Automatic merge from submit-queue

WIP v0 NVIDIA GPU support

```release-note
* Alpha support for scheduling pods on machines with NVIDIA GPUs whose kubelets use the `--experimental-nvidia-gpus` flag, using the alpha.kubernetes.io/nvidia-gpu resource 
```

Implements part of #24071 for  #23587

I am not familiar with the scheduler enough to know what to do with the scores. Mostly punting for now.

Missing items from the implementation plan: limitranger, rkt support, kubectl
support and docs

cc @erictune @davidopp @dchen1107 @vishh @Hui-Zhi @gopinatht 

Automatic merge from submit-queue

Removed obsolete metrics API proposal

As requested in https://github.com/kubernetes/kubernetes/pull/24253#discussion_r60985010

ref #23376

Automatic merge from submit-queue

pkg/apis/rbac: Add Openshift authorization API types

This PR updates #23396 by adding the Openshift RBAC types to a new API group.

Changes from Openshift:

* Omission of [ResourceGroups](https://github.com/openshift/origin/blob/458998788337e983fa3e5f9a837664ec00a89204/pkg/authorization/api/types.go#L32-L104) as most of these were Openshift specific. Would like to add the concept back in for a later release of the API.
* Omission of IsPersonalSubjectAccessReview as its implementation relied on Openshift capability.
* Omission of SubjectAccessReview and ResourceAccessReview types. These are defined in `authorization.k8s.io`

~~API group is named `rbac.authorization.openshift.com` as we omitted the AccessReview stuff and that seemed to be the lest controversial based on conversations in #23396. Would be happy to change it if there's a dislike for the name.~~ Edit: API groups is named `rbac`, sorry misread the original thread.

As discussed in #18762, creating a new API group is kind difficult right now and the documentation is very out of date. Got a little help from @soltysh but I'm sure I'm missing some things. Also still need to add validation and a RESTStorage registry interface. Hence "WIP".

Any initial comments welcome.

cc @erictune @deads2k @sym3tri @philips

Automatic merge from submit-queue

Add a service annotation that allows endpoints for unready pods

See https://github.com/kubernetes/kubernetes/issues/25283 for context 
@smarterclayton @thockin yes?

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/25284)
<!-- Reviewable:end -->

Automatic merge from submit-queue

Automatically create the kube-system namespace

At the same time we ensure that the `default` namespace is present, it also creates `kube-system` if it doesn't exist.

`kube-system` will now exist from the beginning, and will be recreated every 10s if deleted, in the same manner as the `default` ns

This makes UX much better, no need for `kubectl`ing a `kube-system.yaml` file anymore for a function that is essential to Kubernetes (addons). For instance, this makes dashboard deployment much easier when there's no need to check for the `kube-system` ns first.

A follow up in the future may remove places where logic to manually create the kube-system namespace is present.

Also fixed a small bug where `CreateNamespaceIfNeeded` ignored the `ns` parameter and was hardcoded to `api.NamespaceDefault`.

@davidopp @lavalamp @thockin @mikedanese @bryk @cheld @fgrzadkowski @smarterclayton @wojtek-t @dlorenc @vishh @dchen1107 @bgrant0607 @roberthbailey

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/25196)
<!-- Reviewable:end -->

Automatic merge from submit-queue

kubenet: set bridge promiscuous mode based on hairpinMode

Closes: https://github.com/kubernetes/kubernetes/issues/23657
Closes: https://github.com/kubernetes/kubernetes/issues/20475

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/23711)
<!-- Reviewable:end -->

Closes: https://github.com/kubernetes/kubernetes/issues/23657
Closes: https://github.com/kubernetes/kubernetes/issues/20475

Automatic merge from submit-queue

AWS: SSL support for ELB listeners through annotations

In the API, ports have only either TCP or UDP as their protocols, but ELB distinguishes HTTPS->HTTP[S]? from SSL->(SSL|TCP). 

Per #24978, this is implemented through two separate annotations:

`service.beta.kubernetes.io/aws-load-balancer-ssl-cert=arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012`
`service.beta.kubernetes.io/aws-load-balancer-backend-protocol=(https|http|ssl|tcp)`

Mixing plain-text and encrypted listeners will be in a separate PR, implementing #24978's `aws-load-balancer-ssl-ports=LIST`

Automatic merge from submit-queue

Add `kubectl rollout status`

## Pull Request Guidelines

1. Please read our [contributor guidelines](https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md).
1. See our [developer guide](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md).
1. Follow the instructions for [labeling and writing a release note for this PR](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes) in the block below.

```release-note
Implement `kubectl rollout status` that can be used to watch a deployment's rollout status
```

Addresses #17168; depends on #19882 (the "Add kubectl rollout" commit).
See [proposal](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/deploy.md#deployment-version). 

cc @bgrant0607 @nikhiljindal @ironcladlou @kargakis @kubernetes/sig-config @kubernetes/kubectl  @madhusudancs

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/19946)
<!-- Reviewable:end -->

Automatic merge from submit-queue

Add pod condition PodScheduled to detect situation when scheduler tried to schedule a Pod, but failed

Set `PodSchedule` condition to `ConditionFalse` in `scheduleOne()` if scheduling failed and to `ConditionTrue` in `/bind` subresource.

Ref #24404

@mml (as it seems to be related to "why pending" effort)

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/24459)
<!-- Reviewable:end -->

Revert "Add configuration for GCP webhook authorization."

when scheduler tried to schedule a Pod, but failed.

Ref #24404

Support renegotiation in client based on response ContentType

Automatic merge from submit-queue

Updating hack/update-codegen to keep federation_clientset updated

Right now, there is no check for this and hence federation_clientset becomes stale over time.
Updating hack/update-codegen to keep federation_clientset updated.

hack/verify-codegen.sh ensures that it is updated.


cc @caesarxuchao @lavalamp @jianhuiz @kubernetes/sig-cluster-federation 

Automatic merge from submit-queue

Add configuration for GCP webhook authorization.

Plumb through configuration of webhook authorization on GCE.

Automatic merge from submit-queue

Webhook Token Authenticator

Add a webhook token authenticator plugin to allow a remote service to make authentication decisions.

Automatic merge from submit-queue

PSP admission

```release-note
Update PodSecurityPolicy types and add admission controller that could enforce them
```

Still working on removing the non-relevant parts of the tests but I wanted to get this open to start soliciting feedback.

- [x] bring PSP up to date with any new features we've added to SCC for discussion
- [x] create admission controller that is a pared down version of SCC (no ns based strategies, no user/groups/service account permissioning)
- [x] fix tests

@liggitt @pmorie - this is the simple implementation requested that assumes all PSPs should be checked for each requests.  It is a slimmed down version of our SCC admission controller

@erictune @smarterclayton 

Automatic merge from submit-queue

Add a flag to disable dumpig logs after e2e test failure

cc @kubernetes/sig-testing 

Automatic merge from submit-queue

Scheduledjob api

@erictune ScheduledJob api types, based on #21675, so only last two commits counts.
@sdminonne fyi

```release-note
Introducing ScheduledJobs as described in [the proposal](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/scheduledjob.md) as part of `batch/v2alpha1` version (experimental feature).
```


[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()

Automatic merge from submit-queue

Remove myself from a bunch of OWNERS files

For the time being I am too overloaded to do non scheduler/admission related reviews that aren't explicitly assigned to me.

cc/ @brendandburns 

Automatic merge from submit-queue

Corrects some misspellings in comments

This should help to make
https://goreportcard.com/report/k8s.io/kubernetes#misspell
look a little nicer.

Automatic merge from submit-queue

Add --image-type option to GKE kube-up

@maisem @roberthbailey Can you review?

cc/ @andyzheng0831 

Change "speter.net/go/exp/math/dec/inf" dependency to new location

to "https://gopkg.in/inf.v0"

Revert "Fixes #23529 Remove speter.net/go/exp/math/dec/inf from Godep since it is deprecated and in vendor"

Revert "Fixes #23529 Remove speter.net/go/exp/math/dec/inf from Godep since it is deprecated and in vendor"