Automatic merge from submit-queue (batch tested with PRs 38724, 38699)

improve the forbidden message

Improves the forbidden message to include more details about what was denied.

`User "foo" cannot list replicasets.extensions in the namespace "default". `
`User "foo" cannot list replicasets.extensions at the cluster scope. `

@xilabao looks like you looking in a similar area, but focused on errors.
@sttts a lot of usual reviewers are out.

Automatic merge from submit-queue

fix connection upgrades through kuberentes-discovery

The initial upgrade through the proxy doesn't use the passed transport to handle the communication to the remote side.  Since we need auth proxy headers, this broke the upgrade for exec.

This sets those headers once if its an upgrade request (the transport stomps them if called anyway, so it won't shadow.).

@sttts I think this is the last required piece.  Then we start wiring in for e2e.

Automatic merge from submit-queue (batch tested with PRs 38760, 38213)

Avoid exporting fluentd-gcp own logs

To prevent fluentd from exporting its own logs, redirect the output to a file. Ability to read fluentd logs remains, but because these logs will not be exported, we can increase the verbosity of these logs.

Same change should be made for fluentd-es image.

CC @piosz

Automatic merge from submit-queue

Fixed region in cluster validation.

Automatic merge from submit-queue (batch tested with PRs 38720, 38533)

Priority REST Mapper: Actually honor user choice

```release-note
Fixes bug in resolving client-requested API versions
```

RESTMapping takes a desired GroupKind, and a set of versions, and
returns a rest mapper for the first matching version.  It also has a
list of built-in discovered prioritized versions, to which it appends
the user versions.

However, when it goes to parse the versions, it parses them as
GroupVersions.  Since only a version was passed, the group will be the
empty group (""), which will only match rest mappings for the empty
group, ergo, none of the user's versions will match if they are
attempting a match for a non-emtpy-group GroupKind.

This fixes that by taking the parsed GroupVersion, and overriding the
Group with the Group from the passed-in GroupKind.

Automatic merge from submit-queue

prevent audit filter from panic-ing on missing user info

master version of https://github.com/kubernetes/kubernetes/pull/38717

Fixed region in cluster validation.

Automatic merge from submit-queue (batch tested with PRs 38648, 38747)

fix typo

**What this PR does / why we need it**:
    fix typo.

**Release note**:

```NONE
```

Automatic merge from submit-queue

Fake clientset propagates namespace to objects on create/update

**What this PR does / why we need it**:

Unlike the real Clientset, the fake Clientset requires creates and updates of namespaced objects to have the namespace specified in the target runtime object metadata. This difference forces API clients using the fake Clientset for test to propagate the namespaces to the runtime objects in the production code. This propagation is unnecessary and should be handled by the fake implementation.

**Which issue this PR fixes**: fixes kubernetes/client-go#48

**Special notes for your reviewer**:

**Release note**:
NONE

Automatic merge from submit-queue

apiserver(s): Replace glog.Fatals with fmt.Errorfs

Automatic merge from submit-queue

Node Conformance: Node Conformance CI

For https://github.com/kubernetes/kubernetes/issues/37252.

The first 2 commits of this PR are from #38150 and #38152. Please review those 2 PRs first, they are both minor cleanup.

This PR:
* Add `TestSuite` interface in `test/e2e_node/remote` to separate test suite logic (packaging, deploy, run test) from VM lifecycle management logic, so that different test suites can share the same VM lifecycle management logic.
  * Different test suites such as node e2e, node conformance, node soaking, cri validation etc. should implement different `TestSuite`.
  * `test/e2e_node/runner/remote` will initialize and run different test suite based on the subcommand.
* Add `run-kubelet-mode` which only starts and monitors kubelet, similar with `run-services-mode`. The reason we need this:
  * Unlike node e2e, node conformance test doesn't start kubelet inside the test suite (in fact, in the future node e2e shouldn't do that either), it assumes kubelet is already running before the test.
  * In fact, node e2e should use similar node bootstrap script like cluster e2e, and the bootstrap script should initialize the node with all necessary node software including kubelet. However, it's not the case now.
  * The easiest way for now is to reuse the kubelet start logic in the test suite. So in this PR, we added `run-kubelet-mode`, and use the test binary as a kubelet launcher to start kubelet before running the test.
* Implement node e2e `TestSuite`.
* Implement node conformance `TestSuite`. Use `docker save` and `docker load` to create and deploy conformance docker image; Start kubelet by running test binary in `run-kubelet-mode`; Run conformance test with `docker run`.

This PR will make it easy to implement continuous integration node soaking test and cri validation test (https://github.com/kubernetes/kubernetes/pull/35266).

/cc @kubernetes/sig-node

Automatic merge from submit-queue

Remove 'minion' from the code in two places in favor of 'node'

Part of https://github.com/kubernetes/kubernetes/issues/1111

Automatic merge from submit-queue (batch tested with PRs 38638, 38334)

Remove Azure Subnet RouteTable check

**What this PR does / why we need it**:

PR Removes the subnet configuration check for Azure cloudprovider. The subnet check ensures that the subnet is associated with the Route Table. However if the VNET is in a different Azure Resource Group then the check fails, even if the subnet is already valid. This a stop gap fix, to allow Kubernetes to be deployed to Custom VNETs in Azure, that may reside in a different resource group to the cluster.

fixes #38134 

@colemickens

Automatic merge from submit-queue

Use the cluster name in the names of the firewall rules that allow cluster-internal traffic to disambiguate the rules belonging to different clusters.

Also dropping the network name from these firewall rule names.

Network name was used to disambiguate firewall rules in a given network.
However, since two clusters cannot share a name in a GCE project, this
sufficiently disambiguates the firewall rule names. A potential confusion
arises when someone tries to create a firewall rule with the same name
in a different network, but that's also an indication that they shouldn't
be doing that.


@jszczepkowski due to PR #33094
@ixdy for test-infra

cc @kubernetes/sig-federation @nikhiljindal

Automatic merge from submit-queue (batch tested with PRs 38689, 38743, 38734, 38430)

apply sandbox network mode based on network plugin

This allows CRI to use docker's network bridge. Can be combined with noop network plugin. This allows to use docker0 with no further configuration. Good for tools like minikube/hyperkube.

Automatic merge from submit-queue (batch tested with PRs 38689, 38743, 38734, 38430)

Temporarily bump e2e cleanup timeout

Automatic merge from submit-queue

Remove accidentally committed files

Accidentally committed in #37534.

Automatic merge from submit-queue

Fix 1.5 CHANGELOG

Fix broken `docs` link.

Automatic merge from submit-queue

Refactor remotecommand options parsing

Prerequisite to https://github.com/kubernetes/kubernetes/issues/36187 - This separates the options from the request, so they can be pulled from elsewhere.

/cc @liggitt

Automatic merge from submit-queue (batch tested with PRs 38727, 38726, 38347, 38348)

Add 'privileged' to sandbox to indicate if any container might be privileged in it, document privileged

Right now, the privileged flag is this magic thing which does "whatever Docker does". This documents it to make it a little less magic.

In addition, due to how rkt uses `systemd-nspawn` as an outer layer of isolation in creating the sandbox, it's helpful to know beforehand whether the pod will be privileged so additional security options can be applied earlier / applied at all.

I suspect the same indication will be useful for userns since userns should also occur at the pod layer, but it's possible that will be a separate/additional field.


cc @lucab @jonboulle @yujuhong @feiskyer @kubernetes/sig-node 


```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 38727, 38726, 38347, 38348)

kubelet: remove redundant hostNetwork helper

Trivial cleanup.

Automatic merge from submit-queue (batch tested with PRs 38727, 38726, 38347, 38348)

Second pass of renaming kube-dns configure files

Continue work of #38523.

Not sure why cluster/centos/deployAddons.sh was omitted in previous PR. Also deletes the non-use `DNS_REPLICAS` var and changes `-rc` suffix in hack/local-up-cluster.sh.

@thockin @bowei @deads2k

Automatic merge from submit-queue

Ensure the GCI metadata files do not have newline at the end

Fixes #36708

@dchen1107 @Random-Liu  can one of you help with the review?

cc @kubernetes/goog-image FYI

Automatic merge from submit-queue

Inode Eviction Test is Flaky

This Pull Request:
Marks the InodeEviciton test as flaky
Increases the timeout for disk pressure because coreos has nearly 2 million inodes.
Decreases the status polling interval so we can see eviction ordering better.
@Random-Liu