Automatic merge from submit-queue (batch tested with PRs 46235, 44786, 46833, 46756, 46669)

implements StatefulSet update

**What this PR does / why we need it**:
1. Implements rolling update for StatefulSets
2. Implements controller history for StatefulSets.
3. Makes StatefulSet status reporting consistent with DaemonSet and ReplicaSet.

https://github.com/kubernetes/features/issues/188

**Special notes for your reviewer**:

**Release note**:
```release-note
Implements rolling update for StatefulSets. Updates can be performed using the RollingUpdate, Paritioned, or OnDelete strategies. OnDelete implements the manual behavior from 1.6. status now tracks 
replicas, readyReplicas, currentReplicas, and updatedReplicas. The semantics of replicas is now consistent with DaemonSet and ReplicaSet, and readyReplicas has the semantics that replicas did prior to this release.
```

Automatic merge from submit-queue (batch tested with PRs 46235, 44786, 46833, 46756, 46669)

Add Japanese translation for kubectl

**What this PR does / why we need it**:
I messed up the original PR(#45562) which was already been reviewed and approved. This PR provides first attempt to translate kubectl in Japanese (related to #40645 and #40591).

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
No issues

**Special notes for your reviewer**:
Should be reviewed by member of Japanese k8s community (I stayed in Japan for 4 years, but my language is not as good as native Japanese)

Automatic merge from submit-queue (batch tested with PRs 46235, 44786, 46833, 46756, 46669)

Fixed ResourceConsumer.CleanUp to properly clean up non-replication-controller resources and pods

**What this PR does / why we need it**: Without this fix CleanUp does not remove non-replication-controller resources and pods. This leads to pollution that in some cases inadvertently affects what is happening in AfterEachs before the namespace gets deleted.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46235, 44786, 46833, 46756, 46669)

federation: Add admission controller for policy-based placement

@nikhiljindal 

Here's the initial version of the scheduling policy admission controller. It's at the point where it would benefit from having another pair of eyes look at it. The main thing I'm unsure of is the serialization of Kube resources for the webhook/query call.

Release Note:

```
The federation-apiserver now supports a SchedulingPolicy admission controller that enables policy-based control over placement of federated resources.
```

Ref #39982

Automatic merge from submit-queue (batch tested with PRs 46235, 44786, 46833, 46756, 46669)

Get command uses print-column extn from Openapi schema

**What this PR does / why we need it**:

Kubectl Get command now uses metadata 'x-kubernetes-print-column' from Openapi schema to display a resource. This is to enable richer experience for non-compiled types (like service catalog API resources) in Kubectl. This functionality is currently guarded by a boolean flag "use-openapi-print-columns". 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
fixes https://github.com/kubernetes/kubectl/issues/22

**Special notes for your reviewer**:

**Release note**:

```release-note
Get command uses OpenAPI schema to enhance display for a resource if run with flag 'use-openapi-print-columns'. 
An example command:
kubectl get pods --use-openapi-print-columns 
```

Automatic merge from submit-queue

Fix etcd storage location for CRs

Fixes https://github.com/kubernetes/kubernetes/issues/46031

The first commit is easy, the second commit is hard.  

@sttts Read the second commit very carefully and search the repo to make sure that you agree this is only affecting aggregator and apiextensions.

@pmorie @derekwaynecarr make sure you check to see if service catalog is double prefixing.  Looks like we missed it in 1.6, but no one was using it.

Automatic merge from submit-queue (batch tested with PRs 46997, 47021)

Block on projected volume data fetch failure

Fixes #47020

Automatic merge from submit-queue (batch tested with PRs 46997, 47021)

Don't parse human-readable output from gcloud in tests

This is the reason  `[k8s.io] Services should be able to change the type and ports of a service [Slow]` is currently failing on GKE e2e tests. For GKE jobs we run a prerelease version of gcloud, in which the default command output was changed.

gcloud's default output for commands is human readable, and is subject to change. Anything scripting against gcloud should always pass `--format=json|yaml|value(...)`  so you get standardized output.

fixes: #46918

Automatic merge from submit-queue (batch tested with PRs 47083, 44115, 46881, 47082, 46577)

Do not fire InsufficientResourceError when there are intentional reasons

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #45780 


**Special notes for your reviewer**:
Return directly of essential predicates failed.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 47083, 44115, 46881, 47082, 46577)

Revert "Optimize selector for single-matching items"

This reverts commit f93a270e.

Fix: #46851

@smarterclayton 

The problem was that removing the requirement from the predicate resulted in not using "trigger" function in Cacher, which is super critical for performance. And this was messed up.

Automatic merge from submit-queue (batch tested with PRs 47083, 44115, 46881, 47082, 46577)

Add an e2e test for server side get

Print a better error from the response. Performs validation to ensure it
does not regress in alpha state.

This is tests and bug fixes for https://github.com/kubernetes/community/pull/363

@kubernetes/sig-api-machinery-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 47083, 44115, 46881, 47082, 46577)

Scheduler should not log an error when there is no fit

**What this PR does / why we need it**:
The scheduler should not log an error when it is unable to find a fit for a pod as it's an expected situation when resources are unavailable on the cluster that satisfy the pods requirements.

Automatic merge from submit-queue

save kubelet cert between reboots on CVM

fixes https://github.com/kubernetes/kubernetes/issues/46982

Automatic merge from submit-queue

kubeadm: improve quickstart instructions

**What this PR does / why we need it**:

Improves instructional output following setup of a kubernetes master with kubeadm.

This helps prevent unnecessary support overhead such as: https://github.com/kubernetes/kubeadm/issues/212#issuecomment-292015402

**Example current output**:

```
To start using your cluster, you need to run (as a regular user):

  sudo cp /etc/kubernetes/admin.conf $HOME/
  sudo chown $(id -u):$(id -g) $HOME/admin.conf
  export KUBECONFIG=$HOME/admin.conf
```

**Example new output**:

```
To start using your cluster, you need to run (as a regular user):

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config
```

**Release note**:

```release-note
NONE
```

This reverts commit f93a270e.

Get command now uses metadata x-kubernetes-print-columns, if present, in Openapi schema
to format output for a resource. This functionality is guarded by a boolean
flag 'use-openapi-print-columns'.

Implements history utilities for ControllerRevision in the controller/history package
StatefulSetStatus now has additional fields for consistency with DaemonSet and Deployment
StatefulSetStatus.Replicas now represents the current number of createdPods and StatefulSetStatus.ReadyReplicas is the current number of ready Pods

Automatic merge from submit-queue (batch tested with PRs 46718, 46828, 46988)

Simply changed the names of packages of some admission plugins.

**What this PR does / why we need it**:
This PR simply changes the names of packages of some admission plugins so that they are not in conflict with admission pkg.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46718, 46828, 46988)

Update docs/ links to point to main site

**What this PR does / why we need it**:
This updates various links to either point to kubernetes.io or to the kubernetes/community repo instead of the legacy docs/ tree in k/k
Pre-requisite for #46813

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

@kubernetes/sig-docs-maintainers @chenopis @ahmetb @thockin

Automatic merge from submit-queue (batch tested with PRs 46718, 46828, 46988)

handle unversioned objects for encoding for CRs

Fixes https://github.com/kubernetes/kubernetes/issues/47036

This updates the encoding for "special" types like `Status` when coming back through the CR APIs.  It also closes a bug this allowed to be exposed in validation for CRs

xref: https://github.com/kubernetes/features/issues/95

Automatic merge from submit-queue

add gzip compression to GET and LIST requests

Fixes https://github.com/kubernetes/kubernetes/issues/44164



Enable compressed response bodies for non-watch GET and LIST requests on API Objects.

**What this PR does / why we need it**: Adds compression via Accept-Encoding header, returns Content-Encoding header on responses (only supports gzip at this time). Enabled solely for GET and LIST requests which can return very large response bodies. 

**Special notes for your reviewer**:

See https://github.com/kubernetes/kubernetes/issues/44164 for discussion.

**Release note**:

```release-note-
```

Automatic merge from submit-queue (batch tested with PRs 46775, 47009)

kuberuntime: check the value of RunAsNonRoot when verifying

The verification function is fixed to check the value of RunAsNonRoot,
not just the existence of it. Also adds unit tests to verify the correct
behavior.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #46996

**Release note**:

```release-note
Fix the bug where container cannot run as root when SecurityContext.RunAsNonRoot is false.
```

Automatic merge from submit-queue

Rename {kube- ->}apiextensions-{-> api}server

Completely mechanical renaming, as preparation of the repo sync. This repo is generic, the prefix does not make sense.

Part of issue https://github.com/kubernetes/kubernetes/issues/46702

TODOs
- [ ] Waiting for the submit queue to settle, then rebase.

closes #44164

Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875)

kubeadm: Idempotent service account creation.

**What this PR does / why we need it**:
During `kubeadm init`, ignore errors for duplicates when creating service accounts.

https://github.com/kubernetes/kubeadm/issues/278

Fixes: https://github.com/kubernetes/kubeadm/issues/288

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875)

[advanced audit] fix invalid status code for hijacker

Fixes #47035

When using hijacker to take over the connection, the http status code
should be 101 not 200.

PS:
Use "kubectl exec" as an example to review this change.

Part of https://github.com/kubernetes/features/issues/22

Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875)

kubeadm: Make kubeadm use the right CSR approver for the right version

**What this PR does / why we need it**:

fixes regression caused in: https://github.com/kubernetes/kubernetes/pull/45619

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Fixes: https://github.com/kubernetes/kubeadm/issues/289

**Special notes for your reviewer**:

cc @pipejakob our e2e CI should probably go green after this change

**Release note**:

```release-note
NONE
```
@mikedanese @pipejakob @timothysc @liggitt

Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875)

Wait for cloud-init to finish before starting tests.

This fixes #46889.


**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875)

Write audit policy file for GCE/GKE configuration

Setup the audit policy configuration for GCE & GKE. Here is the high level summary of the policy:

- Default logging everything at `Metadata`
- Known write APIs default to `RequestResponse`
- Known read-only APIs default to `Request`
- Except secrets & configmaps are logged at `Metadata`
- Don't log events
- Don't log `/version`, swagger or healthchecks

In addition to the above, I spent time analyzing the noisiest lines in the audit log from a cluster that soaked for 24 hours (and ran a batch of e2e tests). Of those top requests, those that were identified as low-risk (all read-only, except update kube-system endpoints by controllers) are dropped.

I suspect we'll want to tweak this a bit more once we've had a time to soak it on some real clusters.

For kubernetes/features#22

/cc @sttts @ericchiang

Automatic merge from submit-queue

Avoid double printing output of gcloud commands in kubemark

Just noticed we were unnecessarily echoing the result again.

/cc @wojtek-t

Automatic merge from submit-queue (batch tested with PRs 46112, 46764, 46727, 46974, 46968)

iscsi storage plugin: bkpPortal should be initialized beforehand

**What this PR does / why we need it**:
This patch is a follow up patch for the PR #46239.
The bkpPortal in DetachDisk() path should be initialized before using it.

**Special notes for your reviewer**:
/cc @rootfs @childsb 

**Release note**:

```
NONE
```