Automatic merge from submit-queue (batch tested with PRs 41466, 41456, 41550, 41238, 41416)

Delay Deletion of a Pod until volumes are cleaned up

#41436 fixed the bug that caused #41095 and #40239 to have to be reverted.  Now that the bug is fixed, this shouldn't cause problems.

 @vishh @derekwaynecarr @sjenning @jingxu97 @kubernetes/sig-storage-misc

Automatic merge from submit-queue

pkg/api/testing: add deepcopy smoke test to roundtrip test

Fixes https://github.com/kubernetes/kubernetes/issues/41438.

Automatic merge from submit-queue

Bump fluentd-gcp google_cloud plugin version

Bump the version of `fluent-plugin-google-cloud` in fluentd-gcp image, because it's broken for version `0.5.2`.

Recently, gem `google-api-client` was updated to version `0.10.0`. The new version broke `fluent-plugin-google-cloud` which doesn't specify the upper version of `google-api-client` gem. I'm bumping the version used in our image to allow future changes in this release to be run and tested.

This PR doesn't bump the version, since no effective changes has happened, leaving this for the next PR to do.

CC @igorpeshansky

Automatic merge from submit-queue

Updating reviewer list.

Revert "Remove alpha provisioning"

Automatic merge from submit-queue

Promote taint helpers from e2e/framework to util/taints

cc @kevin-wangzefeng

Automatic merge from submit-queue

Ingress e2e typos

**What this PR does / why we need it**: fix typos in e2e test

**Special notes for your reviewer**: none

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 40000, 41508, 41489)

Add toleration to fluentd daemonset to make it run on master

Because of https://github.com/kubernetes/kubernetes/pull/41172 fluentd pods stopped being allocated on master node.

This PR introduces toleration for master taint for fluentd.

CC @davidopp @janetkuo @kubernetes/sig-scheduling-bugs

Unfortunately, we don't have e2e tests to ensure that master logs are being ingested. This problem is a great signal to work on https://github.com/kubernetes/kubernetes/issues/41411

Automatic merge from submit-queue (batch tested with PRs 40000, 41508, 41489)

Make fluentd use default dns instead of cluster dns to make it work o…

Fix https://github.com/kubernetes/kubernetes/issues/41415

Fluentd for Stackdriver requires external urls (e.g. `logging.googleapis.com`) to be available in order to work. If fluentd runs on master, it cannot access the service endpoint of cluster DNS. This change makes fluentd use default dns to fix this problem.

CC @thockin @bowei

Automatic merge from submit-queue

Remove alpha provisioning

This is the first part of https://github.com/kubernetes/features/issues/36

@kubernetes/sig-storage-misc 

**Release note**:
```release-note
Alpha version of dynamic volume provisioning is removed in this release. Annotation
"volume.alpha.kubernetes.io/storage-class" does not have any special meaning. A default storage class
and  DefaultStorageClass admission plugin can be used to preserve similar behavior of Kubernetes cluster,
see https://kubernetes.io/docs/user-guide/persistent-volumes/#class-1 for details.
```

Automatic merge from submit-queue

Replace raw string with const var.

Replace raw string with const string var.

Automatic merge from submit-queue (batch tested with PRs 41531, 40417, 41434)

[CRI] beef up network teardown in  StopPodSandbox

1. Added CheckpointNotFound error to allow dockershim to conduct error handling
2. Retry network teardown if failed

ref: https://github.com/kubernetes/kubernetes/issues/41225

Automatic merge from submit-queue (batch tested with PRs 41531, 40417, 41434)

Always detach volumes in operator executor

**What this PR does / why we need it**:

Instead of marking a volume as detached immediately in Kubelet's
reconciler, delegate the marking asynchronously to the operator
executor. This is necessary to prevent race conditions with other
operations mutating the same volume state.

An example of one such problem:

1. pod is created, volume is added to desired state of the world
2. reconciler process starts
3. reconciler starts MountVolume, which is kicked off asynchronously via
   operation_executor.go
4. MountVolume mounts the volume, but hasn't yet marked it as mounted
5. pod is deleted, volume is removed from desired state of the world
6. reconciler reaches detach volume section, detects volume is no longer in desired state of world,
   removes it from volumes in use
7. MountVolume tries to mark mount, throws an error because
   volume is no longer in actual state of world list. After this, kubelet isn't aware of the mount
   so doesn't try to unmount again.
8. controller-manager tries to detach the volume, this fails because it
   is still mounted to the OS.
9. EBS gets stuck indefinitely in busy state trying to detach.



**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #32881, fixes ##37854 (maybe)

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

Add node binaries to 1.5.3 ChangeLog

`-node-` binaries are published with the release, but links were not included in the release notes. This PR adds the links.

Automatic merge from submit-queue

Apply davidopps comments to TaintController PR

Fix #41318

cc @timothysc @kevin-wangzefeng

Automatic merge from submit-queue

Switch serviceaccounts controller to generated shared informers

Originally part of #40097 

cc @deads2k @sttts @liggitt @smarterclayton @gmarek @wojtek-t @timothysc @kubernetes/sig-scalability-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 37137, 41506, 41239, 41511, 37953)

Add field to control service account token automounting

Fixes https://github.com/kubernetes/kubernetes/issues/16779

* adds an `automountServiceAccountToken *bool` field to `ServiceAccount` and `PodSpec`
* if set in both the service account and pod, the pod wins
* if unset in both the service account and pod, we automount for backwards compatibility

```release-note
An `automountServiceAccountToken *bool` field was added to ServiceAccount and PodSpec objects. If set to `false` on a pod spec, no service account token is automounted in the pod. If set to `false` on a service account, no service account token is automounted for that service account unless explicitly overridden in the pod spec.
```

Automatic merge from submit-queue (batch tested with PRs 37137, 41506, 41239, 41511, 37953)

Fix typos in e2e

**What this PR does / why we need it**: fix typos in e2e test

**Special notes for your reviewer**: none

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 37137, 41506, 41239, 41511, 37953)

e2e test for storage class diskformat verification for vsphere cloud provider

**What this PR does / why we need it**:
This PR adds a new e2e test for vsphere cloud provider.
Test is to verify diskformat specified in storage-class is being honored while volume creation.

Steps:

1. Create StorageClass with diskformat set to valid type (supported options are `eagerzeroedthick`, `zeroedthick` and `thin`)
2. Create PVC which uses the StorageClass created in step 1.
3. Wait for PV to be provisioned.
4. Wait for PVC's status to become Bound
5. Create POD using PVC on specific node.
6. Wait for Disk to be attached to the node.
7. Get node VM's devices and find PV's Volume Disk.
8. Get Backing Info of the Volume Disk and obtain Property of `VirtualDiskFlatVer2BackingInfo` - `EagerlyScrub` and `ThinProvisioned`
9. Based on the value of `EagerlyScrub` and `ThinProvisioned`, verify if diskformat is correct.
10. Delete POD and Wait for Volume Disk to be detached from the Node.
11. Delete PVC, PV and Storage Class



**Which issue this PR fixes** *
fixes #

**Special notes for your reviewer**:
Test is executed against v1.6.0-alpha.1
Test is failing on v1.4.8

**Release Note**
```release-note
NONE
```
@kerneltime @BaluDontu @abrarshivani please review this PR

Automatic merge from submit-queue (batch tested with PRs 37137, 41506, 41239, 41511, 37953)

Bump addon-manager version to v6.4-alpha.1 in kubemark

Fixes https://github.com/kubernetes/kubernetes/issues/41493

cc @wojtek-t @liggitt

Automatic merge from submit-queue

Stop controller when the stop channel is closed (when queue is empty and Pop is hanging)

Fixes: #28158

When a ``Pop`` function is invoked over empty queue, the control loop inside the functions is stacked indefinitely. In order to break the loop, introduce logic that waits for a signal to exit the loop.

Intention of the PR is not to handle situation where manipulation operations are invoked over closed queue. Intention is to break the indefinite loop.

Automatic merge from submit-queue

Empty test starts a single Pod

Automatic merge from submit-queue

Change node e2e cri-validation configs

Copy the configs to a new directory to test non-cri implementation. We can
remove the original directory after the dependent PRs are merged.

Automatic merge from submit-queue (batch tested with PRs 41104, 41245, 40722, 41439, 41502)

Bump the minimum kubeadm control plane version to v1.6.0-alpha.2

**What this PR does / why we need it**:

There went in quite a lot of useful features into v1.6.0-alpha.2 that kubeadm will use.
This bump the minimum limit so we can depend on those features.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@mikedanese @errordeveloper @pires @dmmcquay @dgoodwin

Automatic merge from submit-queue (batch tested with PRs 41104, 41245, 40722, 41439, 41502)

add sample fuzzing tests

Make fuzzing tests as simple as possible from both the API installer and the scheme, so its easy to add for api groups and so that I can build a scheme and then make sure I got it right.

@kubernetes/sig-api-machinery-pr-reviews @sttts @mikedanese

Automatic merge from submit-queue (batch tested with PRs 41104, 41245, 40722, 41439, 41502)

openstack-heat: do not daemonize salt-minion

_openstack-heat_ does currently not setup a _salt-master_, so it is not necessary to  daemonize it.

**What this PR does / why we need it**:
as stated in #40721:

> The _openstack-heat_ provider only installs _salt-minions_, no _salt-master_. The configuration does not take this into account which causes the following issues:
> 
> - the _salt minion_ is not able to DNS resolve `salt` (see fist part of error log below)
> - the _salt-minion_ is daemonized and fails finding the master (second part of error log below). From my understanding is not required when there is no salt-master, as the setup uses `salt-call` 
> anyway (see [gce provider](https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/configure-vm.sh#L328-L339) as reference).
> 
> ```
> Jan 31 03:00:04 kube-stack-master salt-minion[9795]: [ERROR   ] DNS lookup of 'salt' failed.
> Jan 31 03:00:04 kube-stack-master salt-minion[9795]: [ERROR   ] Master hostname: 'salt' not found. Retrying in 30 seconds
> ...
> Jan 31 02:35:30 kube-stack-master salt-minion[9690]: [ERROR   ] Error while bringing up minion for multi-master. Is master at salt responding?
> ```
> 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #40721

**Release note**:
```release-note
Do not daemonize `salt-minion` for the openstack-heat provider.
```

Automatic merge from submit-queue (batch tested with PRs 41104, 41245, 40722, 41439, 41502)

Change the etcd rollback tool to do rollback to 2.2.1 version.

I did some tests of it and for my 3-node cluster with 1 deployment it worked fine.

But before merging this, we should probably do way more testing (we should rerun tests that @mml was doing for the previous script).

@lavalamp @xiang90

Automatic merge from submit-queue

kubeadm: Migrate to client-go

**What this PR does / why we need it**: Finish the migration for kubeadm to use client-go wherever possible

**Which issue this PR fixes**: fixes #https://github.com/kubernetes/kubeadm/issues/52

**Special notes for your reviewer**: /cc @luxas @pires 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

kubelet: Make cadvisor GetContainerInfo tests table driven

Automatic merge from submit-queue

Move private key parsing from serviceaccount/jwt.go to client-go/util/cert

**What this PR does / why we need it**:
Unify private key parsing from serviceaccount/jwt.go into the client-go library.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:
Partial fix to #40807 - only private key functions.

**Special notes for your reviewer**:

**Release note**:

```release-note
Move private key parsing from serviceaccount/jwt.go to client-go/util/cert
```

Some imports dont exist yet (or so it seems) in client-go (examples
being:

  - "k8s.io/kubernetes/pkg/api/validation"
  - "k8s.io/kubernetes/pkg/util/initsystem"
  - "k8s.io/kubernetes/pkg/util/node"

one change in kubelet to import to client-go