Automatic merge from submit-queue (batch tested with PRs 50280, 52529, 53093, 53108, 53168). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Improve PVC ref volume metric test robustness

This test has been flaking. The current working theory is that
volume stats collection didn't run in time to grab the metrics
from the newly created pod.

Made the following changes:
 - Added more logs to help debug future failures
 - Poll metrics a few additional times before failing the test

fixes #53150

Automatic merge from submit-queue (batch tested with PRs 50280, 52529, 53093, 53108, 53168). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add 201/Status to the list of returned objects.

**What this PR does / why we need it**:
Adds 201/202 to the list of codes/objects returned by `POST` and 201 to the list of codes returned by `PUT` requests in Swagger/OpenAPI

**Special notes for your reviewer**:
This helps fix 
https://github.com/kubernetes-client/csharp/issues/29

**Release note**:
```release-note
Adds 201/202 to the list of codes/objects returned by `POST` and 201 to the list of codes returned by `PUT` requests in Swagger/OpenAPI
```

Automatic merge from submit-queue (batch tested with PRs 50280, 52529, 53093, 53108, 53168). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove touch-lock init container from kube-proxy

**What this PR does / why we need it**: Ack https://github.com/kubernetes/kubeadm/issues/298, touch-lock init container is no longer needed after we have https://github.com/kubernetes/kubernetes/pull/46597.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #NONE

**Special notes for your reviewer**:
/assign @bowei @cmluciano 
cc @dixudx 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 50280, 52529, 53093, 53108, 53168). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove certificate manager unused code

**What this PR does / why we need it**:
remove unused const
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 50280, 52529, 53093, 53108, 53168). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Mark volume as detached when node does not exist for photon

If node does not exist, node's volumes will be detached
automatically and become available. So mark them detached and
return false without error.
Fix #50266

**Special notes for your reviewer**:
/assign @jingxu97 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49249, 53203, 53209, 53208, 53177). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

vendor/k8s.io/client-go/tools/record: Fix two swallowed errors in tests

**What this PR does / why we need it**: Fixes two dropped errors in client-go.

```release-note NONE
```

Automatic merge from submit-queue (batch tested with PRs 49249, 53203, 53209, 53208, 53177). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

gce:restrict file permissions for PKI assets

from 644 to 600

Fixes https://github.com/kubernetes/kubernetes/issues/52999

Automatic merge from submit-queue (batch tested with PRs 49249, 53203, 53209, 53208, 53177). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

bazel: set --incompatible_disallow_set_constructor=false to fix breakage

**What this PR does / why we need it**: The build is broken with bazel 0.6.0. I have a proper fix ready, but it'll lock us to bazel 0.6.0+, which I don't want to do quite yet, hence this workaround.

x-ref #52677

**Release note**:

```release-note
NONE
```

/assign @mikedanese @spxtr @BenTheElder 
cc @apelisse

Automatic merge from submit-queue (batch tested with PRs 49249, 53203, 53209, 53208, 53177). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix lint error on kubernetes-worker

**What this PR does / why we need it**:

This fixes a lint error on kubernetes-worker that's causing problems in our CI builds.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix typo in config_test.go

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update kubelet's 'pod-manifest-path' description

Improved grammer of flag `pod-manifest-path` of kubelet

**What this PR does / why we need it**:

It updates the flag description which had an extra `to`,  so this commit removes it.

/approve no-issue

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix kube-proxy addon OWNERS file

**What this PR does / why we need it**: Sorry for the typo :(

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #NONE

**Special notes for your reviewer**:
/assign @thockin @bowei 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix kubectl set resource/selector/subject output

**What this PR does / why we need it**:
kubectl set resource/selector/subject -o yaml doesn't return the expected format

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/kubernetes/kubectl/issues/51

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add documentation comments for volume expand controller

These comments help clear out some of the design choices made
in code.

cc @kubernetes/sig-storage-pr-reviews @NickrenREN

from 644 to 600

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

exposes a method on AdmissionOptions

**What this PR does / why we need it**:
exposes a method on AdmissionOptions that will set default admission plugin names when none were provided from the command line.

**Release note**:

```
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

federation: Move k/test/e2e_federation package to k/federation/test/e2e

No functional change. Just move federation e2e tests inside k/federation directory, so that it is easy to move federation out of core.

Issue ref: #52992

**Release note**:
```release-note
NONE
```

/cc @kubernetes/sig-federation-pr-reviews @irfanurrehman @madhusudancs

Automatic merge from submit-queue (batch tested with PRs 53157, 52628). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Added openstack instance metadata search order

**What this PR does / why we need it**: This PR adds a search order for the instance metadata retrieval on openstack. More information and discussion can be found on #52378 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #52378 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 53157, 52628). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Revert "Make kubelet touch iptables lock file during initialization"

**What this PR does / why we need it**: Revert #47212. #36485 is fixed so this is no longer needed.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #NONE

**Special notes for your reviewer**:
/assign @yujuhong @dchen1107 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add a label which prevents a node from being added to a cloud load balancer

There are a variety of reasons that you may not want a node in a cluster to participate in a cloud load balancer. For example workload isolation for security, or managing network throughput, or because the node is not in the appropriate virtual network (cluster's that span environments)

This PR adds a label so that you can select which nodes you want to participate.

Automatic merge from submit-queue (batch tested with PRs 52634, 53121, 53161). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Normalize RepoTags before checking for match

**What this PR does / why we need it**:

on projectatomic-based docker, we get "docker.io/library/busybox:latest"
when someone uses an unqualified name like "busybox". Though when we
inspect, the RepoTag will still say "docker.io/busybox:latest", So
we have reparse the tag, normalize it and try again. Please see the
additional test case.
Signed-off-by: Andy Goldstein <andy.goldstein@gmail.com>

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Fixes #52110

**Special notes for your reviewer**:

**Release note**:

```release-note
Fixes an issue pulling pod specs referencing unqualified images from docker.io on centos/fedora/rhel
```

Automatic merge from submit-queue (batch tested with PRs 52634, 53121, 53161). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

  fix clusterrolebindings duplicate create in local-up-cluster.sh

Changes to be committed:
  modified:   hack/local-up-cluster.sh



**What this PR does / why we need it**:
currently ,execute hack/local-up-cluster.sh will produce an error :

> Creating kube-system namespace
> Error from server (AlreadyExists): clusterrolebindings.rbac.authorization.k8s.io "system:kube-dns" 
> already exists
> serviceaccount "kube-dns" created

it was caused by duplicate creation in script.
kube-api-server  with RBAC option creates system:kube-dns and kubectl create it again.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Improve codes which checks whether sandbox contains containers

Currently evictSandboxes() checks whether sandbox contains
containers, it traverses all the containers for every sandbox,
but when cluster has many containres, it wastes a lot of time.
It is better to use sets in this case.

**Release note**:
```release-note
NONE
```

This test has been flaking. The current working theory is that
volume stats collection didn't run in time to grab the metrics
from the newly created pod.

Made the following changes:
 - Added more logs to help debug future failures
 - Poll metrics a few additional times before failing the test

on projectatomic-based docker, we get "docker.io/library/busybox:latest"
when someone uses an unqualified name like "busybox". Though when we
inspect, the RepoTag will still say "docker.io/busybox:latest", So
we have reparse the tag, normalize it and try again. Please see the
additional test case.
Signed-off-by: Andy Goldstein <andy.goldstein@gmail.com>

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update kube dns 1.14.5

```release-note
Update kube-dns to 1.14.5
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

federation: Remove manifests which are no longer used

Federation manifests files which are meant to be used by CI jobs are no longer used and are out-dated and no longer maintained. So removing them.

**Release note**:
```release-note
NONE
```

/cc @kubernetes/sig-federation-pr-reviews @madhusudancs

Automatic merge from submit-queue (batch tested with PRs 52630, 53110, 53136, 53075). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

federation/pkg/federation-controller/util: fix swallowed errors

**What this PR does / why we need it**: The re-declaration of `err` inside the `if` block causes it to be lost before the check on line 93, even though it is reassigned on lines 95 and 90. By declaring the secret variable on line 71 I was able to ditch the `:=` assignment on line 72, meaning we can keep the `err` variable previously defined before the block on line 47.

```release-note NONE
```