Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix device unmap for non-attachable plugin case

**What this PR does / why we need it**:

This PR fixes following problem.

- If plugin is non-attachable, global unmap path isn't stored in asw,
  then plugin fails to unmap volume. To store the path, this PR moves
  MarkDeviceAsMounted operation from the `if volumeAttacher != nil` block.

**Which issue(s) this PR fixes**: Fixes #60025

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/sig storage
/cc @msau42 @jingxu97 
@dhirajh @ianchakeres @mlmhl

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Introduce PodSecurityPolicy in the policy/v1beta1 API group

Types/constants are completely the same as in `extensions/v1beta1` except that they are located outside of the `extensions` API group.

**What this PR does / why we need it**:
This is the first step for migrating PSP-related stuff away of `extensions` group. See #43214 for more information.

Also it related to https://github.com/kubernetes/features/issues/5

**Example**:
```console
$ cat restricted2.yaml 
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted2
...
$ kubectl create -f restricted.yaml 
podsecuritypolicy "restricted2" created
$ kubectl get psp restricted2 -o yaml
apiVersion: extensions/v1beta1
kind: PodSecurityPolicy
...
```

**Release note**:
```release-note
The `PodSecurityPolicy` API has been moved to the `policy/v1beta1` API group. The `PodSecurityPolicy` API in the `extensions/v1beta1` API group is deprecated and will be removed in a future release.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Drop init container annotations during conversion

https://github.com/kubernetes/kubernetes/pull/51816/files#diff-0fa94eafdf1c7cd2171c836b53fd6323 removed special handling of init container annotations in API conversion in 1.8

However, older clients (like 1.7 kubectl) still performed that handling in some paths, which would make an object round-tripped through kubectl show up with additional annotations.

Those additions would get flagged as disallowed mutations in some objects.

This change strips init-container annotations during conversion so that old clients sending init container annotations (which are inert in 1.8+) don't trigger validation errors around immutable fields.

Fixes #54816

```release-note
Restores the ability of older clients to delete and scale jobs with initContainers
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Support for resource quota on extended resources

**Which issue(s) this PR fixes** :
Fixes #46639 #57300 for  resource quota support

**Special notes for your reviewer**:
One thing to be determined is if it necessary to Explicitly prohibit defining limits for extended resources in quota, like we did for [hugepages](https://github.com/kubernetes/kubernetes/pull/54292#pullrequestreview-74982771), as the resource is not allowed to overcommit.

**Release note**:

```release-note
Support for resource quota on extended resources
```

/cc @jiayingz @vishh @derekwaynecarr

Automatic merge from submit-queue (batch tested with PRs 59391, 58097, 60057, 60090). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

bzl: use --local_test_jobs

We originally seperated build and test so that only 4 integration tests
would be run at a time, but we didn't want to slow down build, however
we didn't know --local_test_jobs existed. This achieves the same result
but more efficiently.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 59391, 58097, 60057, 60090). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

cleanup printers some more

This cleans up some more dead printer flags and unnecessary arguments for various methods.  We're getting closer.  Still need to clean up some ugly around `PrintSuccess` and then its time to start trimming layers.

@kubernetes/sig-cli-maintainers 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 59391, 58097, 60057, 60090). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add IPv6 to command options.

**What this PR does / why we need it**:
This PR adds IPv6 information to the descriptions for several command options.

[Related PR in kubernetes/website](https://github.com/kubernetes/website/pull/6498)

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Move volume scheduling and local storage to beta

**What this PR does / why we need it**:
* Move the feature gates and APIs for volume scheduling and local storage to beta
* Update tests to use the beta fields
@kubernetes/sig-storage-pr-reviews 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #59390

**Special notes for your reviewer**:

**Release note**:

```release-note
ACTION REQUIRED: VolumeScheduling and LocalPersistentVolume features are beta and enabled by default.  The PersistentVolume NodeAffinity alpha annotation is deprecated and will be removed in a future release.
```

Automatic merge from submit-queue (batch tested with PRs 59634, 59821, 57850, 59916, 60032). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

AllowVolumeExpansion field to storageclass describe
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note

```

Automatic merge from submit-queue (batch tested with PRs 59634, 59821, 57850, 59916, 60032). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add cluster-location to GCE instance attributes

**What this PR does / why we need it**:
Exposes cluster location on GCP as instance attribute. In particular, this metadata is useful for exposing metrics to Stackdriver monitoring system and is necessary for some Stackdriver integration components, i.e. Stackdriver Metadata Agent

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 59634, 59821, 57850, 59916, 60032). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Enable mutating and validating admission webhooks by default on clusters created via kube-up.sh

cc @cheftako @lavalamp 

The deprecation [notice](https://github.com/caesarxuchao/kubernetes/tree/d46e01fe287994bfc5b36984f9f80fa5df19c931/cluster#deprecation-notice-this-directory-has-entered-maintenance-mode-and-will-not-be-accepting-new-providers-please-submit-new-automation-deployments-to-kube-deploy-deployments-in-this-directory-will-continue-to-be-maintained-and-supported-at-their-current-level-of-support) of the `/cluster` directory says "Deployments in this directory will continue to be maintained and supported at their current level of support.", so I think we still need to update the default configs to the latest recommended values.

Automatic merge from submit-queue (batch tested with PRs 59634, 59821, 57850, 59916, 60032). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update to latest gophercloud/gophercloud for 1.10

**What this PR does / why we need it**:

Looks like we end up with just the following change:
https://github.com/gophercloud/gophercloud/pull/730
(Prevent Recursive BuildRequestBody)

The full set of changes between the old and new SHA are here:
https://github.com/gophercloud/gophercloud/compare/8e59687aa4b27ab22a0bf3295f1e165ff7bd5f97...6da026c32e2d622cc242d32984259c77237aefe1


**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove unused function in　test file

remove unused function in
	pkg/controller/replicaset/replica_set_test.go



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note

```

Allow setting PV nodeAffinity if previously unset

We originally seperated build and test so that only 4 integration tests
would be run at a time, but we didn't want to slow down build, however
we didn't know --local_test_jobs existed. This achieves the same result
but more efficiently.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add code and yaml for Istio as an addon

This commit adds the following:
 - YAML for istio components to the addons directory (versions with
   and without auth)
 - logic to copy the appropriate YAML file into the addons manager
   dir, depending on ENABLE_ISTIO and ISTIO_AUTH_TYPE env vars
 - changes to addon manager script which allow plugins to exist in
   namespace other than kube-system. This is needed for Istio
   functionality
 - additional initialization for Istio in addon manager.

This has been manually tested - e2e tests are in progress but require additional code to enable istio in tests. See:
 - https://github.com/istio/istio/pull/2841
 - https://github.com/kubernetes/test-infra/pull/6612



**What this PR does / why we need it**:
Allow [Istio](https://istio.io/) to be installed as an addon. This simplifies the Istio setup process on k8s and GKE. Istio team is trying to make it easier for end users to get to a basic functional installation.  
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

If plugin is non-attachable, global unmap path isn't stored in asw
then plugin fails to unmap volume. To store the path, this PR moves
MarkDeviceAsMounted operation from the `if volumeAttacher != nil` block.

Fixes #60025

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Return information about which int tests failed in the summary

**What this PR does / why we need it**:
Currently if integration tests fail they will print the name of the failing tests as it goes, but the summary only tells that it failed. You need to know what to look for to be able to find all these occurrences. This PR provides a summary next to the failure information, eg:
```
FAILED TESTS: run_cluster_management_tests, run_plugins_tests, 
```
Which should greatly simplify developers integration debugging. 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix race in healthchecking etcds leading to crashes

Fix https://github.com/kubernetes/kubernetes/issues/59338

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

glusterfs: improve a few comments

**What this PR does / why we need it**:

This PR fixes a couple of comments in the glusterfs module:
* fixes a typo in a comment
* removes an outdated comment that is not correct (any more)
* updates one comment to refer to upstream gluster documentation instead of downstream red hat product documentation

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Taint node when it under PID pressure.
Signed-off-by: Da K. Ma <madaxa@cn.ibm.com>

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
part of #54313 

**Release note**:
```release-note
If TaintNodesByCondition enabled, taint node when it under PID pressure 
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add cblecker to vendor OWNERS

**What this PR does / why we need it**:
Adds myself to vendor OWNERS. I can help approve dep bumps of existing deps, and refer to Tim and new deps for license review.

**Release note**:
```release-note
NONE
```

/assign thockin

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 Update bazelbuild/rules_go, kubernetes/repo-infra, and gazelle dependencies

**What this PR does / why we need it**: updates our bazelbuild/rules_go dependency in order to bump everything to go1.9.4. I'm separating this effort into two separate PRs, since updating rules_go requires a large cleanup, removing an attribute from most build rules.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove duplicated definition of ResourceList in Metrics API

**What this PR does / why we need it**:
Remove duplicated definition of ResourceList in Metrics API

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Monitor the /kubepods cgroup for allocatable metrics

**What this PR does / why we need it**:
The current implementation of allocatable memory evictions sums the usage of pods in order to compute the total usage by user processes.
This PR changes this to instead monitor the `/kubepods` cgroup, which contains all pods, and use this value directly.  This is more accurate than summing pod usage, as it is measured at a single point in time.
This also collects metrics from this cgroup on-demand.
This PR is a precursor to memcg notifications on the `/kubepods` cgroup.
This removes the dependency the eviction manager has on the container manager, and adds a dependency for the summary collector on the container manager (to get Cgroup Root)
This also changes the way that the allocatable memory eviction signal and threshold are added to make them in-line with the memory eviction signal to address #53902

**Which issue(s) this PR fixes**:
Fixes #55638
Fixes #53902

**Special notes for your reviewer**:
I have tested this, and can confirm that it works when CgroupsPerQos is set to false.  In this case, it returns node metrics, as it is monitoring the `/` cgroup, rather than the `/kubepods` cgroup (which doesn't exist).

**Release note**:
```release-note
Expose total usage of pods through the "pods" SystemContainer in the Kubelet Summary API
```
cc @sjenning @derekwaynecarr @vishh @kubernetes/sig-node-pr-reviews

Do not refer to downstream Red Hat documentation
in the upstream kubernetes code, if there is upstream
documentation to refer to.
Signed-off-by: Michael Adam <obnox@redhat.com>

Signed-off-by: Michael Adam <obnox@redhat.com>

This was originally added due to a misunderstanding
of the documentation of Heketi (using a different
convention). Heketi's documentation has meanwhile
been clarified.
Signed-off-by: Michael Adam <obnox@redhat.com>

PSP are completely the same as in extensions/v1beta1 except that they
are located outside of the extensions API group.

Automatic merge from submit-queue (batch tested with PRs 59398, 59881). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Pipe error message from openapi/swaggerspec verify checks to stderr

**What this PR does / why we need it**:
This pipes the error messages from openapi and swagger spec verify jobs to stderr so they show up in junit reports.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix invalid match rules for advanced audit policy

When users or groups are set in a rule, this rule should not match
attribute with unauthorized request where user and group are nil.


**Release note**:
```release-note
Unauthorized requests will not match audit policy rules where users or groups are set.
```

Fixes: https://github.com/kubernetes/kubernetes/issues/59331

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fixing CSI e2e test

Current e2e test had some inconsistencies which were preventing it from running successfully on the local cluster.
```release-note
Making sure CSI E2E test runs on a local cluster
```
Closes #60016