Automatic merge from submit-queue

Update to support latest godep

godep v53 and earlier included all subdirs of includes in ./...
godep v54 and later only includes the exact packages required.

So all of the 'extra' packages which were subdirs but were dead code are removed.

That bit us because both codecgen and ginkgo are binaries which we got by chance in Godeps. When godep started tracking exactly what was needed instead of just grabbing entire subdirs we lost those binaries. To solve that problem godeps now have to be built with `godep save ginko codecgen ./...` so that that it explicitly pulls in those two packages. Because no one will ever remember that, I created a script in hack which lists those deps explicitly.

The better import tacking also means that it lists every single package included (transitively) in Godeps.json. Which I believe makes the godep license concatenator from @karlkfi explode in size.

But from an actual 'code that was built' PoV, and easy way to test is to see if a build with and without this PR have any difference. They should be identical.

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/22807)
<!-- Reviewable:end -->

Automatic merge from submit-queue

PodWorkers UpdatePod takes options struct

First commit from https://github.com/kubernetes/kubernetes/pull/24843 

Second commit:
The `PodWorkers.UpdatePod` operation is updated as follows:
* use options struct to pass arguments
* add a pod status func to allow override status
* add pod termination grace period if sync operation requires a kill pod
* add a call-back that is error aware

Third commit:
Add a `killPodNow` to kubelet that does a blocking kill pod call that properly integrates with pod workers.

The plan is to pass `killPodNow` as a function pointer into the out of resource killer.

```
// KillPodFunc kills a pod.
// The pod status is updated, and then it is killed with the specified grace period.
// This function must block until either the pod is killed or an error is encountered.
// Arguments:
// pod - the pod to kill
// status - the desired status to associate with the pod (i.e. why its killed)
// gracePeriodOverride - the grace period override to use instead of what is on the pod spec
type KillPodFunc func(pod *api.Pod, status api.PodStatus, gracePeriodOverride *int64) error
```

You can see it being used here in the WIP out of resource killer PR.

https://github.com/kubernetes/kubernetes/pull/21274/commits/1344f858fba956c285eba6c418a3008576cd3843#diff-92ff0f643237f29824b4929574f84609R277

/cc @vishh @yujuhong @pmorie 

Since its hard for an individual to remember that we need codecgen and
ginkgo in godeps but don't actually have that dependancy listed in a way
that godep can automatically find.

Automatic merge from submit-queue

Add utility for kubelet to log resource lists consistently

This is a simple utility for logging resource lists with standardized output.

I find it useful when logging work in node eviction, similar to kubelet logging convention for pods in same package.

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/24742)
<!-- Reviewable:end -->

Add interface check in Deployment's client

Modify Detach method to take disk name

Reduce LOC in kubelet tests

Reduce LOC in daemon controller tests

Code cleanups in kubelet_test.go

Added negative test case for namespace

Automatic merge from submit-queue

Resource name constants were incorrect in versioned types.go

The constant field names and actual values to quota requests and limits for cpu and memory were incorrect in the v1 types.go file.

Important to note for reviewer:
* the constant fields here are unused in the project at this time
* the values those unused constant fields mapped to are not actually supported by the project
* there is no backwards compatibility concern, but if/when we look to convert to using versioned clients, we should have the correct constant fields and values.

The correct values were here:
https://github.com/kubernetes/kubernetes/blob/master/pkg/api/types.go#L2213

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/24136)
<!-- Reviewable:end -->

tolerate nil error in HandleError

AWS kube-up: default some variables to empty, to avoid warnings

Automatic merge from submit-queue

Reduce allocations during conversion, enable new UnsafeConvertToVersion path

Cleans up the conversion path to avoid a few unnecessary allocations, then creates a new UnsafeConvertToVersion path that will allow encode/decode to bypass copying the object for performance. In that subsequent PR, ConvertToVersion will start to call Copy() and we will refactor conversions to reuse as much of the existing object as possible.

Also changes the unversioned.ObjectKind signature to not require allocations - speeds up a few common paths.

Automatic merge from submit-queue

WIP v0 NVIDIA GPU support

```release-note
* Alpha support for scheduling pods on machines with NVIDIA GPUs whose kubelets use the `--experimental-nvidia-gpus` flag, using the alpha.kubernetes.io/nvidia-gpu resource 
```

Implements part of #24071 for  #23587

I am not familiar with the scheduler enough to know what to do with the scores. Mostly punting for now.

Missing items from the implementation plan: limitranger, rkt support, kubectl
support and docs

cc @erictune @davidopp @dchen1107 @vishh @Hui-Zhi @gopinatht 

Automatic merge from submit-queue

Removed obsolete metrics API proposal

As requested in https://github.com/kubernetes/kubernetes/pull/24253#discussion_r60985010

ref #23376

Automatic merge from submit-queue

pkg/apis/rbac: Add Openshift authorization API types

This PR updates #23396 by adding the Openshift RBAC types to a new API group.

Changes from Openshift:

* Omission of [ResourceGroups](https://github.com/openshift/origin/blob/458998788337e983fa3e5f9a837664ec00a89204/pkg/authorization/api/types.go#L32-L104) as most of these were Openshift specific. Would like to add the concept back in for a later release of the API.
* Omission of IsPersonalSubjectAccessReview as its implementation relied on Openshift capability.
* Omission of SubjectAccessReview and ResourceAccessReview types. These are defined in `authorization.k8s.io`

~~API group is named `rbac.authorization.openshift.com` as we omitted the AccessReview stuff and that seemed to be the lest controversial based on conversations in #23396. Would be happy to change it if there's a dislike for the name.~~ Edit: API groups is named `rbac`, sorry misread the original thread.

As discussed in #18762, creating a new API group is kind difficult right now and the documentation is very out of date. Got a little help from @soltysh but I'm sure I'm missing some things. Also still need to add validation and a RESTStorage registry interface. Hence "WIP".

Any initial comments welcome.

cc @erictune @deads2k @sym3tri @philips

Automatic merge from submit-queue

Add a service annotation that allows endpoints for unready pods

See https://github.com/kubernetes/kubernetes/issues/25283 for context 
@smarterclayton @thockin yes?

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/25284)
<!-- Reviewable:end -->

Automatic merge from submit-queue

Automatically create the kube-system namespace

At the same time we ensure that the `default` namespace is present, it also creates `kube-system` if it doesn't exist.

`kube-system` will now exist from the beginning, and will be recreated every 10s if deleted, in the same manner as the `default` ns

This makes UX much better, no need for `kubectl`ing a `kube-system.yaml` file anymore for a function that is essential to Kubernetes (addons). For instance, this makes dashboard deployment much easier when there's no need to check for the `kube-system` ns first.

A follow up in the future may remove places where logic to manually create the kube-system namespace is present.

Also fixed a small bug where `CreateNamespaceIfNeeded` ignored the `ns` parameter and was hardcoded to `api.NamespaceDefault`.

@davidopp @lavalamp @thockin @mikedanese @bryk @cheld @fgrzadkowski @smarterclayton @wojtek-t @dlorenc @vishh @dchen1107 @bgrant0607 @roberthbailey

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/25196)
<!-- Reviewable:end -->

Automatic merge from submit-queue

kubenet: set bridge promiscuous mode based on hairpinMode

Closes: https://github.com/kubernetes/kubernetes/issues/23657
Closes: https://github.com/kubernetes/kubernetes/issues/20475

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/23711)
<!-- Reviewable:end -->

Closes: https://github.com/kubernetes/kubernetes/issues/23657
Closes: https://github.com/kubernetes/kubernetes/issues/20475

Automatic merge from submit-queue

AWS: SSL support for ELB listeners through annotations

In the API, ports have only either TCP or UDP as their protocols, but ELB distinguishes HTTPS->HTTP[S]? from SSL->(SSL|TCP). 

Per #24978, this is implemented through two separate annotations:

`service.beta.kubernetes.io/aws-load-balancer-ssl-cert=arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012`
`service.beta.kubernetes.io/aws-load-balancer-backend-protocol=(https|http|ssl|tcp)`

Mixing plain-text and encrypted listeners will be in a separate PR, implementing #24978's `aws-load-balancer-ssl-ports=LIST`

Only encode/decode will call this path, to allow us to optimize for
unsafe operations.

Long delayed refactor, avoids a few more allocations.

We don't need to pass a pointer into SetGroupKindVersion() - a
struct works just as well.

We will probably readd these as an opaque object passed down to
conversions that lets the caller get access to more info (like
a negotiated serializer).

Automatic merge from submit-queue

Add `kubectl rollout status`

## Pull Request Guidelines

1. Please read our [contributor guidelines](https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md).
1. See our [developer guide](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md).
1. Follow the instructions for [labeling and writing a release note for this PR](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes) in the block below.

```release-note
Implement `kubectl rollout status` that can be used to watch a deployment's rollout status
```

Addresses #17168; depends on #19882 (the "Add kubectl rollout" commit).
See [proposal](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/deploy.md#deployment-version). 

cc @bgrant0607 @nikhiljindal @ironcladlou @kargakis @kubernetes/sig-config @kubernetes/kubectl  @madhusudancs

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/19946)
<!-- Reviewable:end -->

Automatic merge from submit-queue

Add pod condition PodScheduled to detect situation when scheduler tried to schedule a Pod, but failed

Set `PodSchedule` condition to `ConditionFalse` in `scheduleOne()` if scheduling failed and to `ConditionTrue` in `/bind` subresource.

Ref #24404

@mml (as it seems to be related to "why pending" effort)

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/24459)
<!-- Reviewable:end -->

Revert "Add configuration for GCP webhook authorization."

when scheduler tried to schedule a Pod, but failed.

Ref #24404

Support renegotiation in client based on response ContentType

Automatic merge from submit-queue

Updating hack/update-codegen to keep federation_clientset updated

Right now, there is no check for this and hence federation_clientset becomes stale over time.
Updating hack/update-codegen to keep federation_clientset updated.

hack/verify-codegen.sh ensures that it is updated.


cc @caesarxuchao @lavalamp @jianhuiz @kubernetes/sig-cluster-federation 

Automatic merge from submit-queue

Add configuration for GCP webhook authorization.

Plumb through configuration of webhook authorization on GCE.