Brief changelog compared to gci-dev-54-8743-3-0:
- Fixed performance regression in veth device driver
- Docker and related binaries are statically linked
- Fixed the issue of systemd being oom-killable
- Updated built-in kubelet version to 1.3.7
- add ethtool and ebtables binaries expected by kubelet

Fixes #32596

Automatic merge from submit-queue

To improve error messages, validate the existence of a namespace.

Fixes #15542

@deads2k 
@kubernetes/kubectl

Automatic merge from submit-queue

Fixed #32366: wrong master pd name during kube-down.

Automatic merge from submit-queue

Make it possible to run local kubelet independently of cluster

Makes it possible to start a cluster and kubelet independently (was necessary when debugging issues related to restarting kubelet for existing node).

Automatic merge from submit-queue

plugin/pkg: add ericchiang to owners for OpenID Connect plugins

On the CoreOS side I'm taking over these components.

@erictune has suggested `pkg/registry/{cluster}role{binding}s/OWNERS` as well but I'd feel more comfortable as a reviewer for those specific parts of RBAC for a couple more cycles since @liggitt and @deads2k have had way more experience in the registry code.

Beyond that the only existing OWNERS files for auth are `pkg/auth/OWNERS` and `plugin/pkg/auth/OWNERS` both of which include @liggitt and @erictune. There's also nothing in the `plugin/pkg/client` path. I'm a little unclear on the implications for future PRs that are assigned to me (e.g. webhook or RBAC reviews).

cc @kubernetes/sig-auth

Automatic merge from submit-queue

Fix clientcmd for a non-host cluster client running in a pod. 

This is based on @errordeveloper's PR #32438. It fixes a case where default config is invalid and original config, i.e. `mergedConfig` is empty. It also adds a test for the case where default config is invalid and original config is neither invalid nor empty.

cc @errordeveloper @kubernetes/sig-cluster-federation @pwittrock @colhom

Automatic merge from submit-queue

Docker digest validation is too strict

Docker 1.10 does not guarantee that the pulled digest matches the digest
on disk when dealing with v1 schemas stored in a Docker registry. This
is the case for images like
centos/ruby-23-centos7@sha256:940584acbbfb0347272112d2eb95574625c0c60b4e2fdadb139de5859cf754bf
which as a result of #30366 cannot be pulled by Kube from a Docker 1.10
system.

This partially reverts commit 875fd16e.

Automatic merge from submit-queue

Fix printing container usage in kubectl top

**What this PR does / why we need it**:
Fix a bug in kubectl top, which showed the same value of usage for all containers in a pod.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

Vendor github.com/square/go-jose for kubeadm and kube-discovery

**What this PR does / why we need it**:

This is to be used by `kubeadm` (#31221) and @dgoodwin's `kube-discovery` (PR pending).

***[xref kubernetes/features#11]***

***[cc @kubernetes/sig-cluster-lifecycle]***

**Special notes for your reviewer**:

This is first time I've used `godep`, so please verify if all is quite right about the diff. I'm not 100% sure if there should be secondary dependencies or not.

```release-note
NONE
```

Docker 1.10 does not guarantee that the pulled digest matches the digest
on disk when dealing with v1 schemas stored in a Docker registry. This
is the case for images like
centos/ruby-23-centos7@sha256:940584acbbfb0347272112d2eb95574625c0c60b4e2fdadb139de5859cf754bf
which as a result of #30366 cannot be pulled by Kube from a Docker 1.10
system.

Instead, use RepoDigests field as the primary match, validating the
digest, and then fall back to ID (also validating the match). Adds more
restrictive matching.

Automatic merge from submit-queue

Update Google Cloud API client import paths

This is to be used by kubeadm (#31221) and kube-discovery.
It adds dummy code to make verification scripts pass.

[xref kubernetes/features#11]

Automatic merge from submit-queue

Make networking tests work reasonably fast in large clusters

@bprashanth - FYI

Automatic merge from submit-queue

Create a flag for route reconciliation and deprecate unused node-sync-…

cc @pwittrock to decide if it can go in 1.4. It's a zero risk cleanup, that will reduce confusion about cluster configuration.

Automatic merge from submit-queue

Allow to use GetSigner with vagrant provider

In order to run tests that require ssh access to a node on vagrant
we need to provide path to private ssh key.

Now it will be possible to do using VAGRANT_SSH_KEY environment variable

Automatic merge from submit-queue

Ignore staging folder in update gofmt

small bugfix in hack/update-gofmt.sh

Automatic merge from submit-queue

add break may be better in the loop

Automatic merge from submit-queue

kubectl: run validation for 'top pod'

@mksalawa @kubernetes/kubectl

Fixed #32366: wrong master pd name during kube-down.

Automatic merge from submit-queue

Recombine the condition for the "shouldScale" function

The PR recombine the condition for the "shouldScale" function, abstract the common condition(hpa.Status.LastScaleTime == nil).

Automatic merge from submit-queue

etcd: data rollback tool of v3 -> v2

ref: https://github.com/kubernetes/features/issues/44
ref #20504

What?
This provides a rollback tool for some users to rollback etcd data from v3 to v2.

Automatic merge from submit-queue

Get image and machine info from apiserver in node e2e test

This PR changes node e2e test to get image and machine information from API server instead of pass them from Jenkins test framework. The original format to pass image and machine info is naming the test node as "machine-image-uuid", which is hard to parse because "-" occurs a lot in both machine and image names.

Now we add two labels "image" and "machine" into performance data. The machine type has the format "cpu:1core,memory:3.6GB".

This PR is based on #32250.

Automatic merge from submit-queue

Improving StopContainer failed log level

Using at least Warning level will be more property

Automatic merge from submit-queue

Bumped Heapster to v1.2.0

```release-note
Bumped Heapster to v1.2.0.
More details about the release https://github.com/kubernetes/heapster/releases/tag/v1.2.0
```

Version `v1.2.0` is a stable release of the previous release candidate `v1.2.0-beta.3`. The only difference is bumped Kubernetes deps to the lastest stable release `v1.4.0-beta.3` https://github.com/kubernetes/heapster/pull/1290.

It's low risk change. It may impact HPA and Monitoring e2e tests.

Automatic merge from submit-queue

Move nginx ingress e2e to slow

Normal GCE L7 e2e takes ~15m and runs in a feature private suite. This e2e ensure that the api isn't broken, by creating an nginx controller. I plan to write a really slimmed down version for presubmit, but I need to shave off a minute to get it below 5m. 

Fixes https://github.com/kubernetes/kubernetes/issues/23416

Automatic merge from submit-queue

kubectl version -c has been deprecated, use --client instead

```
Flag shorthand -c has been deprecated, please use --client instead.
```

Automatic merge from submit-queue

Add test for --quiet flag for kubectl run

This adds a test for the changes introduced in #30247 and #28801.

Ref #28695

Automatic merge from submit-queue

Migrate a bunch of priority functions to map-reduce framework

Ref #24246

Automatic merge from submit-queue

Only skip petset test if resource is missing

**What this PR does / why we need it**:
Unblock testing petset on other providers.

cc @pwittrock. Would like to cherrypick onto 1.4 but this is test code only, so it can wait til after release cut.

Automatic merge from submit-queue

add local subject access review API

Adds a local subject access review endpoint to allow a project-admin (someone with full rights within a namespace) the power to inspect whether a person can perform an action in his namespace.  This is a separate resource be factoring like this ensures that it is impossible for him to look outside his namespace and makes it possible to create authorization rules that can restrict this power to a project-admin in his own namespace.  Other factorings require introspection of objects.

@kubernetes/sig-auth

Automatic merge from submit-queue

make --runtime-config=api/all=true|false work

`Passing --runtime-config=api/all=true|false to apiserver will enable/disable all registered api groups`

Previously, only api/all=false was recognized, and it only disabled groups with resources.

Automatic merge from submit-queue

Skip kubectl tests (create quota and exit code) on not supported versions

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**: Fixing broken kubernetes-e2e-gke-1.4-1.3-kubectl-skew tests. Because we're running 1.4 kubectl tests against 1.3 kubectl, some kubectl tests need to be skipped on older kubectl versions. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**: @pwittrock 

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
NONE
```

Bump version of golang.org/x/oauth2
Vendor google.golang.org/cloud/
Vendor google.golang.org/api/
Vendor cloud.google.com/go/compute/
Replace google.golang.org/cloud with cloud.google.com/go/

Fixes #30069

Automatic merge from submit-queue

Update cAdvisor Godeps with new google cloud import path

For https://github.com/kubernetes/kubernetes/issues/30069