Automatic merge from submit-queue

Remove closing audit log file and add error check when writing to audit

This picks the order fix from #33164. Additionally I've removed entirely closing the log file, since it didn't make sense where it was. I've also added error checks when actually writing to audit logs.

@sttts ptal

**1.4 justification:**

Risk: the code only runs if auditing is enabled with an apiserver flag. So the risk is low.
Rollback: nothing should depend on this
Cost: the auditing feature is broken because the impersonation filter is applied before and you might not see the proper user when using `--as` flag. Additionally no errors are logged if writing to audit fails.

Automatic merge from submit-queue

Refactor cert utils into one pkg, add funcs from bootkube for kubeadm to use

**What this PR does / why we need it**:

We have ended-up with rather incomplete and fragmented collection of utils for handling certificates. It may be worse to consider using `cfssl` for doing all of these things, but for now there is some functionality that we need in `kubeadm` that we can borrow from bootkube. It makes sense to move the utils from bookube into core, as discussed in #31221.

**Special notes for your reviewer**: I've taken the opportunity to review names of existing funcs and tried to make some improvements in that area (with help from @peterbourgon).

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

move registry packages for all API groups

This continues the pattern of `registry/<group>/resource` for our backing storage.  This entire pull is nothing but moves.  I'll reswizzle the actual storage next, but these are cargo-culted everywhere, so I want to lay this down early.

@sttts @ncdc

Automatic merge from submit-queue

make verify godeps help you fix your problems instead of taunting you

This should save people so much time

(the changes are pretty minor, but the indentation makes them look major)

Automatic merge from submit-queue

fix planner loop ends before finishing replica assignments

fix planner bug that failed assign all the replicas sometime
#32733 

@quinton-hoole @nikhiljindal @deepak-vij @kshafiee @mwielgus @shashidharatd

Automatic merge from submit-queue

Minor Ingress tests cleanup, that includes service shard and GCE resource cleanups in underlying clusters.

Follow up for #32810.

cc @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Remove cpu limits for dns pod to avoid CPU starvation

The current limits are not based on usage profiles
Fixes #33222

Automatic merge from submit-queue

Allow secure access to apiserver from Admission Controllers

* Allow options.InsecurePort to be set to 0 to switch off insecure access
* In NewSelfClient, Set the TLSClientConfig to the cert and key files
  if InsecurePort is switched off
* Mint a bearer token that allows the client(s) created in NewSelfClient
  to talk to the api server
* Add a new authenticator that checks for this specific bearer token

Fixes #13598

Automatic merge from submit-queue

Update the containervm image to the latest one (container-v1-3-v20160…

Node e2e is running with old containervm image which only has docker 1.9.1. This pr fixed such issue.

Automatic merge from submit-queue

(GCI) Configure logrotate to rotate all .log files in /var/log.

Fixes logrotate configuration in GCI to rotate all "*.log" files in /var/log. 

Fixes issue #33223.

Automatic merge from submit-queue

don't mutate original master->kubelet TLS config

fixes https://github.com/kubernetes/kubernetes/issues/33140

```release-note
Resolves x509 verification issue with masters dialing nodes when started with --kubelet-certificate-authority
```

Signed-off-by: Vishnu kannan <vishnuk@google.com>

Automatic merge from submit-queue

Setting the default image for GKE tests to Container_VM.

@vishh @spxtr @pwittrock

The purpose is to keep the current state of tests as is even if GKE changes the base image.

Automatic merge from submit-queue

test: use low terminationGracePeriod for deployment test

Hopefully fixes https://github.com/kubernetes/kubernetes/issues/32692

@janetkuo PTAL

Revert "simplify RC and SVC listers"

Automatic merge from submit-queue

Fix elasticsearch cluster logging e2e test on GCI

Fix #33126
Fix #32804

Additional timeouts are proven unnecessary, the problem lies with the cpu limits

Automatic merge from submit-queue

Behave gracefully in kubectl if /version returns 404

Fixes https://github.com/kubernetes/kubernetes/issues/32679. 

It's only about caching the swagger spec here. So it's safe to fall back to non-caching mode and continue.

Automatic merge from submit-queue

simplify RC and SVC listers

Make the RC and SVC listers use the common list functions that more closely match client APIs, are consistent with other listers, and avoid unnecessary copies.

Automatic merge from submit-queue

Update the Kubernetes version in sample federation deployment config to 1.4.0.

cc @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Dumping federation events if federation e2e test failed

Updating the e2e framework to dump events in federation control plane if a federation e2e test failed.

This should help in debugging https://github.com/kubernetes/kubernetes/issues/32733

cc @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

When client config is default or default is invalid, check ICC

Alternative fix to #33019

Automatic merge from submit-queue

controller: enhance timeout error message for Recreate deployments

Makes the error message from https://github.com/kubernetes/kubernetes/issues/29197 more obvious

@kubernetes/deployment

Automatic merge from submit-queue

Fix possible panic in PodAffinityChecker

In `PodAffinityChecker.getMatchingAntiAffinityTerms()` `affinity.PodAntiAffinity` can be `nil` in this place. This problem occurs e.g. when `nil` is passed as `meta` to `PodAffinityChecker.InterPodAffinityMatches()`.

Stumbled upon it while working on #31136 (someone PTAL at that PR too, I've submitted it a month ago and seemingly no one noticed it), kube-controller-manager was crashing there.

Minor Ingress tests cleanup, that includes service shard and GCE resource cleanups in underlying clusters.

Automatic merge from submit-queue

delete private interface with no references in package

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:
code quality. 

**Which issue this PR fixes**:
does not fix anything. removes unused interface. 

**Special notes for your reviewer**:
It does not do anything. Let us remove it.

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
NONE
```

Automatic merge from submit-queue

compensate for raft/cache delay in namespace admission

When attempting to create an object in a just-created namespace, the admission plugin can reject the creation attempt for two reasons:

1. The cache of existing namespaces has not observed the creation watch event yet. There was already compensation to perform a live lookup if the namespace was not found in the cache.

2. The live lookup can be performed against a non-leader in a HA etcd setup, and can return NotFound if the non-leader etcd has not observed the creation.

This PR adds a delay, then rechecks the cache before proceeding with the live lookup. This gives both the cache and the backing storage more time to observe the create, before failing the request.

This commit moves away from using a global variable for default
configuration checking, and instead exposes a method on LoadingRules to
determine whether a particular restclient.Config should be considered
"default". This allows kubectl to provide its own defaults (the same
as before, KUBERNETES_MASTER and the static localhost:8080 values) while
allowing other clients to avoid defining them.

In-cluster config defaulting is now easier to read.

Automatic merge from submit-queue

gce/util: $replica-pd --> $replica_pd

\cc @quinton-hoole @madhusudancs 

fixes #32997