Automatic merge from submit-queue

Test if 2 federated informers in rs controller are in sync

cc: @quinton-hoole @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Enable v3 Client as the default on UTs

Updates the default initialization to use clientv3 interface to etcd3, and fixes the UTs.  

This PR includes a cherry-pick of https://github.com/kubernetes/kubernetes/pull/30634 so we can validate the tests, so do not merge until that PR is complete.

Automatic merge from submit-queue

Federated namespace controller e2e test

Depends on #30443

cc: @quinton-hoole @wojtek-t @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Tests for data update in federated secret controller

cc: @quinton-hoole @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Reduce size of images fluentd-gcp and fluentd-elasticsearch

replaces #26652

```
aledbf/fluentd-elasticsearch                   1.19 769ece5c8ba8 About an hour ago 269.9 MB
gcr.io/google_containers/fluentd-elasticsearch 1.18 0a8cbfbea7f7 5 weeks ago       530.3 MB

aledbf/fluentd-gcp                             1.22 ef979b82a767 About an hour ago 307.9 MB
gcr.io/google_containers/fluentd-gcp           1.21 0ef09b1bcfd7 2 weeks ago       498.5 MB
```

closes #29782

Automatic merge from submit-queue

Enabled Rescheduler e2e test for serial suites

Automatic merge from submit-queue

ObjectMeta equivalence in federated controller handlers + update in fed secrets

Federated secrets should trigger also on data/type update, not only on object meta.

cc: @quinton-hoole @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Implements Attacher Plugin Interface for vSphere

This PR does the following,

Fixes #29028 (vsphere volume should implement attacher interface):  Implements Attacher Plugin Interface for vSphere. 
See file: 
pkg/volume/vsphere_volume/vsphere_volume.go. - Removed attach and detach calls from SetupAt and TearDownAt.
pkg/volume/vsphere_volume/attacher.go. - Implements Attacher & Detacher Plugin Interface for vSphere. (Ref :- GCE_PD & AWS attacher.go)
pkg/cloudproviders/provider/vsphere.go - Added DiskIsAttach method.

The vSphere plugin code needs clean up. (ex: The code for getting vSphere instance is repeated in file pkg/cloudprovider/providers/vsphere.go). I will fix this in next PR.

Automatic merge from submit-queue

Add Cluster field in ObjectMeta

There will be no sub-rs, but add `Cluster` field to the ObjectMeta (for all the objects)

"To distinguish the object at the federation level from it's constituents at the cluster level we will add a "Cluster" field to the metadata of all objects (where the federation itself will also have a cluster identifier).  That way it is possible to list, interact with, and distinguish between the objects either at the federation level or at the individual cluster level based on the cluster identifier. "


@quinton-hoole @nikhiljindal @deepak-vij @mfanjie @huangyuqi

[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()

Automatic merge from submit-queue

Set annotation name in federated replica set controller

cc: @quinton-hoole @jianhuiz @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Fix quota constraints funcs for pvc and service objects

Fixes https://github.com/kubernetes/kubernetes/issues/30315

Automatic merge from submit-queue

AppArmor PodSecurityPolicy support

Implements the AppArmor PodSecurityPolicy support based on the alpha API proposed [here](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/apparmor.md#pod-security-policy)

This implementation deviates from the original proposal in one way: it adds a separate option for specifying a default profile:
```
apparmor.security.alpha.kubernetes.io/defaultProfileName
```
This has several advantages over the original proposal:

- The default is explicit, rather than implicit on the ordering
- The default can be specified without constraining the allowed profiles
- The allowed profiles can be restricted without specifying a default (requires every pod to explicitly set a profile)

The E2E cluster does not currently enable the PodSecurityPolicy, so I will submit E2E tests in a separate PR.

/cc @dchen1107 @pweil- @sttts @jfrazelle @Amey-D

Automatic merge from submit-queue

Improve ScaleRC function to be more generic

Relaxed the requirement for RC selector.

Automatic merge from submit-queue

Scheduling algorithm provider flag in kube-up.sh

Follow up of:

#30274 #30992

cc: @piosz @wojtek-t @davidopp

Automatic merge from submit-queue

fix kubectl get cluster display issue

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #31073

**Release note**:
`NONE`

Automatic merge from submit-queue

Unset https_proxy before roundtripper_test

When running `hack/test-go.sh`, if the testing env is behind a https proxy, roundtripper_test will fail randomly.

After `unset https_proxy`, the testing works well. So, add a comment to be a troubleshooting tip.

Fail info:

```
--- FAIL: TestRoundTripAndNewConnection (0.12s)
	roundtripper_test.go:319: proxied http->http: shouldError=false, got true: Get http://127.0.0.1:46711: unexpected EOF
FAIL
FAIL	k8s.io/kubernetes/pkg/util/httpstream/spdy	0.148s
```

```
--- FAIL: TestRoundTripAndNewConnection (0.12s)
	roundtripper_test.go:319: proxied https with auth (valid hostname + RootCAs) -> http: shouldError=false, got true: Get http://127.0.0.1:41028: unexpected EOF
FAIL
FAIL	k8s.io/kubernetes/pkg/util/httpstream/spdy	0.146s
```

Automatic merge from submit-queue

Wrong path for log_handler.go

Automatic merge from submit-queue

check using single quote in cmd/pkg/plugin

Automatic merge from submit-queue

[kubelet test] Improve node status test debug info

I find the output format `%v` of glog couldn't output useful information of an `api.Node` object. The output of this line https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/kubelet_node_status_test.go#L492
is

```
kubelet_node_status_test.go:491: expected
                &TypeMeta{Kind:,APIVersion:,}
                , got
                &TypeMeta{Kind:,APIVersion:,}
```

- It's difficult for me to tell the difference between expected and got.

- I prefer to use `diff.ObjectDiff(expectedNode, updatedNode)` to output the debug information as it will point out the starting character of the different objects.

I think this line https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/kubelet_node_status_test.go#L647 can use `diff.ObjectDiff()` as well.

The related issus is #30952

Automatic merge from submit-queue

Error if someone uses the sub-makefile directly

Produce a more helpful failure when someone errantly uses the generated_files makefile directly.

Automatic merge from submit-queue

federation: Adding support for namespace admission controls in federation-apiserver

Now that we have namespaces in federation apiserver, we can support namespace admission controls.

There are 3 of these:
namespace/autoprovision, namespace/exists and namespace/lifecycle.
namespace/autoprovision, namespace/exists should be deprecated in kubernetes(https://github.com/kubernetes/kubernetes/issues/31195). Adding support for namespace/lifecycle to federation-apiserver.
As in kube-apiserver, enabling namespace/lifecycle by default.


```release-note
Action required: If you have a running federation control plane, you will have to ensure that for all federation resources, the corresponding namespace exists in federation control plane.

federation-apiserver now supports NamespaceLifecycle admission control, which is enabled by default. Set the --admission-control flag on the server to change that.
```

cc @kubernetes/sig-cluster-federation @quinton-hoole

Automatic merge from submit-queue

fix feature_gate env plumbing

Fix gci configure-helper.sh plumbing.

Automatic merge from submit-queue

clean up oldIptablesMasqueradeMark

follow up of #30486

Automatic merge from submit-queue

add an option to controller-manager to auto approve all CSRs

I think we talked about this.

cc @gtank

Automatic merge from submit-queue

Configure webhook

**What this PR does / why we need it**: this configures the image policy webhook + admission controller for gce/gci.

addresses: #22888

**Release note**:
```Configure image verification admission controller and webhook on gce.
```

Automatic merge from submit-queue

Make 'allAlpha' a special feature gate

Rather than making all caller check both allAlpha and their own flag, make `allAlpha` set all of the alpha gates explicitly.

This is hard to test because of the globalness.  I will follow this commit with a new one to add some way to test, but I wanted to float this design