Automatic merge from submit-queue (batch tested with PRs 65897, 65909, 65856, 65815). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

only need to ignore resources that match discovery conditions

GC and quota controllers ignore resources that are too expensive to manage.  In kube this is only events.  The incompatible resources should now be excluded on the basis of discovery.  We should actually reflect that in the RESTStorage (done for GC for events) and discovery too.

@liggitt 
@kubernetes/sig-api-machinery-bugs 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 65897, 65909, 65856, 65815). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

make RBAC escalation error message more useful

Fixes #65804

Tested by granting a namespaced admin role to a user, then attempt to grant a broader role as that user:

```
kubectl create rolebinding user1-admin --clusterrole=admin --user=user1
kubectl create rolebinding user2-volume --as=user1 --clusterrole=system:volume-scheduler --user=user2
```

before:
> Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io "user2-volume" is forbidden: attempt to grant extra privileges: [{[get] [] [persistentvolumes] [] []} {[list] [] [persistentvolumes] [] []} {[patch] [] [persistentvolumes] [] []} {[update] [] [persistentvolumes] [] []} {[watch] [] [persistentvolumes] [] []} {[get] [storage.k8s.io] [storageclasses] [] []} {[list] [storage.k8s.io] [storageclasses] [] []} {[watch] [storage.k8s.io] [storageclasses] [] []}] user=&{user1  [system:authenticated] map[]} ownerrules=[{[create] [authorization.k8s.io] [selfsubjectaccessreviews selfsubjectrulesreviews] [] []} {[get] [] [] [] [/api /api/* /apis /apis/* /healthz /openapi /openapi/* /swagger-2.0.0.pb-v1 /swagger.json /swaggerapi /swaggerapi/* /version /version/]} {[create delete deletecollection get list patch update watch] [] [pods pods/attach pods/exec pods/portforward pods/proxy] [] []} {[create delete deletecollection get list patch update watch] [] [configmaps endpoints persistentvolumeclaims replicationcontrollers replicationcontrollers/scale secrets serviceaccounts services services/proxy] [] []} {[get list watch] [] [bindings events limitranges namespaces/status pods/log pods/status replicationcontrollers/status resourcequotas resourcequotas/status] [] []} {[get list watch] [] [namespaces] [] []} {[impersonate] [] [serviceaccounts] [] []} {[create delete deletecollection get list patch update watch] [apps] [daemonsets deployments deployments/rollback deployments/scale replicasets replicasets/scale statefulsets statefulsets/scale] [] []} {[create delete deletecollection get list patch update watch] [autoscaling] [horizontalpodautoscalers] [] []} {[create delete deletecollection get list patch update watch] [batch] [cronjobs jobs] [] []} {[create delete deletecollection get list patch update watch] [extensions] [daemonsets deployments deployments/rollback deployments/scale ingresses networkpolicies replicasets replicasets/scale replicationcontrollers/scale] [] []} {[create delete deletecollection get list patch update watch] [policy] [poddisruptionbudgets] [] []} {[create delete deletecollection get list patch update watch] [networking.k8s.io] [networkpolicies] [] []} {[create] [authorization.k8s.io] [localsubjectaccessreviews] [] []} {[create delete deletecollection get list patch update watch] [rbac.authorization.k8s.io] [rolebindings roles] [] []}] ruleResolutionErrors=[]

after
> Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io "user2-volume" is forbidden: user "user1" (groups=["system:authenticated"]) is attempting to grant RBAC permissions not currently held:
> {APIGroups:[""], Resources:["persistentvolumes"], Verbs:["get" "list" "patch" "update" "watch"]}
> {APIGroups:["storage.k8s.io"], Resources:["storageclasses"], Verbs:["get" "list" "watch"]}

Automatic merge from submit-queue (batch tested with PRs 65897, 65909, 65856, 65815). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Make proxier params configurable in kubemark

Ref #63025

Automatic merge from submit-queue (batch tested with PRs 65838, 65837). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

output which pods are a pvc in use when kubectl describe pvc is run

**What this PR does / why we need it**:
This PR implements a feature request to display the pods mounted to a PVC when `kubectl describe pvc` is ran. We need it since the only way to see which pods are bound to a PVC is by checking the volume mounts of each individual pod in the namespace. 

Example Output:
```
$ kubectl get pods,pvc
NAME     READY  STATUS    RESTARTS   AGE
test-pod   1/1       Running       0                2h

NAME      STATUS    VOLUME                                   CAPACITY  ACCESS MODES   STORAGECLASS        AGE
test-pvc  Bound     pvc-718681dd-70cc-11e7-aa14-42010af00029   100Gi      RWO            us-east1-b          345d
```

```
$ kubectl describe pvc
Name:          elasticsearch-data-elasticsearch-data-us-east1-b-0
Namespace:     partners-production
StorageClass:  us-east1-b
Status:        Bound
Volume:      pvc-718681dd-70cc-11e7-aa14-42010af00029
Labels:       <none>
Annotations:   <none>
Finalizers:    [kubernetes.io/pvc-protection]
Capacity:      1Gi
Access Modes:  RWO
Events:        <none>
Mounted By:     test-pod
```

Pods using the PVC are shown with the `Mounted By` field

**Which issue(s) this PR fixes**:
Closes #65233 

**Special notes for your reviewer**:

**Release note**:
```release-note
Running `kubectl describe pvc` now shows which pods are mounted to the pvc being described with the `Mounted By` field
```

Automatic merge from submit-queue (batch tested with PRs 65838, 65837). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix kubectl cluster-info bug

**What this PR does / why we need it**:
   When api-server is not avaiable,` kubectl cluster-info `still prints information like: the cluster is running at ...
    This patch fixes this bug

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes: #65817 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

sort pods in kubectl describe pvc with user-defined alignment

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add new owners to vSphere cloud provider

/sig cloud-provider
/cc @abrarshivani @baludontu @divyenpatel @imkin

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add cleanLegacyBindAddr

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #65263

**Special notes for your reviewer**:
To fix the issue,   
use `activeBindAddrs` map which represents ip address successfully bind to DefaultDummyDevice in the round of sync  
use `currentBindAddrs` map which represents ip addresses bind to DefaultDummyDevice from the system  
create a function `cleanLegacyBindAddr` to unbind address which is in `currentBindAddrs` map but not in `activeBindAddrs` map

**Release note**:

```release-note
NONE
```

/sig network
/area kube-proxy

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Bump addon resizer image to 1.8.2

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix azure storage account creation failure

**What this PR does / why we need it**:
fix azure storage account creation failure

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #65845

**Special notes for your reviewer**:
This bug is due to azure-sdk-for-go API change introduced in v1.11:
https://github.com/Azure/azure-sdk-for-go/blob/fbe7db0e3f9793ba3e5704efbab84f51436c136e/services/storage/mgmt/2017-10-01/storage/models.go#L381-L382

there is a new field `Kind` which is required, so any sdk upgrade from and old version would break the storage account creation since old code won't use `Kind`. I have filed an issue to azure-sdk-for-go: https://github.com/Azure/azure-sdk-for-go/issues/2182

**Release note**:

```
fix azure storage account creation failure
```

/kind bug
/sig azure
/assign @khenidak @feiskyer 
cc @brendandburns

fix comments

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

controller-managers: allow high ports in secure serving validation

Certain operating systems will select high port (>32768) when asked for a free port. This PR changes the validation to allow that.

Like https://github.com/kubernetes/kubernetes/pull/65833, but for controller managers.

```release-note
Allow kube- and cloud-controller-manager to listen on ports up to 65535.
```

Automatic merge from submit-queue (batch tested with PRs 65839, 65878). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

juju: Fix kubernetes-worker certificate SANs on AWS

**What this PR does / why we need it**:

This fixes a problem with kubernetes-worker that prevents `kubectl logs` and `kubectl exec` from working when deployed on AWS.

Specifically, this adds hostname back into the certificate request's SANs so that kube-apiserver can talk to kubelet properly.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:

https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/606

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove duplicate check line in cpumanager

**What this PR does / why we need it**:
There is a same [line](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/cm/cpumanager/policy_static.go#L81).

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 64511, 65865, 65867, 65866). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kube-controller-manager: add stopCh plumbing

Needed for integration testing.

Automatic merge from submit-queue (batch tested with PRs 64511, 65865, 65867, 65866). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kube-controller-manager: create self-signed certs

If secure serving is enabled (not automatically wired yet, but 3rdparties could wire it), create self-signed certs if none are given. Reuses the code from k8s.io/apiserver.

Automatic merge from submit-queue (batch tested with PRs 64511, 65865, 65867, 65866). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

split of test-cmd

This pull moves test-cmd to a `test/cmd` folder for team maintenance.  The next commit splits the mega (6 thousand lines or so?) into files based on function.  No changes, just moves.

@kubernetes/sig-cli-maintainers 
@fejta per request

```release-note
NONE
```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Quobyte API update

**What this PR does / why we need it**:
Quobyte vendor API update
The current version supports both UUID/name of the volume for the storage class.

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 64911, 65710). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiextensions-apiserver: add pkg/cmd/server/testing pkg for integration tests

In analogy to kube-apiserver, this implements a uniform apiextensions-apiserver for integration tests which can be started using customized flags.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: use constant instead of hardcoded path

**What this PR does / why we need it**:

Used DefaultCRISocket constant instead of hardcoded path
/var/run/dockershim.sock

**Release note**:
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 65822, 65834, 65859, 65631). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: Add support for reading multiple YAML documents

**What this PR does / why we need it**:
In preparation for splitting the kubelet and kube-proxy componentconfigs out of the MasterConfiguration API struct, add support for reading multiple YAML documents

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
ref: kubernetes/kubeadm#911
Depends on:
 - [x] https://github.com/kubernetes/kubernetes/pull/65776
 - [x] https://github.com/kubernetes/kubernetes/pull/65628
 - [x] https://github.com/kubernetes/kubernetes/pull/65629

**Special notes for your reviewer**:
Please only review the `Refactor a bit of the config YAML loading code, and support loading multiple YAML documents` commit

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 65822, 65834, 65859, 65631). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix field name in autoscaling e2e tests

Use new field name

```release-note
NONE
```

/cc @MaciekPytel

Automatic merge from submit-queue (batch tested with PRs 65822, 65834, 65859, 65631). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiserver: don't create self-signed certs with disabled secure serving

Automatic merge from submit-queue (batch tested with PRs 65822, 65834, 65859, 65631). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Refactor kubemark docker image building logic

This PR:

- cleans up some redundant code in kubemark scripts for image-building
- removes calls to gcloud in image-building (to make it provider independent - ref https://github.com/kubernetes/kubernetes/pull/65242#issuecomment-402479648)

/cc @wojtek-t 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 65805, 65811, 65833, 65488, 65857). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update Cluster Autoscaler version to 1.3.1-beta.1

This update Cluster Autoscaler version to 1.3.1-beta.1 and changes the default value for expendable pods priority cutoff in GCP deployment.

```release-note
Cluster Autoscaler version updated to 1.3.1-beta.1. Release notes: https://github.com/kubernetes/autoscaler/releases/tag/cluster-autoscaler-1.3.1-beta.1
Default value for expendable pod priority cutoff in GCP deployment of Cluster Autoscaler changed from 0 to -10.

action required: users deploying workloads with priority lower than 0 may want to use priority lower than -10 to avoid triggering scale-up.
```

Automatic merge from submit-queue (batch tested with PRs 65805, 65811, 65833, 65488, 65857). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

flatten nested lists for flatten in visitor

Lists which contain lists should themselves be flattened by a flatten call to the resource builder

@kubernetes/sig-cli-maintainers 
@soltysh @juanvallejo 

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 65805, 65811, 65833, 65488, 65857). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kube-scheduler: allow high ports in secure serving validation

Certain operating systems will select high port (>32768) when asked for a free port. This PR changes the validation to allow that.

```release-note
Allow kube-scheduler to listen on ports up to 65535.
```

Automatic merge from submit-queue (batch tested with PRs 65805, 65811, 65833, 65488, 65857). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

client-go/discovery: fix godoc package comment

Fixes https://github.com/kubernetes/client-go/issues/436

/sig api-machinery
/kind cleanup
/shrug

/assign sttts 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 65805, 65811, 65833, 65488, 65857). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix print format string

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

In analogy to kube-apiserver.

Used DefaultCRISocket constant instead of hardcoded path
/var/run/dockershim.sock

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kube-apiserver: drop unused loopback token in insecure mode

The token was not used. Removing the dead code.