Automatic merge from submit-queue

Convert deprecated gcloud --regexp flag into --filter

**What this PR does / why we need it**: #49673 missed a flag in hiding:
```console
WARNING: Flag --regexp is deprecated. Use --filter="name~'REGEXP'" instead.
ERROR: gcloud crashed (TypeError): 'NoneType' object is not iterable

If you would like to report this issue, please run the following command:
  gcloud feedback

To check gcloud for common problems, please run the following command:
  gcloud info --run-diagnostics
```

(Also it's great how gcloud crashes, rather than handling the deprecation gracefully.)

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #49673

**Release note**:

```release-note
NONE
```

cc @pci

Automatic merge from submit-queue (batch tested with PRs 52097, 52054)

Move paused deployment e2e tests to integration

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: xref #52113

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 52097, 52054)

Provide field info in storage configuration

Makes debugging how storage was configured difficult

@kubernetes/sig-api-machinery-bugs

Automatic merge from submit-queue (batch tested with PRs 51239, 51644, 52076)

code-generator/protobuf: cut-off kubernetes specifics

The package list moved to hack/update-generated-protobuf-dockerized.sh.

This make the protobuf generator usable outside of kube.

Automatic merge from submit-queue (batch tested with PRs 51239, 51644, 52076)

do not update init containers status if terminated

fixes #29972 #41580

This fixes an issue where, if a completed init container is removed while the pod or subsequent init containers are still running, the status for that init container will be reset to `Waiting` with `PodInitializing`.  

This can manifest in a number of ways.

If the init container is removed why the main pod containers are running, the status will be reset with no functional problem but the status will be reported incorrectly in `kubectl get pod` for example

If the init container is removed why a subsequent init container is running, the init container will be **re-executed** leading to all manner of badness.

@derekwaynecarr @bparees

Automatic merge from submit-queue (batch tested with PRs 51239, 51644, 52076)

Fix swallowed error in registrytest

**What this PR does / why we need it**: Fixes a swallowed error in the registrytest package.

```release-note NONE
```

Automatic merge from submit-queue

Fix proxied request-uri to be valid HTTP requests

Fixes #52022, introduced in 1.7. Stringifying/re-parsing the URL masked that the path was not constructed with a leading `/` in the first place.

This makes upgrade requests proxied to pods/services via the API server proxy subresources be valid HTTP requests

```release-note
Fixes an issue with upgrade requests made via pod/service/node proxy subresources sending a non-absolute HTTP request-uri to backends
```

Automatic merge from submit-queue

StatefulSet: Deflake e2e RunHostCmd.

The initial retry up to 20s was giving up too soon. I'm seeing this test flake because the Node rebooted and it takes ~2min to recover. Now StatefulSet RunHostCmd calls will use the same 5min timeout as with other Pod state checks.

ref #48031

Automatic merge from submit-queue (batch tested with PRs 52073, 52079)

client-gen: avoid panic for empty groups

Automatic merge from submit-queue

Fix cross-build

**What this PR does / why we need it**:
The cross-build was broken by the following PRs:

https://github.com/kubernetes/kubernetes/pull/51728
https://github.com/kubernetes/kubernetes/pull/51557

This PR fixes the cross-build rather than revert them.

Fixes https://github.com/kubernetes/kubernetes/issues/52074

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

kubeadm: Set the new BT auth group on the init token

**What this PR does / why we need it**:

What I forgot to do in https://github.com/kubernetes/kubernetes/pull/51956 😅 
When we now have the new group, we should also set it on the token, otherwise nodes can't be joined

On the good side, our CI testing broke https://k8s-testgrid.appspot.com/sig-cluster-lifecycle#kubeadm-gce
Great to see that it actually works :)

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews

Automatic merge from submit-queue

kubeadm: add `kubeadm phase addons` command

**What this PR does / why we need it**:
Adds the `addons` phase command to `kubeadm`

fixes: https://github.com/kubernetes/kubeadm/issues/418

/cc @luxas

Automatic merge from submit-queue (batch tested with PRs 51728, 49202)

Fix setNodeAddress when a node IP and a cloud provider are set

**What this PR does / why we need it**:
When a node IP is set and a cloud provider returns the same address with
several types, only the first address was accepted. With the changes made
in PR #45201, the vSphere cloud provider returned the ExternalIP first,
which led to a node without any InternalIP.

The behaviour is modified to return all the address types for the
specified node IP.

**Which issue this PR fixes**: fixes #48760

**Special notes for your reviewer**:
* I'm not a golang expert, is it possible to mock `kubelet.validateNodeIP()` to avoid the need of real host interface addresses in the test ?
* It would be great to have it backported for a next 1.6.8 release.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51728, 49202)

Enable CRI-O stats from cAdvisor

**What this PR does / why we need it**:
cAdvisor may support multiple container runtimes (docker, rkt, cri-o, systemd, etc.)

As long as the kubelet continues to run cAdvisor, runtimes with native cAdvisor support may not want to run multiple monitoring agents to avoid performance regression in production.  Pending kubelet running a more light-weight monitoring solution, this PR allows remote runtimes to have their stats pulled from cAdvisor when cAdvisor is registered stats provider by introspection of the runtime endpoint.

See issue https://github.com/kubernetes/kubernetes/issues/51798

**Special notes for your reviewer**:
cAdvisor will be bumped to pick up https://github.com/google/cadvisor/pull/1741

At that time, CRI-O will support fetching stats from cAdvisor.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

e2e: retry on 404 error for service reachability tests

The initial retry up to 20s was giving up too soon.
I'm seeing this test flake because the Node rebooted and it takes ~2min
to recover.
Now StatefulSet RunHostCmd calls will use the same 5min timeout as with
other Pod state checks.

Automatic merge from submit-queue (batch tested with PRs 51956, 50708)

Move autoscaling/v2 from alpha1 to beta1

This graduates autoscaling/v2alpha1 to autoscaling/v2beta1.  The move is more-or-less just a straightforward rename.

Part of kubernetes/features#117

```release-note
v2 of the autoscaling API group, including improvements to the HorizontalPodAutoscaler, has moved from alpha1 to beta1.
```

Automatic merge from submit-queue (batch tested with PRs 51956, 50708)

kubeadm: Upgrade Bootstrap Tokens to beta when upgrading to v1.8

**What this PR does / why we need it**:

Makes sure the v1.7 -> v1.8 upgrade works regarding the Bootstrap Token alpha -> beta graduation.
Not much have to be done, but some LoC are needed to preserve the behaivor

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 51839, 51987)

GCE: Fall back to network if subnet is unknown

Fixes #51981 

/assign @bowei 

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 51839, 51987)

Disable rbac/v1alpha1, settings/v1alpha1, and scheduling/v1alpha1 by default

**What this PR does / why we need it**: Disables alpha features which were previously enabled by default. Also changes tests which relied on these alpha features being enabled by default.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47691

**Special notes for your reviewer**:

**Release note**:

```release-note
Fixed a bug where some alpha features were enabled by default.

Automatic merge from submit-queue (batch tested with PRs 49133, 51557, 51749, 50842, 52018)

Fix panic in expand controller when checking PVs

Unbound PVs have their Spec.ClaimRef = nil, so we should not dereference it blindly.

In addition, increase AddPVCUpdate test coverage to 100%

fixes #52012 #51995

**Release note**:
```release-note
NONE
```

@kubernetes/sig-storage-pr-reviews 
/assign @gnufied

Automatic merge from submit-queue (batch tested with PRs 49133, 51557, 51749, 50842, 52018)

enhance unit tests of advance audit feature

This change addresses comments from @crassirostris 
https://github.com/kubernetes/kubernetes/pull/49115#discussion_r133416080

It does three things:
1. use auditinternal for unit test in filter stage
2. add a seperate unit test for Audit-ID http header
3. add unit test for audit log backend


**Release note**:
```
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49133, 51557, 51749, 50842, 52018)

Charges quota only for initialized objects

Partially fix https://github.com/kubernetes/kubernetes/issues/51842.

Based on https://github.com/kubernetes/kubernetes/pull/51733/files. Only the commit "Don't charge quota when creating/updating an uninitialized object" is new.

The old plan was to charge quota for each update of uninitialized object. This PR makes the quota admission only charges the update that removes the last pending initializer. Because
* https://github.com/kubernetes/kubernetes/pull/51247, which lets sharedInformer see uninitialized objects, is not making the code freeze deadline. Hence, the quota replenishing controller won't capture deletion of uninitialized objects. We will leak quota if we charge quota for uninitialized objects.
* @lavalamp @erictune pointed out calculating/reserving quota is expensive, we should avoid doing it for every initializer update.
* My original argument was that quota admission should fail early so that user can easily figure out which initializer causes the quota outage. @lavalamp @erictune convinced me that user could easily figure the culprit if they watch the initialization process.

Automatic merge from submit-queue (batch tested with PRs 49133, 51557, 51749, 50842, 52018)

Implement StatsProvider interface using CRI stats

Ref: https://github.com/kubernetes/kubernetes/issues/46984

This is the follow up of https://github.com/kubernetes/kubernetes/pull/50932

- I include the cadvisor dependency changes in this PR for now to make it build. @dashpole will update the cadvisor dependency very soon, and I will remove the change once it's updated.
- Please take a closer look at the implementation in `cri_stats_provider.go` since we currently don't have any runtime implementing the CRI stats interface and the changes here cannot be enabled in e2e tests.
- Pod level network stats and container level logs stats are not provided.
- In `cadvisor_stats_provider.go`, we are able to remove the call to `getCgroupStats` in `ImageFsStats` for getting the timestamp of the stats, given that we've changed cadvisor to include the timestamp in `FsInfo`.
- Fixed the usage of `assert.Equal` in unit tests.

**Release note**:
```
Support getting container stats from CRI.
```

/assign @yujuhong 
/assign @Random-Liu

Automatic merge from submit-queue (batch tested with PRs 49133, 51557, 51749, 50842, 52018)

add controller permissions to set blockOwnerDeletion

fixes https://github.com/kubernetes/kubernetes/issues/51970

`blockOwnerDeletion` requires delete permissions on the owner object.  This adds that permission for our controllers.

@kubernetes/sig-auth-misc 

```release-note
The OwnerReferencesPermissionEnforcement admission plugin now requires `update` permission on the `finalizers` subresource of the referenced owner in order to set `blockOwnerDeletion` on an owner reference.
```

The feature is still Alpha and at times, the IP address previously used
by the load balancer in the test will not completely freed even after
the load balancer is long gone. In this case, the test URL with the IP
would return a 404 response. Tolerate this error and retry until the new
load balancer is fully established.

Charge object count when object is created, no matter if the object is
initialized or not.
Charge the remaining quota when the object is initialized.

Also, checking initializer.Pending and initializer.Result when
determining if an object is initialized. We didn't need to check them
because before 51082, having 0 pending initializer and nil
initializers.Result is invalid.