* Expected value comes before actual value in assert.Equal()
* Use assert.Equal() instead of assert.True() when possible
* Add a unit test that verifies no-op pod updates to the
  secret_manager and the configmap_manager
* Add a clarifying comment about why it's good to seemingly
  delete a secret on updates.
* Fix (for now, non-buggy) variable shadowing issue

Automatic merge from submit-queue (batch tested with PRs 51839, 51987)

GCE: Fall back to network if subnet is unknown

Fixes #51981 

/assign @bowei 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51839, 51987)

Disable rbac/v1alpha1, settings/v1alpha1, and scheduling/v1alpha1 by default

**What this PR does / why we need it**: Disables alpha features which were previously enabled by default. Also changes tests which relied on these alpha features being enabled by default.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47691

**Special notes for your reviewer**:

**Release note**:

```release-note
Fixed a bug where some alpha features were enabled by default.

Automatic merge from submit-queue (batch tested with PRs 49133, 51557, 51749, 50842, 52018)

Fix panic in expand controller when checking PVs

Unbound PVs have their Spec.ClaimRef = nil, so we should not dereference it blindly.

In addition, increase AddPVCUpdate test coverage to 100%

fixes #52012 #51995

**Release note**:
```release-note
NONE
```

@kubernetes/sig-storage-pr-reviews 
/assign @gnufied

Automatic merge from submit-queue (batch tested with PRs 49133, 51557, 51749, 50842, 52018)

enhance unit tests of advance audit feature

This change addresses comments from @crassirostris 
https://github.com/kubernetes/kubernetes/pull/49115#discussion_r133416080

It does three things:
1. use auditinternal for unit test in filter stage
2. add a seperate unit test for Audit-ID http header
3. add unit test for audit log backend


**Release note**:
```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49133, 51557, 51749, 50842, 52018)

Charges quota only for initialized objects

Partially fix https://github.com/kubernetes/kubernetes/issues/51842.

Based on https://github.com/kubernetes/kubernetes/pull/51733/files. Only the commit "Don't charge quota when creating/updating an uninitialized object" is new.

The old plan was to charge quota for each update of uninitialized object. This PR makes the quota admission only charges the update that removes the last pending initializer. Because
* https://github.com/kubernetes/kubernetes/pull/51247, which lets sharedInformer see uninitialized objects, is not making the code freeze deadline. Hence, the quota replenishing controller won't capture deletion of uninitialized objects. We will leak quota if we charge quota for uninitialized objects.
* @lavalamp @erictune pointed out calculating/reserving quota is expensive, we should avoid doing it for every initializer update.
* My original argument was that quota admission should fail early so that user can easily figure out which initializer causes the quota outage. @lavalamp @erictune convinced me that user could easily figure the culprit if they watch the initialization process.

Automatic merge from submit-queue (batch tested with PRs 49133, 51557, 51749, 50842, 52018)

Implement StatsProvider interface using CRI stats

Ref: https://github.com/kubernetes/kubernetes/issues/46984

This is the follow up of https://github.com/kubernetes/kubernetes/pull/50932

- I include the cadvisor dependency changes in this PR for now to make it build. @dashpole will update the cadvisor dependency very soon, and I will remove the change once it's updated.
- Please take a closer look at the implementation in `cri_stats_provider.go` since we currently don't have any runtime implementing the CRI stats interface and the changes here cannot be enabled in e2e tests.
- Pod level network stats and container level logs stats are not provided.
- In `cadvisor_stats_provider.go`, we are able to remove the call to `getCgroupStats` in `ImageFsStats` for getting the timestamp of the stats, given that we've changed cadvisor to include the timestamp in `FsInfo`.
- Fixed the usage of `assert.Equal` in unit tests.

**Release note**:
```
Support getting container stats from CRI.
```

/assign @yujuhong 
/assign @Random-Liu

Automatic merge from submit-queue (batch tested with PRs 49133, 51557, 51749, 50842, 52018)

add controller permissions to set blockOwnerDeletion

fixes https://github.com/kubernetes/kubernetes/issues/51970

`blockOwnerDeletion` requires delete permissions on the owner object.  This adds that permission for our controllers.

@kubernetes/sig-auth-misc 

```release-note
The OwnerReferencesPermissionEnforcement admission plugin now requires `update` permission on the `finalizers` subresource of the referenced owner in order to set `blockOwnerDeletion` on an owner reference.
```

Charge object count when object is created, no matter if the object is
initialized or not.
Charge the remaining quota when the object is initialized.

Also, checking initializer.Pending and initializer.Result when
determining if an object is initialized. We didn't need to check them
because before 51082, having 0 pending initializer and nil
initializers.Result is invalid.

Automatic merge from submit-queue

set AdvancedAuditing feature gate to true by default

All feature commits are merged. The types are updated already to beta. This only enable the feature gate by default.

**Release note**:
```
Promote the AdvancedAuditing feature to beta and enable the feature gate by default.
```

This change does three things:
    1. use auditinternal for unit test in filter stage
    2. add a seperate unit test for Audit-ID http header
    3. add unit test for audit log backend

Automatic merge from submit-queue

Bump Cluster Autoscaler to 0.7.0-alpha2

This is a part of Cluster Autoscaler release process for 1.8.

Unbound PVs have their Spec.ClaimRef = nil, so we should not dereference it blindly.

In addition, increase AddPVCUpdate test coverage to 100%

Automatic merge from submit-queue (batch tested with PRs 51603, 51653)

Graduate metrics/v1alpha1 to v1beta1

This introduces v1beta1 of the resource metrics API, previously in alpha.
The v1alpha1 version remains for compatibility with the Heapster legacy version
of the resource metrics API, which is compatible with the v1alpha1 version.  It also
renames the v1beta1 version to `resource-metrics.metrics.k8s.io`.

The HPA controller's REST clients (but not the legacy client) have been migrated as well.

Part of kubernetes/features#118.

```release-note
Migrate the metrics/v1alpha1 API to metrics/v1beta1.  The HorizontalPodAutoscaler
controller REST client now uses that version.  For v1beta1, the API is now known as
resource-metrics.metrics.k8s.io.
```

Automatic merge from submit-queue (batch tested with PRs 51603, 51653)

fix taint controller panic

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #51586 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51733, 51838)

Decouple kube-proxy upgrade/downgrade tests from upgradeTests

**What this PR does / why we need it**:

Fixes the failing kube-proxy migration CI jobs:
- https://k8s-testgrid.appspot.com/sig-network#gci-gce-latest-upgrade-kube-proxy-ds
- https://k8s-testgrid.appspot.com/sig-network#gci-gce-latest-downgrade-kube-proxy-ds

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #51729

**Special notes for your reviewer**:

/assign @krousey @nicksardo 
Could you please take a look post code-freeze (I believe it is fixing things)? Thanks!

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51733, 51838)

Relax update validation of uninitialized pod

Split from https://github.com/kubernetes/kubernetes/pull/50344

Fix https://github.com/kubernetes/kubernetes/issues/47837

* Let the podStrategy to only call `validation.ValidatePod()` if the old pod is not initialized, so fields are mutable.
* Let the podStatusStrategy refuse updates if the old pod is not initialized.

cc @smarterclayton 

```release-note
Pod spec is mutable when the pod is uninitialized. The apiserver requires the pod spec to be valid even if it's uninitialized. Updating the status field of uninitialized pods is invalid.
```

Automatic merge from submit-queue

Fix dynamic discovery error in e2e

Actually fixes #51910 (I blame the reviewer of #51915, definitely not the author)
The helper function never identified dynamic discovery errors

Automatic merge from submit-queue (batch tested with PRs 51921, 51829, 51968, 51988, 51986)

COS/GCE: bump the max pids for the docker service

**What this PR does / why we need it**:
TasksMax limits how many threads/processes docker can create. Insufficient limit affects container starts.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:
fixes #51977

**Special notes for your reviewer**:

**Release note**:
```release-note
Ensure TasksMax is sufficient for docker
```

Automatic merge from submit-queue (batch tested with PRs 51921, 51829, 51968, 51988, 51986)

Fix unbound variable in configure-helper.sh

This isn't plumbed yet on GKE, so results in an unbound variable.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51921, 51829, 51968, 51988, 51986)

GCE: pass GCE_ALPHA_FEATURES environment variable

This fixes #51976

This PR fixes the tests in https://k8s-testgrid.appspot.com/sig-network#gce-alpha-api

Automatic merge from submit-queue (batch tested with PRs 51921, 51829, 51968, 51988, 51986)

Category expansion fully based on discovery

**What this PR does / why we need it**: Makes the expansion of resource names in `kubectl` (e.g. "all" in "kubectl get all") respect the "categories"  field in the API, and fallback to the legacy expander.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/kubernetes/kubernetes/issues/41353

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Improve APIService auto-registration for HA/upgrade scenarios

Fixes #51912

Required for 1.8 due to impact on HA upgrades.

/assign @deads2k

cc @kubernetes/sig-api-machinery-bugs

```release-note
Fixes an issue with APIService auto-registration affecting rolling HA apiserver restarts that add or remove API groups being served.
```

Automatic merge from submit-queue

Make *fakeMountInterface in container_manager_unsupported_test.go implement mount.Interface again.

This was broken in #45724

**Release note**:
```release-note
NONE
```
/sig storage
/sig node

/cc @jsafrane, @vishh

Automatic merge from submit-queue (batch tested with PRs 51984, 51351, 51873, 51795, 51634)

Revert to using isolated PID namespaces in Docker

**What this PR does / why we need it**: Reverts to the previous docker default of using isolated PID namespaces for containers in a pod. There exist container images that expect always to be PID 1 which we want to support unmodified in 1.8.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #48937

**Special notes for your reviewer**:

**Release note**:

```release-note
Sharing a PID namespace between containers in a pod is disabled by default in 1.8. To enable for a node, use the --docker-disable-shared-pid=false kubelet flag. Note that PID namespace sharing requires docker >= 1.13.1.
```

Automatic merge from submit-queue (batch tested with PRs 51984, 51351, 51873, 51795, 51634)

Bug Fix - Adding an allowed address pair wipes port security groups

**What this PR does / why we need it**:

Fix for cloud routes enabled instances will have their security groups
removed when the allowed address pair is added to the instance's port.

Upstream bug report is in:
https://github.com/gophercloud/gophercloud/issues/509

Upstream bug fix is in:
https://github.com/gophercloud/gophercloud/pull/510

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Fixes #51755

**Special notes for your reviewer**:

Just an fix in vendored code. minimal changes needed in OpenStack cloud provider

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51984, 51351, 51873, 51795, 51634)

Build test targets for all server platforms

**What this PR does / why we need it**:

🤦

I really should have checked this before code freeze, but tbh forgot it in the rush. Also I thought this was the case already...
As part of https://github.com/kubernetes/features/issues/288; these binaries should be built for all server platforms indeed.

This is just a straightforward add to that list.
Can we please get this into v1.8?
There is virtually no risk involved here really...

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Build test targets for all server platforms
```
@ixdy @jdumars @mkumatag

Automatic merge from submit-queue (batch tested with PRs 51984, 51351, 51873, 51795, 51634)

Add EgressRule to NetworkPolicy

**What this PR does / why we need it**:
Add EgressRule to NetworkPolicy

**Which issue this PR fixes**: fixes #50453

**Special notes for your reviewer**:
- Please take a look at the comments for the various types. I tried to mimic some of the language used in the Ingress comments, but I may have mangled some sentences.
- Let me know if I should add some test cases for validation. I have 2-3, and did not think it was necessary to replicate each case already covered in ingress.

**Release note**:
```
Add egress policies to NetworkPolicy
```

Automatic merge from submit-queue

Make hugepages comparison work on 32-bit platforms

fixes #51978

Automatic merge from submit-queue (batch tested with PRs 51186, 50350, 51751, 51645, 51837)

Enabling aggregator functionality on kubemark, gce

Enabling full functionality aggregator functionality in kubemark tests.
This includes configuring it to work in gce (we seem to assume gce in our kubemark tests)
It also includes setting up the relevant security and auth config.

**What this PR does / why we need it**: Configure aggregator properly on kubemark tests.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #48428 

**Special notes for your reviewer**:

**Release note**:

```release-note NONE
```

Automatic merge from submit-queue (batch tested with PRs 51186, 50350, 51751, 51645, 51837)

Set up DNS server in containerized mounter path

During NFS/GlusterFS mount, it requires to have DNS server to be able to
resolve service name. This PR gets the DNS server ip from kubelet and
add it to the containerized mounter path. So if containerized mounter is
used, service name could be resolved during mount
**Release note**:

```release-note
Allow DNS resolution of service name for COS using containerized mounter.  It fixed the issue with DNS resolution of NFS and Gluster services.
```

Automatic merge from submit-queue (batch tested with PRs 51186, 50350, 51751, 51645, 51837)

Update Cadvisor Dependency

Fixes: https://github.com/kubernetes/kubernetes/issues/51832
This is the worst dependency update ever... 
The root of the problem is the [name change of Sirupsen -> sirupsen](https://github.com/sirupsen/logrus/issues/570#issuecomment-313933276).  This means that in order to update cadvisor, which venders the lowercase, we need to update all dependencies to use the lower-cased version.  With that being said, this PR updates the following packages:

`github.com/docker/docker`
- `github.com/docker/distribution`
  - `github.com/opencontainers/go-digest`
  - `github.com/opencontainers/image-spec`
  - `github.com/opencontainers/runtime-spec`
  - `github.com/opencontainers/selinux`
  - `github.com/opencontainers/runc`
    - `github.com/mrunalp/fileutils`
  - `golang.org/x/crypto`
    - `golang.org/x/sys`
- `github.com/docker/go-connections`
- `github.com/docker/go-units`
- `github.com/docker/libnetwork`
- `github.com/docker/libtrust`
- `github.com/sirupsen/logrus`
- `github.com/vishvananda/netlink`

`github.com/google/cadvisor`
- `github.com/euank/go-kmsg-parser`

`github.com/json-iterator/go`

Fixed https://github.com/kubernetes/kubernetes/issues/51832

```release-note
Fix journalctl leak on kubelet restart
Fix container memory rss
Add hugepages monitoring support
Fix incorrect CPU usage metrics with 4.7 kernel
Add tmpfs monitoring support
```