Automatic merge from submit-queue (batch tested with PRs 55824, 53179). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Allow Pod Security Policy to manage access to the Flexvolumes

**What this PR does / why we need it**:
For proposal: https://github.com/kubernetes/community/blob/a1b9495e1b722699196ccec88d831fc850100827/contributors/design-proposals/auth/flex-volumes-drivers-psp.md (https://github.com/kubernetes/community/issues/723)
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Pod Security Policy can now manage access to specific FlexVolume drivers
```

Automatic merge from submit-queue (batch tested with PRs 55824, 53179). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Postpone Deletion of a Persistent Volume Claim in case It Is Used by a Pod

**What this PR does / why we need it**:
to fix https://github.com/kubernetes/kubernetes/issues/45143

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubernetes/issues/45143

**Special notes for your reviewer**:
**Design:** https://github.com/kubernetes/community/blob/master/contributors/design-proposals/storage/postpone-pvc-deletion-if-used-in-a-pod.md
@msau42 @jsafrane @gnufied PTAL

**Release note**:

```release-note
PVC Finalizing Controller is introduced in order to prevent deletion of a PVC that is being used by a pod.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Bump CPU requirements of L7 LB controller.

**Which issue(s) this PR fixes**
Fixes #56051

**Release note**:
```release-note
NONE
```

It watches PVCs and Pods and updates PVCs.

This controller removes protection finalizer from PVCs that are being
deleted and are not referenced by any pod.

This admission plugin puts finalizer to every created PVC. The finalizer is
removed by PVCProtectionController when the PVC is not referenced by any
pods and thus the PVC can be deleted.

Kubelet must not start pods that use PVCs that are being
deleted.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add deployment for Stackdriver Metadata Agent with version and resource requirement controlled by env variable

**What this PR does / why we need it**:
Introduces Stackdriver Metadata Agent - a daemon set providing metadata for kubernetes objects connected to the same node.

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54843, 55810). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Integrating cadvisor stats to CRI Pod stats collection

For kubernetes-incubator/cri-containerd#341



**What this PR does / why we need it**:
This PR contains changes to update kubelet to consume metrics from both CRI and cadvisor for Pod stats. The corresponding cadvisor changes are here https://github.com/google/cadvisor/pull/1795.
Today CRI stats provides only core metrics such as CPU Usage, Memory Usage, Disk Usage. However the stats exposed by kubelet which is a superset of core metrics and Network, User Defined Metrics are not provided by CRI stats. Hence kubelet stats are extracted from 2 sources , CRI stats and cadvisor stats. 
After the change the summary stats for a CRI based runtime (containerd) is as show here:
https://gist.github.com/abhi/d7351861df6430eb4bc5d711d274ec35

This PR also contains test case change to reflect the stats for cri stats provider. 

**Which issue(s) this PR fixes** :
Fixes # https://github.com/kubernetes-incubator/cri-containerd/issues/341

**Special notes for your reviewer**:
https://docs.google.com/presentation/d/1Os3nyMRBlFuiBLCjPgeaPv6jXylrZW5jiDXJejlA3Wg/edit#slide=id.g27cb4cb6d8_0_0

Godep will be updated to main tree after https://github.com/google/cadvisor/pull/1795 PR is merged.

**Release note**:

```release-note
Kubelet can provide full summary api support except container log stats for CRI container runtime now.
```
cc @Random-Liu

Automatic merge from submit-queue (batch tested with PRs 54843, 55810). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix testSupport in downwardapi_test

add some code to test plugin.CanSupport function
/sig storage

Automatic merge from submit-queue (batch tested with PRs 56249, 56118, 56255, 56252, 56256). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kube-proxy: Fix NewProxyServer

Different OSes need different args.  This is not a great fix, but better
than adding an arg to Windows which doesn't need it.

Fixes #56238

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 56249, 56118, 56255, 56252, 56256). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

clear resourceversion for migrated cluster roles

Fixes #56248

Need to clear the resource version.  Alternatively, we could clear it in storage when we clear and stomp other fields.

Works locally for me.

Automatic merge from submit-queue (batch tested with PRs 56249, 56118, 56255, 56252, 56256). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fixing etcd version for 1.10.X kubernetes

Closes #56254

Automatic merge from submit-queue (batch tested with PRs 56249, 56118, 56255, 56252, 56256). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Implement ebs resize

Implement EBS disk resizing. 

xref - kubernetes/features#284


```release-note
Add support for resizing EBS disks
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use `git archive` to produce kubernetes-src.tar.gz when git tree is clean

**What this PR does / why we need it**: uses `git archive` to embed version information in the kubernetes source tarball produced in releases. Due to recent changes, the version information was missing from the source tarball, causing builds from these source tarballs to potentially fail.

This also includes a fix inspired by #56216, since the ld flags in `hack/lib/version.sh` are not space-safe.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #56246

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/assign @david-mcmahon 
/priority urgent-soon
/sig release
cc @mrueg

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Adds custom expansions to the listers for apps/v1

**What this PR does / why we need it**:
We need to add the listers expansions for the apps group version API objects.
```release-note
NONE
```

This commit container modification to cri stats test
to verify CPU, Memory, Network stats collected by
cadvisor.
Signed-off-by: abhi <abhi@docker.com>

This commit addresses the issue described here
https://github.com/kubernetes-incubator/cri-containerd/issues/341
The changes include using cadvisor stats in addition to CRI stats
for CRI runtimes. As described in the issue above , the CRI stats
currently doesnt provide all the necessary stats for the kubelet.
This commit addreses the need to extract stats from cadvisor which
is not available as CRI stats.
Signed-off-by: abhi <abhi@docker.com>

Automatic merge from submit-queue (batch tested with PRs 55952, 49112, 55450, 56178, 56151). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add environment variable to enable support for new Stackdriver resource model

To be merged after #56211 


**What this PR does / why we need it**:
This PR adds env variable to control Stackdriver sink in Heapster - whether it export metrics for new resource model or old resource model.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 55952, 49112, 55450, 56178, 56151). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add PodDisruptionBudget support in pod preemption

**What this PR does / why we need it**:
This PR adds the logic to make scheduler preemption aware of PodDisruptionBudget. Preemption tries to avoid preempting pods whose PDBs are violated by preemption. If preemption does not find any other pods to preempt, it will preempt pods despite violating their PDBs.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #53913

**Special notes for your reviewer**:

**Release note**:

```release-note
Add PodDisruptionBudget support during pod preemption
```

ref/ #47604

/sig scheduling

Automatic merge from submit-queue (batch tested with PRs 55952, 49112, 55450, 56178, 56151). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix the wrong localhost seccomp path of CRI

**What this PR does / why we need it**:

Fix the wrong seccomp path comment.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #55359

**Special notes for your reviewer**:

**Release note**:

```release-note
Fix CRI localhost seccomp path in format localhost//profileRoot/profileName.
```

Automatic merge from submit-queue (batch tested with PRs 55952, 49112, 55450, 56178, 56151). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

New API group for Events.

Fix kubernetes/features#383

cc @shyamjvs 

```release-note
Add events.k8s.io api group with v1beta1 API containing redesigned Event type.
```

Automatic merge from submit-queue (batch tested with PRs 55952, 49112, 55450, 56178, 56151). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add support to kubeadm upgrade for CoreDNS

**What this PR does / why we need it**:
This PR enables to get CoreDNS in the kubeadm upgrade and alpha phases addons via feature-gates.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubeadm/issues/446

**Special notes for your reviewer**:

**Release note**:

```release-note
kubeadm: Add CoreDNS support for kubeadm "upgrade" and "alpha phases addons".
```

Automatic merge from submit-queue (batch tested with PRs 52767, 55065, 55148, 56228, 56221). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

log errors while trying to GC resources

If GC can't update a finalizer, we need to see evidence of that failure.  This updates the code to log it.

Automatic merge from submit-queue (batch tested with PRs 52767, 55065, 55148, 56228, 56221). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add Feature tag to CPU Manager node e2e test.

**What this PR does / why we need it**: Adds a `Feature` tag to the CPU manager node e2e tests.

CC @ConnorDoyle

Automatic merge from submit-queue (batch tested with PRs 52767, 55065, 55148, 56228, 56221). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

change DefaultGarbageCollectionPolicy to DeleteDependents for workloads controllers

**What this PR does / why we need it**:
As part of the apps/v1 GA effort (kubernetes/features#353) for v1.9. For core controllers, like `Deployment`, `DaemonSet`, `ReplicaSet`, and `StatefulSet`, changing the `DefaultGarbageCollectionPolicy` from `OrphanDependents` to `DeleteDependents` will make these objects consistent with the default behavior for all new objects.

For legacy API versions, the `DefaultGarbageCollectionPolicy` remains `OrphanDependents`.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
ref #55027

**Special notes for your reviewer**:
/cc @enisoc @caesarxuchao @kow3ns
/assign @kubernetes/sig-apps-api-reviews 

**Release note**:

```release-note
The default garbage collection policy for Deployment, DaemonSet, StatefulSet, and ReplicaSet has changed from OrphanDependents to DeleteDependents when the deletion is requested through an `apps/v1` endpoint. Clients using older endpoints will be unaffected. This change is only at the REST API level and is independent of the default behavior of particular clients (e.g. this does not affect the default for the kubectl `--cascade` flag).

If you upgrade your client-go libs and use the `AppsV1()` interface, please note that the default garbage collection behavior is changed.
```

Automatic merge from submit-queue (batch tested with PRs 52767, 55065, 55148, 56228, 56221). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

LimitRange e2e test improved.

**What this PR does / why we need it**: Improves the e2e test for LimitRange API by testing Update, Delete and Watch features.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 52767, 55065, 55148, 56228, 56221). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add resize support for ceph RBD

Add resize support for ceph RBD
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: part of [#657](https://github.com/kubernetes/community/pull/657)

**Special notes for your reviewer**:

**Release note**:
```release-note
Add resize support for ceph RBD
```

WIP, need to add fs resize,
assign to myself first

/assign @NickrenREN

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Expose single annotation/label via downward API

**What this PR does / why we need it**:

https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/annotations-downward-api.md

Support exposing single annotation via both env and volume downward API using the following syntax:

```
metadata.annotations['key']
metadata.labels['key']
```

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

#31218

**Special notes for your reviewer**:

This PR takes over the work in https://github.com/kubernetes/kubernetes/pull/41648.

**Release note**:

```
A single value in metadata.annotations/metadata.labels can be passed into the containers via Downward API
```

/assign @thockin @vishh

Update bazel files

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fixes service controller update race condition

**What this PR does / why we need it**:

Fixes service controller update race condition that can happen with the node sync loop and the worker(s). This PR allows the node sync loop to utilize the same work queue as service updates so that the queue can ensure the service is being acted upon by only one goroutine. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #53462

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/cc @wlan0 @luxas @prydie @andrewsykim 

/sig cluster-lifecycle
/area cloudprovider

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fixtypo

**What this PR does / why we need it**:
fixtypo
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
None
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Combine downward api e2e test cases.

**What this PR does / why we need it**:
This will reduce one loop of create/delete pod. Hope it can save some test time.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 55545, 55548, 55815, 56136, 56185). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: add `--print-join-command` flag for token create.

**What this PR does / why we need it**: This change adds a new flag `kubeadm token create --print-join-command`. When this flag is passed, kubeadm prints the full `kubeadm join [...]` command, including the CA certificate hash which is otherwise annoying to calculate.

**Which issue(s) this PR fixes** fixes https://github.com/kubernetes/kubeadm/issues/519

**Special notes for your reviewer**:

### Example Output
```
$ kubeadm token create --print-join-command
kubeadm join --token 447067.20b55955bd6abe6c 192.168.99.100:8443 --discovery-token-ca-cert-hash sha256:17023a5c90b996e50c514e63e161e46f78be216fd48c0c3df3be67e008b28889
$ kubeadm token create -h
[...]
      --print-join-command   Instead of printing only the token, print the full 'kubeadm join' flag needed to join the cluster using the token.
[...]
```

I ended up not using the approach suggested by @xiangpengzhao in https://github.com/kubernetes/kubernetes/pull/56025 (and also by @fabriziopandini) of reusing the `bootstrap-token` phase code, since that code assumes it can load the CA certificates from `/etc/kubernetes`, but that is only true if kubeadm is run on an already-joined node.

Instead, I wrote code to pull the CA certificates and server endpoint from the kubeconfig that `kubeadm token create` is called with, since that also contains the data and is available even if, e.g., kubeadm is being run from outside the cluster.

**Release note**:
```release-note
kubeadm: added `--print-join-command` flag for `kubeadm token create`.
```

/sig cluster-lifecycle

/cc @fabriziopandini @xiangpengzhao @luxas

Automatic merge from submit-queue (batch tested with PRs 55545, 55548, 55815, 56136, 56185). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix storageclass unit tests

Before this change, a unit test fails:
```
make test WHAT=k8s.io/kubernetes/pkg/registry/storage/storageclass/storage
```

**Release note**:
```release-note
NONE
```

/assign @saad-ali 
/assign @thockin

Automatic merge from submit-queue (batch tested with PRs 55545, 55548, 55815, 56136, 56185). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Implement node fs resize

Implement kubelet side resizing of file system.

xref - https://github.com/kubernetes/features/issues/284 

```release-note
Implement kubelet side file system resizing. Also implement GCE PD resizing
```