Automatic merge from submit-queue (batch tested with PRs 38315, 38624, 38572, 38544)

kubernetes-discovery proxy

The last commit adds an authenticating (but not authorizing) proxy to `kubernetes-discovery`.  The other commits are in the submit queue already.

@sttts @cjcullen This is it.  After this we can start e2e wiring.