Automatic merge from submit-queue (batch tested with PRs 47656, 47488)

Checked whether balanced Pods were created.

**What this PR does / why we need it**:
In #47382, it seems balanced Pods were not created; this PR will check whether balanced Pods were created, and show logs.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: partially fixes #47382 

**Release note**:

```release-note-none
```

Automatic merge from submit-queue

Speed up PV integration tests

Integration tests are ~20 seconds shorter. Before (with #47645 applied):
```
--- PASS: TestPodDeletionWithDswp (3.70s)
--- PASS: TestPodUpdateWithWithADC (3.61s)
--- PASS: TestPodUpdateWithKeepTerminatedPodVolumes (3.59s)
--- PASS: TestPodAddedByDswp (5.69s)
--- PASS: TestPersistentVolumeRecycler (2.68s)
--- PASS: TestPersistentVolumeDeleter (12.61s)
--- PASS: TestPersistentVolumeBindRace (12.53s)
--- PASS: TestPersistentVolumeClaimLabelSelector (12.52s)
--- PASS: TestPersistentVolumeClaimLabelSelectorMatchExpressions (2.62s)
--- PASS: TestPersistentVolumeMultiPVs (3.98s)
--- PASS: TestPersistentVolumeMultiPVsPVCs (3.67s)
--- PASS: TestPersistentVolumeControllerStartup (7.41s)
--- PASS: TestPersistentVolumeProvisionMultiPVCs (4.85s)
--- PASS: TestPersistentVolumeMultiPVsDiffAccessModes (2.71s)
ok  	k8s.io/kubernetes/test/integration/volume	82.304s
```

After:
```
--- PASS: TestPodDeletionWithDswp (3.70s)
--- PASS: TestPodUpdateWithWithADC (3.61s)
--- PASS: TestPodUpdateWithKeepTerminatedPodVolumes (3.63s)
--- PASS: TestPodAddedByDswp (5.73s)
--- PASS: TestPersistentVolumeRecycler (3.53s)
--- PASS: TestPersistentVolumeDeleter (4.56s)
--- PASS: TestPersistentVolumeBindRace (3.52s)
--- PASS: TestPersistentVolumeClaimLabelSelector (3.52s)
--- PASS: TestPersistentVolumeClaimLabelSelectorMatchExpressions (3.49s)
--- PASS: TestPersistentVolumeMultiPVs (3.07s)
--- PASS: TestPersistentVolumeMultiPVsPVCs (3.94s)
--- PASS: TestPersistentVolumeControllerStartup (7.64s)
--- PASS: TestPersistentVolumeProvisionMultiPVCs (6.25s)
--- PASS: TestPersistentVolumeMultiPVsDiffAccessModes (3.55s)
ok  	k8s.io/kubernetes/test/integration/volume	59.945s
```

/assign @gnufied 
@kubernetes/sig-storage-pr-reviews 

Release note
```release-note
NONE
```

Automatic merge from submit-queue

Retry service syncs with exponential backoff in endpoints-controller

This should make it avoid missing any syncs.

/cc @smarterclayton @gmarek @seh

Automatic merge from submit-queue (batch tested with PRs 46425, 47975)

make proto time precision match json

json readers/writers see second precision, but protobuf readers/writers seen nanosecond precision.  This means that a json client can read and write and accidentally mutate fields as seen by protobuf clients.

This makes the precision consistent.

@kubernetes/sig-api-machinery-misc @smarterclayton 

```release-note
Update protobuf time serialization for a one second granularity
```

Automatic merge from submit-queue

Move the workload e2e tests to it's own package

**What this PR does / why we need it**:

Move the workload e2e tests to it's own package

**Release note**:
```
None
```

Automatic merge from submit-queue

Get rid of 30s ResyncPeriod in endpoint controller

Ref: #47597 
This should fix one of the demons of endpoint controller.

/cc @smarterclayton @gmarek

Automatic merge from submit-queue (batch tested with PRs 47961, 46276)

Remove duplicate error message output in hyperkube.

**What this PR does / why we need it**:
Currently hyperkube binary will always print duplicate messages if fatal error occurs:
```
$ ./kubelet # run without permission
I0523 08:38:02.642638   25701 feature_gate.go:144] feature gates: map[]
W0523 08:38:02.642827   25701 server.go:472] No API client: no api servers specified
Error: failed to run Kubelet: error reading /var/run/kubernetes/kubelet.key, certificate and key must be supplied as a pair
Error: failed to run Kubelet: error reading /var/run/kubernetes/kubelet.key, certificate and key must be supplied as a pair
```

This is due to RunToExit will print out the error which Run has just printed. https://github.com/kubernetes/kubernetes/blob/8bee44b/cmd/hyperkube/hyperkube.go#L178-L189

This was introduced in following commit for adding GOMAXPROCS calls.
https://github.com/kubernetes/kubernetes/commit/1e679f0069f629d76fcab6f9f39ef0efc1814cc4

The following commit removes GOMAXPROCS calls, but did not remove the corresponding error output line.
https://github.com/kubernetes/kubernetes/commit/88ea80b5728fe4adb5c0f43f0283302ab3b9eb22


**Which issue this PR fixes**

**Special notes for your reviewer**:

**Release note**:

Automatic merge from submit-queue (batch tested with PRs 47961, 46276)

Bumped Heapster to v1.4.0-beta.0

Heapster release candidate for Kubernetes 1.7

cc @dchen1107 @caesarxuchao

Automatic merge from submit-queue

Fix mismatched types Verbose and bool

Fix invalid operation: mismatched types Verbose and bool


**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

Cleanup predicates.go

**What this PR does / why we need it**:
cleanup some comments and errors.New().

**Special notes for your reviewer**:
/cc @jayunit100
 
**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

[Federation]Remove duplicate constants

Clean up them, the constants are defined in replicaset_test.go and replicasetcontroller_test.go, and replicaset_test.go did not use them.
**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

kubeadm: Remove the validate phase as it's not needed

**What this PR does / why we need it**:

This validation code was added in v1.4 as a way to remove flakiness between deploying the control plane in Static Pods and deploying kube-discovery as a Deployment.

That isn't the case anymore and we're not experiencing such flakiness, as we're using other methods like checking `/healthz` to determine a healthy control plane before proceeding.

https://github.com/kubernetes/kubernetes/pull/43881 removed this logic from `kubeadm init` to having it as a phase. But that phase isn't needed or used in any way, so now I'm removing it here.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

Targets v1.8

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews @timothysc @mikedanese

Automatic merge from submit-queue

kubeadm: Cleanup version gates for the Node Authorizer when targeting v1.8

**What this PR does / why we need it**:

 - Similar to https://github.com/kubernetes/kubernetes/pull/47339, but for the Node Authorizer feature
 - Using the API validation code to make sure RBAC and Node authorization modes are present 
 - Defaulting to using both the RBAC and Node authorizers
 - Removing the version gate on the feature

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
Targets v1.8

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews @timothysc @liggitt @mikedanese

Automatic merge from submit-queue

Plumb preferred version to nested object encoder

Fixes https://github.com/kubernetes/kubernetes/issues/48018

Automatic merge from submit-queue

kubelet should let cloud-controller-manager set the node addresses

*Before this change:*

1. cloud-controller-manager sets all the addresses for a node.
2. kubelet on that node replaces these addresses with an incomplete set. (i.e. replace InternalIP and Hostname and delete all other addresses--ExternalIP, etc.)

*After this change:*

kubelet doesn't touch its node's addresses when there is an external cloudprovider.

Fixes #47155

```release-note
NONE
```

Automatic merge from submit-queue

Cleanup pkg/kubectl

I was reading through `pkg/kubectl` in preparation for completing https://github.com/kubernetes/kubectl/issues/11 and noticed several opportunities for improvement. This should be easy to review since it's mostly mechanical changes. The only complicated changes are in `addFromEnvFile`, which I refactored into two functions and wrote tests for.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 47869, 48013, 48016, 48005)

Adds IPv6 unit test cases to kubeadm

**What this PR does / why we need it**:
Adds IPv6 test cases to kubeadm. It's needed to ensure test cases cover IPv6 related networking scenarios for kubeadm-based k8s deployments.

**Which issue this PR fixes**
This PR is in support of Issue #1443.

**Special notes for your reviewer**:
Additional PR's may follow as e2e testing is being developed by Issue #47666.

**Release note**:
```NONE
```

Automatic merge from submit-queue (batch tested with PRs 47869, 48013, 48016, 48005)

Fix kubectl api-versions caching

xref https://github.com/kubernetes/kubectl/issues/41

The point of the `api-versions` and `version` commands is to ask the server for its API groups or versions, so we don't want to use cached data

Automatic merge from submit-queue (batch tested with PRs 47869, 48013, 48016, 48005)

[Federation]Fix forgeting to close file

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Removes alpha feature gate for affinity annotations.  

**What this PR does / why we need it**:
In 1.5 we added a backstop to support alpha affinity annotations.  This PR removes that support in favor of the Beta fields per discussions.  

It also serves as a precursor to some of the component config work that @ncdc has done around @mikedanese design proposal.  

xref: https://github.com/kubernetes/kubernetes/pull/41617 

**Special notes for your reviewer**:

**Release note**:

```
Removes alpha feature gate for pod affinity annotations.  
```

/cc @kubernetes/sig-scheduling-pr-reviews @kubernetes/sig-cluster-lifecycle-misc

Automatic merge from submit-queue (batch tested with PRs 47650, 47936, 47939, 47986, 48006)

Remove e2e test that checked scheduler priority function for spreading of ReplicationController pods

**What this PR does / why we need it**:
Remove e2e test that checked scheduler priority function for spreading of ReplicationController pods.
The test is flaky in our test clusters, but passes in our local clusters. It looks like our e2e test clusters are not deterministic enough for checking all of the scheduler priority functions. Besides, this functionality is checked extensively by our unit tests.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47769

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 47650, 47936, 47939, 47986, 48006)

[esipp-e2e] Change service port to avoid collision

**What this PR does / why we need it**: As https://github.com/kubernetes/kubernetes/issues/47745#issuecomment-310750499 indicates, changing service port in test to avoid collision. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47745

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 47650, 47936, 47939, 47986, 48006)

Save docker image tarfiles in _output/release-images/$arch/

Additionally, add option `KUBE_BUILD_HYPERKUBE` to build hyperkube
outside of the release flow.

**What this PR does / why we need it**: Saves all of the docker tarfiles in a separate directory that the release scripts can use to push to a docker registry. This is easier than trying to guess which images should be pushed from the local docker engine, and supports work in https://github.com/kubernetes/test-infra/issues/1400. 

If we eventually use this for the official release workflow (`anago`) this may prevent something like https://github.com/kubernetes/kubernetes/issues/47307 from happening again.

**Release note**:

```release-note
NONE
```

/release-note-none
/assign @luxas @david-mcmahon 
cc @madhusudancs @roberthbailey

Automatic merge from submit-queue (batch tested with PRs 47650, 47936, 47939, 47986, 48006)

External dependency of k8s.io/api

Fix https://github.com/kubernetes/kubernetes/issues/48007

It's unfortunate that k8s.io/api has external dependencies.

Most of the dependencies are introduced by "k8s.io/apimachinery/pkg/util/intstr" and ugorji.

Automatic merge from submit-queue

fixed the logging of which conversions.

Hi Guys,

After enable the function of logging of which conversions at [TestSpecificKind](https://github.com/jianzhangbjz/kubernetes/blob/d31a7cb301468323d91b962cb7aefeea9101e107/pkg/api/serialization_test.go#L140), I got the below errors:
```
pkg/api/serialization_test.go:140: cannot refer to unexported name api.scheme
pkg/api/serialization_test.go:140: undefined: api.scheme in api.scheme.Log
ok  	k8s.io/kubernetes/cmd/genutils	0.066s
```
So, this PR will fix that.

Automatic merge from submit-queue (batch tested with PRs 47776, 46220, 46878, 47942, 47947)

fix comment mistake

fix comment mistake


**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 47776, 46220, 46878, 47942, 47947)

update openstack metadata-service url

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 47776, 46220, 46878, 47942, 47947)

Adds --insecure to cockroachdb client command

Automatic merge from submit-queue (batch tested with PRs 47776, 46220, 46878, 47942, 47947)

Add statefulset to the completion candidates of kubectl scale

**What this PR does / why we need it**: This commit adds `statefulset` to the completion candidates of kubectl scale.
```
$ kubectl scale <tab>
deployment             job                    --replicas             replicaset             replicationcontroller  statefulset
```

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes kubernetes/kubectl#14

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Parameterize the binary path and host arch for the hyperkube image

As the [cluster/images/hyperkube/README.md](https://github.com/kubernetes/kubernetes/tree/master/cluster/images/hyperkube) shows, I run the command: `make build VERSION=test ARCH=ppc64le`, but got the below errors, so this PR will fix it.
```
ARCH=ppc64le
cp -r ./* /tmp/hyperkubeTFbYrI
mkdir -p /tmp/hyperkubeTFbYrI/cni-bin
cp ../../../_output/dockerized/bin/linux/ppc64le/hyperkube /tmp/hyperkubeTFbYrI
cp: cannot stat '../../../_output/dockerized/bin/linux/ppc64le/hyperkube': No such file or directory
Makefile:62: recipe for target 'build' failed
make: *** [build] Error 1
```

Automatic merge from submit-queue

Add token authentication method for websocket browser clients

Closes #47967

Browser clients do not have the ability to set an `Authorization` header programatically on websocket requests. All they have control over is the URL and the websocket subprotocols sent (see https://developer.mozilla.org/en-US/docs/Web/API/WebSocket)

This PR adds support for specifying a bearer token via a websocket subprotocol, with the format `base64url.bearer.authorization.k8s.io.<encoded-token>`

1. The client must specify at least one other subprotocol, since the server must echo a selected subprotocol back
2. `<encoded-token>` is `base64url-without-padding(token)`

This enables web consoles to use websocket-based APIs (like watch, exec, logs, etc) using bearer token authentication.

For example, to authenticate with the bearer token `mytoken`, the client could do:
```js
var ws = new WebSocket(
  "wss://<server>/api/v1/namespaces/myns/pods/mypod/logs?follow=true",
  [
    "base64url.bearer.authorization.k8s.io.bXl0b2tlbg",
    "base64.binary.k8s.io"
  ]
);
```

This results in the following headers:
```
Sec-WebSocket-Protocol: base64url.bearer.authorization.k8s.io.bXl0b2tlbg, base64.binary.k8s.io
```

Which this authenticator would recognize as the token `mytoken`, and if authentication succeeded, hand off to the rest of the API server with the headers
```
Sec-WebSocket-Protocol: base64.binary.k8s.io
```

Base64-encoding the token is required, since bearer tokens can contain characters a websocket protocol may not (`/` and `=`)

```release-note
Websocket requests may now authenticate to the API server by passing a bearer token in a websocket subprotocol of the form `base64url.bearer.authorization.k8s.io.<base64url-encoded-bearer-token>`
```

Automatic merge from submit-queue

Fix const naming in node/metrics

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```