Automatic merge from submit-queue

Allow secure access to apiserver from Admission Controllers

* Allow options.InsecurePort to be set to 0 to switch off insecure access
* In NewSelfClient, Set the TLSClientConfig to the cert and key files
  if InsecurePort is switched off
* Mint a bearer token that allows the client(s) created in NewSelfClient
  to talk to the api server
* Add a new authenticator that checks for this specific bearer token

Fixes #13598

Automatic merge from submit-queue

Update the containervm image to the latest one (container-v1-3-v20160…

Node e2e is running with old containervm image which only has docker 1.9.1. This pr fixed such issue.

Automatic merge from submit-queue

(GCI) Configure logrotate to rotate all .log files in /var/log.

Fixes logrotate configuration in GCI to rotate all "*.log" files in /var/log. 

Fixes issue #33223.

Automatic merge from submit-queue

don't mutate original master->kubelet TLS config

fixes https://github.com/kubernetes/kubernetes/issues/33140

```release-note
Resolves x509 verification issue with masters dialing nodes when started with --kubelet-certificate-authority
```

Automatic merge from submit-queue

Setting the default image for GKE tests to Container_VM.

@vishh @spxtr @pwittrock

The purpose is to keep the current state of tests as is even if GKE changes the base image.

Automatic merge from submit-queue

test: use low terminationGracePeriod for deployment test

Hopefully fixes https://github.com/kubernetes/kubernetes/issues/32692

@janetkuo PTAL

Revert "simplify RC and SVC listers"

Automatic merge from submit-queue

Fix elasticsearch cluster logging e2e test on GCI

Fix #33126
Fix #32804

Additional timeouts are proven unnecessary, the problem lies with the cpu limits

Automatic merge from submit-queue

Behave gracefully in kubectl if /version returns 404

Fixes https://github.com/kubernetes/kubernetes/issues/32679. 

It's only about caching the swagger spec here. So it's safe to fall back to non-caching mode and continue.

Automatic merge from submit-queue

simplify RC and SVC listers

Make the RC and SVC listers use the common list functions that more closely match client APIs, are consistent with other listers, and avoid unnecessary copies.

Automatic merge from submit-queue

Update the Kubernetes version in sample federation deployment config to 1.4.0.

cc @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

Dumping federation events if federation e2e test failed

Updating the e2e framework to dump events in federation control plane if a federation e2e test failed.

This should help in debugging https://github.com/kubernetes/kubernetes/issues/32733

cc @kubernetes/sig-cluster-federation

Automatic merge from submit-queue

When client config is default or default is invalid, check ICC

Alternative fix to #33019

Automatic merge from submit-queue

controller: enhance timeout error message for Recreate deployments

Makes the error message from https://github.com/kubernetes/kubernetes/issues/29197 more obvious

@kubernetes/deployment

Automatic merge from submit-queue

Fix possible panic in PodAffinityChecker

In `PodAffinityChecker.getMatchingAntiAffinityTerms()` `affinity.PodAntiAffinity` can be `nil` in this place. This problem occurs e.g. when `nil` is passed as `meta` to `PodAffinityChecker.InterPodAffinityMatches()`.

Stumbled upon it while working on #31136 (someone PTAL at that PR too, I've submitted it a month ago and seemingly no one noticed it), kube-controller-manager was crashing there.

Automatic merge from submit-queue

delete private interface with no references in package

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:
code quality. 

**Which issue this PR fixes**:
does not fix anything. removes unused interface. 

**Special notes for your reviewer**:
It does not do anything. Let us remove it.

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
NONE
```

Automatic merge from submit-queue

compensate for raft/cache delay in namespace admission

When attempting to create an object in a just-created namespace, the admission plugin can reject the creation attempt for two reasons:

1. The cache of existing namespaces has not observed the creation watch event yet. There was already compensation to perform a live lookup if the namespace was not found in the cache.

2. The live lookup can be performed against a non-leader in a HA etcd setup, and can return NotFound if the non-leader etcd has not observed the creation.

This PR adds a delay, then rechecks the cache before proceeding with the live lookup. This gives both the cache and the backing storage more time to observe the create, before failing the request.

This commit moves away from using a global variable for default
configuration checking, and instead exposes a method on LoadingRules to
determine whether a particular restclient.Config should be considered
"default". This allows kubectl to provide its own defaults (the same
as before, KUBERNETES_MASTER and the static localhost:8080 values) while
allowing other clients to avoid defining them.

In-cluster config defaulting is now easier to read.

Automatic merge from submit-queue

gce/util: $replica-pd --> $replica_pd

\cc @quinton-hoole @madhusudancs 

fixes #32997

Automatic merge from submit-queue

Move generated openAPI specs out of genericapiserver and make it configurable

A follow up to #31468

Generated OpenAPI Spec does not belong to genericapiserver package. A new package "generated" created in hope of all generated codes goes into it in future. Openapi folder of that package contains generated definitions and generic API server will accept the definition map as a configuration parameter.

Reference: #13414

Automatic merge from submit-queue

stop etcd watcher when watch chan is closed

When startWatching() stops due to the watch chan is closed, the watcher could still keeps running in the background. When this case happen, we should stop the watcher entirely and close ResultChan() too.

Automatic merge from submit-queue

federation ingress controller: Fixing a panic by initialising the map before using it

Ref https://github.com/kubernetes/kubernetes/issues/32733#issuecomment-248428635

cc @kubernetes/sig-cluster-federation @quinton-hoole

Automatic merge from submit-queue

Only approve evictions when budgets would stay enforced after.

Prior to this, we would approve eviction as long as the current state of
the pods matched the budget.  The new version requires that after the
eviction, the pods would still match the budget.

Also update tests to match.

Prior to this, we would approve eviction as long as the current state of
the pods matched the budget.  The new version requires that after the
eviction, the pods would still match the budget.

Also update tests to match.

Automatic merge from submit-queue

Stop referring to loop variable inside closure.

Prior to this, I was actually running the same (last) test 5 times in a row.  :-(

Fixes #33137

Automatic merge from submit-queue

Fix the properties file for node e2e cri validation.

I fixed this locally before, but accidentally missed in the PR. Sorry about that.

This time, I've tried myself, it should work.

@yujuhong

Automatic merge from submit-queue

In error, the first letter is low-case letter

Automatic merge from submit-queue

Fix backward compatibility issue caused by promoting initcontainers f…

#31026 moves init-container feature from alpha to beta, but only took care the backward compatibility for pod specification, not deal with status. For status, it simply moved from `pods.beta.kubernetes.io/init-container-statuses` to
`pods.beta.kubernetes.io/init-container-statuses` instead of introducing one more pods.beta.kubernetes.io/init-container-statuses. This breaks when the cluster is running with 1.4, but the user is still running with kubectl 1.3.x. 

Fixed #32711

Automatic merge from submit-queue

Bump up GCI version.

```release-note
   Upgrading Container-VM base image for k8s on GCE. Brief changelog as follows:
    - Fixed performance regression in veth device driver
    - Docker and related binaries are statically linked
    - Fixed the issue of systemd being oom-killable
```

Fixes #32596

This needs a cherrypick into v1.4 release branch because it is fixing v1.4 release blocking issues. This patch is easy and safe to rollback in case of emergencies.

@vishh can you please review?

Fixes #32596 and many other issues.
cc/ @kubernetes/goog-image  FYI

Automatic merge from submit-queue

Move HighWaterMark to the top of the struct in order to fix arm

I haven't tested this yet, but let's see how e2e tests react.
It should be no difference at all except for that it will fix arm.

etcd has had to do this some times (and I think there are some fixes like this that are needed for etcd as well)

For reference see: https://golang.org/pkg/sync/atomic/

This should be a cherrypick-candidate for v1.4.1 (as I understand it, v1.4.0 has clearly left the cherrypickable state)

@lavalamp @pwittrock @xiang90 @smarterclayton

Automatic merge from submit-queue

use groupmetafactoryregistry

Switches all groups to the new API registration mechanism.

@ncdc ptal