Automatic merge from submit-queue (batch tested with PRs 46734, 46810, 46759, 46259, 46771)

Added node to persistent-volume-binder clusterrole

**What this PR does / why we need it**: Added missing permission to volume-binder clusterrole

**Which issue this PR fixes**: fixes #46770

**Special notes for your reviewer**: Non

**Release note**: Non

Automatic merge from submit-queue (batch tested with PRs 46734, 46810, 46759, 46259, 46771)

Add iptables lock-file mount to kube-proxy manifest

**What this PR does / why we need it**: kube-proxy is broken in make bazel-release. The new iptables binary uses a lockfile in "/run", but the directory doesn't exist. This causes iptables-restore to fail. We need to share the same lock-file amongst all containers, so mount the host /run dir.

This is similar to #46132 but expediency matters, since builds are broken.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #46103

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 46734, 46810, 46759, 46259, 46771)

Improve code coverage for pkg/kubelet/images/image_gc_manager

**What this PR does / why we need it**:
#39559 #40780

code coverage from 74.5% to 77.4%

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46734, 46810, 46759, 46259, 46771)

Update the COS kernel sha for node e2e gpu installer

cc @mindprince

Relevant COS image - https://github.com/kubernetes/kubernetes/blob/master/test/e2e_node/jenkins/image-config-serial.yaml#L19

Automatic merge from submit-queue (batch tested with PRs 46734, 46810, 46759, 46259, 46771)

OpenAPI aggregation for kube-aggregator

This PR implements OpenAPI aggregation layer for kube-aggregator. On each API registration, it tries to download swagger.spec of the user api server. On failure it will try again next time (either on another add or get /swagger.* on aggregator server) up to five times. To merge specs, it first remove all unrelated paths from the downloaded spec (anything other than group/version of the API service) and then remove all unused definitions. Adding paths are straightforward as they won't have any conflicts, but definitions will most probably have conflicts. To resolve that, we would reused any definition that is not changed (documentation changes are fine) and rename the definition otherwise.

To use this PR, kube aggregator should have nonResourceURLs (for get verb) to user apiserver.

```release-note
Support OpenAPI spec aggregation for kube-aggregator
```

fixes: #43717

Automatic merge from submit-queue (batch tested with PRs 45871, 46498, 46729, 46144, 46804)

PD e2e test: Ready node check now uses the most up-to-date node count.

Follow-up to PR #46746 

<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access)
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`.

Automatic merge from submit-queue (batch tested with PRs 45871, 46498, 46729, 46144, 46804)

Implement kubectl rollout undo and history for DaemonSet

~Depends on #45924, only the 2nd commit needs review~ (merged)

Ref https://github.com/kubernetes/community/pull/527/

TODOs:
- [x] kubectl rollout history
  - [x] sort controller history, print overview (with revision number and change cause)
  - [x] print detail view (content of a history) 
    - [x] print template 
    - [x] ~(do we need to?) print labels and annotations~
- [x] kubectl rollout undo: 
  - [x] list controller history, figure out which revision to rollback to
    - if toRevision == 0, rollback to the latest revision, otherwise choose the history with matching revision
  - [x] update the ds using the history to rollback to 
    - [x] replace the ds template with history's
    - [x] ~(do we need to?) replace the ds labels and annotations with history's~
- [x] test-cmd.sh 

@kubernetes/sig-apps-pr-reviews @erictune @kow3ns @lukaszo @kargakis @kubernetes/sig-cli-maintainers 

--- 

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 45871, 46498, 46729, 46144, 46804)

Enable some pod-related admission plugins for kubemark

Ref https://github.com/kubernetes/kubernetes/issues/44701

This should help reduce discrepancy in "list pods" latency wrt real cluster. Let's see.

/cc @wojtek-t @gmarek

Automatic merge from submit-queue (batch tested with PRs 45871, 46498, 46729, 46144, 46804)

Fix some comments in dnsprovider

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

delete the useless "gv" in Errorf
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>



**What this PR does / why we need it**:
Fix "no formatting directive in Errorf call"
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 43852, 44255)

Bump github.com/mitchellh/mapstructure

**What this PR does / why we need it**:

This PR bump revision of github.com/mitchellh/mapstructure.
The library is required by Gophercloud, also they has passed tests with the newer revision.
So, since Gophercloud is update, please also renew this library.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

Add SuccessfulMountVolume message to the events of pod

**What this PR does / why we need it:**
When creating a pod with volume, the volume mount may failed at first, but eventually succeed after retry several times. kubectl describe pod can only see the failed messages, so i think it will be better to add the SuccessfulMountVolume message to the pod events too.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
Fixes #42867

Delete federation system namespace from all the federated clusters.

This is part of the namespace deletion big hammer. `kubefed join` not
just creates federation-system namespace, but also cluster role and
cluster role bindings in the joining clusters. Sometimes unjoin fails
to delete them. So we use a big hammer here to delete them.

This smells like a real problem in kubefed and needs investigation.
This is a short term fix to unblock the submit queue.

This is a big hammer. `kubefed join` creates federation-system namespace
in the joining clusters if they don't already exist. This namespace
usually exists in the host cluster and hence cannot be deleted while
unjoining. So in order to be safe, we don't delete the federation-system
namespace from any federated cluster while unjoining them. This causes
a problem in our test environment if certain resources are left in the
namespace. Therefore we are deleting all federation-system namespace in
all the clusters.

PV is a non-namespaced resource. Running `kubectl delete pv --all`, even
with `--namespace` is going to delete all the PVs in the cluster. This
is a dangerous operation and should not be deleted this way.

Instead we now retrieve the PVs bound to the PVCs in the namespace we
are deleteing and delete only those PVs.

Fixes issue #46380.

Automatic merge from submit-queue

Respect PDBs during node upgrades and add test coverage to the ServiceTest upgrade test.

This is still a WIP... needs to be squashed at least, and I don't think it's currently passing until I increase the scale of the RC, but please have a look at the general outline.  Thanks!

Fixes #38336 

@kow3ns @bdbauer @krousey @erictune @maisem @davidopp 

```
On GCE, node upgrades will now respect PodDisruptionBudgets, if present.
```

Automatic merge from submit-queue

Delete all dead containers and sandboxes when under disk pressure.

This PR modifies the eviction manager to add dead container and sandbox garbage collection as a resource reclaim function for disk.  It also modifies the container GC logic to allow pods that are terminated, but not deleted to be removed.

It still does not delete containers that are less than the minGcAge.  This should prevent nodes from entering a permanently bad state if the entire disk is occupied by pods that are terminated (in the state failed, or succeeded), but not deleted.

There are two improvements we should consider making in the future:

- Track the disk space and inodes reclaimed by deleting containers.  We currently do not track this, and it prevents us from determining if deleting containers resolves disk pressure.  So we may still evict a pod even if we are able to free disk space by deleting dead containers.
- Once we can track disk space and inodes reclaimed, we should consider only deleting the containers we need to in order to relieve disk pressure.  This should help avoid a scenario where we try and delete a massive number of containers all at once, and overwhelm the runtime.

/assign @vishh 
cc @derekwaynecarr 

```release-note
Disk Pressure triggers the deletion of terminated containers on the node.
```

Automatic merge from submit-queue

Delete meaningless check

**What this PR does / why we need it**:
Delete meaningless check
The deleted check is redundant.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46681, 46786, 46264, 46680, 46805)

Bump cluster-proportional-autoscaler to 1.1.2

From https://github.com/kubernetes-incubator/cluster-proportional-autoscaler/pull/33.

/assign @bowei 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46681, 46786, 46264, 46680, 46805)

Enable Dialer on the Aggregator

Centralize the creation of the dialer during startup.
Have the dialer then passed in to both APIServer and Aggregator.
Aggregator the uses the dialer as its Transport base.

**What this PR does / why we need it**:Enables the Aggregator to use the Dialer/SSHTunneler to connect to the user-apiserver.

**Which issue this PR fixes** : fixes ##46679

**Special notes for your reviewer**:

**Release note**: None

Automatic merge from submit-queue (batch tested with PRs 46681, 46786, 46264, 46680, 46805)

Add annotation for image policy webhook fail open.

**What this PR does / why we need it**: there's no good way to audit log if binary verification fails open. Adding an annotation can solve that, and provide a useful tool to audit [non-malicious] containers.

**Release note**: add the annotation "alpha.image-policy.k8s.io/failed-open=true" to pods created when the image policy webhook fails open.

```release-note
Add the `alpha.image-policy.k8s.io/failed-open=true` annotation when the image policy webhook encounters an error and fails open.
```

Automatic merge from submit-queue (batch tested with PRs 46681, 46786, 46264, 46680, 46805)

Added sig leads alias to OWNERS_ALIAS

**What this PR does / why we need it**:

Add sig leads section to OWNERS_ALIASES so sig leads without maintainers access can add status labels to issues (important to 1.7 milestone)

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

Let me know you know of additional sig leads that should be added.

**Release note**:

```NONE
```

Automatic merge from submit-queue (batch tested with PRs 46681, 46786, 46264, 46680, 46805)

Fix for-loop and err definition

**What this PR does / why we need it**:
we can use j directly, it's odd to use i then get j through i.
we can put err definition into if{} , after all the para. was only used in if{}.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 40760, 46706, 46783, 46742, 46751)

Pre-generate SNI test certs

Pre-generates test certs for SNI tests, since doing this dynamically can take a loooong time in entropy-starved or CPU-bound test envs (like in a container).

Automatic merge from submit-queue (batch tested with PRs 40760, 46706, 46783, 46742, 46751)

Update gengo to the latest

Automatic merge from submit-queue (batch tested with PRs 40760, 46706, 46783, 46742, 46751)

complete the controller context for init funcs

This completes the conversion to initFuncs for the controller initialization to make easier and more manageable to add them.

Automatic merge from submit-queue (batch tested with PRs 40760, 46706, 46783, 46742, 46751)

Fix unit test for kubectl create role

When expected err is not nil but error deos not happen, we should report error in unit test.
**Release note**:

```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 40760, 46706, 46783, 46742, 46751)

enable kubelet csr bootstrap in GCE/GKE

@jcbsmpsn @pipejakob 

Fixes https://github.com/kubernetes/kubernetes/issues/31168

```release-note
Enable kubelet csr bootstrap in GCE/GKE
```