Automatic merge from submit-queue (batch tested with PRs 46635, 45619, 46637, 45059, 46415)

Update url information to prevent http 304 redirection

Although repo [https://github.com/GoogleCloudPlatform/kubernetes](https://github.com/GoogleCloudPlatform/kubernetes) still can be access, but I think one more 304 redirection is no needed

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46635, 45619, 46637, 45059, 46415)

Certificate rotation for kubelet server certs.

Replaces the current kubelet server side self signed certs with certs signed by
the Certificate Request Signing API on the API server. Also renews expiring
kubelet server certs as expiration approaches.

Two Points:
1. With `--feature-gates=RotateKubeletServerCertificate=true` set, the kubelet will
    request a certificate during the boot cycle and pause waiting for the request to
    be satisfied.
2. In order to have the kubelet's certificate signing request auto approved,
    `--insecure-experimental-approve-all-kubelet-csrs-for-group=` must be set on
    the cluster controller manager. There is an improved mechanism for auto
    approval [proposed](https://github.com/kubernetes/kubernetes/issues/45030).

**Release note**:
```release-note
With `--feature-gates=RotateKubeletServerCertificate=true` set, the kubelet will
request a server certificate from the API server during the boot cycle and pause
waiting for the request to be satisfied. It will continually refresh the certificate as
the certificates expiration approaches.
```

Automatic merge from submit-queue (batch tested with PRs 46635, 45619, 46637, 45059, 46415)

fix a comment and log message in the nodecontroller

I was poking around in the nodecontroller code and this looked wrong.

Automatic merge from submit-queue (batch tested with PRs 46635, 45619, 46637, 45059, 46415)

migrate group approver to use subject access reviews

WIP, needs test and changes to kubeadm

depends on https://github.com/kubernetes/kubernetes/pull/45514

Automatic merge from submit-queue

Switch gcloud compute copy-files to scp

gcloud is deprecating `gcloud compute copy-files` and switching to `gcloud compute scp`. Make the change before things start to break.

https://cloud.google.com/sdk/gcloud/reference/compute/copy-files

Warnings we get: `W0529 10:28:59.097] WARNING: `gcloud compute copy-files` is deprecated.  Please use `gcloud compute scp` instead.  Note that `gcloud compute scp` does not have recursive copy on by default.  To turn on recursion, use the `--recurse` flag.`

/cc @jlowdermilk

Automatic merge from submit-queue (batch tested with PRs 44061, 46614, 46419, 46628, 46134)

clientgo/examples/out-of-cluster: add instructions

Automatic merge from submit-queue (batch tested with PRs 44061, 46614, 46419, 46628, 46134)

cleanup kubelet new node status test

**What this PR does / why we need it**:
this scopes the test to just testing allocatable values.  extra parts of the original test were copied from another test that was not relevant.

Merge pull request #46419 from bruceauyeung/k8s-branch-fix-make-release-doesnt-respect-go-build-flags

Automatic merge from submit-queue (batch tested with PRs 44061, 46614, 46419, 46628, 46134)

fix make release/quick-release doesn't respect go build flags

**What this PR does / why we need it**:
k8s build process run `make cross` in a docker container, so we have to pass make command line variables to docker container, then  each environment variable in docker container will be transformed into a makefile variable with the same name and value.
with this PR, `make release GOFLAGS=xx GOLDFLAGS=xx GOGCFLAGS=xx`, `make quick-release GOFLAGS=xx GOLDFLAGS=xx GOGCFLAGS=xx` will work as expected

**Which issue this PR fixes**: 
fixes #46274

Automatic merge from submit-queue (batch tested with PRs 44061, 46614, 46419, 46628, 46134)

Remove glusterfs fuse client mount library version check for `auto_unmount` mount option.

Automatic merge from submit-queue

kubelet: group all container-runtime-specific flags/options into a separate struct

They don't belong in the KubeletConfig.

This addresses #43253

Automatic merge from submit-queue

add myself and liggitt to pkg/kubelet/certificats OWNERs

For as long a kubelet is using the internal client, this certificate
manager is bound to the kubelet. Once kubelet has moved to client-go we
plan to extract this library to be general purpose. In the meantime,
liggitt and I should handle reviews of this code.

@liggitt @timstclair

Automatic merge from submit-queue

Support grabbing test suite metrics

**What this PR does / why we need it**:
Add support for grabbing metrics that cover the entire test suite's execution.

Update the "interesting" controller-manager metrics to match the
current names for the garbage collector, and add namespace controller
metrics to the list.

If you enable `--gather-suite-metrics-at-teardown`, the metrics file is written to a file with a name such as `MetricsForE2ESuite_2017-05-25T20:25:57Z.json` in the `--report-dir`. If you don't specify `--report-dir`, the metrics are written to the test log output.

I'd like to enable this for some of the `pull-*` CI jobs, which will require a separate PR to test-infra.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

@kubernetes/sig-testing-pr-reviews @smarterclayton @wojtek-t @gmarek @derekwaynecarr @timothysc

Automatic merge from submit-queue

add test in validation

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

For as long a kubelet is using the internal client, this certificate
manager is bound to the kubelet. Once kubelet has moved to client-go we
plan to extract this library to be general purpose. In the meantime,
liggitt and I should handle reviews of this code.

Automatic merge from submit-queue (batch tested with PRs 42240, 46100, 46154, 46431, 45755)

Differentiate update/create message on set-context

Automatic merge from submit-queue (batch tested with PRs 42240, 46100, 46154, 46431, 45755)

Fix api description in swagger

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
　NONE
```

Automatic merge from submit-queue (batch tested with PRs 42240, 46100, 46154, 46431, 45755)

Attempt certificate rotation as expiration approaches.

Automatic merge from submit-queue (batch tested with PRs 42240, 46100, 46154, 46431, 45755)

clean up: put test description in head to clear

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

correct misspell "identify" in client_config.go

Automatic merge from submit-queue

fixtypo 

**What this PR does / why we need it**:
fix typo seperated -> separated

**Release note**:

```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 46489, 46281, 46463, 46114, 43946)

Allow PSP's to specify a whitelist of allowed paths for host volume

**What this PR does / why we need it**:

This PR adds the ability to whitelist paths for the host volume to ensure pods cannot access directories they aren't supposed to. E.g. `/var/lib/kubelet`, `/etc/kubernetes/*`, etc. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #29326


**Special notes for your reviewer**:

**Release note**:

```release-note
Allow PSP's to specify a whitelist of allowed paths for host volume based on path prefixes
```

Automatic merge from submit-queue (batch tested with PRs 46489, 46281, 46463, 46114, 43946)

Add `kubectl config rename-context`

Add `kubectl config rename-context`

This command allows renaming a context, instead of editing manually in .kubeconfig

Fix https://github.com/kubernetes/kubernetes/issues/45131

```release-note
Add `kubectl config rename-context`
```

Automatic merge from submit-queue (batch tested with PRs 46489, 46281, 46463, 46114, 43946)

AWS: consider instances of all states in DisksAreAttached, not just "running"

Require callers of `getInstancesByNodeNames(Cached)` to specify the states they want to filter instances by, if any. DisksAreAttached, cannot only get "running" instances because of the following attach/detach bug we discovered:

1. Node A stops (or reboots) and stays down for x amount of time
2. Kube reschedules all pods to different nodes; the ones using ebs volumes cannot run because their volumes are still attached to node A
3. Verify volumes are attached check happens while node A is down
4. Since aws ebs bulk verify filters by running nodes, it assumes the volumes attached to node A are detached and removes them all from ASW
5. Node A comes back; its volumes are still attached to it but the attach detach controller has removed them all from asw and so will never detach them even though they are no longer desired on this node and in fact desired elsewhere
6. Pods cannot run because their volumes are still attached to node A

So the idea here is to remove the wrong assumption that callers of `getInstancesByNodeNames(Cached)` only want "running" nodes.

I hope this isn't too confusing, open to alternative ways of fixing the bug + making the code nice.

ping @gnufied @kubernetes/sig-storage-bugs

```release-note
Fix AWS EBS volumes not getting detached from node if routine to verify volumes are attached runs while the node is down
```

Automatic merge from submit-queue (batch tested with PRs 46489, 46281, 46463, 46114, 43946)

add error info

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46489, 46281, 46463, 46114, 43946)

De-duplication of verb in policy.go

**What this PR does / why we need it**:
https://github.com/kubernetes/kubernetes/blob/master/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go#L224 contains `get` verb. 

**Which issue this PR fixes**:

**Special notes for your reviewer**:

**Release note**:

```release-note
None
```

Automatic merge from submit-queue

Move hardPodAffinitySymmetricWeight to scheduler policy config

**What this PR does / why we need it**:
Move hardPodAffinitySymmetricWeight to scheduler policy config
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #43845 

**Special notes for your reviewer**:
If you like this, will add test later
**Release note**:
```
Move hardPodAffinitySymmetricWeight from KubeSchedulerConfiguration to scheduler Policy config
```

Adding instructions for out-of-cluster example and making it work without
specifying the -kubeconfig argument if the home directory can be inferred.

This is part of the body of work improving the client library samples.
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>

Automatic merge from submit-queue

Support storageclass storage updates to v1

**What this PR does / why we need it**: enable cluster administrators to update storageclasses stored in etcd from storage.k8s.io/v1beta1 to storage.k8s.io/v1. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**: I had a hard time getting the test to work with how it was handling KUBE_API_VERSIONS and RUNTIME_CONFIG. I would appreciate some extra review attention there. Also, I had to hack in a `cluster-scoped` "namespace" to get the verification portions of the test script to work. I'm definitely open to ideas for how to improve that if needed.

**Release note**:

```release-note
Support updating storageclasses in etcd to storage.k8s.io/v1. You must do this prior to upgrading to 1.8.
```

cc @kubernetes/sig-storage-pr-reviews @kubernetes/sig-api-machinery-pr-reviews @jsafrane @deads2k @saad-ali @enj

Automatic merge from submit-queue (batch tested with PRs 46552, 46608, 46390, 46605, 46459)

Move admission lifecycle to genericapi

**What this PR does / why we need it**:  ends the whole sequence of moving some admission plugins to generic api.


**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46552, 46608, 46390, 46605, 46459)

Make kubemark scripts fail fast

Fixes https://github.com/kubernetes/kubernetes/issues/46601

/cc @wojtek-t @gmarek

Automatic merge from submit-queue (batch tested with PRs 46552, 46608, 46390, 46605, 46459)

Require DeleteStrategy for all registry.Store

**What this PR does / why we need it**:

All `registry.Store` objects already set a non-nil `DeleteStrategy`.  This change ensures that all future objects do so as well.
Signed-off-by: Monis Khan <mkhan@redhat.com>

xref: #24153 openshift/origin/issues/14198

cc @deads2k @liggitt @caesarxuchao @lavalamp @smarterclayton @derekmahar 

In regards to this, why is the `RESTDeleteStrategy` a useless interface (as far as deletion goes)?  We cast it to `GarbageCollectionDeleteStrategy` or `RESTGracefulDeleteStrategy` in an attempt to do operations related to deletion, but we have "default" behavior for both of those cases.  It should be possible to make `DeleteStrategy` optional by using the other strategies as the `runtime.ObjectTyper` and then defaulting a `nil` `DeleteStrategy` with the expected behavior.

```go
// RESTDeleteStrategy defines deletion behavior on an object that follows Kubernetes
// API conventions.
type RESTDeleteStrategy interface {
	runtime.ObjectTyper
}

type GarbageCollectionPolicy string

const (
	DeleteDependents GarbageCollectionPolicy = "DeleteDependents"
	OrphanDependents GarbageCollectionPolicy = "OrphanDependents"
)

// GarbageCollectionDeleteStrategy must be implemented by the registry that wants to
// orphan dependents by default.
type GarbageCollectionDeleteStrategy interface {
	// DefaultGarbageCollectionPolicy returns the default garbage collection behavior.
	DefaultGarbageCollectionPolicy() GarbageCollectionPolicy
}

// RESTGracefulDeleteStrategy must be implemented by the registry that supports
// graceful deletion.
type RESTGracefulDeleteStrategy interface {
	// CheckGracefulDelete should return true if the object can be gracefully deleted and set
	// any default values on the DeleteOptions.
	CheckGracefulDelete(ctx genericapirequest.Context, obj runtime.Object, options *metav1.DeleteOptions) bool
}
```

**Release note**:

```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46552, 46608, 46390, 46605, 46459)

Fixes kubectl cached discovery on Windows

Fixes https://github.com/kubernetes/kubectl/issues/18

The `kubectl` cached discovery makes use of `func (f *File) Chmod(mode FileMode) error` which is not supported and errors out on Windows, making `kubectl get` and potentially a number of other commands to fail miserably on that platform. `os.Chmod` by file name, on the other hand, does not error out and should be used instead.

**Release note**:

```release-note
NONE
```
@deads2k @brendandburns @kubernetes/sig-cli-pr-reviews

Automatic merge from submit-queue

gcloud command syntax changed between alpha and beta versions

syntax for secondary-ranges changed from:
  name=NAME,range=RANGE
to
  NAME=RANGE

Do not store them in kubelet's configuration. Eventually, we would like
to deprecate all these flags as they should not be part of kubelet.

Automatic merge from submit-queue (batch tested with PRs 43275, 45014, 46449, 46488, 46525)

move CustomResourceDefinitions from alpha to beta

CRDs are built upon the known ThirdPartyResource API with the lessons learned guiding the new shape.  Short comings of the old TPR API even have specific tests to ensure that CRDs do not face the same issues.  Given that, this API qualifies for beta.

These are straight mechanical changes.

@kubernetes/sig-api-machinery-misc 
@ericchiang  You asked about this in the original pull.