Automatic merge from submit-queue

allow a read-only rbd image mounted by multiple pods

allow pod to run read-only rbd volume 
fix #27725

Automatic merge from submit-queue

remove useless value copy

Copy something to values in parameters won't change them in go. So, remove it to avoid making people confused.

Automatic merge from submit-queue

Update secrets.md

Automatic merge from submit-queue

add delete strategy to certificates registry

So that CSRs can be deleted.

cc @gtank 

```console
$ kubectl delete certificatesigningrequest foo
error: error when deleting "foo": http: server closed connection
```
and on the apiserver:
```
E0806 00:11:53.791039       5 runtime.go:64] Observed a panic: "invalid memory address or nil pointer dereference" (runtime error: invalid memory address or nil pointer dereference)
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/util/runtime/runtime.go:70
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/util/runtime/runtime.go:63
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/util/runtime/runtime.go:49
/usr/local/go/src/runtime/asm_amd64.s:472
/usr/local/go/src/runtime/panic.go:443
/usr/local/go/src/runtime/panic.go:62
/usr/local/go/src/runtime/sigpanic_unix.go:24
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/api/rest/create.go:115
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/api/rest/delete.go:50
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/registry/generic/registry/store.go:634
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/apiserver/resthandler.go:799
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/apiserver/resthandler.go:953
/usr/local/go/src/runtime/asm_amd64.s:1998
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
        panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xb code=0x1 addr=0x20 pc=0xa268ee]

goroutine 1161 [running]:
panic(0x2a00240, 0xc820014070)
        /usr/local/go/src/runtime/panic.go:481 +0x3e6
k8s.io/kubernetes/pkg/util/runtime.HandleCrash(0xc821ecbef8, 0x1, 0x1)
        /go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/util/runtime/runtime.go:56 +0x153
panic(0x2a00240, 0xc820014070)
        /usr/local/go/src/runtime/panic.go:443 +0x4e9
k8s.io/kubernetes/pkg/api/rest.objectMetaAndKind(0x0, 0x0, 0x7faf1332ee78, 0xc8220f0600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
        /go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/api/rest/create.go:115 +0x1ee
k8s.io/kubernetes/pkg/api/rest.BeforeDelete(0x0, 0x0, 0x7faf13188338, 0xc821e218f0, 0x7faf1332ee78, 0xc8220f0600, 0xc821eb11c0, 0x0, 0x0, 0x0)
        /go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/api/rest/delete.go:50 +0x94
k8s.io/kubernetes/pkg/registry/generic/registry.(*Store).Delete(0xc82013c9a0, 0x7faf13188338, 0xc821e218f0, 0xc821e0bdde, 0xa, 0xc821eb11c0, 0x0, 0x0, 0x0, 0x0)
        /go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/registry/generic/registry/store.go:634 +0x3b8
k8s.io/kubernetes/pkg/apiserver.DeleteResource.func1.1(0x0, 0x0, 0x0, 0x0)
        /go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/apiserver/resthandler.go:799 +0xa4
k8s.io/kubernetes/pkg/apiserver.finishRequest.func1(0xc821e081e0, 0xc821eb12c0, 0xc821e08000, 0xc821e0bf80)
        /go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/apiserver/resthandler.go:953 +0xd9
created by k8s.io/kubernetes/pkg/apiserver.finishRequest
        /go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/pkg/apiserver/resthandler.go:958 +0xf1
```

Signed-off-by: Huamin Chen <hchen@redhat.com>

Typo, environment should be prod not pod

Automatic merge from submit-queue

e2e flake: real fix of PodAntiAffinity test

The fix in PR https://github.com/kubernetes/kubernetes/pull/30135 was wrong in using a wrong test condition for an already broken test.

### Summary

The test tries to launch a pod with an anti-affinity annotation, waits 10
seconds and then checks that it is still pending.

But the anti-affinity annotation does not forbid to launch that pod on just
another node that does not have the zone label at all.

This commit changes this behavior by labeling two nodes with the zone label
and then forcing the pod to be launched on one of those two nodes.

**I assume here that a non-existing label is considered as a different label value.**

  Fixes #30078

Automatic merge from submit-queue

SchedulerExtender: add failedPredicateMap in Filter() returns

Fix #25797. modify extender.Filter for adding extenders information to “failedPredicateMap” in findNodesThatFit.
When all the filtered nodes that passed "predicateFuncs" don’t pass the extenders filter, the failedPredicateMap hasn’t the extenders information, should add it, I think. So when the length of the “filteredNodes.Items” is 0, we can know the integral information. (The length of the “filteredNodes.Items” is 0, may be because the extenders filter failed.)

Automatic merge from submit-queue

Adding a default eviction disk check in test

This is to test that eviction options don't affect e2e tests

Automatic merge from submit-queue

refractoring findContainerStatus of status_manager

make findContainerStatus of status_manager simple

Automatic merge from submit-queue

make correction to two variables in inverse order

from Fprintf info ""Renaming %s to %s\n", it should be renamed from old to new.

Automatic merge from submit-queue

[kubelet] Auto-discover node IP if neither cloud provider exists and IP is not explicitly specified

One example where the earlier implementation failed is when running kubelet on CoreOS (bare-metal), where the nameserver is set to `8.8.8.8`. kubelet tries to lookup the node name agains Google DNS, which obviously fails. The kubelet won't recover after that.

The workaround hsa been to set `--hostname-override` to an IP address, but it's quite annoying to try to make a multi-distro way of getting the IP in bash for example. This way is much cleaner.

Refactored the function a little bit at the same time

@vishh @yujuhong @resouer @Random-Liu 

Automatic merge from submit-queue

Verify volume.GetPath() never returns ""

Add a new helper method volume.GetPath(Mounter) instead of calling
the GetPath() of the Mounter directly. Check if GetPath() is returning
a "" and convert that into an error.

Fixes #23163

Automatic merge from submit-queue

WIP: Add goimports to the cross build

A couple of verifiers have their own Dockerfiles because this doesn't have goimports (the protobuf one and the new runtime one)

Automatic merge from submit-queue

Use report-dir in test framework instead.

We already have `report-dir` option in framework test context.
The node e2e framework should use it as well.

/cc @ronnielai 

Automatic merge from submit-queue

node_e2e: Use upstream CoreOS image directly

.. and update it to the latest alpha

This will make updating the CoreOS image in the future much simpler since it won't involve project-copying, manual-baking, or so on.

cc @pwittrock @vishh @bboreham @yifan-gu 

Automatic merge from submit-queue

kubectl config set-crentials: add arguments for auth providers

This PR adds `--auth-provider` and `--auth-provider-arg` flags to the
`kubectl config set-credentials` sub-command.

There's currently no way of interacting with the new auth provider framework added in #23066 through kubectl. You have to render a custom kubeconfig to use them. Additionally `kubectl config set` just sort of craps out when attempting to interact with authentication info objects (#29312).

This is a minimal implementation of allowing `kubect config set-credentials` to set fields for client auth providers.

cc @cjcullen @kubernetes/kubectl

Automatic merge from submit-queue

Added an node e2e test for pod evictions due to disk pressure.

#29800 

Automatic merge from submit-queue

Small Makefile cleanup on build flags

Automatic merge from submit-queue

E2E & Node E2E: Move configmap, docker_containers, downward_api, expansion and secrets test into common directory.

This is the 3rd part of #29494.

For #29081.
Based on #29092, #29806.

The first commit is squash of all dependent commits. Please only review the second commit.

The second PR added 17 lines.

@vishh @timstclair 

Automatic merge from submit-queue

Log more info of container for debugging.

Automatic merge from submit-queue

For e2e_node tests tell etcd to listen on ports 2379 and 4001

This is the default for etcd2, but etcd3 only listens on 2379.
Specifying the ports keeps things consistent no matter which version the user has installed.

Fixes #29117

Automatic merge from submit-queue

Scheduledjob controller

Supersedes #25952; first 7 commits come from #25816

<!--
Checklist for submitting a Pull Request

Please remove this comment block before submitting.

1. Please read our [contributor guidelines](https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md).
2. See our [developer guide](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md).
3. If you want this PR to automatically close an issue when it is merged,
   add `fixes #<issue number>` or `fixes #<issue number>, fixes #<issue number>`
   to close multiple issues (see: https://github.com/blog/1506-closing-issues-via-pull-requests).
4. Follow the instructions for [labeling and writing a release note for this PR](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes) in the block below.
-->

```release-note
```

so that csrs can be deleted.

Automatic merge from submit-queue

Bug fix: Use p.Name instead of pod.Name

For example, if you used `pod.GenerateName`, `pod.Name` might be the empty
string while `p.Name` contains the actual name of your pod. Thus passing
`pod.Name` can result in a `resource name may not be empty` error.

Automatic merge from submit-queue

Mark "downward API volume should update annotations / labels on modification" as flaky test.

Because of a known race https://github.com/kubernetes/kubernetes/issues/29633, the test is flaky.
https://github.com/kubernetes/kubernetes/issues/28462
https://github.com/kubernetes/kubernetes/issues/28416

After we move the test to be shared by e2e and node e2e https://github.com/kubernetes/kubernetes/pull/29807, it flakes more in node e2e.
https://github.com/kubernetes/kubernetes/issues/30132
https://github.com/kubernetes/kubernetes/issues/30124

Mark the test as flaky and we should reenable it after #29633 is fixed.

@saad-ali 

Automatic merge from submit-queue

Run goimport for the whole repo

While removing GOMAXPROC and running goimports, I noticed quite a lot of other files also needed a goimport format. Didn't commit `*.generated.go`, `*.deepcopy.go` or files in `vendor`

This is more for testing if it builds.
The only strange thing here is the gopkg.in/gcfg.v1 => github.com/scalingdata/gcfg replace.
cc @jfrazelle @thockin

Automatic merge from submit-queue

optimize conditions of ServiceReplenishmentUpdateFunc to replenish service

Originally, the  replenishQuota method didn't focus on the third parameter object even if others transfered to it, i think the function is not efficient and perfect. then i use the third param to get MatchResources, it will be more exact. for example, if the old pod was quota tracked and the new was not, the replenishQuota only focus on usage resource of the old pod, still if  the third parameter object is nil, the process will be same as before

Added image-policy proposal

For example, if you used pod.GenerateName, pod.Name might be the empty
string while p.Name contains the actual name of your pod. Thus passing
pod.Name can result in a `resource name may not be empty` error.

Automatic merge from submit-queue

add subjectaccessreviews resource

Adds a subjectaccessreviews endpoint that uses the API server's authorizer to determine if a subject is allowed to perform an action.

Part of kubernetes/features#37 

modification" as flaky.

Automatic merge from submit-queue

enhancements to run local-up-cluster.sh

- fix containerized kubelet: bind mount /dev and cloud credential directories
- add CLOUD_CONFIG env to get openstack credentials

@kubernetes/sig-storage @jayunit100 

Automatic merge from submit-queue

Detail unit testing workflow