Check status of framework.CheckPodsRunningReady and fail test if it's false, instead of silently
ignoring the failure.

Implement OIDC client AuthProvider

Update node e2e containervm image to not start kubelet as part of ini…

Removing indirection from proxy exec test

Make addon-manager cross-platform and use it with hyperkube

kubelet: Optionally, have kubelet exit if lock file contention is observed, using --exit-on-lock-contention flag

Clearly identify errors killing pods in events and logs

Turn on kubenet for GCE

Bump up glbc version to 0.6.2

Fix a nit in the downward api proposal for resources.

Fix kubemark which was broken by a backwards incompatible flag change to controller-manager

rkt: Don't warn on empty pod logs

GCI: fix a breakage in controller-manager

Automatic merge from submit-queue

Update AWS under the hood doc with ELB SSL annotations

Document #23495. No e2e tests or release notes needed (the other PR is already in the release docs).

Automatic merge from submit-queue

add CIDR allocator for NodeController

This PR:

* use pkg/controller/framework to watch nodes and	reduce lists when allocate CIDR for node
* decouple the cidr allocation logic from monitoring status logic

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/19242)
<!-- Reviewable:end -->

Large changes to the docker deployment. Added kube-addon-manager as a static pod. The addon-manager deploys kube-proxy as a DaemonSet as well as Dashboard and DNS automatically. SecurityContextDeny is removed from the manifests. Also, the turnup.sh and turndown.sh scripts are removed because we don't need them anymore, they're covered by the online documentation

Make the addon-manager cross-platform, change naming to binary-arch:version, remove deprecated kubectl command, add support for DaemonSets

I removed the netexec and goproxy pods from the proxy exec test. Instead
it now runs kubectl locally and the proxy is running in-process. Since
Go won't proxy for localhost requests, this test cannot pass if the API
server is local. However it was already disabled for local clusters.

Update node e2e containervm image to not start kubelet as part of init.  Update the node e2e host setup.sh to also do this when creating new images.

Automatic merge from submit-queue

Add 'kubectl set image'

```release-note
Add "kubectl set image" for easier updating container images (for pods or resources with pod templates). 
```

**Usage:**
```
kubectl set image (-f FILENAME | TYPE NAME) CONTAINER_NAME_1=CONTAINER_IMAGE_1 ... CONTAINER_NAME_N=CONTAINER_IMAGE_N
```
**Example:**
```console 
# Set a deployment's nginx container image to 'nginx:1.9.1', and its busybox container image to 'busybox'.
$ kubectl set image deployment/nginx busybox=busybox nginx=nginx:1.9.1

# Update all deployments' nginx container's image to 'nginx:1.9.1'
$ kubectl set image deployments nginx=nginx:1.9.1 --all

# Update image of all containers of daemonset abc to 'nginx:1.9.1'
$ kubectl set image daemonset abc *=nginx:1.9.1

# Print result (in yaml format) of updating nginx container image from local file, without hitting the server 
$ kubectl set image -f path/to/file.yaml nginx=nginx:1.9.1 --local -o yaml
```

I abandoned the `--container=xxx --image=xxx` flags in the [deploy proposal](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/deploy.md#kubectl-set) since it's much easier to use with just KEY=VALUE (CONTAINER_NAME=CONTAINER_IMAGE) pairs. 

Ref #21648 
@kubernetes/kubectl @bgrant0607 @kubernetes/sig-config 


[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()

Bumped Heapster to v1.1.0-beta2

Automatic merge from submit-queue

kubelet: Don't attempt to apply the oom score if container exited already

Containers could terminate before kubelet applies the oom score. This is normal
and the function should not error out.

This addresses #25844 partially.

/cc @smarterclayton @Random-Liu 

Automatic merge from submit-queue

Fixes panic on round tripper when TLS under a proxy

When under a proxy with a valid cert from a trusted authority, the `SpdyRoundTripper` will likely not have a `*tls.Config` (no cert verification nor `InsecureSkipVerify` happened), which will result in a panic. So we have to create a new `*tls.Config` to be able to create a TLS client right after. If `RootCAs` in that new config is nil, the system pool will be used.

@ncdc PTAL 

[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()

Automatic merge from submit-queue

SchedulerPredicates e2e test: be more verbose about requested resource

When ``validates resource limits of pods that are allowed to run [Conformance]`` test is run, logs could give more information about requested resource and say it is for cpu and in mili units.

cpu is stored in m units here:

```
nodeToCapacityMap[node.Name] = capacity.MilliValue()
```

Automatic merge from submit-queue

NodeController doesn't evict Pods if no Nodes are Ready

Fix #13412 #24597

When NodeControllers don't see any Ready Node it goes into "network segmentation mode". In this mode it cancels all evictions and don't evict any Pods.

It leaves network segmentation mode when it sees at least one Ready Node. When leaving it resets all timers, so each Node has full grace period to reconnect to the cluster.

cc @lavalamp @davidopp @mml @wojtek-t @fgrzadkowski 

Automatic merge from submit-queue

Fix JENKINS_USE_SKEW_KUBECTL

I got this logic wrong; the first is a NOT comparison, so the second should only be available if that NOT comparison returns true.

Automatic merge from submit-queue

Add a timeout to the node e2e Ginkgo test runner

Also add a few debugging statements to indicate progress.

Should help prevent #25639, since we'll timeout tests before Jenkins times out the build.

Automatic merge from submit-queue

Cassandra examples updating images to v9

- this is a version bump for the C* image
- I also increased the cpu to .5 because .1 is slow like warm death

Who can actually run the build to get the container to the examples repo?

Automatic merge from submit-queue

Properly handle init containers in convertToAPIContainerStatuses

Fix https://github.com/kubernetes/kubernetes/issues/25879
Fix https://github.com/kubernetes/kubernetes/issues/25844

This PR changed `convertToAPIContainerStatuses` to only generate waiting state when the init container really needs to be restarted.
Addresses https://github.com/kubernetes/kubernetes/issues/25844#issuecomment-220418068

Will send a better fix and add unit test later.
/cc @yujuhong @smarterclayton 

Automatic merge from submit-queue

volume controller: Fix method name in a log message

It's deleteVolume, not deleteClaim.

@kubernetes/sig-storage 

Automatic merge from submit-queue

Update vendor package google.golang.org/api/googleapi.

Automatic merge from submit-queue

Downward API proposal for resources (cpu, memory) limits and requests

Proposal to address #9473
This PR proposes three approaches to expose values of resource limits and requests as env vars and volumes.This proposal has details about merits and demerits of each approach, and I am looking for community feedback regarding which one (or may more than one) we would like to go with. Also would like to know if there is any other approach.

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/24051)
<!-- Reviewable:end -->