptyDir volume
2. Add scratch and overlay storage type used by container level or
node level


**Release note**:

```release-note
Alpha feature: Local volume Storage Capacity Isolation allows users to set storage limit to isolate EmptyDir volumes, container storage overlay, and also supports allocatable storage for shared root file system. 
```

Automatic merge from submit-queue

support setElementOrder

Implement [proposal](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/preserve-order-in-strategic-merge-patch.md).

Fixes #40373

```release-note
kubectl edit and kubectl apply will keep the ordering of elements in merged lists
```

Automatic merge from submit-queue

Disable all alpha feature gates by default in local-up-cluster.sh

**What this PR does / why we need it**:
Disable all alpha feature gates by default in local-up-cluster.sh
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #46691

**Special notes for your reviewer**:

**Release note**:
```
None
```

Automatic merge from submit-queue

hack/verify-staging-imports.sh: simplify by negating package list

The forbidden list of repos got lengthy. The inverse is much shorter and easiert to maintain.

Automatic merge from submit-queue

Extract volume relevant events reason

Extract volume relevant events reason and make them const


**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Update fluentd-gcp version

Updates the `fluent-plugin-google-cloud` version to `0.6.2`. This patch containes bug fixes

Automatic merge from submit-queue

Checked node condition for DaemonSets when updating node.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #45628

**Release note**:

```release-note-none
```

Automatic merge from submit-queue (batch tested with PRs 43505, 45168, 46439, 46677, 46623)

aggregator: unify resolver implementation and tests

This is https://github.com/kubernetes/kubernetes/pull/45082, but without the port support.

Automatic merge from submit-queue (batch tested with PRs 43505, 45168, 46439, 46677, 46623)

Add TPR to CRD migration helper.

This is a helper for migrating TPR data to CustomResource. It's rather hacky because it requires crossing apiserver boundaries, but doing it this way keeps the mess contained to the TPR code, which is scheduled for deletion anyway.

It's also not completely hands-free because making it resilient enough to be completely automated is too involved to be worth it for an alpha-to-beta migration, and would require investing significant effort to fix up soon-to-be-deleted TPR code. Instead, this feature will be documented as a best-effort helper whose results should be verified by hand.

The intended benefit of this over a totally manual process is that it should be possible to copy TPR data into a CRD without having to tear everything down in the middle. The process would look like this:

1. Upgrade to k8s 1.7. Nothing happens to your TPRs.
1. Create CRD with group/version and resource names that match the TPR. Still nothing happens to your TPRs, as the CRD is hidden by the overlapping TPR.
1. Delete the TPR. The TPR data is converted to CustomResource data, and the CRD begins serving at the same REST path.

Note that the old TPR data is left behind by this process, so watchers should not receive DELETE events. This also means the user can revert to the pre-migration state by recreating the TPR definition.

Ref. https://github.com/kubernetes/kubernetes/issues/45728

Automatic merge from submit-queue (batch tested with PRs 43505, 45168, 46439, 46677, 46623)

Test finalization for CRs

**What this PR does / why we need it**:
Updates #45511 with a test for finalizers for CRDs.

**Release note**:
```release-note
NONE
```
@deads2k

Automatic merge from submit-queue (batch tested with PRs 43505, 45168, 46439, 46677, 46623)

fix AWS tagging to add missing tags only

It seems that intention of original code was to build map of missing
tags and call AWS API to add just them, but due to typo full
set of tags was always (re)added

```release-note
NONE
```

Automatic merge from submit-queue

unit test for kubectl config set-cluster

**What this PR does / why we need it**:
unit test for create cluster

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
i want test secure mode,but CA path how set?

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Performance tests also cover configmaps now

Similar to secrets.
We should be able to get this in once https://github.com/kubernetes/kubernetes/pull/46470 is merged.

/cc @wojtek-t @gmarek

Automatic merge from submit-queue (batch tested with PRs 46686, 45049, 46323, 45708, 46487)

set LANG to 'C' in Makefile

Now we support multi-languages:
https://github.com/kubernetes/kubernetes/tree/master/translations

But some tests support only English. This test fails when LANG is set to zh_CN.UTF-8:
https://github.com/kubernetes/kubernetes/blob/master/hack/make-rules/test-cmd-util.sh#L2838
The expected err string is translated to Chinese:
https://github.com/kubernetes/kubernetes/blob/master/translations/kubectl/zh_CN/LC_MESSAGES/k8s.po#L82

**Release note**:

```
NONE
```