Automatic merge from submit-queue (batch tested with PRs 46124, 46434, 46089, 45589, 46045)

Copy kubeconfig to kubemark master

This should save the effort of digging through jenkins agent and its container to get the kubeconfig.
Ideally we should have kubectl directly working on the kubemark master, but I'm facing some issues due to older version of kubectl present by default on the node.

cc @wojtek-t @gmarek

Automatic merge from submit-queue (batch tested with PRs 46124, 46434, 46089, 45589, 46045)

Add CephFS volume source to describe printer.

Automatic merge from submit-queue (batch tested with PRs 45949, 46009, 46320, 46423, 46437)

Up namespace controller workers to 5

Increase the number of namespace controller workers from 2 to 5 in an
effort to speed up namespace deletions.

xref #20051

Automatic merge from submit-queue (batch tested with PRs 45949, 46009, 46320, 46423, 46437)

Fix performance test issues

Fix #46198

Automatic merge from submit-queue (batch tested with PRs 45949, 46009, 46320, 46423, 46437)

e2e tests for storage policy support in Kubernetes

This PR covers e2e test cases for vSphere storage policy support in Kubernetes - #46176.

The following test scenario have been implemented.
- Specify only SPBM storage policy name.
     - Verify if the disk is provisioned on a compatible datastore with max free space.
- Specify a storage policy name which is not defined on VC.
    - Verify if PVC create errors out that no pbm profile with this policy is found.
- Specify both SPBM storage policy name and VSAN capabilities together.
    - Verify if PVC create errors out that you can't use both SPBM policy name with VSAN capabilities. You can only specify one.
- Specify SPBM storage policy name with user specified datastore which is non-compatible.
   - Verify if PVC create errors out that it can't provision a disk on a non-compatible datastore.

@jeffvance @divyenpatel

**Release note**:

```release-note
None
```

Automatic merge from submit-queue (batch tested with PRs 45949, 46009, 46320, 46423, 46437)

Implement audit policy logic

Includes https://github.com/kubernetes/kubernetes/pull/45315#discussion_r117115932 (ignore the first commit)

Feature: https://github.com/kubernetes/features/issues/22

Remaining work:

- [x] Load the policy into the `server.Config`
- [x] Rebase on https://github.com/kubernetes/kubernetes/pull/45315
- [x] Establish shared code for audit api scheme (with https://github.com/kubernetes/kubernetes/pull/45919)
- [x] Once https://github.com/kubernetes/kubernetes/pull/45766 is merged, call the policy checker in the audit path

/cc @sttts @soltysh @ericchiang @ihmccreery @pweil- @deads2k

Automatic merge from submit-queue (batch tested with PRs 45949, 46009, 46320, 46423, 46437)

Unregister some metrics

delete some registered metrics since they are not observed


**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 45518, 46127, 46146, 45932, 45003)

PodDisruptionBudget should use ControllerRef

Fixes https://github.com/kubernetes/kubernetes/issues/42284

```release-note
PodDisruptionBudget now uses ControllerRef to decide which controller owns a given Pod, so it doesn't get confused by controllers with overlapping selectors.
```

Automatic merge from submit-queue (batch tested with PRs 45518, 46127, 46146, 45932, 45003)

aws: Support for ELB tagging by users

This PR provides support for tagging AWS ELBs using information in an
annotation and provided as a list of comma separated key-value pairs.

Closes https://github.com/kubernetes/community/pull/404

Automatic merge from submit-queue (batch tested with PRs 45518, 46127, 46146, 45932, 45003)

Fix bug in SMP test

Fixing a bug in strategic merge patch test.

before:
we check if customizedSort(input) == customizedSort(expected), which is always true
after:
we check if customizedSort(input) == expected

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 45518, 46127, 46146, 45932, 45003)

Return MethodNotSupported when accessing unwatcheable resource with ?watch=true

Currently, if a RESTStorage does not implement Watch(), accessing the list endpoint with ?watch=true will call List, with ListOptions.Watch=true. It should return a MethodNotSupported error.

Automatic merge from submit-queue (batch tested with PRs 45518, 46127, 46146, 45932, 45003)

Remove requirement to run the Portworx volume driver on master node

**What this PR does / why we need it**:
This change removes requirement to run the Portworx volume driver on Kubernetes master node.

**Special notes for your reviewer**:
Before this pull request, in order to use a Portworx volume, users had to run the Portworx container on the master node. Since it isn't ideal (and impossible on GKE) to schedule any pods on the master node, this PR removes that requirement.

Automatic merge from submit-queue

fix regression in UX experience for double attach volume

send event when volume is not allowed to multi-attach

Fixes #46012

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 45269, 46219, 45966)

Update RBAC policy for configmap locked leader leasing.

**What this PR does / why we need it**:
Updates the bootstrap policy to allow for configmap get/update/list/watch for leader leasing. 

**Which issue this PR fixes** 
Follow on PR from: https://github.com/kubernetes/kubernetes/pull/45739

xref: #44857

**Special notes for your reviewer**:

**Release note**:

```
NONE
```

/cc @kubernetes/sig-auth-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 45269, 46219, 45966)

Add overriding Stackdriver API endpoint

Allow using Stackdriver test endpoint.

Automatic merge from submit-queue (batch tested with PRs 45269, 46219, 45966)

update gopass to fix format error

```
#kubectl get no
Please enter Username: admin
Please enter Password: ********
                               NAME        STATUS    AGE       VERSION
127.0.0.1   Ready     28s       v1.7.0-alpha.2.357+904b0207-dirty
```
`godep update github.com/howeyc/gopass/` can fix it.

Increase the number of namespace controller workers from 2 to 5 in an
effort to speed up namespace deletions.

Automatic merge from submit-queue (batch tested with PRs 44774, 46266, 46248, 46403, 46430)

apiextensions: fix nil dereference during deletion

The returned condition was possibly nil and we dereferenced it.

Automatic merge from submit-queue (batch tested with PRs 44774, 46266, 46248, 46403, 46430)

hollow-node.go:delete useless para. and import

**What this PR does / why we need it**:
hollow-node.go:delete useless para. and import

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 44774, 46266, 46248, 46403, 46430)

[Federation] ClusterSelector for Service Controller

This pull request adds ClusterSelector to the Federated Service Controller ref: design #29887 This back ports the same functionality from the sync controller (merged pull #40234).

cc: @nikhiljindal @marun

Automatic merge from submit-queue (batch tested with PRs 44774, 46266, 46248, 46403, 46430)

kube-proxy: ratelimit runs of iptables by sync-period flags

This bounds how frequently iptables can be synced.  It will be no more often than every 10 seconds and no less often than every 1 minute, by default.

@timothysc FYI

@dcbw @freehan FYI

Automatic merge from submit-queue

Switch Deployments to new hashing algo w/ collision avoidance mechanism

Implements https://github.com/kubernetes/community/pull/477

@kubernetes/sig-apps-api-reviews @kubernetes/sig-apps-pr-reviews 

Fixes https://github.com/kubernetes/kubernetes/issues/29735
Fixes https://github.com/kubernetes/kubernetes/issues/43948

```release-note
Deployments are updated to use (1) a more stable hashing algorithm (fnv) than the previous one (adler) and (2) a hashing collision avoidance mechanism that will ensure new rollouts will not block on hashing collisions anymore.
```

Signed-off-by: Michail Kargakis <mkargaki@redhat.com>

Automatic merge from submit-queue (batch tested with PRs 45573, 46354, 46376, 46162, 46366)

GCE - Retrieve subnetwork name/url from gce.conf 

**What this PR does / why we need it**:
Features like ILB require specifying the subnetwork if the network is type manual.

**Notes:**
The network URL can be [constructed](https://github.com/nicksardo/kubernetes/blob/68e7e18698d60050924c0f0e8f794a21820f2a1a/pkg/cloudprovider/providers/gce/gce.go#L211-L217) by fetching instance metadata; however, the subnetwork is not provided through this feature. Users must specify the subnetwork name/url through the gce.conf.

Although multiple subnets can exist in the same region for a network, the cloud provider will only use one subnet url for creating LBs. 


**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 45573, 46354, 46376, 46162, 46366)

break the loop when found true

break the loop when found true.

Automatic merge from submit-queue (batch tested with PRs 45573, 46354, 46376, 46162, 46366)

[Federation] Uniquify the ClusterRole and ClusterRoleBinding names created by `kubefed join`

This allows a cluster to be in multiple federations.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 45573, 46354, 46376, 46162, 46366)

Subresources are not included in apiserver prometheus metrics

Subresources are very often completely different code paths and errors
generated on those code paths are important to distinguish.

@kubernetes/sig-api-machinery-pr-reviews

```release-note
The Prometheus metrics for the kube-apiserver for tracking incoming API requests and latencies now return the `subresource` label for correctly attributing the type of API call.
```

Automatic merge from submit-queue (batch tested with PRs 45573, 46354, 46376, 46162, 46366)

Add Simplified Chinese translation for kubectl

What this PR does / why we need it:
This PR provides first attempt to translate kubectl in Simplified Chinese.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #
No issues

Special notes for your reviewer:
Although I'm a native speaker for Mandarin Chinese, but I think translation is a whole different knowledge which I'm not good at it, so this pr absolutely need to be polished.
@adohe @mengqiy @resouer @k82cn @caesarxuchao @wanghaoran1988 sorry I think there are so many folks who are good at Chinese I haven't mention, feel free to leave a comment on it : )
also cc @brendandburns

Signed-off-by: Michail Kargakis <mkargaki@redhat.com>

Signed-off-by: Michail Kargakis <mkargaki@redhat.com>

Signed-off-by: Michail Kargakis <mkargaki@redhat.com>

Signed-off-by: Michail Kargakis <mkargaki@redhat.com>

Automatic merge from submit-queue (batch tested with PRs 45913, 46065, 46352, 46363, 46373)

don't queue namespaces for deletion if the namespace isn't deleted

Most namespaces aren't deleted most of the time.  No need to queue them for cleanup if they aren't deleted.

Automatic merge from submit-queue (batch tested with PRs 45913, 46065, 46352, 46363, 46373)

Fix CheckPodsCondition to print out the correct podName

From a couple CIs (https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/logs/ci-kubernetes-e2e-gce-serial/1114, https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/logs/ci-kubernetes-e2e-gce-gci-qa-serial-master/2246, https://storage.googleapis.com/kubernetes-jenkins/logs/ci-kubernetes-e2e-gci-gke-pre-release/2187), all indicate we print out the wrong pod name in CheckPodsCondition for _"Pod XXX failed to be running and ready, or succeeded."_:
```
I0524 02:09:50.173] May 24 02:09:50.173: INFO: Waiting for pod heapster-v1.3.0-3806988011-kzkg6 in namespace 'kube-system' status to be 'running and ready, or succeeded'(found phase: "Running", readiness: false) (4m55.033881993s elapsed)
I0524 02:09:52.178] May 24 02:09:52.178: INFO: Waiting for pod heapster-v1.3.0-3806988011-kzkg6 in namespace 'kube-system' status to be 'running and ready, or succeeded'(found phase: "Running", readiness: false) (4m57.03848264s elapsed)
I0524 02:09:54.183] May 24 02:09:54.182: INFO: Waiting for pod heapster-v1.3.0-3806988011-kzkg6 in namespace 'kube-system' status to be 'running and ready, or succeeded'(found phase: "Running", readiness: false) (4m59.043463323s elapsed)
I0524 02:09:56.183] May 24 02:09:56.183: INFO: Pod fluentd-gcp-v2.0-6wf67 failed to be running and ready, or succeeded.
I0524 02:09:56.184] May 24 02:09:56.183: INFO: Wanted all 23 pods to be running and ready, or succeeded. Result: false. Pods: [heapster-v1.3.0-3806988011-kzkg6 kube-proxy-bootstrap-e2e-minion-group-bbwn rescheduler-v0.3.0-bootstrap-e2e-master monitoring-influxdb-grafana-v4-1q59k l7-default-backend-1044750973-zgxsc etcd-server-events-bootstrap-e2e-master kube-apiserver-bootstrap-e2e-master kube-proxy-bootstrap-e2e-minion-group-6nqb kube-proxy-bootstrap-e2e-minion-group-mzbz fluentd-gcp-v2.0-chd2x kube-dns-806549836-f8p46 fluentd-gcp-v2.0-44x97 kube-dns-autoscaler-2528518105-vlg8t fluentd-gcp-v2.0-p1h4b kube-controller-manager-bootstrap-e2e-master l7-lb-controller-v0.9.3-bootstrap-e2e-master kubernetes-dashboard-2917854236-tn3nx kube-dns-806549836-fq2fp kube-scheduler-bootstrap-e2e-master etcd-empty-dir-cleanup-bootstrap-e2e-master kube-addon-manager-bootstrap-e2e-master etcd-server-bootstrap-e2e-master fluentd-gcp-v2.0-6wf67]
I0524 02:09:56.184] May 24 02:09:56.183: INFO: At least one pod wasn't running and ready or succeeded at test start.
I0524 02:09:56.184] [AfterEach] [k8s.io] Restart [Disruptive]
```

Check the codes and found we always print out the last pod name, which is random. Pass the pod name into channel to fix.

**Release note**:

```release-note
NONE
```