The bootstrap RBAC roles "admin", "edit", and "view" should all be
able to apply their respective access verbs to the "ingresses"
resource in order to facilitate both publishing Ingress resources (for
service administrators) and consuming them (for ingress controllers).

Automatic merge from submit-queue

add patch RS to deployment controller

Found in http://gcsweb.k8s.io/gcs/kubernetes-jenkins/logs/ci-kubernetes-e2e-gci-gce/2841/artifacts/bootstrap-e2e-master/, `RBAC DENY: user "system:serviceaccount:kube-system:deployment-controller" groups [system:serviceaccounts system:serviceaccounts:kube-system system:authenticated] cannot "patch" on "replicasets.extensions/" in namespace "e2e-tests-deployment-3rj5g"
`

@kubernetes/sig-auth-misc

Automatic merge from submit-queue

Give replicaset controller patch permission on pods

Needed for AdoptPod/ReleasePod

Fixes denials seen in autoscaling test log:
`RBAC DENY: user "system:serviceaccount:kube-system:replicaset-controller" groups [system:serviceaccounts system:serviceaccounts:kube-system system:authenticated] cannot "patch" on "pods./"`

Automatic merge from submit-queue (batch tested with PRs 38592, 39949, 39946, 39882)

move api/errors to apimachinery

`pkg/api/errors` is a set of helpers around `meta/v1.Status` that help to create and interpret various apiserver errors.  Things like `.NewNotFound` and `IsNotFound` pairings.  This pull moves it into apimachinery for use by the clients and servers.

@smarterclayton @lavalamp First commit is the move plus minor fitting.  Second commit is straight replace and generation.

Automatic merge from submit-queue (batch tested with PRs 38592, 39949, 39946, 39882)

genericapiserver: cut off pkg/apis/extensions and pkg/storage dependencies

Move BuildDefaultStorageFactory to kubeapiserver.

Automatic merge from submit-queue (batch tested with PRs 38592, 39949, 39946, 39882)

Remove fluentd buffers if fluentd is stuck

Fluentd now stores its buffers on disk for the resiliency. However, if buffer is corrupted, fluentd will be restarting forever.

Following change will make fluentd liveness probe delete buffers if fluentd is stuck for more than X minutes (15 by default).

Automatic merge from submit-queue (batch tested with PRs 38592, 39949, 39946, 39882)

Add optional per-request context to restclient

**What this PR does / why we need it**: It adds per-request contexts to restclient's API, and uses them to add timeouts to all proxy calls in the e2e tests. An entire e2e shouldn't hang for hours on a single API call.

**Which issue this PR fixes**: #38305

**Special notes for your reviewer**:

This adds a feature to the low-level rest client request feature that is entirely optional. It doesn't affect any requests that don't use it. The api of the generated clients does not change, and they currently don't take advantage of this.

I intend to patch this in to 1.5 as a mostly test only change since it's not going to affect any controller, generated client, or user of the generated client.


cc @kubernetes/sig-api-machinery 
cc @saad-ali

Needed for AdoptPod/ReleasePod

Automatic merge from submit-queue (batch tested with PRs 39947, 39936, 39902, 39859, 39915)

Make api serialization test easier to follow

**What this PR does / why we need it**:

This PR makes the serialization test easier to understand and is informed by the recent experience of writing a new serialization test in SIG service catalog.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 39947, 39936, 39902, 39859, 39915)

Moved _pkg to embeded script.

fixes #39840

Automatic merge from submit-queue (batch tested with PRs 39947, 39936, 39902, 39859, 39915)

don't lie about starting the controllers in the controller manager

We print started even if it didn't start.

Automatic merge from submit-queue (batch tested with PRs 39947, 39936, 39902, 39859, 39915)

fix example in set selector

Automatic merge from submit-queue (batch tested with PRs 39947, 39936, 39902, 39859, 39915)

genericapiserver: cut off certificates api dependency

By cutting off pkg/apis/certificates depenedency from pkg/util/certs.

Automatic merge from submit-queue

Fix examples e2e permission check

Ref #39382
Follow-up from #39896

Permission check should be done within the e2e test namespace, not cluster-wide

Also improved RBAC audit logging to make the scope of the permission check clearer

Automatic merge from submit-queue

move more things to apiserver

```
pkg/genericapiserver/api/handlers/negotiation/ -> apiserver/pkg/handlers/negotiation
pkg/genericapiserver/api/metrics -> apiserver/pkg/metrics
pkg/genericapiserver/api/request -> apiserver/pkg/request
pkg/util/wsstream -> apiserver/pkg/util/wsstream
plugin/pkg/auth/authenticator/request/headerrequest -> apiserver/pkg/authentication/request/headerrequest
plugin/pkg/webhook -> apiserver/pkg/webhook
```

and mechanicals.

`k8s.io/kubernetes/pkg/genericapiserver/routes/data/swagger` needs to be sorted out.

example run failed

Automatic merge from submit-queue

PodFitsPorts has been replaced by PodFitsHostPorts

**What this PR does / why we need it**:

in  [defaults.go](https://github.com/kubernetes/kubernetes/blob/master/plugin/pkg/scheduler/algorithmprovider/defaults/defaults.go)
>  PodFitsPorts has been replaced by PodFitsHostPorts for better user understanding.
 For backwards compatibility with 1.0, PodFitsPorts is registered as well.



So  ,  I replaced PodFitsPorts  with PodFitsHostPorts  in scheduler examples

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

Fix typo in resource quota controller comments

Automatic merge from submit-queue (batch tested with PRs 39417, 39679)

Fix 2 `sucessfully` typos

**What this PR does / why we need it**: Only fixes two typos in comments/logging

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 39417, 39679)

fix typo

Automatic merge from submit-queue

Include gcl logging test in gke suite

Automatic merge from submit-queue

add rbac role for certificate-controller

@liggitt @jcbsmpsn @pipejakob

Automatic merge from submit-queue

Don't blame DNS spec on Kubernetes requirement for lower-case DNS labels.

**What this PR does / why we need it**: #39635 was rejected because it wasn't clear to the author (me) that lower-case DNS labels are in fact a [Kubernetes requirement](https://github.com/kubernetes/kubernetes/pull/39635#issuecomment-271404975) rather than from the [DNS RFC 1035](https://www.ietf.org/rfc/rfc1035.txt) or/and [DNS RFC 1123](https://www.ietf.org/rfc/rfc1123.txt).

**Special notes for your reviewer**: @thockin this is a first pass to make the error messages clearer about the fact that DNS specs are not to _blame_.

Automatic merge from submit-queue (batch tested with PRs 39609, 39105)

Stop running most unit tests outside of bazel.

Lets not duplicate our efforts. The two I still run here are the two we currently skip in bazel. We should fix those.

Automatic merge from submit-queue

Remove sleep from DynamicProvisioner test.

The comment says that the sleep is there because of 10 minute PV controller
sync. The controller sync is now 15 seconds and it should be quick enough
to hide this in subsequent `WaitForPersistentVolumeDeleted(.. , 20*time.Minute)`

Automatic merge from submit-queue (batch tested with PRs 38427, 39896, 39889, 39871, 39895)

Fix expected error text

I had initially coded the expected text to match what was coming out of stderr, which was wrong. This makes it match against what comes from stdout.

Automatic merge from submit-queue (batch tested with PRs 38427, 39896, 39889, 39871, 39895)

Conditionally write token file entries

Fixes #39863

We have a bigger problem with not knowing what is calling these functions, but this will at least tolerate callers that are not setting the envvars we expect

Automatic merge from submit-queue (batch tested with PRs 38427, 39896, 39889, 39871, 39895)

Add docker 1.12 in node e2e.

Add docker 1.12 image in node e2e (including regular node e2e and cri node e2e).

@dchen1107 @yujuhong 
/cc @kubernetes/sig-node-misc

Automatic merge from submit-queue (batch tested with PRs 38427, 39896, 39889, 39871, 39895)

Grant permissions to e2e examples test service account

ref #39382

Automatic merge from submit-queue (batch tested with PRs 38427, 39896, 39889, 39871, 39895)

gitattributes for better reviews

Reviewable will ignore files marked as -diff.

Automatic merge from submit-queue

Generate protobuf into vendor for pseudo vendored models

Fixes #39764

@ncdc