Automatic merge from submit-queue

Move image pull throttling logic to pkg/kubelet/images

This is part of #31458

This allows runtimes in different packages (dockertools, rkt, kuberuntime) to
share the same logic. Before this change, only dockertools support this
feature. Now all three packages support image pull throttling.

/cc @kubernetes/sig-node

Automatic merge from submit-queue

Integration tests: Migrate scheduler perf to the integration suite, s…

*Problem*

issues like https://github.com/kubernetes/kubernetes/pull/32384/ happen because we dont compile the integration tests as part of the build

*Solution*

This pr will make it so scheduler_perf is included in the integration tests, but it will run in short mode that only makes sure compilation happens .  it also removes the over generalized test/component directory which only has one entry

```
test/integration/replicationcontroller
test/integration/scheduler
test/integration/scheduler
test/integration/scheduler_perf
test/integration/scheduler_perf
test/integration/secrets
test/integration/serviceaccount
test/integration/storageclasses
```

Automatic merge from submit-queue

Remove closing audit log file and add error check when writing to audit

This picks the order fix from #33164. Additionally I've removed entirely closing the log file, since it didn't make sense where it was. I've also added error checks when actually writing to audit logs.

@sttts ptal

**1.4 justification:**

Risk: the code only runs if auditing is enabled with an apiserver flag. So the risk is low.
Rollback: nothing should depend on this
Cost: the auditing feature is broken because the impersonation filter is applied before and you might not see the proper user when using `--as` flag. Additionally no errors are logged if writing to audit fails.

Automatic merge from submit-queue

Refactor cert utils into one pkg, add funcs from bootkube for kubeadm to use

**What this PR does / why we need it**:

We have ended-up with rather incomplete and fragmented collection of utils for handling certificates. It may be worse to consider using `cfssl` for doing all of these things, but for now there is some functionality that we need in `kubeadm` that we can borrow from bootkube. It makes sense to move the utils from bookube into core, as discussed in #31221.

**Special notes for your reviewer**: I've taken the opportunity to review names of existing funcs and tried to make some improvements in that area (with help from @peterbourgon).

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

move registry packages for all API groups

This continues the pattern of `registry/<group>/resource` for our backing storage.  This entire pull is nothing but moves.  I'll reswizzle the actual storage next, but these are cargo-culted everywhere, so I want to lay this down early.

@sttts @ncdc

Automatic merge from submit-queue

make verify godeps help you fix your problems instead of taunting you

This should save people so much time

(the changes are pretty minor, but the indentation makes them look major)

Automatic merge from submit-queue

fix planner loop ends before finishing replica assignments

fix planner bug that failed assign all the replicas sometime
#32733 

@quinton-hoole @nikhiljindal @deepak-vij @kshafiee @mwielgus @shashidharatd

Automatic merge from submit-queue

Minor Ingress tests cleanup, that includes service shard and GCE resource cleanups in underlying clusters.

Follow up for #32810.

cc @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Remove cpu limits for dns pod to avoid CPU starvation

The current limits are not based on usage profiles
Fixes #33222

Automatic merge from submit-queue

Allow secure access to apiserver from Admission Controllers

* Allow options.InsecurePort to be set to 0 to switch off insecure access
* In NewSelfClient, Set the TLSClientConfig to the cert and key files
  if InsecurePort is switched off
* Mint a bearer token that allows the client(s) created in NewSelfClient
  to talk to the api server
* Add a new authenticator that checks for this specific bearer token

Fixes #13598

Automatic merge from submit-queue

Update the containervm image to the latest one (container-v1-3-v20160…

Node e2e is running with old containervm image which only has docker 1.9.1. This pr fixed such issue.

Automatic merge from submit-queue

(GCI) Configure logrotate to rotate all .log files in /var/log.

Fixes logrotate configuration in GCI to rotate all "*.log" files in /var/log. 

Fixes issue #33223.

Automatic merge from submit-queue

don't mutate original master->kubelet TLS config

fixes https://github.com/kubernetes/kubernetes/issues/33140

```release-note
Resolves x509 verification issue with masters dialing nodes when started with --kubelet-certificate-authority
```

Signed-off-by: Vishnu kannan <vishnuk@google.com>

This allows runtimes in different packages (dockertools, rkt, kuberuntime) to
share the same logic. Before this change, only dockertools support this
feature. Now all three packages support image pull throttling.

Automatic merge from submit-queue

Setting the default image for GKE tests to Container_VM.

@vishh @spxtr @pwittrock

The purpose is to keep the current state of tests as is even if GKE changes the base image.

Automatic merge from submit-queue

test: use low terminationGracePeriod for deployment test

Hopefully fixes https://github.com/kubernetes/kubernetes/issues/32692

@janetkuo PTAL

Revert "simplify RC and SVC listers"

Automatic merge from submit-queue

Fix elasticsearch cluster logging e2e test on GCI

Fix #33126
Fix #32804

Additional timeouts are proven unnecessary, the problem lies with the cpu limits

Automatic merge from submit-queue

Behave gracefully in kubectl if /version returns 404

Fixes https://github.com/kubernetes/kubernetes/issues/32679. 

It's only about caching the swagger spec here. So it's safe to fall back to non-caching mode and continue.

Automatic merge from submit-queue

simplify RC and SVC listers

Make the RC and SVC listers use the common list functions that more closely match client APIs, are consistent with other listers, and avoid unnecessary copies.

Automatic merge from submit-queue

Update the Kubernetes version in sample federation deployment config to 1.4.0.

cc @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Dumping federation events if federation e2e test failed

Updating the e2e framework to dump events in federation control plane if a federation e2e test failed.

This should help in debugging https://github.com/kubernetes/kubernetes/issues/32733

cc @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

When client config is default or default is invalid, check ICC

Alternative fix to #33019

Automatic merge from submit-queue

controller: enhance timeout error message for Recreate deployments

Makes the error message from https://github.com/kubernetes/kubernetes/issues/29197 more obvious

@kubernetes/deployment

Automatic merge from submit-queue

Fix possible panic in PodAffinityChecker

In `PodAffinityChecker.getMatchingAntiAffinityTerms()` `affinity.PodAntiAffinity` can be `nil` in this place. This problem occurs e.g. when `nil` is passed as `meta` to `PodAffinityChecker.InterPodAffinityMatches()`.

Stumbled upon it while working on #31136 (someone PTAL at that PR too, I've submitted it a month ago and seemingly no one noticed it), kube-controller-manager was crashing there.

Minor Ingress tests cleanup, that includes service shard and GCE resource cleanups in underlying clusters.