Automatic merge from submit-queue (batch tested with PRs 63624, 59847). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

explicit kubelet config key in Node.Spec.ConfigSource.ConfigMap

This makes the Kubelet config key in the ConfigMap an explicit part of
the API, so we can stop using magic key names.
    
As part of this change, we are retiring ConfigMapRef for ConfigMap.


```release-note
You must now specify Node.Spec.ConfigSource.ConfigMap.KubeletConfigKey when using dynamic Kubelet config to tell the Kubelet which key of the ConfigMap identifies its config file.
```

Automatic merge from submit-queue (batch tested with PRs 63624, 59847). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

continued discovery cleanup, aggregator e2e test deflaking

deflakes one set of failures seen in https://github.com/kubernetes/kubernetes/issues/63622 in which the aggregator test fails because of an unrelated simultaneous CRD change made by another test

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[kubeadm] Support `HostPathType` of ExtraVolumes in the kubeadm configuration file.

**What this PR does / why we need it**:

Now we use `DirectoryOrCreate ` as a default `HostPathType` in the kubeadm configuration file, when we create user's extra volumes(like `apiServerExtraVolumes`). So, user can't use other `HostPathType`. In order to let users use other types of `HostPath`(like `File`), I think we should support `HostPathType` of ExtraVolumes in the kubeadm configuration file. 

**Which issue(s) this PR fixes**

ref [kubernetes/kubeadm#788](https://github.com/kubernetes/kubeadm/issues/788)

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63593, 63539). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Refactor cachingSecretManager

I have a POC of watch-based implementation of SecretManager in https://github.com/kubernetes/kubernetes/pull/63461

This is an initial refactoring that would make that change easier.

@yujuhong - if you're fine with this PR, I will do the same for configmaps in the follow up PR.

Automatic merge from submit-queue (batch tested with PRs 63593, 63539). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix typo in envelope transform error message

genvelope -> envelope

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 59284, 63602). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 category expansion can only come from the server

A couple release ago we moved category expansion to the server instead of hardcoding it in the client.  Similar to restmappings, there is no valid client-side expansion anymore, so this removes the code that hardcoded the list and moves the category expansion to the same package as our discovery based restmappers.

@kubernetes/sig-cli-maintainers 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 59284, 63602). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Exclude keys containing empty patches in the final patch

**What this PR does / why we need it**: 
This minimizes the 3-way JSON merge patch generated when calculating the patch necessary to send to the server. It does this by removing empty maps created from deleting keys in the keepOrDeleteNullInObj method.

This is not only a slight performance improvement (less PATCH requests) but also necessary when working with custom resources that have RBAC restrictions.

**Which issue(s) this PR fixes**: N/A

**Special notes for your reviewer**: N/A

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62850, 63504). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Improve where we load builds from for kubeadm upgrade jobs

**What this PR does / why we need it**:

For 1.8,1.9,1.10 branches, we need to load the latest
version from ci/latest*.txt.

For master, we need to load the version number from
ci-cross/latest.txt

try these to verify:
```
gsutil cat gs://kubernetes-release-dev/ci/latest-1.9.txt
gsutil cat gs://kubernetes-release-dev/ci-cross/latest.txt
```


**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubernetes/issues/61483

**Special notes for your reviewer**:

**Release note**:

```release-note
Fixed where we get latest builds for stable branches
```

Automatic merge from submit-queue (batch tested with PRs 62850, 63504). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm-token: search for existing kubeconfig files

**What this PR does / why we need it**:

Add means to search the current user home path and
the environment variable KUBECONFIG for existing files if the
user does not provide a --kubeconfig flag.

If the user provides a --kubeconfig flag respect it.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubeadm/issues/198

**Special notes for your reviewer**:

i'm not 100% sure if that's the correct approach and if that's what's requested. so let's discuss it.

**Release note**:

```release-note
Search standard KubeConfig file locations when using `kubeadm token` without `--kubeconfig`.
```

Automatic merge from submit-queue (batch tested with PRs 63597, 63599). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

push ToRESTMapper down a layer

The RESTMapper is needed to drive some use-cases for a dynamic client and takes a little bit of wiring (nested restmappers).  This pull pushes that into information derived from the kubeconfig flags to allow easy re-use.

@kubernetes/sig-cli-maintainers 
/assign @juanvallejo 
/assign @soltysh 

assigned to original creators.


```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 63597, 63599). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

don't block e2e namespace cleanup checks on metrics.k8s.io API group

e2e tests discovery persisted resource types and ensure they were cleaned up by namespace deletion

the metrics.k8s.io API group doesn't have any persisted resources, so if there is a discovery error involving that group, we can ignore it for purposes of e2e cleanup checks

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62354, 62934, 63502). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Run resource discovery in parallel

best viewed ignoring whitespace (https://github.com/kubernetes/kubernetes/pull/63502/files?w=1)

on high-latency connections, serializing resource discovery requests across group versions can take significant amounts of time. this parallelizes the network request portion of the discovery call

xref #63368 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62354, 62934, 63502). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Refactor GetResourceRequest and GetResourceLimit

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
/assign @bsalamat 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 62354, 62934, 63502). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add support for AWS charm

Support AWS integration via proxy charm.



**What this PR does / why we need it**: Add support for Juju charms to connect to AWS integration charm to automatically manage IAM tags and roles, and cloud-provider setting for AWS.

**Release note**:

```release-note
NONE
```

We should stop special casing "ci-cross" and just use the
configuration in test-infra to dictate where we pick up
the builds from.

For 1.8,1.9,1.10 branches, we need to load the latest
version from ci/latest*.txt.

For master, 1.11 etc, we need to load from ci-cross/latest*.txt.

We need to update test-infra configs if things fail.

try these to verify:
```
gsutil cat gs://kubernetes-release-dev/ci/latest-1.9.txt
gsutil cat gs://kubernetes-release-dev/ci-cross/latest.txt
```

Automatic merge from submit-queue (batch tested with PRs 57954, 62166). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fluentd-elasticsearch addon: allow graceful shutdown in fluentd-es image.

This PR contains an optimisation to the fluentd-elasticsearch addon. Restarting fluentd pods took unnecessarily long because the start script in the image did not support propagating signals to the actual fluentd process. This patch fixes this behaviour.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 57954, 62166). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

clean up useless func in pkg/kubelet/network/plugins.go

**What this PR does / why we need it**:
clean up useless func in pkg/kubelet/network/plugins.go

**Release note**:

```release-note

```NONE

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Include more information when multiple security groups are tagged

**What this PR does / why we need it**:

When trying to create ELB we can sometime fail if there is more then one AWS
security group tagged. It very useful to get the list of security groups printed in
the error message.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
  Include the list of security groups when failing with the errors that more then one is tagged
```

Automatic merge from submit-queue (batch tested with PRs 59034, 63565, 63533). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiextensions: allow "required" at root with status subresource

In the subresources alpha we intentionally disallowed anything than `properties` at the root of the validation schema in order to allow us to project it to the .status subtree. By doing this we also disallowed `required` at the root which is necessary to enforce e.g. a spec to be set. This PR fixes this.

Moreover, it fixes that the restriction is only enforced when the status subresource is actually enabled. Before this PR we were enforcing the restriction as soon as the feature gate was enabled, leading to a backwards incompatible change.

```release-note
Allow "required" to be used at the CRD OpenAPI validation schema when the /status subresource is enabled.
```

There was an issue reporting the bug. But cannot find it.

Automatic merge from submit-queue (batch tested with PRs 59034, 63565, 63533). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Bump kube-openapi dependency

picks: https://github.com/kubernetes/kube-openapi/pull/67
ref: https://github.com/kubernetes/kubernetes/issues/63494

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 59034, 63565, 63533). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[RBD block device ]ignore the loopbackdevice error, or the rbd volume will not get detached

The rbd volume loop device maybe not found and then the volume will  not get detached.
so need to ignore the error.
@mtanino @sbezverk
Can you take a look?

Release note:
```
ignore the loopback device not found error when  `GetLoopDevice` 
```

Automatic merge from submit-queue (batch tested with PRs 63537, 63385). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[CustomResourceSubresources] fix status subresource

This change make the codes consistent with the document.
Fixes: https://github.com/kubernetes/kubernetes/issues/63359



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
/assign @nikhita 
**Release note**:

```release-note
When updating /status subresource of a custom resource, only the value at the `.status` subpath for the update is considered.
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Return error when has no RequestInfo in handlerchain

**What this PR does / why we need it**:
we should return error when has no RequestInfo.
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Supported nodeSelector.matchFields in scheduler.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
part of  #61410

**Special notes for your reviewer**:

**Release note**:
```release-note
Supported nodeSelector.matchFields (node's `metadata.node`) in scheduler.
```

Automatic merge from submit-queue (batch tested with PRs 63563, 63541). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Do not check vmSetName when getting Azure node's IP

**What this PR does / why we need it**:

Do not check vmSetName when getting Azure node's IP.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #63538

**Special notes for your reviewer**:

**Release note**:

```release-note
Do not check vmSetName when getting Azure node's IP
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix cgroup names in node_container_manager_test.

**What this PR does / why we need it**:

Fix cgroup names in node_container_manager_test.

The names were made invalid for the CgroupName refactor in #62541, so update them here.

Furthermore, as the new names are now compatible with what EnforceNodeAllocatable wants, reuse the constants there as well.

Tested:
```
  $ make test-e2e-node REMOTE=true HOSTS=test-cos-beta-67-10575-27-0 FOCUS='Validate Node Allocatable' SKIP='' TEST_ARGS='--feature-gates=DynamicKubeletConfig=true'
  • [SLOW TEST:39.488 seconds]
  [k8s.io] Node Container Manager [Serial]
    Validate Node Allocatable
      set's up the node and runs the test
  Ran 1 of 261 Specs in 57.348 seconds
  SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 260 Skipped
```




**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #63549

**Special notes for your reviewer**:
/assign @dashpole 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 58580, 63120). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

-Remove TODO comment of GetNonzeroRequests function

**What this PR does / why we need it**:

-Remove TODO comment of GetNonzeroRequests function

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
NONE

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 58580, 63120). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Admit BestEffort if it tolerates memory pressure.
Signed-off-by: Da K. Ma <klaus1982.cn@gmail.com>

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #58505 

**Release note**:
```release-note
None
```