Automatic merge from submit-queue (batch tested with PRs 40392, 39242, 40579, 40628, 40713)

optimize podSandboxChanged() function and fix some function notes

Automatic merge from submit-queue (batch tested with PRs 40392, 39242, 40579, 40628, 40713)

[Federation][kubefed] Create a dedicated service account for federation controller manager in the host cluster and give it appropriate permissions.

Ref: Issue #39555

cc @kubernetes/sig-federation-pr-reviews @kubernetes/sig-auth-misc @kubernetes/sig-auth-pr-reviews 

```release-note
kubefed init creates a service account for federation controller manager in the federation-system namespace and binds that service account to the federation-system:federation-controller-manager role that has read and list access on secrets in the federation-system namespace. 
```

Automatic merge from submit-queue (batch tested with PRs 38443, 40145, 40701, 40682)

Move kubeadm etcd SELinux options from container to pod.

**What this PR does / why we need it**:

Works around a bug that surfaces in Docker 1.12+ related to the pause
container's namespace and selinux labels being transferred to the etcd
container when it runs.

At present it appears that applying selinux options to a container may
be broken, or perhaps shouldn't be supported at all. Moving these to the
pod causes all containers (including pause) to run with the correct
labels.



**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

Related to and partial fix for https://github.com/kubernetes/kubeadm/issues/107

This is one of several selinux related fixes in flight for upcoming releases, and newer versions of Docker. To successfully run kubeadm with selinux enforcing right now would like require a recent container-selinux build as uncovered in https://github.com/kubernetes/kubeadm/issues/107, a bugfix for the format labels in #40179, and finally this fix.

**Release note**:

```release-note
Fixed an SELinux issue in kubeadm on Docker 1.12+ by moving etcd SELinux options from container to pod.
```

Automatic merge from submit-queue (batch tested with PRs 38443, 40145, 40701, 40682)

fix nil deref in exec admission

Fixes #40615 

@ncdc @jsravn @smarterclayton

Automatic merge from submit-queue (batch tested with PRs 38443, 40145, 40701, 40682)

pkg/util/iptables missing unit tests

Automatic merge from submit-queue (batch tested with PRs 38443, 40145, 40701, 40682)

fix GetVolumeInUse() function

Since we just want to get volume name info, each volume name just need to added once.  desiredStateOfWorld.GetVolumesToMount() will return volume and pod binding info,
if one volume is mounted to several pods, the volume name will be return several times. That is not what we want in this function.
We can add a new function to only get the volume name info  or judge whether the volume name is added to the desiredVolumesMap array.

Automatic merge from submit-queue (batch tested with PRs 40691, 40551, 40683, 40700, 40702)

Replace + with _ in the image tag version since + is not a valid image tag character.

We already push the image to the registry by replacing `+` with `_` in the
preceding build and push stages. This change is just propagating the same
to the deploy stage.

cc @kubernetes/sig-federation-pr-reviews @nikhiljindal @shashidharatd

Automatic merge from submit-queue (batch tested with PRs 40691, 40551, 40683, 40700, 40702)

Clean up generated comment for lister/informers

The generated comment including the command line means the addition of a new group/version touches all listers/informers, not just the ones for the new group/version

@ncdc PTAL

Automatic merge from submit-queue (batch tested with PRs 40691, 40551, 40683, 40700, 40702)

Enable protobufs as storage format by default

**Release note**:

```release-note
Change default storage format to protobufs. With this PR apiserver will be writing objects serialized as protobufs to etcd. If the apiserver was upgraded in the existing clusters, until an object will be written, it will still be stored as JSON. Apiserver can deal with some data being in json and some in protobuf format as of 1.4 release.
```

@kubernetes/sig-api-machinery-misc @kubernetes/sig-api-machinery-pr-reviews

Merge pull request #40551 from juanvallejo/jvallejo/only-output-no-resources-found-for-human-readable-printer

Automatic merge from submit-queue (batch tested with PRs 40691, 40551, 40683, 40700, 40702)

only output "No resources found." for human readable printers

**Release note**:
```release-note
release note none
```

This patch removes the message `No resources found` (currently printed through stderr) when printing through a generic / non-human-readable printer (json, yaml, jsonpath, custom-columns).

**Before***
```
$ kubectl get pods -o json
No resources found.
{
    "apiVersion": "v1",
    "items": [],
    "kind": "List",
    "metadata": {},
    "resourceVersion": "",
    "selfLink": ""
}
```

**After**
```
$ kubectl get pods -o json
{
    "apiVersion": "v1",
    "items": [],
    "kind": "List",
    "metadata": {},
    "resourceVersion": "",
    "selfLink": ""
}
```

cc @fabianofranz @stevekuznetsov

Automatic merge from submit-queue (batch tested with PRs 40691, 40551, 40683, 40700, 40702)

Juju kubernetes-master charm: improve status messages

**What this PR does / why we need it**:

This update to the kubernetes-master charm does the following:
1. Remove "Kubernetes master services ready" status which was occurring too early
2. Add "Waiting for kube-system pods to start" status
3. Replace "Rendering the Kubernetes DNS files." status with "Deploying KubeDNS"
4. Add "Waiting to retry KubeDNS deployment" status

The purpose of this is to give better feedback to the operator during cluster deployment.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:

Fixes https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/143, which we are tracking in a separate repository

**Special notes for your reviewer**:

This is a rebase of https://github.com/juju-solutions/kubernetes/pull/103, where prior review was done, though it was targeted against a fork.

**Release note**:

```release-note
Juju kubernetes-master charm: improve status messages
```

Automatic merge from submit-queue (batch tested with PRs 40703, 40093, 40618, 40659, 39810)

Add AndSelectors helper function

I needed a simple way to logically `AND` two `Selectors` in https://github.com/openshift/origin/pull/11909 for [this](https://github.com/enj/origin/blob/7259bf75966b961cb9c7aa2c0ee2930471a59eed/pkg/oauth/registry/oauthclientauthorization/etcd/etcd.go#L95-L114).

This seems like the cleanest way to express that intent.
Signed-off-by: Monis Khan <mkhan@redhat.com>

Automatic merge from submit-queue (batch tested with PRs 40703, 40093, 40618, 40659, 39810)

hack/verify-staging-imports.sh: print actual dependencies

Example:

```shell
$ hack/verify-staging-imports.sh
apiserver has a forbidden dependency:

  k8s.io/apiserver/pkg/admission imports k8s.io/apimachinery/pkg/api/errors
  k8s.io/apiserver/pkg/admission imports k8s.io/apimachinery/pkg/api/meta
  k8s.io/apiserver/pkg/admission imports k8s.io/apimachinery/pkg/runtime
  k8s.io/apiserver/pkg/admission imports k8s.io/apimachinery/pkg/runtime/schema
  k8s.io/apiserver/pkg/admission imports k8s.io/apimachinery/pkg/util/errors
  k8s.io/apiserver/pkg/admission imports k8s.io/apimachinery/pkg/util/sets
```

Automatic merge from submit-queue (batch tested with PRs 40703, 40093, 40618, 40659, 39810)

Print resource name when patch is done

Before:
```console
$ kubectl patch deployment nginx -p '{"spec":{"progressDeadlineSeconds":200}}'
"nginx" patched
```

After:
```console
$ kubectl patch deployment nginx -p '{"spec":{"progressDeadlineSeconds":200}}'
deployment "nginx" patched
```

Automatic merge from submit-queue (batch tested with PRs 40703, 40093, 40618, 40659, 39810)

Change kubemark Makefile to be provider independent

Ref issue #38967

The Kubemark Makefile is defaulted to gcr.io. Instead, make it
provider independent.

The kubemark makefile is set to push the kubemark image to the gcr.io registry. In order to make kubemark not as provider specific, allow the developer to choose a registry.

Automatic merge from submit-queue (batch tested with PRs 40703, 40093, 40618, 40659, 39810)

Update Ubuntu OWNERS

**What this PR does / why we need it**:

This cleans up our team's OWNER files so the right people are getting PR notifications and allows us to use the bots more effectively. 

**Special notes for your reviewer**: None.

**Release note**: 

```NONE```

Automatic merge from submit-queue

move util/intstr to apimachinery

`IntOrString` looks to be a common type across the stack.  This move it to api machinery.

@smarterclayton @lavalamp

We already push the image to the registry by replacing + with _ in the
previous build and push stage. This change is just propagating the same
to the deploy stage.

Avoids spurious diffs to all generated files when a new group/version is added

Automatic merge from submit-queue

add deads2k to hack owners

There are several verify and update scripts that are updated and need sig-api-machinery review, that I think I'm qualified to approve.  We logically own the codegenerator scripts and their verifies.

I promise to use my powers for good and not approve outside the files I know.

Automatic merge from submit-queue

Update function name for public function in commend

**What this PR does / why we need it**:
Update function name for public function in commend and fix some typos in log information.

Signed-off-by: yuexiao-wang wang.yuexiao@zte.com.cn

Automatic merge from submit-queue (batch tested with PRs 34543, 40606)

sync client-go and move util/workqueue

The vision of client-go is that it provides enough utilities to build a reasonable controller.  It has been copying `util/workqueue`.  This makes it authoritative.

@liggitt I'm getting really close to making client-go authoritative ptal.

approved based on https://github.com/kubernetes/kubernetes/issues/40363

Automatic merge from submit-queue

Don't require failureDomains in PodAffinityChecker

`failureDomains` are only used for `PreferredDuringScheduling` pod
anti-affinity, which is ignored by `PodAffinityChecker`.
This unnecessary requirement was making it hard to move
`PodAffinityChecker` to `GeneralPredicates` because that would require
passing `--failure-domains` to both `kubelet` and `kube-controller-manager`.

This message was occurring prematurely - the master is running,
but the charm still has work to do. e.g. deploy KubeDNS.

Automatic merge from submit-queue

controller: don't run informers in unit tests when unnecessary

Fixes https://github.com/kubernetes/kubernetes/issues/39908

@mfojtik it seems that using informers makes the deployment sync for the initial relist so this races with the enqueue that these tests are testing.

Works around a bug that surfaces in Docker 1.12+ related to the pause
container's namespace and selinux labels being transferred to the etcd
container when it runs.

At present it appears that applying selinux options to a container may
be broken, or perhaps shouldn't be supported at all. Moving these to the
pod causes all containers (including pause) to run with the correct
labels.