kubeadm: adds etcd server version for 1.13

Sparse cert creation for `kubeadm init`

kubeadm: fix issues in the v1beta1 godoc

Signed-off-by: Chuck Ha <ha.chuck@gmail.com>

Add flags to kubeadm init phase uploadconfig all

- make the whole config example actually pass strict verification
(i.e. make the config work with --config)
- add print init-defaults/join defaults
- other small fixes

Fix flaky 'shouldn't trigger additional scale-ups during processing scale-up' test

Add yue9944882 to CRD/CR apiserver reviewer

Revert "Make bootstrap client cert loading part of rotation"

This reverts commit 0af19875.

Revert "Ensure the bootstrap rotation code is tested by forcing rotation"

This reverts commit de293b2d.

Add option to k8s apiserver to reject incoming requests upon audit failure

Ignore non socket files in the kubelet plugin watcher

Make bootstrap client cert loading part of rotation

migrate service account volume to a projected volume when BoundServiceAccountTokenVolumes are enabled

Promote raw block volume support to beta

Fix kubelet panic.

fix a scheduler panic due to internal cache inconsistency

ensure scheduler preemptor behaves in an efficient/correct path

authn: extend authenticator.Token to support audience validation

Expose both a Stop() method (for cleanup) and a method to force
cert rotation, but only expose Stop() on the interface.

Verify that we choose the correct client.

Ensure that bootstrap+clientcert-rotation in the Kubelet can:

1. happen in the background so that static pods aren't blocked by bootstrap
2. collapse down to a single call path for requesting a CSR
3. reorganize the code to allow future flexibility in retrieving bootstrap creds

Fetching the first certificate and later certificates when the kubelet
is using client rotation and bootstrapping should share the same code
path. We also want to start the Kubelet static pod loop before
bootstrapping completes. Finally, we want to take an incremental step
towards improving how the bootstrap credentials are loaded from disk
(potentially allowing for a CLI call to get credentials, or a remote
plugin that better integrates with cloud providers or KSMs).

Reorganize how the kubelet client config is determined. If rotation is
off, simplify the code path. If rotation is on, load the config
from disk, and then pass that into the cert manager. The cert manager
creates a client each time it tries to request a new cert.

Preserve existing behavior where:

1. bootstrap kubeconfig is used if the current kubeconfig is invalid/expired
2. we create the kubeconfig file based on the bootstrap kubeconfig, pointing to
   the location that new client certs will be placed
3. the newest client cert is used once it has been loaded

Revert openapi publish

Don't allow --csr-only for CA certs or all

Remove devicePath dependency for CSI volumes

Fix race between MountVolume and UnmountDevice

Augmenting API call retry in nodeinfomanager; Revert #70891

Introduce apiserver.config.k8s.io/v1 and use standard method for parsing encryption config file

Signed-off-by: Lantao Liu <lantaol@google.com>