Automatic merge from submit-queue

Add more test cases to k8s e2e upgrade tests

**Special notes for your reviewer**: 
Added guestbook, secrets, daemonsets, configmaps, jobs to e2e upgrade tests according to the discussions in #35078
Still need to run these test cases in real setup, raised a PR here for initial comments

@quinton-hoole

Automatic merge from submit-queue

Fix hostname truncate.

Fixes https://github.com/kubernetes/kubernetes/issues/36951.

This PR will keep truncating the hostname until the ending character is valid.

/cc @kubernetes/sig-node 

Mark v1.5 because this is a bug fix.
/cc @saad-ali

Automatic merge from submit-queue

make kubectl create --edit iterate

`kubectl create --edit` is broken after #36148 merged.
`kubectl create --edit` will fail when a manifest that contains multiple resources.
I guess the root cause is that dynamic typer doesn't support a list of resources currently.

This PR makes `kubectl create --edit` iterate again as `kubectl create`.

Automatic merge from submit-queue

Federation: allow specification of dns zone by ID

Automatic merge from submit-queue

Replace controller presence checking logic

fixes #36912

Automatic merge from submit-queue

Revert "add e2e test for kubectl in a Pod"

Reverts kubernetes/kubernetes#33850

That PR introduced a test `Kubectl should be able to talk to api server kubectl running in a pod could talk to api server` that runs against GKE.

Ever since the PR merged the test has been failing against [kubernetes-e2e-gke](https://k8s-gubernator.appspot.com/builds/kubernetes-jenkins/logs/kubernetes-e2e-gke) though it was initially passing in [kubernetes-e2e-gci-gke](https://k8s-gubernator.appspot.com/builds/kubernetes-jenkins/logs/kubernetes-e2e-gci-gke). Presumably this was because the path to kubectl was different between GCI and container-vm (the two test suites).

PR https://github.com/kubernetes/kubernetes/pull/36864 attempted to fix this, but ended up breaking the test in both suites. That PR has been reverted (https://github.com/kubernetes/kubernetes/pull/36971).

Because the test introduced in kubernetes/kubernetes#33850 is still broken, it is being reverted (we should've reverted immediately after it merged instead of waiting this long).

Automatic merge from submit-queue

Add clarity/retries to proxy url test

Improve one segment of the kube-proxy networking test by:      
1. Retrying for 30s 
2. Bucketing into 2 failure modes
3. Adding some clarity by describing the exec pod on failure

Althought 1 shouldn't be necessary, I don't think we lose anything if the kube-proxy convenience endpoint doesn't respond immediately, and if it fails for 30s straight it is indicative of something that requires attention probably within 1.5. 

Fixes https://github.com/kubernetes/kubernetes/issues/32436

Automatic merge from submit-queue

Require BOOTSTRAP_MIGRATION, JENKINS_BUILD_STARTED or JENKINS_BUILD_F…

If we do not do this then we upload finished.json and update latest-build.txt before the build fiinshes, breaking the SQ

Revert "Fix path to kubectl on host in kubectl-in-pod"

Fix path to kubectl on host in kubectl-in-pod

Automatic merge from submit-queue

Bump gci image version for cri builds

#36681 didn't change all the configs.

Automatic merge from submit-queue

Fixed typo - cluser -> cluster, and replicasets -> ReplicaSet for consistency

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
```

Automatic merge from submit-queue

Enable NFSv4 and GlusterFS tests on cluster e2e tests

Enable NFSv4 and GlusterFS tests on cluster e2e tests for GCI images
only.

Automatic merge from submit-queue

Fix syntax error in local-up-cluster.sh when CGROUP_ROOT is set

Fix syntax error when `CGROUP_ROOT` is set, or it will complain a following error:

```
hack/local-up-cluster.sh: line 39: CGROUP_ROOT: "": syntax error: operand expected (error token is """")
```

cc/ @derekwaynecarr

Automatic merge from submit-queue

Handle Empty clusterCIDR

**What this PR does / why we need it**:
Handles empty clusterCIDR by skipping the corresponding rule.

**Which issue this PR fixes** 
fixes #36652

**Special notes for your reviewer**:
1. Added test to check for presence/absence of XLB to SVC rule
2. Changed an error statement to log rules along with the error string in case of a failure; This ensures that full debug info is available in case of iptables-restore errors.


Empty clusterCIDR causes invalid rules generation.
Fixes issue #36652

Automatic merge from submit-queue

Fix SA2003, deferred Lock right after locking

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:
Fixes a re-locking right after a lock. This is a part if issue #36858.

**Special notes for your reviewer**:
N/A

**Release note**:
NONE

Automatic merge from submit-queue

dockershim: remove sandbox container upon naming conflicts

We have observed that, after failing to create a container due to "device or
resource busy", docker may end up having inconsistent internal state. One
symptom is that docker will not report the existence of the "failed to create"
container, but if kubelet tries to create a new container with the same name,
docker will error out with a naming conflict message.

To work around this, this commit parses the creation error message and if there
is a naming conflict, it would attempt to remove the existing container.

Automatic merge from submit-queue

fix kubectl taint test flake

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:
Kubectl taint tests fail often recently, this PR is trying to fix it.

**Which issue this PR fixes**: ref #29503, #32535

**Special notes for your reviewer**:
This PR cannot 100% fix the flake, but just reduce the failing rate, if the two "kubectl taint" tests are running at the same time, it still has chance to fail.
Maybe should mark the tests "Serial" (see also #31906, #36781), but then they won't run for each PR.

We have observed that, after failing to create a container due to "device or
resource busy", docker may end up having inconsistent internal state. One
symptom is that docker will not report the existence of the "failed to create"
container, but if kubelet tries to create a new container with the same name,
docker will error out with a naming conflict message.

To work around this, this commit parses the creation error message and if there
is a naming conflict, it would attempt to remove the existing container.

Automatic merge from submit-queue

Use Gid when provisioning Gluster Volumes.

Bug # https://github.com/openshift/origin/issues/11556

Update API server CPU constraints in the density test

Enable NFSv4 and GlusterFS tests on cluster e2e tests for GCI images
only.

BUG # https://github.com/openshift/origin/issues/11556Signed-off-by: Humble Chirammal <hchiramm@redhat.com>

Automatic merge from submit-queue

Add ServiceAccounts to kubemark

cc @yujuhong

Automatic merge from submit-queue

CRI: add docs for sysctls

#34830 adds `sysctls` features in CRI, it is based on sandbox annotations, this PR adds docs for it. 

@yujuhong @timstclair @jonboulle

Automatic merge from submit-queue

Node E2E: Avoid printing test result twice.

This is a problem since long time ago.

`RunSshCommand` includes the command output to the error. If the command running the test fails, the test output will also be included in the error. [The runner prints both the test output and the error](https://github.com/kubernetes/kubernetes/blob/master/test/e2e_node/runner/remote/run_remote.go#L270), which leads the test result to be printed twice. (See the [test result](https://storage.googleapis.com/kubernetes-jenkins/logs/kubelet-gce-e2e-ci/10968/build-log.txt) on node tmp-node-e2e-af900a4d-e2e-node-ubuntu-trusty-docker9-v1-image)

This PR changes `RunSshCommand` not to put command output into the error, and leave the caller to decide how to deal with command output when the command fails.

Automatic merge from submit-queue

CRI: Clarify User in CRI.

Addressed https://github.com/kubernetes/kubernetes/pull/36423#issuecomment-259343135.

This PR clarifies the user related fields in CRI.

One question is that:
What is the meaning of the `run_as_user` field in `LinuxSandboxSecurityContext`?
* **Is it user on the host?** Then it doesn't make sense, user shouldn't care about what users are on the host.
* **Is it user inside the infra container image?** This is how the field is currently used. However, Infra container is docker specific, I'm not sure whether we should expose this in CRI.
* **Is it the default user inside the pod?** It tells runtime that if there is a container (infra container, or some other helper containers like streaming container etc.), if their `user` is not specified, use the default "sandbox user". Then how can we guarantee that infra or helper container image have the `user`?
* **It doesn't make sense?** If we remove it, we are relying on the shim to set right user (maybe always root) for infra or helper containers (if there will be any in the future), I'm not sure whether this is what we expect.

@yujuhong @feiskyer @jonboulle @yifan-gu 
/cc @kubernetes/sig-node

Automatic merge from submit-queue

Add e2e test for CockroachDB statefulset

Refactor the code of statefulset e2e test for clustered applications, and add a test for CockroachDB. 

The yaml file is copied from examples/cockroachdb/

cc @erictune @foxish @kow3ns @kubernetes/sig-apps

Automatic merge from submit-queue

Add debug logging to all etcd migration operations.

Automatic merge from submit-queue

e2e pod cleanup test: restrict pods to be assigned to nodes observed …

The test checks the individual kubelet /runningPods endpoint based on the
initial list of nodes it observes. It is important that all pods are
scheduled only onto those nodes. Apply node labels to ensure no stray pods on
other nodes.

This fixes #35197