Automatic merge from submit-queue

automation.md: fix typos

Automatic merge from submit-queue

allow restricting subresource access

Looks like subresource resolution got lost in the port.  Adding it back in as `"resource/subresource"`.  That allows easy expression of rules and we can later allow something like `"*/subresource"` to handle cases like the hpa controller.

@kubernetes/sig-auth 

Revert "Add density (batch pods creation latency and resource) and resource performance tests to `test-e2e-node'"

Revert "Add density (batch pods creation latency and resource) and resource performance tests to `test-e2e-node'"

Automatic merge from submit-queue

E2E & Node E2E: Improve node e2e test framework

This is first part of https://github.com/kubernetes/kubernetes/pull/29494.
I split #29494 into several PRs to help review. 

For https://github.com/kubernetes/kubernetes/issues/29081.

This PR changes TestContainerOutput to use the framework pod client:** so that all test using `TestContainerOutput` could be shared automatically. For example: https://github.com/kubernetes/kubernetes/blob/master/test/e2e/configmap.go#L198

@vishh @timstclair 
/cc @kubernetes/sig-node 

Automatic merge from submit-queue

Add density (batch pods creation latency and resource) and resource performance tests to `test-e2e-node'

This PR contains two new tests (migrate from e2e test):
1. Density test: verify startup latency and resource usage when create a batch of pod with throughput control. Throughput control is done by sleep for an interval between firing concurrently create pod operations. 
It tests both batch creation and sequential (back-to-back) creation and report the throughputs. 

2. Verify resource usage of steady state kubelet.

The test creates a new resource controller for `test-node-e2e' (resource_controller.go) which monitors resource through a standalone Cadvisor pod (port 8090) with 1s housekeeping interval.

Automatic merge from submit-queue

kubectl: notfound errors should not error out

Fixes the flake in https://github.com/kubernetes/kubernetes/issues/28378#issuecomment-234677846

@pwittrock ptal

Automatic merge from submit-queue

Change the owner of JSON NodeAffinity test

Make @kevin-wangzefeng an owner of SchedulerPredicates JSON NodeAffinity test.

cc @fejta 

Automatic merge from submit-queue

Refactoring runner resource container linedelimiter to it's own pkg

Continuing my work ref #15634

Anyone is ok to review this fix.

Automatic merge from submit-queue

Stabilize volume unit tests by waiting for exact state

Wait for specific final state instead of waiting for specific number of
operations in controller unit tests. The tests are more readable and will survive
random goroutine ordering (PV and PVC controller have both their own
goroutine).

@kubernetes/sig-storage 

Automatic merge from submit-queue

Increase test timeouts for creating LB in large clusters

Ref #29189

Automatic merge from submit-queue

Update the AppArmor design proposal

3 modifications to the original AppArmor design proposal:

1. Remove the pod-level AppArmor profile specification, since it was unnecessary complexity. I think the typical multi-container case is a main app, some side-cars (e.g. log helpers), and maybe some init containers. All of those containers are likely to have very different permissions needs, so I do not see benefit to the pod-level profile. If there is sufficient demand (i.e. user feedback) for this feature we can add it back.
2. Added a proposal for the beta (and GA) API. Beginning the discussion of this API now will smooth the transition from alpha, and guide the implementation of the internal API.
3. [EDIT] The profile deployment pod will poll the source directories for changes. This change is motivated by the fact that DaemonSets must run with RestartAlways.

/cc @bgrant0607 @erictune @pmorie @pweil-

Automatic merge from submit-queue

Delete useless code

The correct code is `cluster, ok := obj.(*v1beta1.Cluster)`, so the above `cluster := obj.(*v1beta1.Cluster)` is useless.

Automatic merge from submit-queue

Kubelet: add gRPC implementation of new runtime interface

Add gRPC implementation of new runtime interface.

CC @yujuhong @Random-Liu  @kubernetes/sig-node 

Automatic merge from submit-queue

Validate list objects when building scheme

The first commit is #29468. This PR is a followup.

Modified the description of **List** in api-convention.md to:
`The name of a list kind must end with "List". Lists have a limited set of common metadata. All lists use the required "items" field to contain the array of objects they return. Any kind that has the "items" field must be a list kind.`

Also added code to enforce the above rules during scheme registration.

@kubernetes/sig-api-machinery @bgrant0607 @erictune @lavalamp @smarterclayton 

Automatic merge from submit-queue

Documented second arg to create-flanneld-opts in cluster/ubuntu/util.sh

This is a bug fix, no release note needed.

Fixes #29546

Automatic merge from submit-queue

add err return

Since err can be returned by previous code,  add err return.

Automatic merge from submit-queue

Allow Secret & ConfigMap keys to contain caps, dots, and underscores

[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()

Re: #23722

This makes loosens the regex used in in Secrets and ConfigMap,
in order to make environment variable style keys valid

Automatic merge from submit-queue

Give away my e2e tests.

Automatic merge from submit-queue

Fix bad Godeps.

These changes make the updated verify-godeps.sh in #29920 pass.

Fixes #29402.

Automatic merge from submit-queue

dockershim: Implement PodSandboxMethods

Only the last three commits are new. 

Automatic merge from submit-queue

Fix the allow-all example NetworkPolicy

[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()

This is a bug fix, no release note required.

Fixes #28795

Automatic merge from submit-queue

Clone kubernetes/release into something other than /release due to conflict with /release.

It looks like $WORKSPACE is the root of the kubernetes clone.  I think ideally we'd move that down a level and allow subdirectories of different repos.  I think this may become the norm as we split things up further as well.  What do you think and how should we proceed here?  @ixdy @spxtr 

Automatic merge from submit-queue

GKE test-build-release: Actually do the build.

Multiple devs (myself included!) have experienced frustration with the fact that if `KUBERNETES_PROVIDER=gke` then `hack/e2e.go --build` doesn't actually do a build.

Are we actually relying on this behavior anywhere?

Automatic merge from submit-queue

allow watching old resources with kubectl

Right now, one can not watch a resource with kubectl whose resourceVersion is outside the etcd watch window.  Specifying resourceVersion=0 returns the current object, then watches from the current index.

This PR changes the logic to use resourceVersion=0, which will work regardless of the resourceVersion of the object, and discard the first event if --watch-only is specified.

@ncdc @aveshagarwal 

Revert "Modified influxdb petset to provision persistent  volume."

Fixes #29546

Automatic merge from submit-queue

[Garbage Collector] add e2e tests again

#27151 is reverted because gke didn't start correctly after it's merged (https://github.com/kubernetes/kubernetes/pull/27151#issuecomment-233030686).

The possible problem is the `unbound variable`, which is fixed in the second commit of this PR. However, I cannot verify if the PR will fail the gke suite since I don't have the environment to run that suite.

@wojtek-t @lavalamp