Automatic merge from submit-queue

AWS: support node port health check

**What this PR does / why we need it**:
if a custom health check is set from the beta annotation on a service it
should be used for the ELB health check. This patch adds support for
that.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
Let me know if any tests need to be added.
**Release note**:

```release-note
```

Automatic merge from submit-queue

typos: spelling fixes in pkg/util/wait/wait.go

```release-note
NONE
```

Automatic merge from submit-queue

Fix go-xgettext (go get) reference on translations README

The `go get` command to install `xgettext` was wrongly pointing to `tree/master`.

Automatic merge from submit-queue (batch tested with PRs 45699, 46200, 46335, 46599)

Bump CNI and etcd go base images to 1.7.6

**What this PR does / why we need it**:
Addresses #46391 for CNI and etcd images.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/assign @luxas

Automatic merge from submit-queue (batch tested with PRs 45699, 46200, 46335, 46599)

audit: implement stages

Based on https://github.com/kubernetes/kubernetes/pull/46065. Implementing https://github.com/kubernetes/kubernetes/pull/46065#discussion_r117438531.

Automatic merge from submit-queue (batch tested with PRs 45699, 46200, 46335, 46599)

apiextensions: add integration test for name conflicts

**What this PR does / why we need it**: Add integration test for name conflicts.
Create 2 CRDs with name conflict. The controller sets the NameConflict condition on the second one. Delete the first one. The second CRD should now get accepted.

Update:
- [x] Add integration test for name conflicts
- [x] Fix naming controller so that when a resource is deleted, other resources in the same group are added to the queue
- [x]  Add integration test for self link (cluster scoped resources)
- [x] Add bigger poll interval
- [x] Fix DeleteCustomResourceDefinition poll condition


**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: for #45511 

**Special notes for your reviewer**:

**Release note**:

```
NONE
```
@sttts

Automatic merge from submit-queue (batch tested with PRs 45699, 46200, 46335, 46599)

modify the initialization statement

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

Fix kubemark/run-e2e-tests.sh

This should make most common arguments work.

cc @shyamjvs

Automatic merge from submit-queue

Fix minor bugs in setting API call metrics with subresource

Based on changes from https://github.com/kubernetes/kubernetes/pull/46354

/cc @wojtek-t @smarterclayton

* add integration test for name conflicts of CRDs
* fix naming controller so that when a resource is deleted,
other resources in the same group are added to the queue
* add integration test for self link (clusterscoped resources)
* fix minor nits

address comments
add comments and fix nits

Bigger poll interval

customResource -> crd

Fix DeleteCustomResourceDefinition condition

Automatic merge from submit-queue

Add generic NoExecute Toleration to NPD

Ref. #44445

cc @davidopp 

```release-note
Add generic Toleration for NoExecute Taints to NodeProblemDetector
```

Automatic merge from submit-queue

Fix panics in load test

Automatic merge from submit-queue

Optimize provisioner plugin result check logic

If err is not returned by findProvisionablePlugin(...), storageClass is certainly not nil


**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Fix audit level none

... and add a testcase for it

https://github.com/kubernetes/features/issues/22

/cc @sttts @ericchiang

Automatic merge from submit-queue

Let kubemark exit if it fails to start

Fix the bug: If there is sth wrong to run hollow kubelet, kubemark will just hang instead of exiting. 

I came across the problem when I tried to start kubemark with no-root user.

```
I0523 15:27:39.721447   16855 docker_service.go:223] Setting cgroupDriver to cgroupfs
I0523 15:27:39.721634   16855 docker_legacy.go:151] No legacy containers found, stop performing legacy cleanup.
I0523 15:27:39.722208   16855 kubelet.go:559] Starting the GRPC server for the docker CRI shim.
I0523 15:27:39.722228   16855 docker_server.go:60] Start dockershim grpc server
I0523 15:27:39.722265   16855 server.go:819] failed to unlink socket file "/var/run/dockershim.sock": permission denied
E0523 15:27:39.722327   16855 container_manager_linux.go:98] Unable to ensure the docker processes run in the desired containers
```

Automatic merge from submit-queue

Added k82cn as one of scheduler approver.

According to the requirement of Approver at [community-membership.md](https://github.com/kubernetes/community/blob/master/community-membership.md), I meet the requirements as follow; so I'd like to add myself as an approver of scheduler.

* Reviewer of the codebase for at least 3 months
[k82cn]: [~3 months](https://github.com/kubernetes/kubernetes/commit/6cc40678b6988124940f76b780657bfc46e14a7a )
* Primary reviewer for at least 10 substantial PRs to the codebase
[k82cn] Reviewed [40 PRs](https://github.com/issues?q=assignee%3Ak82cn+is%3Aclosed)
* Reviewed or merged at least 30 PRs to the codebase
[k82cn]: 71 merged PRs in kubernetes/kubernetes, and ~100 PRs in kuberentes at https://goo.gl/j2D1fR

As an approver,

* I agree to only approve familiar PRs
* I agree to be responsive to review/approve requests as per community expectations
* I agree to continue my reviewer work as per community expectations
* I agree to continue my contribution, e.g. PRs, mentor contributors

Automatic merge from submit-queue (batch tested with PRs 46407, 46457)

GCE - Refactor API for firewall and backend service creation

**What this PR does / why we need it**:
 - Currently, firewall creation function actually instantiates the firewall object; this is inconsistent with the rest of GCE api calls. The API normally gets passed in an existing object.
 - Necessary information for firewall creation, (`computeHostTags`,`nodeTags`,`networkURL`,`subnetworkURL`,`region`) were private to within the package. These now have public getters.
 - Consumers might need to know whether the cluster is running on a cross-project network. A new `OnXPN` func will make that information available.
 - Backend services for regions have been added. Global ones have been renamed to specify global. 
 - NamedPort management of instance groups has been changed from an `AddPortsToInstanceGroup` func (and missing complementary `Remove...`) to a single, simple `SetNamedPortsOfInstanceGroup`
 - Addressed nitpick review comments of #45524 

ILB needs the regional backend services and firewall refactor.  The ingress controller needs the new `OnXPN` func to decide whether to create a firewall.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 46407, 46457)

Remove deletecollection support from namespace object

Namespace storage accidentally picked up deletecollection support from embedding the generic store. If invoked, it skips the custom namespace `Delete()` storage method that enforces finalization, and skips the namespace lifecycle admission plugin that protects immortal namespaces from deletion.

Given the data integrity implications of skipping namespace finalization, I'd backport this as far as we're releasing patch releases.

```release-note
The namespace API object no longer supports the deletecollection operation.
```

Automatic merge from submit-queue

Move NetworkPolicy to v1

Move NetworkPolicy to v1

@kubernetes/sig-network-misc 

**Release note**:
```release-note
NetworkPolicy has been moved from `extensions/v1beta1` to the new
`networking.k8s.io/v1` API group. The structure remains unchanged from
the beta1 API.

The `net.beta.kubernetes.io/network-policy` annotation on Namespaces
to opt in to isolation has been removed. Instead, isolation is now
determined at a per-pod level, with pods being isolated if there is
any NetworkPolicy whose spec.podSelector targets them. Pods that are
targeted by NetworkPolicies accept traffic that is accepted by any of
the NetworkPolicies (and nothing else), and pods that are not targeted
by any NetworkPolicy accept all traffic by default.

Action Required:

When upgrading to Kubernetes 1.7 (and a network plugin that supports
the new NetworkPolicy v1 semantics), to ensure full behavioral
compatibility with v1beta1:

    1. In Namespaces that previously had the "DefaultDeny" annotation,
       you can create equivalent v1 semantics by creating a
       NetworkPolicy that matches all pods but does not allow any
       traffic:

           kind: NetworkPolicy
           apiVersion: networking.k8s.io/v1
           metadata:
             name: default-deny
           spec:
             podSelector:

       This will ensure that pods that aren't match by any other
       NetworkPolicy will continue to be fully-isolated, as they were
       before.

    2. In Namespaces that previously did not have the "DefaultDeny"
       annotation, you should delete any existing NetworkPolicy
       objects. These would have had no effect before, but with v1
       semantics they might cause some traffic to be blocked that you
       didn't intend to be blocked.
```

Automatic merge from submit-queue

chmod +x kubemark scripts

Just noticed. We don't need to do chmod each time.

/cc @wojtek-t @gmarek

Automatic merge from submit-queue

Update troubleshooting link in ISSUE_TEMPLATE.md

**What this PR does / why we need it**:
Since our troubleshooting page has been moved, we should update the issue template.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
ref: #44434

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

fix some typo in docs[example/volumes]

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Protobuf generation for k8s.io/metrics

This PR introduces protobuf generation for k8s.io/metrics.  Doing so required:

- fixing a bug in `go-to-protobuf` causing the `cast{key,value,type}` values to not be quoted when coming from struct tags (and not auto-injection by `go-to-protobuf` itself).
- Making sure the proto IDL in k8s.io/client-go had a package name of `k8s.io.client_go.xyz` and not `k8s.io.kubernetes.xyz`.

Additionally, I updated `go-to-protobuf` to skip functions and non-public types when composing the import list, which cuts down on the more bizarre imports in the IDL (like importing the sample API package in every IDL file because it contained `addToScheme`, like every other API package).

We use `castvalue` to force gogo-proto to realize that it should consider the value of the map which underlies `ResourceList` when calculating which imports need to be named.  Otherwise, it ignores the value's type, leading to compilation errors when it later can't find an import it assumed existed.  We accidentally didn't hit this in `k8s.io/kubernetes/pkg/api/v1` since another field coincidentally happens to directly use `resource.Quantity` (the value type of `ResourceList`).

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue

Bazel: mount tmpfs on /tmp

**What this PR does / why we need it**: our custom `go_genrule` assumes a hermetic `/tmp/` directory, but Bazel 0.5.0 just mounts the host `/tmp` read-write by default.

As a result, we can run into build failures like:
```
W0526 23:53:12.504] ERROR: /workspace/k8s.io/kubernetes/pkg/generated/openapi/BUILD:7:1: error executing shell command: 'set -e
W0526 23:53:12.504] export GOROOT=$(pwd)/external/io_bazel_rules_go_toolchain/bin/..
W0526 23:53:12.504] export GOPATH=/tmp/gopath
W0526 23:53:12.505] export GO_WORKSPACE=${GOPATH}/src/k8s.io/kubernetes
W0526 23:53:12.505] mkdir -p ${GO_WORKSPACE%/*}
W0526 23:53:12.505] ln -s $(pwd) ${GO_W...' failed: bash failed: error executing command 
W0526 23:53:12.506]   (exec env - \
W0526 23:53:12.506]   /bin/bash -c 'set -e
W0526 23:53:12.506] export GOROOT=$(pwd)/external/io_bazel_rules_go_toolchain/bin/..
W0526 23:53:12.506] export GOPATH=/tmp/gopath
W0526 23:53:12.506] export GO_WORKSPACE=${GOPATH}/src/k8s.io/kubernetes
W0526 23:53:12.507] mkdir -p ${GO_WORKSPACE%/*}
W0526 23:53:12.507] ln -s $(pwd) ${GO_WORKSPACE}
W0526 23:53:12.507] export GENGOPATH=/tmp/gengopath
W0526 23:53:12.508] export GENGO_WORKSPACE=${GENGOPATH}/src/k8s.io/kubernetes
W0526 23:53:12.508] mkdir -p ${GENGO_WORKSPACE%/*}
W0526 23:53:12.508] ln -s $(pwd)/bazel-out/local-fastbuild/genfiles ${GENGO_WORKSPACE}
W0526 23:53:12.508] export GOPATH=${GOPATH}:${GENGOPATH}
W0526 23:53:12.508] cd ${GO_WORKSPACE}
W0526 23:53:12.510] bazel-out/host/bin/cmd/libs/go2idl/openapi-gen/openapi-gen --v 1 --logtostderr --go-header-file hack/boilerplate/boilerplate.go.txt --output-file-base zz_generated.openapi --output-package k8s.io/kubernetes/pkg/generated/openapi --input-dirs k8s.io/kubernetes/cmd/libs/go2idl/client-gen/test_apis/testgroup/v1,k8s.io/kubernetes/federation/apis/federation/v1beta1,k8s.io/kubernetes/pkg/api/v1,k8s.io/kubernetes/pkg/apis/abac/v0,k8s.io/kubernetes/pkg/apis/abac/v1beta1,k8s.io/kubernetes/pkg/apis/admission/v1alpha1,k8s.io/kubernetes/pkg/apis/admissionregistration/v1alpha1,k8s.io/kubernetes/pkg/apis/apps/v1beta1,k8s.io/kubernetes/pkg/apis/authentication/v1,k8s.io/kubernetes/pkg/apis/authentication/v1beta1,k8s.io/kubernetes/pkg/apis/authorization/v1,k8s.io/kubernetes/pkg/apis/authorization/v1beta1,k8s.io/kubernetes/pkg/apis/autoscaling/v1,k8s.io/kubernetes/pkg/apis/autoscaling/v2alpha1,k8s.io/kubernetes/pkg/apis/batch/v1,k8s.io/kubernetes/pkg/apis/batch/v2alpha1,k8s.io/kubernetes/pkg/apis/certificates/v1beta1,k8s.io/kubernetes/pkg/apis/componentconfig/v1alpha1,k8s.io/kubernetes/pkg/apis/extensions/v1beta1,k8s.io/kubernetes/pkg/apis/imagepolicy/v1alpha1,k8s.io/kubernetes/pkg/apis/policy/v1beta1,k8s.io/kubernetes/pkg/apis/rbac/v1alpha1,k8s.io/kubernetes/pkg/apis/rbac/v1beta1,k8s.io/kubernetes/pkg/apis/settings/v1alpha1,k8s.io/kubernetes/pkg/apis/storage/v1,k8s.io/kubernetes/pkg/apis/storage/v1beta1,k8s.io/kubernetes/pkg/version,k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/api/resource,k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/apis/meta/v1,k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/apis/meta/v1alpha1,k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/runtime,k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/intstr,k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/version,k8s.io/kubernetes/vendor/k8s.io/apiserver/pkg/apis/audit/v1alpha1,k8s.io/kubernetes/vendor/k8s.io/apiserver/pkg/apis/example/v1,k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/api/v1,k8s.io/kubernetes/vendor/k8s.io/metrics/pkg/apis/custom_metrics/v1alpha1,k8s.io/kubernetes/vendor/k8s.io/metrics/pkg/apis/metrics/v1alpha1 && cp pkg/generated/openapi/zz_generated.openapi.go bazel-out/local-fastbuild/genfiles/pkg/generated/openapi')
```

By specifying this flag, we can restore the old behavior.
/assign @mikedanese @spxtr 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Apply KubeProxyEndpointLagTimeout to ESIPP tests

Fixes #46533.

The previous construction of ESIPP tests is weird, so I redo it a bit.

A 30 seconds `KubeProxyEndpointLagTimeout` is introduced, as these tests ain't verifying performance, may be better to not make it too tight.

/assign @thockin 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

fix typo in build.sh

**What this PR does / why we need it**:
fix typo in build.sh
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
NONE
**Special notes for your reviewer**:
NONE
**Release note**:

```release-note
NONE
```