Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add validation of kubelet and kube-proxy configuration in kubeadm.

**What this PR does / why we need it**:
kubeadm has implemented the support for Kubelet Dynamic Configuration. This PR adds validation on the kubelet configuration.

kube-proxy validation also added in this PR.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
ref: https://github.com/kubernetes/kubeadm/issues/28

**Special notes for your reviewer**:
/cc @luxas @kubernetes/sig-cluster-lifecycle-pr-reviews

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove SupportIPVSProxyMode feature gate in kubeadm.

**What this PR does / why we need it**:
Since #55972 gets merged, kubeadm now supports using kube-proxy ComponentConfig. Then `SupportIPVSProxyMode` feature gate can be configured in kube-proxy config. There is no need to config the feature gate in kubeadm (workaround introduced by #53962). The benefit of removing it I can think of is that we don't need to care about the IPVS feature evolution in kubeadm any longer.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubeadm/issues/512

**Special notes for your reviewer**:
/cc @luxas @Lion-Wei @kubernetes/sig-cluster-lifecycle-pr-reviews 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update NetworkUnavailable condition in ipam controller

Ref #56332

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Make healthchecks skippable, and check masters only

**What this PR does / why we need it**:

Previously kubeadm would abort if _any_ node was not Ready.  This is obviously infeasible in a non-trivial (esp. baremetal) cluster.

This PR makes two changes:
- Allows kubeadm healthchecks to be selectively skipped (made non-fatal) with --ignore-checks-errors.
- Check only that the *master* nodes are Ready.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes/kubeadm#539

**Special notes for your reviewer**:

Builds on #56072

**Release note**:

```release-note
kubeadm health checks can also be skipped with `--ignore-checks-errors`
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use PATCHs instead of PUTs in CIDR allocator

Ref https://github.com/kubernetes/kubernetes/issues/52292

/cc @wojtek-t 

cc @kubernetes/sig-network-misc @bowei @MrHohn 

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use kube-proxy ComponentConfig in kubeadm clusters

This change adds configuring the kube-proxy bind address to be an
IPv6 address based on the whether the API server advertise address is IPv6.

It is doing this via the kube-proxy ComponentConfig API now from v1.9

**What this PR does / why we need it**:
This PR sets the bind address for kube-proxy to be a IPv6 address. This is needed for IPv6

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #50927
Fixes https://github.com/kubernetes/kubeadm/issues/527

**Special notes for your reviewer**:

**Release note**:

```release-note
Adds kubeadm support for using ComponentConfig for the kube-proxy
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix controlplane unit tests

What this PR does / why we need it:

when the flexvolumeDirVolumePath is truely existent in the host,
```cmd/kubeadm/app/phases/controlplane``` unit tests will be failed.

Fixes #56189

Release note:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 52049, 56176). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Install kmod instead of module-init-tools in iptables image

**What this PR does / why we need it**: another bit of #52744 that was inadvertently missed.
The debian-iptables image that was pushed already had this fix, but it got lost in rebase, I think.

`module-init-tools` was an alias for `kmod` in debian:jessie, but debian:stretch removed the former.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix failure to load volume plugins for #52048

Currently we have two plugin managers.
However one of them limits the cloud plugins it loads.
This means that if cloud provider is set to external the plugins will
not be loaded in *that* plugin manager. However they will be loaded in
the other instance of the plugin manager. So it does not actually save
us anything. It does hamper the efforts to actually get stage 1
separation working.

**What this PR does / why we need it**: It allows the plugins be found for the cloud providers working on stage 1 separation.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #52048 

**Special notes for your reviewer**:

**Release note**:
```release-note NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Migrate CIDR allocators to shared node informer

Ref https://github.com/kubernetes/kubernetes/issues/52292

/cc @wojtek-t @bowei

Automatic merge from submit-queue (batch tested with PRs 56208, 55690). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Dump last curl output if cluster fails to come up.

**What this PR does / why we need it**:
This is a step toward solving #55686

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 56208, 55690). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: rename flag to --ignore-preflight-errors

**What this PR does / why we need it**:
Addresses comments in #56072
Improves user experience by using name that is more
descriptive.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes/kubeadm#480

**Special notes for your reviewer**:
/area kubeadm
/sig cluster-lifecycle
/assign @timothysc

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 55824, 53179). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Allow Pod Security Policy to manage access to the Flexvolumes

**What this PR does / why we need it**:
For proposal: https://github.com/kubernetes/community/blob/a1b9495e1b722699196ccec88d831fc850100827/contributors/design-proposals/auth/flex-volumes-drivers-psp.md (https://github.com/kubernetes/community/issues/723)
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Pod Security Policy can now manage access to specific FlexVolume drivers
```

Automatic merge from submit-queue (batch tested with PRs 55824, 53179). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Postpone Deletion of a Persistent Volume Claim in case It Is Used by a Pod

**What this PR does / why we need it**:
to fix https://github.com/kubernetes/kubernetes/issues/45143

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubernetes/issues/45143

**Special notes for your reviewer**:
**Design:** https://github.com/kubernetes/community/blob/master/contributors/design-proposals/storage/postpone-pvc-deletion-if-used-in-a-pod.md
@msau42 @jsafrane @gnufied PTAL

**Release note**:

```release-note
PVC Finalizing Controller is introduced in order to prevent deletion of a PVC that is being used by a pod.
```

Improves user experience by using name that is more
descriptive.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Bump CPU requirements of L7 LB controller.

**Which issue(s) this PR fixes**
Fixes #56051

**Release note**:
```release-note
NONE
```

It watches PVCs and Pods and updates PVCs.

This controller removes protection finalizer from PVCs that are being
deleted and are not referenced by any pod.

This admission plugin puts finalizer to every created PVC. The finalizer is
removed by PVCProtectionController when the PVC is not referenced by any
pods and thus the PVC can be deleted.

Kubelet must not start pods that use PVCs that are being
deleted.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add deployment for Stackdriver Metadata Agent with version and resource requirement controlled by env variable

**What this PR does / why we need it**:
Introduces Stackdriver Metadata Agent - a daemon set providing metadata for kubernetes objects connected to the same node.

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 54843, 55810). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Integrating cadvisor stats to CRI Pod stats collection

For kubernetes-incubator/cri-containerd#341



**What this PR does / why we need it**:
This PR contains changes to update kubelet to consume metrics from both CRI and cadvisor for Pod stats. The corresponding cadvisor changes are here https://github.com/google/cadvisor/pull/1795.
Today CRI stats provides only core metrics such as CPU Usage, Memory Usage, Disk Usage. However the stats exposed by kubelet which is a superset of core metrics and Network, User Defined Metrics are not provided by CRI stats. Hence kubelet stats are extracted from 2 sources , CRI stats and cadvisor stats. 
After the change the summary stats for a CRI based runtime (containerd) is as show here:
https://gist.github.com/abhi/d7351861df6430eb4bc5d711d274ec35

This PR also contains test case change to reflect the stats for cri stats provider. 

**Which issue(s) this PR fixes** :
Fixes # https://github.com/kubernetes-incubator/cri-containerd/issues/341

**Special notes for your reviewer**:
https://docs.google.com/presentation/d/1Os3nyMRBlFuiBLCjPgeaPv6jXylrZW5jiDXJejlA3Wg/edit#slide=id.g27cb4cb6d8_0_0

Godep will be updated to main tree after https://github.com/google/cadvisor/pull/1795 PR is merged.

**Release note**:

```release-note
Kubelet can provide full summary api support except container log stats for CRI container runtime now.
```
cc @Random-Liu

Automatic merge from submit-queue (batch tested with PRs 54843, 55810). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix testSupport in downwardapi_test

add some code to test plugin.CanSupport function
/sig storage

Automatic merge from submit-queue (batch tested with PRs 56249, 56118, 56255, 56252, 56256). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kube-proxy: Fix NewProxyServer

Different OSes need different args.  This is not a great fix, but better
than adding an arg to Windows which doesn't need it.

Fixes #56238

```release-note
NONE
```