Get command now uses metadata x-kubernetes-print-columns, if present, in Openapi schema
to format output for a resource. This functionality is guarded by a boolean
flag 'use-openapi-print-columns'.

Automatic merge from submit-queue (batch tested with PRs 46718, 46828, 46988)

Simply changed the names of packages of some admission plugins.

**What this PR does / why we need it**:
This PR simply changes the names of packages of some admission plugins so that they are not in conflict with admission pkg.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46718, 46828, 46988)

Update docs/ links to point to main site

**What this PR does / why we need it**:
This updates various links to either point to kubernetes.io or to the kubernetes/community repo instead of the legacy docs/ tree in k/k
Pre-requisite for #46813

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

@kubernetes/sig-docs-maintainers @chenopis @ahmetb @thockin

Automatic merge from submit-queue (batch tested with PRs 46718, 46828, 46988)

handle unversioned objects for encoding for CRs

Fixes https://github.com/kubernetes/kubernetes/issues/47036

This updates the encoding for "special" types like `Status` when coming back through the CR APIs.  It also closes a bug this allowed to be exposed in validation for CRs

xref: https://github.com/kubernetes/features/issues/95

Automatic merge from submit-queue

add gzip compression to GET and LIST requests

Fixes https://github.com/kubernetes/kubernetes/issues/44164



Enable compressed response bodies for non-watch GET and LIST requests on API Objects.

**What this PR does / why we need it**: Adds compression via Accept-Encoding header, returns Content-Encoding header on responses (only supports gzip at this time). Enabled solely for GET and LIST requests which can return very large response bodies. 

**Special notes for your reviewer**:

See https://github.com/kubernetes/kubernetes/issues/44164 for discussion.

**Release note**:

```release-note-
```

Automatic merge from submit-queue (batch tested with PRs 46775, 47009)

kuberuntime: check the value of RunAsNonRoot when verifying

The verification function is fixed to check the value of RunAsNonRoot,
not just the existence of it. Also adds unit tests to verify the correct
behavior.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #46996

**Release note**:

```release-note
Fix the bug where container cannot run as root when SecurityContext.RunAsNonRoot is false.
```

Automatic merge from submit-queue

Rename {kube- ->}apiextensions-{-> api}server

Completely mechanical renaming, as preparation of the repo sync. This repo is generic, the prefix does not make sense.

Part of issue https://github.com/kubernetes/kubernetes/issues/46702

TODOs
- [ ] Waiting for the submit queue to settle, then rebase.

closes #44164

Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875)

kubeadm: Idempotent service account creation.

**What this PR does / why we need it**:
During `kubeadm init`, ignore errors for duplicates when creating service accounts.

https://github.com/kubernetes/kubeadm/issues/278

Fixes: https://github.com/kubernetes/kubeadm/issues/288

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875)

[advanced audit] fix invalid status code for hijacker

Fixes #47035

When using hijacker to take over the connection, the http status code
should be 101 not 200.

PS:
Use "kubectl exec" as an example to review this change.

Part of https://github.com/kubernetes/features/issues/22

Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875)

kubeadm: Make kubeadm use the right CSR approver for the right version

**What this PR does / why we need it**:

fixes regression caused in: https://github.com/kubernetes/kubernetes/pull/45619

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Fixes: https://github.com/kubernetes/kubeadm/issues/289

**Special notes for your reviewer**:

cc @pipejakob our e2e CI should probably go green after this change

**Release note**:

```release-note
NONE
```
@mikedanese @pipejakob @timothysc @liggitt

Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875)

Wait for cloud-init to finish before starting tests.

This fixes #46889.


**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875)

Write audit policy file for GCE/GKE configuration

Setup the audit policy configuration for GCE & GKE. Here is the high level summary of the policy:

- Default logging everything at `Metadata`
- Known write APIs default to `RequestResponse`
- Known read-only APIs default to `Request`
- Except secrets & configmaps are logged at `Metadata`
- Don't log events
- Don't log `/version`, swagger or healthchecks

In addition to the above, I spent time analyzing the noisiest lines in the audit log from a cluster that soaked for 24 hours (and ran a batch of e2e tests). Of those top requests, those that were identified as low-risk (all read-only, except update kube-system endpoints by controllers) are dropped.

I suspect we'll want to tweak this a bit more once we've had a time to soak it on some real clusters.

For kubernetes/features#22

/cc @sttts @ericchiang

Automatic merge from submit-queue

Avoid double printing output of gcloud commands in kubemark

Just noticed we were unnecessarily echoing the result again.

/cc @wojtek-t

Automatic merge from submit-queue (batch tested with PRs 46112, 46764, 46727, 46974, 46968)

iscsi storage plugin: bkpPortal should be initialized beforehand

**What this PR does / why we need it**:
This patch is a follow up patch for the PR #46239.
The bkpPortal in DetachDisk() path should be initialized before using it.

**Special notes for your reviewer**:
/cc @rootfs @childsb 

**Release note**:

```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46112, 46764, 46727, 46974, 46968)

Avoid * in filenames

Fixes #46958

Automatic merge from submit-queue (batch tested with PRs 46112, 46764, 46727, 46974, 46968)

Add controllerrevisions as valid resource in kubectl help

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**: controllerrevisions is a new resource added in 1.7 @kubernetes/sig-cli-maintainers 

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 46112, 46764, 46727, 46974, 46968)

empty audit policy file is legal configuration

Empty audit policy file or policy file contains only comments means
using default audit level for all requests.

**Release note**:

```
NONE
```

Part of https://github.com/kubernetes/features/issues/22

Automatic merge from submit-queue

apimachinery: move unversioned registration to metav1

Follow-up from the discussions in https://github.com/kubernetes/kubernetes/pull/43027:

We need `Status` as unversioned type which is hardcoded to `GroupVersion{Group: "", Version: "v1"}`. If the core group is not in the scheme, we miss `Status`.

Fixing https://github.com/kubernetes/kubernetes/issues/47030.

Automatic merge from submit-queue (batch tested with PRs 46787, 46876, 46621, 46907, 46819)

kubeadm: Only create bootstrap configmap if not exists.

**What this PR does / why we need it**:
The fact that this method was not idempotent was breaking kubeadm upgrades.

https://github.com/kubernetes/kubeadm/issues/278

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46787, 46876, 46621, 46907, 46819)

Add fatal message

**What this PR does / why we need it**:
Add fatal message

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46787, 46876, 46621, 46907, 46819)

Highlight nodeSelector when checking nodeSelector for Pod.

**What this PR does / why we need it**:
Currently, we are using function name as `PodSelectorMatches` to check if `nodeSelector` matches for a Pod, it is better update the function name a bit to reflect it is checking `nodeSelector` for a Pod.

The proposal is rename `PodSelectorMatches` as `PodMatchNodeSelector`.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46787, 46876, 46621, 46907, 46819)

Fix cAdvisorPort, 0 is a valid option

wrt #11710, this maintains the current default if nobody provides the flag, but allows explicitly passing 0.

/cc @farcaller @vishh @liggitt @antoineco @philips 
/assign @liggitt @vishh 

```release-note
Fixes a bug with cAdvisorPort in the KubeletConfiguration that prevented setting it to 0, which is in fact a valid option, as noted in issue #11710.
```

Automatic merge from submit-queue

Update the fluentd-gcp image

Rolled back fluentd version to 0.12 to avoid performance problems and unnecessary noise in logs: https://github.com/kubernetes/contrib/pull/2625

Fixes https://github.com/kubernetes/kubernetes/issues/46990

Ignore errors for duplicates when creating service accounts.

https://github.com/kubernetes/kubeadm/issues/278

Automatic merge from submit-queue

Add event exporter deployment to the fluentd-gcp addon

Introduce event exporter deployment to the fluentd-gcp addon so that by default if logging to Stackdriver is enabled, events will be available there also.

In this release, event exporter is a non-critical pod in BestEffort QoS class to avoid preempting actual workload in tightly loaded clusters. It will become critical in one of the future releases.


```release-note
Stackdriver cluster logging now deploys a new component to export Kubernetes events.
```

Automatic merge from submit-queue

Add EmptyDir volume capacity isolation

This PR adds the support for isolating the emptyDir volume use. If user
sets a size limit for emptyDir volume, kubelet's eviction manager monitors its usage
and evict the pod if the usage exceeds the limit.

This feature is part of local storage capacity isolation and described in the proposal kubernetes/community#306

**Release note**:

```release-note
Alpha feature: allows users to set storage limit to isolate EmptyDir volumes. It enforces the limit by evicting pods that exceed their storage limits  
```

Automatic merge from submit-queue

kubeadm: don't duplicate master taint if it already exists.

**What this PR does / why we need it**:
This helps enable a graceful upgrade/downgrade process between 1.6.x and 1.7.x kubeadm clusters (although no guarantees outside of that range) by doing:

    $ kubeadm init --kubernetes-version <version> --skip-preflight-checks

Without this change, the command fails with an error that the node taint is duplicated.

This is part of https://github.com/kubernetes/kubeadm/issues/278

**Release note**:

```release-note
NONE
```
Fixes: https://github.com/kubernetes/kubeadm/issues/288

Automatic merge from submit-queue (batch tested with PRs 46967, 46992, 43338, 46717, 46672)

Select initializers from the dynamic configuration

Continues #36721

kubernetes/features#209

Automatic merge from submit-queue (batch tested with PRs 46967, 46992, 43338, 46717, 46672)

Generate protobuf for the audit API

Add protobuf generation & annotations for the advanced auditing API. We're not using them directly now, but settling on the field numbering will help with some 3rd party integrations.

For kubernetes/features#22

/cc @ihmccreery

Automatic merge from submit-queue (batch tested with PRs 46967, 46992, 43338, 46717, 46672)

Add group alias names to API resources to allow discovery

**What this PR does / why we need it**: 
Adds `GroupNames []string` to API resources, which represents the list of group aliases that every resource belongs to. 

Partially fixes https://github.com/kubernetes/kubernetes/issues/41353

This moves the logic of "all" (which currently [translates](https://github.com/kubernetes/kubernetes/blob/fbc94c089657045217999995aaf08e4025b53c52/pkg/kubectl/cmd/util/shortcut_restmapper.go#L106) to "pods,replicationcontrollers,services,...") to the server-side. Will allow clients like `kubectl` to discover group aliases instead of having it hardcoded and the API server to better handle consistency across multiple clients, version skew, etc; and will make "all" un-special and allow other groups to be created.

As a follow-up we'll patch `kubectl` to make groups aliases discoverable and the hardcoded list a fallback while we still have to support it.

Related to https://github.com/kubernetes/kubernetes/pull/42595#issuecomment-286839885.

**Release note**:
```release-note
Adds the `Categories []string` field to API resources, which represents the list of group aliases (e.g. "all") that every resource belongs to. 
```
@kubernetes/sig-api-machinery-misc @deads2k @bgrant0607

Automatic merge from submit-queue (batch tested with PRs 46967, 46992, 43338, 46717, 46672)

save kubelet bootstrap certs on GCI

Fix https://github.com/kubernetes/kubernetes/issues/46982

Automatic merge from submit-queue (batch tested with PRs 46967, 46992, 43338, 46717, 46672)

deflake CRD watch tests

Fixes https://github.com/kubernetes/kubernetes/issues/46446. Again...

This flake window is caused by the watch cache starting late.  This pull updates the test to do fancy list/create/watch/delete semantics to catch the problem.  In the field, this should be treated the same as any other "resourceVersion tool old" error and handled with a list/watch.  The test cannot be level driven, it is actually testing the edge behavior, so we have to do something weird like this.

@sttts @liggitt let's try this again...