HA master: initial support for creation/removal of masters replicas by
kube-up/kube-down scripts for GCE on gci.

Automatic merge from submit-queue

fix a typo in nodeaffinity

Automatic merge from submit-queue

fix go vet errors

<!--
Checklist for submitting a Pull Request

Please remove this comment block before submitting.

1. Please read our [contributor guidelines](https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md).
2. See our [developer guide](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md).
3. If you want this PR to automatically close an issue when it is merged,
   add `fixes #<issue number>` or `fixes #<issue number>, fixes #<issue number>`
   to close multiple issues (see: https://github.com/blog/1506-closing-issues-via-pull-requests).
4. Follow the instructions for [labeling and writing a release note for this PR](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes) in the block below.
-->

```release-note
```

This fixes the `go vet` errors brought about by go 1.7 testing re (#28742).

The are all pretty trivial and mostly related to literal composites.

also related to #16086

Automatic merge from submit-queue

examples/elasticsearch: fix awkward sentence

Automatic merge from submit-queue

issue-template: remove emoji suggestion

Removes emoji suggestion since it doesn't generate a notification on the issue. 

When people 👍 the issue, it'll most likely won't have any effects, its better if people explain their thoughts through a reply

Automatic merge from submit-queue

Adding events to federation clientset and adding an e2e

Fixes https://github.com/kubernetes/kubernetes/issues/27026

events was added to federation-apiserver in https://github.com/kubernetes/kubernetes/pull/30421

cc @kubernetes/sig-cluster-federation @mfanjie

Automatic merge from submit-queue

CRI: remove pod sandbox resources

The pod-level resources need further discussion. Remove it from CRI for now.

See the original discussion in #29871

Automatic merge from submit-queue

Fix subtle build breakage

Repro case:
$ make clean generated_files
$ hack/update-generated-protobuf.sh

This would complain about not finding `fmt`, and it was indicating the wrong
GOROOT.  The problem was that the first step built binaries for generating
code, which *embeds* the value of GOROOT into the binary.  The whole tree was
bind-mounted into the build container and then JUST the dockerized dir was
mounted over it.  The in-container build tried to use the existing binaries,
but GOROOT is wrong.

This change whites-out the whole _output dir.

I first made just an anonymous volume for _output, but docker makes that as
root, which means I can't write to it from our non-root build.  So I just put
it in the data container.  This seems to work.  The biggest change this makes
is that the $GOPATH/bin/ and $GOPATH/pkg/ dirs will persist across dockerized
builds.

NB: this requires a `make clean` to activate.

@lavalamp @jbeda @quinton-hoole @david-mcmahon

Automatic merge from submit-queue

Use --regions instead of --region for gcloud list [resource]

gcloud has started complaining:
```
WARNING: Abbreviated flag [--region] will be disabled in release 132.0.0, use the full name [--regions].
WARNING: Abbreviated flag [--region] will be disabled in release 132.0.0, use the full name [--regions].
WARNING: Abbreviated flag [--region] will be disabled in release 132.0.0, use the full name [--regions].
```

We'll probably need to cherry-pick this, as otherwise the list-resources script will start failing at some point in the future.

Automatic merge from submit-queue

fix three spelling errors in flannel-integration.md

fix three spelling errors in flannel-integration.md

Automatic merge from submit-queue

pkg/apiserver/authenticator: reorder oidc plugin to auth after service accounts

Both plugins verify JWTs, but the OpenID Connect plugin performs
much worse when faced with cache misses. Reorder the plugins so
the service account plugin tries to authenticate a bearer token
first.

I had a fun time with this by writing an OpenID Connect provider that stores its data in third party resources. When it's running in the cluster it uses a service account and caused some interesting behavior when the keys expired.

Our OpenID Connect plugin needs a more sophisticated caching model to avoid continuously re-requesting keys when seeing a lot of tokens it doesn't recognize. However, I feel this reordering is generally useful since service accounts will be more common than OpenID Connect tokens.

cc @kubernetes/sig-auth

Automatic merge from submit-queue

two new pv e2e tests

Added two more pv e2e tests: 1) creating a claim before the pv (both not pre-bound), 2) creating a claim before the pv with the claim pre-bound to the PV via Spec.Volumename.

Automatic merge from submit-queue

Fix resource requests in cassandra-daemonset.yaml

The current file fails validation because the resource request syntax is incorrect.

Automatic merge from submit-queue

Remove pods along with jobs when Replace ConcurrentPolicy is set

Fixes #30442

This builds on #30327 and needs a bit more love in tests.

@janetkuo @erictune fyi

Automatic merge from submit-queue

docs/proposal: add proposal for kubectl login

This PR updates https://github.com/kubernetes/features/issues/32 and https://github.com/kubernetes/kubernetes/pull/25758 by adding a proposal for a "kubectl login" command.

It's a bit more involved than the implementation discussed with @deads2k in #25758, by proposing a long term goal for the overall subcommand.

cc @kubernetes/sig-auth @kubernetes/kubectl

Automatic merge from submit-queue

Run CI Jenkins node e2e tests in project k8s-jkns-ci-node-e2e

Fixes #27648.

If node VMs leak, they should only harm themselves, not the rest of Jenkins.

This also lets us do VM cleanup without worrying that we might accidentally delete important Jenkins VMs.

The `k8s-jkns-ci-node-e2e` should have the right ACLs in place already. The quota is at defaults, but I don't think we'll need to increase it at this point.

Automatic merge from submit-queue

Fix third party APIResource reporting

@polvi @caesarxuchao @deads2k 

This "fixes" some additional bugs in third party `APIResourceList` reporting.

This code needs a bunch of cleanup, and more tests, but sending it out for a quick smell check review in case I'm doing something stupid.

Fixes the bug referenced here:  https://github.com/kubernetes/kubernetes/pull/28414#issuecomment-235346108 and in https://github.com/kubernetes/kubernetes/issues/23831

Fixes https://github.com/kubernetes/kubernetes/issues/25570

Automatic merge from submit-queue

Let load and density e2e tests use GC if it's on

I've run the 100 and 500 nodes tests and they both pass.

The test-infra half of the PR is https://github.com/kubernetes/test-infra/pull/369

cc @lavalamp

Automatic merge from submit-queue

Add CloudStack cloud provider (extended and refactored)

This PR is superseding PR #26165 is which some groundwork for this PR has been done. So this PR now fixes #26165 and fixes #26045.

I've been in contact with @ngtuna about this updated version of his earlier work (which is still in this PR as one squashed commit) and he has given his 👍  for this 😉

This PR adds additional logic for allocating and associating a public IP, if the `—load-balancer-ip` option is not used. It will do proper management of public IP’s that are allocated by this provider ( so IP’s that are no longer needed/used will also be released again).

Additionally the provider can now also work with CloudStack projects and advanced (VPC) networks. And lastly the Zone interface now returns an actual zone (supplied by the cloud config), a few logical errors are fixed and the first few tests are added.

All the functionality is extensively tested against both basic and advanced (VPC) networks and of course all new and existing (integration) tests are all passing.

Automatic merge from submit-queue

Move new etcd storage (low level storage) into cacher

In an effort for #29888, we are pushing forward this:

What?
- It changes creating etcd storage.Interface impl into creating config
- In creating cacher storage (StorageWithCacher), it passes config created above and new etcd storage inside.

Why?
- We want to expose the information of (etcd) kv client to cacher. Cacher storage uses this information to talk to remote storage.

Automatic merge from submit-queue

move syncNetworkConfig to Init for cni network plugin

start syncNetworkConfig routine in `Init` instead of probing. This fixes a bug where the syncNetworkConfig runs periodically even `cni` network plugin is not in use.

Automatic merge from submit-queue

Install bc in the kubekins-test image

I finally figured out those
```
/dev/fd/63: line 124: bc: command not found
/dev/fd/63: line 125: bc: command not found
```
lines that keep appearing in build logs.

Image is not yet pushed.

Automatic merge from submit-queue

add RequiresExactMatch test for empty andterm

What?
Add a test path for empty andterm.

Why?
fields.Everything() returns empty andterm.
fields.SelectorFromSet() returns empty andterm.

Automatic merge from submit-queue

Remove resource specifications from CRI until further notice

See #29871 for the discussion issue.

cc @dchen1107 @vishh @yujuhong @euank @yifan-gu @feiskyer

Automatic merge from submit-queue

Endpoint controller logs errors during normal cluster behavior

The endpoint controller logs an error when its forbidden from creating new endpoints during namespace termination.  This is normal cluster behavior, and therefore should not be logged.  This confuses operators administrating the cluster.

Updated to log at a lower level in response to a forbidden message when performing a create operation.  In case of an error on the API server side of the house, I continue to requeue the key.  It should be ignored in a future syncService call once the service is deleted as part of namespace termination.

See https://bugzilla.redhat.com/show_bug.cgi?id=1347425

/cc @kubernetes/rh-cluster-infra

Automatic merge from submit-queue

Update core etcd references to use 3.0.4

This updates the core references to use 3.0.4. 

There are still legacy references in the code base that should be cleaned, or just removed but I'm reluctant to purge.  

/cc @kubernetes/sig-scalability

This commit adds logic for allocating and associating a public IP, if the `—load-balancer-ip` option is not used. It will do proper management of IP’s that are allocated by this provider, so IP’s that are no longer needed/used will also be released again.

Additionally the provider can now also work with CloudStack projects and advanced (VPC) networks.

Lastly the Zone interface now returns an actual zone (supplied by the cloud config), a few logical errors are fixed and the first few tests are added.

All the functionality is extensively tested against both basic and advanced (VPC) networks.

Automatic merge from submit-queue

speed up RC scaler

The RC scaler was waiting before starting the scale and then didn't use a watch to observe the result.  That led to longer than expected wait times.

@fabianofranz ptal.  You may want to sweep the rest of the file.  It could use some tidying with `RetryOnConflict` and `watch.Until`.

Automatic merge from submit-queue

Add user-specified kubectl arguments to addons start script

This is a simple way, using the same environment variable paradigm used throughout these scripts, to let a user specify kubectl arguments to the addons script.

fixes #30371

Automatic merge from submit-queue

Validate SHA/Tag when checking docker images

Docker API does not validate the tag/sha, for example, all the following
calls work say for a alpine image with short SHA "4e38e38c8ce0"
echo -e "GET /images/alpine:4e38e38c8ce0/json HTTP/1.0\r\n" | nc -U /var/run/docker.sock
echo -e "GET /images/alpine:4e38e38c/json HTTP/1.0\r\n" | nc -U /var/run/docker.sock
echo -e "GET /images/alpine:4/json HTTP/1.0\r\n" | nc -U /var/run/docker.sock

So we should check the response from the Docker API and look for the tags or SHA explicitly.

Fixes #30355

Automatic merge from submit-queue

Set user info in CertificateSigningRequest.Spec on create

Fixes #30239

Automatic merge from submit-queue

Use unversioned client in scheduledjobs and set group version to batch/v2alpha1

Fixes #30323