Automatic merge from submit-queue (batch tested with PRs 51439, 51361, 51140, 51539, 51585)

[Scheduler] regroup imports
Signed-off-by: sakeven <jc5930@sina.cn>



**What this PR does / why we need it**:

>Imports are organized in groups, with blank lines between them. The standard library packages are always in the first group.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51439, 51361, 51140, 51539, 51585)

Enable alpha GCE disk API

This PR builds on top of #50467 to allow the GCE disk API to use either the alpha or stable APIs.

CC @freehan

Automatic merge from submit-queue (batch tested with PRs 51439, 51361, 51140, 51539, 51585)

CPU manager interfaces.

Please review / merge #51132 first.
Blocker for CPU manager #49186 (3 of 6)

@sjenning @derekwaynecarr

Automatic merge from submit-queue (batch tested with PRs 51439, 51361, 51140, 51539, 51585)

Iscsi handle failed mount

**What this PR does / why we need it**:

**Which issue this PR fixes**: fixes #50556

**Special notes for your reviewer**:

**Release note**:

```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 51439, 51361, 51140, 51539, 51585)

Fix list-features script

Automatic merge from submit-queue (batch tested with PRs 47054, 50398, 51541, 51535, 51545)

e2e/integration: simplify deepcopy calls

Automatic merge from submit-queue (batch tested with PRs 47054, 50398, 51541, 51535, 51545)

allow disabling the scheduler port

Unlike the `kube-apiserver`, the scheduler can function without exposing a status port.  This provides the option to disable it by explicitly passing a `-1`.  This does not change default behavior.

@aveshagarwal

Automatic merge from submit-queue (batch tested with PRs 47054, 50398, 51541, 51535, 51545)

scheduler: simplify deepcopy calls

Pre-requisite of https://github.com/kubernetes/kubernetes/pull/49575.

Automatic merge from submit-queue (batch tested with PRs 47054, 50398, 51541, 51535, 51545)

Switch away from gcloud deprecated flags in compute resource listings

**What is fixed**

Remove deprecated `gcloud compute` flags, see linked issue.

**Which issue this PR fixes**:

fixes #49673 

**Special notes for your reviewer**:

The change in `gcloudComputeResourceList` in `test/e2e/framework/ingress_utils.go` isn't strictly needed as currently no affected resources are called on within that file, however the function has the _potential_ to access affected resources so I covered it as well. Happy to change if deemed unnecessary.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Improve description for --masquerade-all and --cluster-cidr flags

**What this PR does / why we need it**:

Improves the help text for the kube-proxy's `--masquerade-all` and `--cluster-cidr` flags, which previously were vague and confusing.

Fixes https://github.com/kubernetes/kubernetes/issues/47213

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51228, 50185, 50940, 51544, 51543)

admission plugins: simplify deepcopy calls

Automatic merge from submit-queue (batch tested with PRs 51228, 50185, 50940, 51544, 51543)

pkg/api: simplify deepcopy calls

Automatic merge from submit-queue (batch tested with PRs 51228, 50185, 50940, 51544, 51543)

Add upgrades tests for kube-proxy daemonset migration path

**What this PR does / why we need it**:
From #23225, this is a part of setting up CIs to validate the kube-proxy migration path (static pods -> daemonset and reverse).
The other part of the works (adding real CIs that run these tests) will be in a separate PR against [kubernetes/test-infra](https://github.com/kubernetes/test-infra).

Though this is currently blocked by #50705.

**Special notes for your reviewer**:
cc @roberthbailey  @pwittrock 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51228, 50185, 50940, 51544, 51543)

Task 4: Ignored node condition predicates if TaintsByCondition enabled.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: part of #42001 

**Release note**:
```release-note
None
```

Automatic merge from submit-queue

Add storageClass.mountOptions and use it in all applicable plugins

split off from https://github.com/kubernetes/kubernetes/pull/50919 and still dependent on it. cc @gnufied


issue: https://github.com/kubernetes/features/issues/168

```release-note
Add mount options field to StorageClass. The options listed there are automatically added to PVs provisioned using the class.
```

Automatic merge from submit-queue (batch tested with PRs 51377, 46580, 50998, 51466, 49749)

Adding e2e SELinux test for local storage

Adding e2e test for SELinux enabled local storage
/sig storage
Closes #45054

Automatic merge from submit-queue (batch tested with PRs 51377, 46580, 50998, 51466, 49749)

Use the pre-built docker binaries on Ubuntu for benchmark tests

- Tested manually.
- The `ubuntu-init-docker.yaml` is copied from `cos-init-docker.yaml` with the following changes needed by Ubuntu. This change is temporary -- we will remove the script and the tests once we know the performance of using the pre-built Docker 1.12 on Ubuntu.

```
71,72c71,72
<         mount --bind "${install_location}"/docker-containerd /usr/bin/docker-containerd
<         mount --bind "${install_location}"/docker-containerd-shim /usr/bin/docker-containerd-shim
---
>         mount --bind "${install_location}"/docker-containerd /usr/bin/containerd
>         mount --bind "${install_location}"/docker-containerd-shim /usr/bin/containerd-shim
75c75
<         mount --bind "${install_location}"/docker-runc /usr/bin/docker-runc
---
>         mount --bind "${install_location}"/docker-runc /usr/sbin/runc
88c88
<         local requested_version="$(get_metadata "gci-docker-version")"
---
>         local requested_version="$(get_metadata "ubuntu-docker-version")"
93,98d92
<         # Check if we have the requested version installed.
<         if check_installed /usr/bin/docker "${requested_version}"; then
<           echo "Requested version already installed. Exiting."
<           exit 0
<         fi
< 
100c94
<         /usr/bin/systemctl stop docker
---
>         systemctl stop docker
106c100
<         /usr/bin/systemctl start docker && exit $rc
---
>         systemctl start docker && exit $rc
```

- Updated all tests to use the latest Ubuntu image.

**Release note**:
```
None
```

/assign @Random-Liu

Automatic merge from submit-queue (batch tested with PRs 51377, 46580, 50998, 51466, 49749)

feat(#21648 )Add kubectl set env command.

**What this PR does / why we need it**:
#21648
Moved from OpenShift to Kubenetes.
@kargakis @smarterclayton 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51377, 46580, 50998, 51466, 49749)

Implement IPVS-based in-cluster service load balancing

**What this PR does / why we need it**:

Implement IPVS-based in-cluster service load balancing. It can provide some performance enhancement and some other benefits to kube-proxy while comparing iptables and userspace mode. Besides, it also support more sophisticated load balancing algorithms than iptables (least conns, weighted, hash and so on).

**Which issue this PR fixes**

#17470 #44063

**Special notes for your reviewer**:


* Since the PR is a bit large, I splitted it and move the commits related to ipvs util pkg to PR #48994. Hopefully can make it easier to review.

@thockin @quinton-hoole @kevin-wangzefeng @deepak-vij @haibinxie @dhilipkumars @fisherxu 

**Release note**:

```release-note
Implement IPVS-based in-cluster service load balancing
```

Automatic merge from submit-queue

Implement stop function in streaming server.

Implement streaming server stop, so that we could properly stop streaming server.

We need this to properly stop cri-containerd.

Automatic merge from submit-queue (batch tested with PRs 49961, 50005, 50738, 51045, 49927)

adding validations on kubelet starting configurations

**What this PR does / why we need it**:
I found some validations of kubelet starting options were missing when I was creating a custom cluster from scratch. The kubelet does not check invalid configurations on `--cadvisor-port`, `--event-burst`, `--image-gc-high-threshold`, etc. I have added some validations in kubelet like validations in `cmd/kube-apiserver/app/options/validation.go`.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Adds additional validation for kubelet in `pkg/kubelet/apis/kubeletconfig/validation`.
```

Automatic merge from submit-queue (batch tested with PRs 49961, 50005, 50738, 51045, 49927)

Move rotating kubelet client certificate to beta.

```release-note
Release the kubelet client certificate rotation as beta.
```

Automatic merge from submit-queue (batch tested with PRs 49961, 50005, 50738, 51045, 49927)

controllers: simplify deepcopy calls

Automatic merge from submit-queue (batch tested with PRs 49961, 50005, 50738, 51045, 49927)

Add cluster e2es to verify scheduler local storage support

Add cluster e2es to verify scheduler local storage support and remove some unused private functions

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:  
part of #50818

**Release note**:
```release-note
Add cluster e2es to verify scheduler local ephemeral storage support
```

/assign @jingxu97 
/cc @ddysher

Automatic merge from submit-queue (batch tested with PRs 49961, 50005, 50738, 51045, 49927)

Add --append-hash flag to kubectl create configmap/secret

**What this PR does / why we need it**:
Specifying this new flag will automatically hash the configmap/secret
contents with sha256 and append the first 40 hex-encoded bits of the
hash to the name of the configmap/secret. This is especially useful for
workflows that generate configmaps/secrets from files (e.g.
--from-file).

See this Google doc for more background:
https://docs.google.com/document/d/1x1fJ3pGRx20ujR-Y89HUAw8glUL8-ygaztLkkmQeCdU/edit

**Release note**:
```release-note
Adds --append-hash flag to kubectl create configmap/secret, which will append a short hash of the configmap/secret contents to the name during creation.
```

Signed-off-by: sakeven <jc5930@sina.cn>

Conflicts:
	pkg/util/ipvs/ipvs_unsupported.go

Automatic merge from submit-queue

apiextensions: validation for customresources

- [x] Add types for validation of CustomResources
- [x] Fix conversion-gen: #49747
- [x] Fix defaulter-gen: kubernetes/gengo#61
- [x] Convert to OpenAPI types
- [x] Validate CR using go-openapi
- [x] Validate CRD Schema
- [x] Add integration tests
- [x] Fix round trip tests: #51204 
- [x] Add custom fuzzer functions
- [x] Add custom conversion functions
- [x] Fix data race while updating CRD: #50098 
- [x] Add feature gate for CustomResourceValidation
- [x] Fix protobuf generation

Proposal: https://github.com/kubernetes/community/pull/708
Additional discussion: https://github.com/kubernetes/kubernetes/issues/49879, https://github.com/kubernetes/kubernetes/pull/50625

**Release note**:

```release-note
Add validation for CustomResources via JSON Schema.
```

/cc @sttts @deads2k

Correct default cluster-ip-range subnet

Automatic merge from submit-queue

Add Google cloud KMS service for envelope encryption transformer

This adds the required pieces which will allow addition of KMS based encryption providers (envelope transformer).

For now, we will be implementing it using Google Cloud KMS, but the code should make it easy to add support for any other such provider which can expose Decrypt and Encrypt calls.

Writing tests for Google Cloud KMS Service may cause a significant overhead to the testing framework. It has been tested locally and on GKE though.

Upcoming after this PR:
* Complete implementation of the envelope transformer, which uses LRU cache to maintain decrypted DEKs in memory.
* Track key version to assist in data re-encryption after a KEK rotation.

Development branch containing the changes described above: https://github.com/sakshamsharma/kubernetes/pull/4

Envelope transformer used by this PR was merged in #49350 

Concerns #48522 

Planned configuration:
```
kind: EncryptionConfig
apiVersion: v1
resources:
  - resources:
    - secrets
    providers:
    - kms:
        cachesize: 100
        configfile: gcp-cloudkms.conf
        name: gcp-cloudkms
    - identity: {}
```

gcp-cloudkms.conf:
```
[GoogleCloudKMS]
    kms-location: global
    kms-keyring: google-container-engine
    kms-cryptokey: example-key
```