Automatic merge from submit-queue

Avoid unnecessary copies & allocations in field selectors

Automatic merge from submit-queue

Bump cluster autoscaler to 0.3.0-beta3

cc: @piosz @fgrzadkowski @jszczepkowski

Automatic merge from submit-queue

add quota test for creating update requests

Adding a kube test for https://github.com/kubernetes/kubernetes/pull/30907 as requested in https://github.com/kubernetes/kubernetes/pull/30907#issuecomment-241139913 .

Automatic merge from submit-queue

[GarbageCollector] add absent owner cache

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:
Reducing the Request sent to the API server by the garbage collector to check if an owner exists.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

#26120

**Special notes for your reviewer**:

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
```

Currently when processing an item in the dirtyQueue, the garbage collector issues GET to check if any of its owners exist. If the owner is a replication controller with 1000 pods, the garbage collector sends a GET for the RC 1000 times. This PR caches the owner's UID if it does not exist according to the API server. This cuts 1/3 of the garbage collection time of the density test in the gce-500 and gce-scale, where the QPS is the bottleneck.

Automatic merge from submit-queue

rkt: Improve support for privileged pod (pod whose all containers are privileged) 

Fix https://github.com/kubernetes/kubernetes/issues/31100

This takes advantage of https://github.com/coreos/rkt/pull/2983 . By appending the new `--all-run` insecure-options to `rkt run-prepared` command when all the containers are privileged. The pod now gets more privileged power.

Automatic merge from submit-queue

Add sysctl support

Implementation of proposal https://github.com/kubernetes/kubernetes/pull/26057, feature  https://github.com/kubernetes/features/issues/34

TODO:
- [x] change types.go
- [x] implement docker and rkt support
- [x] add e2e tests
- [x] decide whether we want apiserver validation
- ~~[ ] add documentation~~: api docs exist. Existing PodSecurityContext docs is very light and links back to the api docs anyway: https://github.com/kubernetes/kubernetes.github.io/blob/6684555ed9e3121388d30e9c49ac6556ef0241e0/docs/user-guide/security-context.md
- [x] change PodSecurityPolicy in types.go
- [x] write admission controller support for PodSecurityPolicy
- [x] write e2e test for PodSecurityPolicy
- [x] make sure we are compatible in the sense of https://github.com/kubernetes/kubernetes/blob/master/docs/devel/api_changes.md
- [x] test e2e with rkt: it only works with kubenet, not with no-op network plugin. The later has no sysctl support.
- ~~[ ] add RunC implementation~~ (~~if that is already in kube,~~ it isn't)
- [x] update whitelist
- [x] switch PSC fields to annotations
- [x] switch PSP fields to annotations
- [x] decide about `--experimental-whitelist-sysctl` flag to be additive or absolute
- [x] decide whether to add a sysctl node whitelist annotation

### Release notes:

```release-note
The pod annotation `security.alpha.kubernetes.io/sysctls` now allows customization of namespaced and well isolated kernel parameters (sysctls), starting with `kernel.shm_rmid_forced`, `net.ipv4.ip_local_port_range`, `net.ipv4.tcp_max_syn_backlog` and `net.ipv4.tcp_syncookies` for Kubernetes 1.4.

The pod annotation  `security.alpha.kubernetes.io/unsafeSysctls` allows customization of namespaced sysctls where isolation is unclear. Unsafe sysctls must be enabled at-your-own-risk on the kubelet with the `--experimental-allowed-unsafe-sysctls` flag. Future versions will improve on resource isolation and more sysctls will be considered safe.
```

Automatic merge from submit-queue

Fix scale x->x in kubectl for ReplicationController

Fix #31374

This fixes problem introduced in #31051 (which in turn was fixing a different problem).

@lavalamp - FYI

Automatic merge from submit-queue

Underscore is not a valid secret data key, so use hyphen instead.

cc @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

[Scheduler] Improve pod log output debuggability

Address issue is #30675

The result of my expirments shows that both `glog.Infof("%v", pod)` and `glog.Infof("%+v", pod)` can't output useful information of a pod, it can only output `kind:"" apiVersion:""`. 

`%#v` can output the whole content of pod, but it seems too much!

So, my opinion is output pod info use the format of `%v` to print`pod.Namespace/pod.Name` instead of the pod **object** in both [here](https://github.com/kubernetes/kubernetes/blob/master/plugin/pkg/scheduler/scheduler.go#L96) and [here](https://github.com/kubernetes/kubernetes/blob/master/plugin/pkg/scheduler/scheduler.go#L100).

@wojtek-t

Automatic merge from submit-queue

add throughput in perf data and disable --cgroups-per-qos

This PR adds throughput data to printed perf data for benchmark. It also disables --cgrous-per-qos in jenkinds-benchmark.properties.

Automatic merge from submit-queue

Increase request timeout based on termination grace period

When terminationGracePeriodSeconds is set to > 2 minutes (which is
the default request timeout), ContainerStop() times out at 2 minutes.
We should check the timeout being passed in and bump up the
request timeout if needed.

Fixes #31219

Automatic merge from submit-queue

Use non-fed client for subclusters in federated namespace e2e test

Currently we use fed 1.4 clients constructed using federation/utils. The utils have troubles building valid clients in e2e environment.

Automatic merge from submit-queue

kubectl: display ExternalName for services

User-visible part of https://github.com/kubernetes/features/issues/33

Also add ExternalIPs in `describe`

cc @thockin @smarterclayton

Automatic merge from submit-queue

add valid resources when args is nil

add valid resources message is more friendly to user when running `kubectl explain`
and this also can be same with other cmd like get\describe.

Automatic merge from submit-queue

Make sure the StatusCode is taken into account in DoRaw()

**What this PR does / why we need it**:
Currently if there is an error (not found) the error printed out
is to do with the inablity to convert an empty body into the expected json.

This patch will fill in the err correctly.

example of before (with NotFound error):
$ kubectl top node
failed to unmarshall heapster response: json: cannot unmarshal object into Go value of type []v1alpha1.NodeMetrics

Now:
$ kubectl top node
the server could not find the requested resource (get services http:heapster:)

**Which issue this PR fixes** 
related to bug #30818

**Special notes for your reviewer**:
None

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

Enable GC by default in Kubemark

Since GC is enabled by default, we should also enable it by default in kubemark

Automatic merge from submit-queue

Kubelet code move: volume / util

Addresses some odds and ends that I apparently missed earlier.  Preparation for kubelet code-move ENDGAME.

cc @kubernetes/sig-node

Automatic merge from submit-queue

Fixed two issues of kubectl bash completion.

This patch includes the fix of the following issue:
• Correct the method invocation from "__kubectl_namespace_flag"
  to "__kubectl_override_flags"
• Support bash completion if "--namespace=xxx" style flags are
  specified in the kubectl command

Fixes #31134

Automatic merge from submit-queue

Update fluent images

continues #29883 
fix #29782

```release-note
Reduced size of fluentd images.
```

Automatic merge from submit-queue

Add validation for KUBE_USER

Malformed KUBE_USER causes error in cluster setup.

cc/ @kubernetes/goog-image 
@Q-Lee @Amey-D  Can you please review?

Automatic merge from submit-queue

etcd3 compactor: update docs

Minor fix/improvement on compactor docs.

Automatic merge from submit-queue

Dynamic volume gate

Rebased on #31140, only review last commit.  Adds a feature-gate flag for dynamic volume provisioning alpha, defaulting to enabled to avoid breaking people. Key should be removed when support for the alpha version of this is removed.

Automatic merge from submit-queue

Revert "Enable v3 Client as the default on UTs"

Reverts kubernetes/kubernetes#30890

Fix flake problems (#31262)

Automatic merge from submit-queue

Skip disk eviction test on non-supported images.

Automatic merge from submit-queue

Delete e2e-runner and related images

https://github.com/kubernetes/test-infra/pull/444 migrates these files to test-infra

Automatic merge from submit-queue

fix #30376 that broken cross-build

ref: #30376

Automatic merge from submit-queue

Update kube-dns changelog for 1.6 bump

Fixes #29712

Automatic merge from submit-queue

Refactor the hyperkube image and add various features

@cheld @zreigz @mikedanese