Automatic merge from submit-queue (batch tested with PRs 50033, 49988, 51132, 49674, 51207)

Adding fsGroup check before mounting a volume

fsGroup check will be enforcing that if a volume has already been
mounted by one pod and another pod wants to mount it but has a different
fsGroup value, this mount operation will not be allowed.

Closes #45053

Automatic merge from submit-queue (batch tested with PRs 50033, 49988, 51132, 49674, 51207)

Add IPBlock to Network Policy

**What this PR does / why we need it**:
 Add ipBlockRule to NetworkPolicyPeer.

**Which issue this PR fixes**
fixes #49978

**Special notes for your reviewer**:
- I added this directly as a field on the existing API per guidance from API-Machinery/lazy SIG-Network consensus.

Todo:
- [ ] Documentation comments to mention this is beta, unless we want to go straight to GA
- [ ] e2e tests

**Release note**:
```
Support ipBlock in NetworkPolicy
```

Automatic merge from submit-queue (batch tested with PRs 50872, 51103, 51220, 51285, 50841)

Fix issue(#49695)kubectl set image deployment is ignoring --selector

**What this PR does / why we need it**:
closes #49695

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 50872, 51103, 51220, 51285, 50841)

Update CockroachDB tag to v1.0.5

cc @a-robinson

Automatic merge from submit-queue (batch tested with PRs 50872, 51103, 51220, 51285, 50841)

add sig leads to owners-aliases

**What this PR does / why we need it**:
Adds sig leads listed in community sigs.yaml file into OWNERS aliases.  Useful for granting privileges to sig leads, such as accepting issues into the milestone during burndown by adding `approved-for-milestone` label.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

@marun @spiffxp @dchen1107

Automatic merge from submit-queue (batch tested with PRs 50872, 51103, 51220, 51285, 50841)

ScaleIO:  Use VolumeHost.GetExec() to execute stuff in volume plugins

This PR updates ScaleIO volume plugin to use `VolumeHost.GetExec()` to execute utilities like mkfs and lsblk instead of simple `os/exec` + to use a fresh `mounter` for every `SetUp` / `TearDown` calls, as they may be different each time.

This prepares the volume plugin to run these utilities in containers instead of running them on the host + makes the volume plugin more independent and less hardcoded.

See proposal in https://github.com/kubernetes/community/pull/589.

Note that this PR does **not** change place where the utilities are executed - `VolumeHost.GetExec()` still leads directly to `os/exec`. It will be changed when the aforementioned proposal is merged and implemented.

**Special notes for your reviewer**:

* I needed to pass `mount.Exec` interface from the place where it is available down to `SioClient` where it's needed to execute stuff.


@kubernetes/sig-storage-pr-reviews 
/assign @vladimirvivien @rootfs 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 50872, 51103, 51220, 51285, 50841)

kubeadm: Add 'kubeadm upgrade plan' and 'kubeadm upgrade apply' CLI commands

**What this PR does / why we need it**:

This PR is splitted out from: https://github.com/kubernetes/kubernetes/pull/48899 and only handles the CLI/command code. It adds no-op functions only to `phases/upgrade`.

A large chunk of this code is unit tests.
The code here should be pretty straightforward as there is no actual upgrade or business logic here.
It would be cool to get this merged soon-ish.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

fixes: https://github.com/kubernetes/kubeadm/issues/14

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews PTAL

Automatic merge from submit-queue (batch tested with PRs 46986, 51214, 51169, 50155, 51261)

remove deprecated rbac rule

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46986, 51214, 51169, 50155, 51261)

Add Italian translation for kubectl

**What this PR does / why we need it:**
This PR provides first attempt to translate kubectl in Italian (related to #40645, #45573,
#45562, #40591, #46559).

**Which issue this PR fixes** _(`optional, in fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)_: fixes #
No issues

**Special notes for your reviewer:**
This PR requires Italian people to assist in the review. I'm native in Italian with BS in Computer Science.

```release-note
Adding Italian translation for kubectl
```

Automatic merge from submit-queue (batch tested with PRs 46986, 51214, 51169, 50155, 51261)

refactor(flexvolume): simplify capabilities handling

```release-note
Simplify capabilities handling in FlexVolume.
```

Automatic merge from submit-queue (batch tested with PRs 46986, 51214, 51169, 50155, 51261)

admission api: cut off api from k8s.io/apiserver

Automatic merge from submit-queue (batch tested with PRs 46986, 51214, 51169, 50155, 51261)

Add OpenAPI README file

Add a README.md file to OpenAPI folder explaining extensions we have on OpenAPI spec.

ref: #0

Automatic merge from submit-queue (batch tested with PRs 51114, 51233, 51024, 51053, 51197)

default field selectors

We have a lot of code around field selectors that doesn't add much value. Every gettable resources probably wants name and namespace by default and since they all use metav1 (today), we can assign that as a default. If we think we'll always have metav1 style name and namespace, then this makes a reasonable default and you can always set something different.

This removes cruft and avoids the risk of accidentally forgetting a field selector.  

@kubernetes/sig-api-machinery-misc @smarterclayton

Automatic merge from submit-queue (batch tested with PRs 51114, 51233, 51024, 51053, 51197)

Add debug logs to conversion-gen

These were useful when tracking a different problem.

Automatic merge from submit-queue (batch tested with PRs 51114, 51233, 51024, 51053, 51197)

add UT for pkg/apis/autoscaling/v2alpha1/defaults.go

**What this PR does / why we need it**:
add UT for pkg/apis/autoscaling/v2alpha1/defaults.go

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 51114, 51233, 51024, 51053, 51197)

Add AddAliasToInstance() to gce cloud provider

- Adds AddAliasToInstance() to the GCE cloud provider.
- Adds field "secondary-range-name" to the gce.conf configuration file.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51114, 51233, 51024, 51053, 51197)

rbd: Use VolumeHost.GetExec() to execute stuff in volume plugins

**What this PR does / why we need it**:

This PR updates rbd volume plugin to use `VolumeHost.GetExec()` to execute utilities like mkfs and lsblk instead of simple `os/exec`. This prepares the volume plugin to run these utilities in containers instead of running them on the host + makes the volume plugin more independent and less hardcoded.

See proposal in https://github.com/kubernetes/community/pull/589.

Note that this PR does **not** change place where the utilities are executed - `VolumeHost.GetExec()` still leads directly to `os/exec`. It will be changed when the aforementioned proposal is merged and implemented.

@kubernetes/sig-storage-pr-reviews 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

AllowedNotReadyNodes allowed to be not ready for absolutely *any* reason

It's as good as we allow those many nodes to be not part of the cluster at all, ever.

Btw - currently our 5k-node correctness test fails if "kubelet stopped posting node status" or "route not created", etc (ref: https://storage.googleapis.com/kubernetes-jenkins/logs/ci-kubernetes-e2e-gce-scale-correctness/3/build-log.txt)

cc @kubernetes/sig-scalability-misc

Automatic merge from submit-queue

RBD Plugin: Log RBD Attach/Mount/Unmout actions in addition to Detach

**What this PR does / why we need it**:

Currently, RBD Plugin can log a info message for a successful action of RBD Unmap, e.g.:

```
I0822 09:32:31.595162   15177 rbd_util.go:349] rbd: successfully unmap device /dev/rbd0
```

This PR adds logs for another three important actions: Attach, Mount and Unmount.

Logging these actions and associated info is *very* useful in diagnosing problems.

**Special notes for your reviewer**:

Example RBD Plugin logs of successful pod volume attaching and mounting:

```
I0822 09:30:27.512015   15177 rbd_util.go:148] lock list output "2017-08-22 09:30:27.493889 7fa4ae3c23c0 -1 auth: unable to find a keyring on /etc/ceph/ceph.client.kube.keyring,/etc/ceph/ceph.keyring,/etc/ceph/keyring,/etc/ceph/keyring.bin: (2) No such file or directory\n"
W0822 09:30:27.547513   15177 rbd_util.go:460] rbd: no watchers on kubernetes-dynamic-pvc-83bfd49e-871c-11e7-b88e-000c291fbe71
I0822 09:30:27.704703   15177 rbd_util.go:315] rbd: successfully map image kube/kubernetes-dynamic-pvc-83bfd49e-871c-11e7-b88e-000c291fbe71 to /dev/rbd0
I0822 09:30:27.965603   15177 rbd_util.go:322] rbd: successfully mount image kube/kubernetes-dynamic-pvc-83bfd49e-871c-11e7-b88e-000c291fbe71 at /var/lib/kubelet/plugins/kubernetes.io/rbd/rbd/kube-image-kubernetes-dynamic-pvc-83bfd49e-871c-11e7-b88e-000c291fbe71
```

Example RBD Plugin logs of successful pod volume detaching and unmouting:

```
I0822 09:32:31.380124   15177 rbd_util.go:334] rbd: successfully umount mountpoint /var/lib/kubelet/plugins/kubernetes.io/rbd/rbd/kube-image-kubernetes-dynamic-pvc-83bfd49e-871c-11e7-b88e-000c291fbe71
I0822 09:32:31.459867   15177 rbd_util.go:148] lock list output "2017-08-22 09:32:31.443643 7f2bb8ab53c0 -1 auth: unable to find a keyring on /etc/ceph/ceph.client.kube.keyring,/etc/ceph/ceph.keyring,/etc/ceph/keyring,/etc/ceph/keyring.bin: (2) No such file or directory\nThere is 1 exclusive lock on this image.\nLocker       ID                     Address                    \nclient.64117 kubelet_lock_magic_k8s 192.168.2.128:0/4124042516 \n"
I0822 09:32:31.595162   15177 rbd_util.go:349] rbd: successfully unmap device /dev/rbd0
```

It does not add too much logs, but admins/ops can know what RBD plugin are doing internally and exact time a RBD image is mapped, mounted or unmounted (in addition to unmapped).

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51244, 50559, 49770, 51194, 50901)

Fix zsh completion for kubeadm

**What this PR does / why we need it**:

kubeadm zsh completion will report an error when using after '--flag':
```
kubeadm join --token=1 __handle_flag:25: bad math expression: operand expected at end of string
```

There is a similar bug in kubectl which has been fixed by #48553. It is due to `__kubeadm_declare` gets 'declare -A' into function scope, and `__kubeadm_declare` could be removed now.

This is to port that fix here. 

**Which issue this PR fixes**

**Special notes for your reviewer**:

**Release note**:

Automatic merge from submit-queue (batch tested with PRs 51244, 50559, 49770, 51194, 50901)

Distribute pods efficiently in CA scalability tests

**What this PR does / why we need it**:
Instead of using runReplicatedPodOnEachNode method
which is suited to a small number of nodes,
distribute pods on the nodes with desired load
using RCs that eat up all the space we want to be
empty after distribution.

**Release note**:
```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51244, 50559, 49770, 51194, 50901)

Fix the matching rule of instance ProviderID

Url.Parse() can't parse ProviderID which contains ':///'.
This PR use regexp to match ProviderID.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
Fix #49769

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51244, 50559, 49770, 51194, 50901)

Remove deprecated flag "long-running-request-regexp".

**What this PR does / why we need it**:
remove `long-running-request-regexp` post-1.6.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51244, 50559, 49770, 51194, 50901)

fix status in deployment_rollback response

**What this PR does / why we need it**:

fix status in deployment_rollback response

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
#51243

This caused an import cycle: api -> apiserver -> api

Fixes https://github.com/kubernetes/kubernetes/issues/51212

Automatic merge from submit-queue (batch tested with PRs 51229, 50131, 51074, 51167, 51213)

Avoid explicit mention of plugin name in error strings.

Automatic merge from submit-queue (batch tested with PRs 51229, 50131, 51074, 51167, 51213)

Allow remote runtimes to pass apparmor host validation

**What this PR does / why we need it**:

Allow remote runtimes to pass apparmor host validation.

**Which issue this PR fixes** : fixes #51156

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51229, 50131, 51074, 51167, 51213)

[proxy] Clean up LocalPort related functions and structures in proxier.go

**What this PR does / why we need it**:

See, https://github.com/kubernetes/kubernetes/blob/master/pkg/proxy/iptables/proxier.go#L1694

I think RevertPorts() is independent from iptables, and would be used by other proxiers which needs to hold/close local port.

Perhaps we can move RevertPorts() from proxier.go to pkg/proxy/util package so that it can be consumed among different proxiers. And, reduce codes in proxier.go

**Which issue this PR fixes**:

fixes #51073 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51229, 50131, 51074, 51167, 51213)

Fix typos in kubefed

**What this PR does / why we need it**:

Fix some typos in kubefed.

**Which issue this PR fixes** : fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Always create vendor/BUILD in hack/update-bazel.sh

**What this PR does / why we need it**: makes sure there's always a `vendor/BUILD` file.
When updating `godeps`, the [instructions](https://github.com/kubernetes/community/blob/master/contributors/devel/godep.md) say to recursively remove `vendor/`, which also removes the `vendor/BUILD` file. Unless you manually recreate this file, running `update-bazel.sh` would instead update the `all-srcs` rule in the root `BUILD.bazel` file, which is not desired. `gazelle` and `kazel` won't create `vendor/BUILD` on their own, since there are no go sources directly in `vendor/`. 

With this PR, we'll make sure that the `vendor/BUILD` file always exists, creating it if necessary.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #51075

**Release note**:

```release-note
NONE
```

/assign @spxtr @mikedanese 
cc @thockin

Automatic merge from submit-queue (batch tested with PRs 50213, 50707, 49502, 51230, 50848)

Expand the test to include other flags as well

**What this PR does / why we need it**:

Expand the test to include other flags as well

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```
 `NONE`

Automatic merge from submit-queue (batch tested with PRs 50213, 50707, 49502, 51230, 50848)

StatefulSet: Deflake e2e `kubectl exec` commands.

This may help with another source of flakiness found while investigating #48031.

We seem to get a lot of flakes due to "connection refused" while running `kubectl exec`. I can't find any reason this would be caused by the test flow, so I'm adding retries to see if that helps.

Automatic merge from submit-queue (batch tested with PRs 50213, 50707, 49502, 51230, 50848)

Refactor CephFS PV spec

**What this PR does / why we need it**:
refactor CephFS Volume Persistent Volume Spec so CephFS PV's SecretRef allows referencing a secret from a persistent volume in any namespace. This allows locating credentials for persistent volumes in namespaces other than the one containing the PVC.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/kubernetes-incubator/external-storage/issues/309

**Special notes for your reviewer**:
@kubernetes/sig-storage-api-reviews 

**Release note**:

```release-note
Allow CephFS PV to specify a namespace for secret
```

Automatic merge from submit-queue (batch tested with PRs 50213, 50707, 49502, 51230, 50848)

Fix forkedjson.LookupPatchMetadata for pointers.

**What this PR does / why we need it**:

Fixes a bug in `forkedjson.LookupPatchMetadata`. It is triggered when called with some API objects such as the `Selector` field (a pointer) in https://godoc.org/k8s.io/api/extensions/v1beta1#DeploymentSpec.

The provided test case fails without the lines added to `fields.go`.

**Which issue this PR fixes** N/A

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 50213, 50707, 49502, 51230, 50848)

Fix comment of cronjob utils.go

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/kubernetes/kubernetes/issues/50951

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51224, 51191, 51158, 50669, 51222)

Change the FakeCloudAddressService to store Alpha objects internally

The change assumes the compute Alpha object is the superset of the v1
object. By storing the Alpha objects internally in the fake, we can
convert them to Beta and v1 to test different functions.