addressed review comments

Addressed review comment for pv_reclaimpolicy.go to verify content of the volume

addressed 2nd round of review comments

addressed 3rd round of review comments from jeffvance

Automatic merge from submit-queue

dnsprovider: Add upsert

Although Google Cloud DNS requires strict add & remove calls, most
dnsproviders actually support upsert, and an add & remove is much more
expensive (primarily because of the need to fetch the pre-image).

Add support for 'upsert' operations, which don't require the pre-image,
and simply overwrite the existing record.  This is much cheaper on
Amazon Route53, for example.

```release-note
NONE
```

Automatic merge from submit-queue

Adding approvers for componentconfig

Automatic merge from submit-queue (batch tested with PRs 41023, 41031, 40947)

apiserver command line options lead to config

Logically command line options lead to config, not the other way around.  We're clean enough now we can actually do the inversion.

WIP because I have some test cycles to fix, but this is all the meat.

@kubernetes/sig-api-machinery-misc

Automatic merge from submit-queue (batch tested with PRs 41023, 41031, 40947)

scrub aggregator names to eliminate discovery

Cleanup old uses of `discovery`.  Also removes the legacy functionality.

@kubernetes/sig-api-machinery-misc @sttts

Automatic merge from submit-queue (batch tested with PRs 41023, 41031, 40947)

move admission read logic to apiserver

Promised followup to https://github.com/kubernetes/kubernetes/pull/40943

@sttts @kubernetes/sig-api-machinery-misc

Automatic merge from submit-queue (batch tested with PRs 40980, 40985)

added short names for resources which are exposed during discovery

**What this PR does / why we need it**:
The changes add short names for resources. The short names will be delivered to kubectl during discovery.

Automatic merge from submit-queue (batch tested with PRs 40980, 40985)

Updated NodeRef to clientv1.ObjectReference.

fixes #40979

Automatic merge from submit-queue (batch tested with PRs 40382, 41060)

Fix incorrect watch cache sizes

Fix #41013

Automatic merge from submit-queue (batch tested with PRs 40382, 41060)

Make kube-dns mount optional configmap

Switches add-on templates to use an optional mounted configmap for dns

Uses options added in https://github.com/kubernetes/dns/pull/39

Blocks https://github.com/kubernetes/kubernetes/pull/38816

Automatic merge from submit-queue

add basic auth option to apiserver in local cluster

Add this can fix #40192 @liggitt

Automatic merge from submit-queue (batch tested with PRs 40971, 41027, 40709, 40903, 39369)

Validate unique  against HostPort/Protocol/HostIP

**What this PR does / why we need it**:
We can bind to specific IPs however validation will fail for different HostIP:HostPort combination. This is a small fix to check combination of HostPort/Protocol/HostIP rather than just HostPort/Protocol.

Sample configuration
...
"ports": [
              {
                "protocol": "TCP",
                "containerPort": 53,
                "hostPort": 55,
                "hostIP": "127.0.0.1",
                "name": "dns-local-tcp"
              },
              {
                "protocol": "TCP",
                "containerPort": 53,
                "hostPort": 55,
                "hostIP": "127.0.0.2",
                "name": "dns-local-tcp2"
              }
]

Before:
* spec.template.spec.containers[1].ports[2].hostPort: Duplicate value: "55/TCP"
* spec.template.spec.containers[1].ports[3].hostPort: Duplicate value: "55/TCP"

After applying the patch:
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:55            0.0.0.0:*               LISTEN      3644/docker-proxy
tcp        0      0 127.0.0.2:55            0.0.0.0:*               LISTEN      3629/docker-proxy

Thanks
Ashley

**Release note**:

```release-note
```

Automatic merge from submit-queue (batch tested with PRs 40971, 41027, 40709, 40903, 39369)

Set docker opt separator correctly for SELinux options

This is based on @pmorie's commit from #40179

Automatic merge from submit-queue (batch tested with PRs 40971, 41027, 40709, 40903, 39369)

Promote SubjectAccessReview to v1

We have multiple features that depend on this API:

SubjectAccessReview
- [webhook authorization](https://kubernetes.io/docs/admin/authorization/#webhook-mode)
- [kubelet delegated authorization](https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authorization)
- add-on API server delegated authorization

The API has been in use since 1.3 in beta status (v1beta1) with negligible changes:
- Added a status field for reporting errors evaluating access
- A typo was discovered in the SubjectAccessReviewSpec Groups field name

This PR promotes the existing v1beta1 API to v1, with the only change being the typo fix to the groups field. (fixes https://github.com/kubernetes/kubernetes/issues/32709)

Because the API does not persist data (it is a query/response-style API), there are no data migration concerns.

This positions us to promote the features that depend on this API to stable in 1.7

cc @kubernetes/sig-auth-api-reviews @kubernetes/sig-auth-misc

```release-note
The authorization.k8s.io API group was promoted to v1
```

Automatic merge from submit-queue (batch tested with PRs 40971, 41027, 40709, 40903, 39369)

Bump GCI to gci-beta-56-9000-80-0

cc/ @Random-Liu @adityakali 

Changelogs since gci-dev-56-8977-0-0 (currently used in Kubernetes):
 - "net.ipv4.conf.eth0.forwarding" and "net.ipv4.ip_forward" may get reset to 0
 - Track CVE-2016-9962 in Docker in GCI
 - Linux kernel CVE-2016-7097
 - Linux kernel CVE-2015-8964
 - Linux kernel CVE-2016-6828
 - Linux kernel CVE-2016-7917
 - Linux kernel CVE-2016-7042
 - Linux kernel CVE-2016-9793
 - Linux kernel CVE-2016-7039 and CVE-2016-8666
 - Linux kernel CVE-2016-8655
 - Toolbox: allow docker image to be loaded from local tarball
 - Update compute-image-package in GCI 
 - Change the product name on /etc/os-release (to COS)
 - Remove 'dogfood' from HWID_OVERRIDE in /etc/lsb-release
 - Include Google NVME extensions to optimize LocalSSD performance.
 - /proc/<pid>/io missing on GCI (enables process stats accounting)
 - Enable BLK_DEV_THROTTLING

cc/ @roberthbailey @fabioy for GKE cluster update

Automatic merge from submit-queue (batch tested with PRs 40971, 41027, 40709, 40903, 39369)

test: bump deployment condition timeout

@fejta @spxtr ptal

Fixes https://github.com/kubernetes/kubernetes/issues/39785

Automatic merge from submit-queue

federation: Refactoring namespaced resources deletion code from kube ns controller and sharing it with fed ns controller

Ref https://github.com/kubernetes/kubernetes/issues/33612

Refactoring code in kube namespace controller to delete all resources in a namespace when the namespace is deleted. Refactored this code into a separate NamespacedResourcesDeleter class and calling it from federation namespace controller.
This is required for enabling cascading deletion of namespaced resources in federation apiserver.
Before this PR, we were directly deleting the namespaced resources and assuming that they go away immediately. With cascading deletion, we will have to wait for the corresponding controllers to first delete the resources from underlying clusters and then delete the resource from federation control plane. NamespacedResourcesDeleter has this waiting logic.

cc @kubernetes/sig-federation-misc @caesarxuchao @derekwaynecarr @mwielgus

Automatic merge from submit-queue (batch tested with PRs 40385, 40786, 40999, 41026, 40996)

optimize duplicate openstack serverList judgement

if len(serverList) > 1, we will return err in pager.EachPage() function,so here we do not need to judge again

Automatic merge from submit-queue (batch tested with PRs 40385, 40786, 40999, 41026, 40996)

kubeadm: change os.Remove to os.RemoveAll

**What this PR does / why we need it**: This would not correctly clean out the tmp dir, since os.Remove doesn't recursively remove dirs, which could exist in the tmp dir.

Unit tests are a WIP from #34136

**Special notes for your reviewer**: /cc @luxas @pires 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 40385, 40786, 40999, 41026, 40996)

Fixed a tiny bug on using RoleBindingGenerator

Fixed a typo bug while using RoleBindingGenerator, this
bug causes error when binding role to service accounts
through "kubectl create rolebinding" command.

Automatic merge from submit-queue (batch tested with PRs 40385, 40786, 40999, 41026, 40996)

Refactor federated services tests a bit to move a test that requires no cluster creation to a separate block.

Follow up to PR #40769.

cc @kubernetes/sig-federation-pr-reviews

Automatic merge from submit-queue

Replace hand-written informers with generated ones

Replace existing uses of hand-written informers with generated ones.
Follow-up commits will switch the use of one-off informers to shared
informers.

This is a precursor to #40097. That PR will switch one-off informers to shared informers for the majority of the code base (but not quite all of it...).

NOTE: this does create a second set of shared informers in the kube-controller-manager. This will be resolved back down to a single factory once #40097 is reviewed and merged.

There are a couple of places where I expanded the # of caches we wait for in the calls to `WaitForCacheSync` - please pay attention to those. I also added in a commented-out wait in the attach/detach controller. If @kubernetes/sig-storage-pr-reviews is ok with enabling the waiting, I'll do it (I'll just need to tweak an integration test slightly).

@deads2k @sttts @smarterclayton @liggitt @soltysh @timothysc @lavalamp @wojtek-t @gmarek @sjenning @derekwaynecarr @kubernetes/sig-scalability-pr-reviews

Signed-off-by: Vishnu Kannan <vishnuk@google.com>

Automatic merge from submit-queue

Make client-admin.key of local-up-cluster.sh readable by kubectl

Follow-up of https://github.com/kubernetes/kubernetes/pull/40922

Automatic merge from submit-queue

local-up-cluster: fix instructions for set-credentials

After launching the services, local-up-cluster.sh tells the
user how to configure kubectl to access it. The instructions
for 'set-credentials' enable plain password auth, but the
services are configured to mandate client certificate auth.
As a result it is not possible to access the cluster with
the instructions printed.

The use of client certs by default was added in

  commit a1b17db4
  Author: Dr. Stefan Schimanski <sttts@redhat.com>
  Date:   Sat Nov 12 23:09:04 2016 +0100

    Configure client certs in local-cluster-up.sh

and the instructions were correctly updated to refer to
client certificates.

The changed instructions were (mistakenly) reverted though
when the following commit was merged:

  commit 72e0e91b
  Author: xilabao <chenr.fnst@cn.fujitsu.com>
  Date:   Fri Dec 2 11:04:25 2016 +0800

    change prompt for enabling RBAC on local-up-cluster

Fixes: #40192
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

Automatic merge from submit-queue

add deads2k to registry package owners

I established the package layout and wrote a lot of the non-boilerplate code in this package.

Use specific v1beta1 Authorization client

Add client expansions

Automatic merge from submit-queue (batch tested with PRs 40930, 40951)

Fix CRI port forwarding

Websocket support was introduced #33684, which broke the CRI
implementation. This change fixes it.

Automatic merge from submit-queue (batch tested with PRs 40930, 40951)

update negotiation to reflect current kubectl state

Very few things actually require negotiation, but the client-cache attempts it all the time.  If you've explicitly requested one, you still fail.  If you haven't requested one and the server doesn't have one, you still get the client behavior.  After this, if you haven't requested one and the client and server don't have one, you simply get an empty you can interpret how you choose.

@lavalamp without this, you're unable to use `kubectl` against arbitrary servers.