Automatic merge from submit-queue

Fake clientset propagates namespace to objects on create/update

**What this PR does / why we need it**:

Unlike the real Clientset, the fake Clientset requires creates and updates of namespaced objects to have the namespace specified in the target runtime object metadata. This difference forces API clients using the fake Clientset for test to propagate the namespaces to the runtime objects in the production code. This propagation is unnecessary and should be handled by the fake implementation.

**Which issue this PR fixes**: fixes kubernetes/client-go#48

**Special notes for your reviewer**:

**Release note**:
NONE

Automatic merge from submit-queue

apiserver(s): Replace glog.Fatals with fmt.Errorfs

Automatic merge from submit-queue

Node Conformance: Node Conformance CI

For https://github.com/kubernetes/kubernetes/issues/37252.

The first 2 commits of this PR are from #38150 and #38152. Please review those 2 PRs first, they are both minor cleanup.

This PR:
* Add `TestSuite` interface in `test/e2e_node/remote` to separate test suite logic (packaging, deploy, run test) from VM lifecycle management logic, so that different test suites can share the same VM lifecycle management logic.
  * Different test suites such as node e2e, node conformance, node soaking, cri validation etc. should implement different `TestSuite`.
  * `test/e2e_node/runner/remote` will initialize and run different test suite based on the subcommand.
* Add `run-kubelet-mode` which only starts and monitors kubelet, similar with `run-services-mode`. The reason we need this:
  * Unlike node e2e, node conformance test doesn't start kubelet inside the test suite (in fact, in the future node e2e shouldn't do that either), it assumes kubelet is already running before the test.
  * In fact, node e2e should use similar node bootstrap script like cluster e2e, and the bootstrap script should initialize the node with all necessary node software including kubelet. However, it's not the case now.
  * The easiest way for now is to reuse the kubelet start logic in the test suite. So in this PR, we added `run-kubelet-mode`, and use the test binary as a kubelet launcher to start kubelet before running the test.
* Implement node e2e `TestSuite`.
* Implement node conformance `TestSuite`. Use `docker save` and `docker load` to create and deploy conformance docker image; Start kubelet by running test binary in `run-kubelet-mode`; Run conformance test with `docker run`.

This PR will make it easy to implement continuous integration node soaking test and cri validation test (https://github.com/kubernetes/kubernetes/pull/35266).

/cc @kubernetes/sig-node

Automatic merge from submit-queue

Remove 'minion' from the code in two places in favor of 'node'

Part of https://github.com/kubernetes/kubernetes/issues/1111

Automatic merge from submit-queue (batch tested with PRs 38638, 38334)

Remove Azure Subnet RouteTable check

**What this PR does / why we need it**:

PR Removes the subnet configuration check for Azure cloudprovider. The subnet check ensures that the subnet is associated with the Route Table. However if the VNET is in a different Azure Resource Group then the check fails, even if the subnet is already valid. This a stop gap fix, to allow Kubernetes to be deployed to Custom VNETs in Azure, that may reside in a different resource group to the cluster.

fixes #38134 

@colemickens

Automatic merge from submit-queue

Use the cluster name in the names of the firewall rules that allow cluster-internal traffic to disambiguate the rules belonging to different clusters.

Also dropping the network name from these firewall rule names.

Network name was used to disambiguate firewall rules in a given network.
However, since two clusters cannot share a name in a GCE project, this
sufficiently disambiguates the firewall rule names. A potential confusion
arises when someone tries to create a firewall rule with the same name
in a different network, but that's also an indication that they shouldn't
be doing that.


@jszczepkowski due to PR #33094
@ixdy for test-infra

cc @kubernetes/sig-federation @nikhiljindal

Automatic merge from submit-queue (batch tested with PRs 38689, 38743, 38734, 38430)

apply sandbox network mode based on network plugin

This allows CRI to use docker's network bridge. Can be combined with noop network plugin. This allows to use docker0 with no further configuration. Good for tools like minikube/hyperkube.

Automatic merge from submit-queue (batch tested with PRs 38689, 38743, 38734, 38430)

Temporarily bump e2e cleanup timeout

Automatic merge from submit-queue

Remove accidentally committed files

Accidentally committed in #37534.

Automatic merge from submit-queue

Fix 1.5 CHANGELOG

Fix broken `docs` link.

Automatic merge from submit-queue

Refactor remotecommand options parsing

Prerequisite to https://github.com/kubernetes/kubernetes/issues/36187 - This separates the options from the request, so they can be pulled from elsewhere.

/cc @liggitt

Automatic merge from submit-queue (batch tested with PRs 38727, 38726, 38347, 38348)

Add 'privileged' to sandbox to indicate if any container might be privileged in it, document privileged

Right now, the privileged flag is this magic thing which does "whatever Docker does". This documents it to make it a little less magic.

In addition, due to how rkt uses `systemd-nspawn` as an outer layer of isolation in creating the sandbox, it's helpful to know beforehand whether the pod will be privileged so additional security options can be applied earlier / applied at all.

I suspect the same indication will be useful for userns since userns should also occur at the pod layer, but it's possible that will be a separate/additional field.


cc @lucab @jonboulle @yujuhong @feiskyer @kubernetes/sig-node 


```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 38727, 38726, 38347, 38348)

kubelet: remove redundant hostNetwork helper

Trivial cleanup.

Automatic merge from submit-queue (batch tested with PRs 38727, 38726, 38347, 38348)

Second pass of renaming kube-dns configure files

Continue work of #38523.

Not sure why cluster/centos/deployAddons.sh was omitted in previous PR. Also deletes the non-use `DNS_REPLICAS` var and changes `-rc` suffix in hack/local-up-cluster.sh.

@thockin @bowei @deads2k

Automatic merge from submit-queue

Ensure the GCI metadata files do not have newline at the end

Fixes #36708

@dchen1107 @Random-Liu  can one of you help with the review?

cc @kubernetes/goog-image FYI

Automatic merge from submit-queue

Inode Eviction Test is Flaky

This Pull Request:
Marks the InodeEviciton test as flaky
Increases the timeout for disk pressure because coreos has nearly 2 million inodes.
Decreases the status polling interval so we can see eviction ordering better.
@Random-Liu

Fixes #36708

Automatic merge from submit-queue

Curating Owners: pkg/runtime

cc @lavalamp @smarterclayton @deads2k @caesarxuchao

In an effort to expand the existing pool of reviewers and establish a
two-tiered review process (first someone lgtms and then someone
experienced in the project approves), we are adding new reviewers to
existing owners files.


If You Care About the Process:
------------------------------

We did this by algorithmically figuring out who’s contributed code to
the project and in what directories.  Unfortunately, that doesn’t work
well: people that have made mechanical code changes (e.g change the
copyright header across all directories) end up as reviewers in lots of
places.

Instead of using pure commit data, we generated an excessively large
list of reviewers and pruned based on all time commit data, recent
commit data and review data (number of PRs commented on).

At this point we have a decent list of reviewers, but it needs one last
pass for fine tuning.

Also, see https://github.com/kubernetes/contrib/issues/1389.

TLDR:
-----

As an owner of a sig/directory and a leader of the project, here’s what
we need from you:

1. Use PR https://github.com/kubernetes/kubernetes/pull/35715 as an example.

2. The pull-request is made editable, please edit the `OWNERS` file to
remove the names of people that shouldn't be reviewing code in the
future in the **reviewers** section. You probably do NOT need to modify
the **approvers** section. Names asre sorted by relevance, using some
secret statistics.

3. Notify me if you want some OWNERS file to be removed.  Being an
approver or reviewer of a parent directory makes you a reviewer/approver
of the subdirectories too, so not all OWNERS files may be necessary.

4. Please use ALIAS if you want to use the same list of people over and
over again (don't hesitate to ask me for help, or use the pull-request
above as an example)

Automatic merge from submit-queue

Bump glbc version, cleanup test

Matches https://github.com/kubernetes/ingress/pull/55

Automatic merge from submit-queue (batch tested with PRs 35436, 37090, 38700)

Significantly speed-up make

- do not call `dirname` for every go file => gives **>8 seconds** on each make run
- do not preserve time during rsync from `_output/local/go/bin` to `_output/local/bin/<os>/<arch>`:
  
  We do a touch after our rebuild heuristic triggers.
  
  If in `_output/local/go/bin` you have an older binary and go decides that it's good enough, the following rsync will "preserve the timestamp" of the binary copy in `_output/local/bin/<os>/<arch>`. This reverts the effect of any previous `touch` (compare `Makefile.generated_files`).

  We do a complete rsync of binaries for each go target, not only the one which is rebuilt. This means that later go targets will overwrite the timestamps of freshly touched binaries. Hence, our rebuild heuristic will trigger again and again when running `make`.

  This PR remove the "preserve mtime" from the rsync call. Hence, the effect of touch is not reverted anymore by later rsyncs.

Automatic merge from submit-queue (batch tested with PRs 35436, 37090, 38700)

Make iscsi pv/pvc aware of nodiskconflict feature

Being iscsi a `RWO, ROX` volume we should conflict if more than one pod is using same iscsi LUN.  
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>

Automatic merge from submit-queue

Add a package for handling version numbers (including non-"Semantic" versions)

As noted in #32401, we are using Semantic Version-parsing libraries to parse version numbers that aren't necessarily "Semantic". Although, contrary to what I'd said there, it turns out that this wasn't actually currently a problem for the iptables code, because the regexp used to extract the version number out of the "iptables --version" output only pulled out three components, so given "iptables v1.4.19.1", it would have extracted just "1.4.19". Still, it could be a problem if they later release "1.5" rather than "1.5.0", or if we eventually need to _compare_ against a 4-digit version number.

Also, as noted in #23854, we were also using two different semver libraries in different parts of the code (plus a wrapper around one of them in pkg/version).

This PR adds pkg/util/version, with code to parse and compare both semver and non-semver version strings, and then updates kubernetes to use it everywhere (including getting rid of a bunch of code duplication in kubelet by making utilversion.Version implement the kubecontainer.Version interface directly).

Ironically, this does not actually allow us to get rid of either of the vendored semver libraries, because we still have other dependencies that depend on each of them. (cadvisor uses blang/semver and etcd uses coreos/go-semver)

fixes #32401, #23854

Automatic merge from submit-queue (batch tested with PRs 38171, 37968)

add QoS pod status field

Right now, applications retrieving pod information must reimplement the QoS classification logic on the client side if they wish to know the QoS class of the pod.

The PR adds the QoS class to the pod status so it can be used directly by clients.

This is a step toward addressing #33255

@ConnorDoyle @derekwaynecarr @vishh

Automatic merge from submit-queue

Fixed a typo of wildcard DNS regex variable name.

Happened to see the typo while reading code, fixed the typo and refined the code.

Network name was used to disambiguate firewall rules in a given network.
However, since two clusters cannot share a name in a GCE project, this
sufficiently disambiguates the firewall rule names. A potential confusion
arises when someone tries to create a firewall rule with the same name
in a different network, but that's also an indication that they shouldn't
be doing that.