Automatic merge from submit-queue (batch tested with PRs 42025, 44169, 43940)

[CRI] Remove all containers in the sandbox

Remove all containers in the sandbox, when we remove the sandbox.

/cc @feiskyer @Random-Liu 
Signed-off-by: Xianglin Gao <xlgao@zju.edu.cn>

Automatic merge from submit-queue (batch tested with PRs 42025, 44169, 43940)

if we have a dedicated serviceaccount keypair, use it to verify serviceaccounts

Automatic merge from submit-queue

[Federation] Add integration test for secrets

This PR adds an integration test for secrets that:

 - performs create/read/update/delete on federation resources and validates that the changes are propagated to member clusters.  
 - uses an abstraction layer (fixture and adapter) to minimize the code required to support each federated type
   - It should be possible to replace a test-specific adapter with a runtime adapter in the future (as per #41050)
 - reuses fixture (federation api and clusters) across different resource types to minimize setup overhead
   - on a fast machine, setup takes ~4s, and validating each type takes ~2s  
 - uses the [Subtest feature added in Go 1.7](https://blog.golang.org/subtests) to allow the test for a specific controller to be run in isolation
   - ``make test-integration WHAT="federation  -test.run=TestFederationCRUD/secret"``

Once this PR merges the test can be extended to target other federated types.

This PR targets #40705

cc: @kubernetes/sig-federation-pr-reviews @derekwaynecarr

Automatic merge from submit-queue

make salt return non-zero exit code on failure

Fixes https://github.com/kubernetes/kubernetes/issues/32478

Automatic merge from submit-queue (batch tested with PRs 41189, 43818)

Reduce deployment replicas in e2e tests

Fixes https://github.com/kubernetes/kubernetes/issues/41063

There are still two tests that run multiple replicas (testScaledRolloutDeployment, testIterativeDeployments), we may want to revisit them at some point.

Automatic merge from submit-queue (batch tested with PRs 41189, 43818)

add dswp unit test case

Automatic merge from submit-queue

Restore "Setting endpoints" log message

**What this PR does / why we need it**:

The "Setting endpoints" message from kube-proxy at high verbosity was
lost as part of a larger simplification in kubernetes/kubernetes#42747.

This change brings it back, simply outputting the just-constructed
addresses list.

I need this message to monitor delays in propagating endpoints changes across nodes.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Adding krousey as a kubeadm reviewer and owner

I would like to join the illustrious ranks of kubeadm owners. I plan to spend a considerable amount of time integrating this tool into our GCE and GKE deployments. If approver is too much, I would still like to be a reviewer.

I will mark this as "Do not merge" until I see approval from all current owners.

Automatic merge from submit-queue (batch tested with PRs 43871, 44053)

Proxy healthchecks overhaul

The first commit is #44051 

These three commits are tightly coupled, but should be reviewed one-by-one.  The first adds tests for healthchecks, and found a bug.  The second basically rewrites the healthcheck pkg to be much simpler and less flexible (since we weren't using the flexibility).  The third tweaks how healthchecks are handled in endpoints-path to be more like they are in services-path.

@MrHohn because I know you were in here for source-IP GA work.

@wojtek-t

Automatic merge from submit-queue (batch tested with PRs 43871, 44053)

Fix original object mutation on patch retry

When applying a patch, the original state of the object and patch are captured so that retries can determine if an overlapping update was made to the object, and the patch API call should abort with a conflict.

However, the `strategicPatchObject -> applyPatchToObject -> StrategicMergeMapPatch -> mergeMap` call mutates both the original object map and the patch map, making them unsuitable for reusing for subsequent calls.

We saw this in a [downstream test](https://github.com/openshift/origin/blob/master/test/integration/patch_test.go) that exercises patch conflict retries, where the data being submitted in a patch was showing up in the original object data map.

Since mergeMap *also* mutates the patch map passed in (deletes patch directives as it encounters them), we *also* cannot reuse the patch map in `applyPatchToObject` once it has been used.

This PR:
* Builds `originalObjMap` separate from the initial patch application for later use in conflict detection
* Changes the `originalPatchMap` to a helper that returns a fresh map from original sources
* Adds an integration test that exercises retry of non-overlapping patches with patches containing `$patch` directives

for printing. Only do this if verbosity requires it.

Automatic merge from submit-queue (batch tested with PRs 44143, 44133)

Mark PD test as flaky.

**What this PR does / why we need it**: Marks "PD should be mountable" as flaky. See #43977, which shows that it has flaked at least 7 times in the last 3 days. @kubernetes/sig-storage-test-failures

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 44143, 44133)

Fix panic in kubeadm master node setup

The problem was [caught](https://travis-ci.org/Mirantis/kubeadm-dind-cluster/jobs/218999640#L3249) by kubeadm-dind-cluster CI.
```
[kubeadm] WARNING: kubeadm is in beta, please do not use it for production clusters.
[init] Using Kubernetes version: v1.6.1
[init] Using Authorization mode: RBAC
[preflight] Skipping pre-flight checks
[certificates] Generated CA certificate and key.
[certificates] Generated API server certificate and key.
[certificates] API Server serving cert is signed for DNS names [kube-master kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 10.192.0.2]
[certificates] Generated API server kubelet client certificate and key.
[certificates] Generated service account token signing key and public key.
[certificates] Generated front-proxy CA certificate and key.
[certificates] Generated front-proxy client certificate and key.
[certificates] Valid certificates and keys now exist in "/etc/kubernetes/pki"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/scheduler.conf"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/admin.conf"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/kubelet.conf"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/controller-manager.conf"
[apiclient] Created API client, waiting for the control plane to become ready
[apiclient] All control plane components are healthy after 19.017839 seconds
panic: assignment to entry in nil map

goroutine 1 [running]:
panic(0x1b62140, 0xc4203f0380)
	/usr/local/go/src/runtime/panic.go:500 +0x1a1
k8s.io/kubernetes/cmd/kubeadm/app/phases/apiconfig.attemptToUpdateMasterRoleLabelsAndTaints(0xc420b18be0, 0x4e, 0x0)
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/phases/apiconfig/setupmaster.go:57 +0x15b
k8s.io/kubernetes/cmd/kubeadm/app/phases/apiconfig.UpdateMasterRoleLabelsAndTaints(0xc420b18be0, 0x1a, 0xc420b18be0)
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/phases/apiconfig/setupmaster.go:86 +0x2f
k8s.io/kubernetes/cmd/kubeadm/app/cmd.(*Init).Run(0xc4201a4040, 0x29886e0, 0xc420022010, 0x1c73d01, 0xc4201a4040)
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/init.go:220 +0x29c
k8s.io/kubernetes/cmd/kubeadm/app/cmd.NewCmdInit.func1(0xc4203a46c0, 0xc420660680, 0x0, 0x2)
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/cmd/init.go:86 +0x197
k8s.io/kubernetes/vendor/github.com/spf13/cobra.(*Command).execute(0xc4203a46c0, 0xc420660560, 0x2, 0x2, 0xc4203a46c0, 0xc420660560)
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/spf13/cobra/command.go:603 +0x439
k8s.io/kubernetes/vendor/github.com/spf13/cobra.(*Command).ExecuteC(0xc4203b1d40, 0xc4203a4b40, 0xc4203a46c0, 0xc4203a4000)
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/spf13/cobra/command.go:689 +0x367
k8s.io/kubernetes/vendor/github.com/spf13/cobra.(*Command).Execute(0xc4203b1d40, 0xc42046c420, 0x29886a0)
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/vendor/github.com/spf13/cobra/command.go:648 +0x2b
k8s.io/kubernetes/cmd/kubeadm/app.Run(0xc420627f70, 0xc4200001a0)
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/app/kubeadm.go:35 +0xe8
main.main()
	/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/cmd/kubeadm/kubeadm.go:26 +0x22
```

Automatic merge from submit-queue

Extract e2e utility code into framework

**What this PR does / why we need it**:
There's a growing dependency on Volume e2e utilities related to creating / test against NFS volumes.  For this reason, it's useful to relocate the relevant functions to the `framework` pkg.   Doing so makes these utility functions available to e2e tests outside the `e2e` package.


This PR only moves code from the `e2e` package to `framework` and handle the relevant changes in calls.  It does not change any logic.  


```release-note
NONE
```

@jingxu97 I think there's value here in reducing duplicate code in the `common` package, given that these functions have been copied down to it.  However, there's been some divergence.  Can you PTAL and let me know if there's any reason we can't remove the duplicate `common` code?

cc @jeffvance

Automatic merge from submit-queue (batch tested with PRs 42961, 44042)

Allow swapping NotReady and Unschedulable Taints

Fix #43444

cc @kubernetes/sig-scheduling-pr-reviews @davidopp @aveshagarwal @mdshuai

For cherrypick @ethernetdan

Automatic merge from submit-queue

leader election lock based on scheduler name

**What this PR does / why we need it**:
This pr changed the leader election lock based on scheduler name.
**Which issue this PR fixes** :
fixes #39032

**Special notes for your reviewer**:

**Release note**:
```
[scheduling]Fix a bug for multiple-schedulers that you cannot start a second scheduler without disabling leader-elect if the default scheduler has leader-elect enabled(default). We changed the leader election lock based on scheduler name.
```

The "Setting endpoints" message from kube-proxy at high verbosity was
lost as part of a larger simplification in kubernetes/kubernetes#42747.

This change brings it back, simply outputting the just-constructed
addresses list.

Automatic merge from submit-queue

Allow multiple providers for authorizationMode

fixes https://github.com/kubernetes/kubeadm/issues/177

Signed-off-by: Michail Kargakis <mkargaki@redhat.com>

Automatic merge from submit-queue

Fix Cluster-Autoscaler e2e on testgrid

Fix an e2e test failing in CI. The failures were caused by maximum nodes in test env being lower than the number of nodes required by the test.

Automatic merge from submit-queue (batch tested with PRs 43963, 43965)

Update deployment retries to a saner count

It seems that the current retries sum up to no more than 0.2s so some transient errors may drop deployments out of the queue.

Automatic merge from submit-queue (batch tested with PRs 43963, 43965)

Wait for clean old RSs statuses in the middle of Recreate rollouts

After https://github.com/kubernetes/kubernetes/pull/43508 got merged, we started returning ReplicaSets with no pods but with stale statuses back to the rollout functions. As a consequence, one of our e2e tests that checks if a Recreate Deployment runs pods from different versions, started flakying because the Deployment status may be incorrect. This change simply waits for the statuses to get cleaned up before proceeding with scaling up the new RS.

Fixes https://github.com/kubernetes/kubernetes/issues/43864

@kubernetes/sig-apps-bugs

Automatic merge from submit-queue

[Federation] Remove FEDERATIONS_DOMAIN_MAP references

Remove all references to FEDERATIONS_DOMAIN_MAP as this method is no longer is used and is replaced by adding federation domain map to kube-dns configmap.

cc @madhusudancs @kubernetes/sig-federation-pr-reviews 

**Release note**:
```
[Federation] Mechanism of adding `federation domain maps` to kube-dns deployment via `--federations` flag is superseded by adding/updating `federations` key in `kube-system/kube-dns` configmap. If user is using kubefed tool to join cluster federation, adding federation domain maps to kube-dns is already taken care by `kubefed join` and does not need further action.
```

Automatic merge from submit-queue

[Federation] Use cascading deletion when deleting resources in underlying clusters

The Federation control plane issues a delete command unless it wants to orphan the underlying per-cluster resource. When issuing that command, always set the orphanDependents to false.

/release-note-none
/sig-federation

Automatic merge from submit-queue

kube-proxy: filter INPUT as well as OUTPUT

We need to apply filter rules on the way in (nodeports) and out (cluster
IPs).  Testing here is insufficient to have caught this - will come back
for that.

Fixes #43969

@justinsb since you have the best repro, can you test?  It passes what I think is repro.

@ethernetdan we will want this in 1.6.x

```release-note
Fix bug with service nodeports that have no backends not being rejected, when they should be.  This is not a regression vs v1.5 - it's a fix that didn't quite fix hard enough.
```

Automatic merge from submit-queue (batch tested with PRs 42141, 43447)

Fix AddPodToVolume: Change arg to volumeGidValue instead of devicePath

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 42141, 43447)

fix typo

retries and hierarchy  typo error

Automatic merge from submit-queue

cleanup: remove TODO(resolved) and var(unused)

**Release note**:

```release-note
NONE
```

add test case for dswp

Automatic merge from submit-queue (batch tested with PRs 44084, 42964)

Updated AddOrUpdateTolerationInPod to return bool only.

Updated AddOrUpdateTolerationInPod to return bool only, as there's no case to generate error (the error was used for annotation, it'll not return error after moving to field); and also update admission & daemonset accordingly.

Automatic merge from submit-queue (batch tested with PRs 44084, 42964)

Removing both finalizers in federation controllers in a single update

Fixes https://github.com/kubernetes/kubernetes/issues/43828

There is a bug right now where the controller fails to delete the object if one finalizer is removed and the second isnt.
This updates the code so that both the finalizers are removed in a single API call. Kept the code changes minimum to enable cherrypick in 1.6.x

cc @csbell @kubernetes/sig-federation-bugs