Automatic merge from submit-queue (batch tested with PRs 49218, 48253, 48967, 48460, 49230)

Fix the Azure file to work within different cloud environments

**What this PR does / why we need it**:
Fix the Azure file plugin to work within different cloud environments.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #46081

cc @rootfs @brendandburns

Automatic merge from submit-queue (batch tested with PRs 49218, 48253, 48967, 48460, 49230)

additional backoff in azure cloudprovider

Fixes #48971

**What this PR does / why we need it**:

We want to be able to opt in to backoff retry logic for kubelet-originating request behavior: node IP address resolution and node load balancer pool membership enforcement.

**Special notes for your reviewer**:

The use-case for this is azure cloudprovider clusters with large node counts, especially during cluster installation, or other scenarios when lots of nodes come online at once and attempt to register all resources with the backend API. To allow clusters at scale more control over the API request rate in-cluster, backoff config has the ability to meaningful slow down this rate, when appropriate.

**Release note**:

```additional backoff in azure cloudprovider
```

Automatic merge from submit-queue (batch tested with PRs 49218, 48253, 48967, 48460, 49230)

allow impersonate serviceaccount in cli

We can impersonate four kinds of resources according to the code:
https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/pkg/endpoints/filters/impersonation.go#L83

**Release note**:

```
allow impersonate serviceaccount in cli
```
Fixes: https://github.com/kubernetes/kubernetes/issues/48260

Automatic merge from submit-queue (batch tested with PRs 49218, 48253, 48967, 48460, 49230)

Restrict the visibility of two generated packages in pkg/client/

These two packages are deprecated. Please use the client-go copy of these two packages.

Currently staging/copy.sh copied these two packages to client-go. I'll send follow-up PRs to let code-gen output to client-go directly and remove these two packages. The purpose of this PR is to prevent more imports of these packages while I refactor the codegen.

Automatic merge from submit-queue (batch tested with PRs 48377, 48940, 49144, 49062, 49148)

add some more deprecation warnings to cluster

Part of https://github.com/kubernetes/kubernetes/issues/49213
@kubernetes/sig-cluster-lifecycle-misc

Automatic merge from submit-queue (batch tested with PRs 48377, 48940, 49144, 49062, 49148)

Add cos-dev-61-9733-0-0 to the benchmark tests

Ref: https://github.com/kubernetes/kubernetes/issues/42926

m60 has docker 1.13.1 while m61 has 17.03. This PR adds m61 to the benchmark tests so that we will have more data to compare.

PS: We will support fetching the latest image in an image family in the node e2e tests in the future.

**Release note**:

```
None
```

/assign @yujuhong 
/cc @kewu1992 @abgworrall

Automatic merge from submit-queue (batch tested with PRs 48377, 48940, 49144, 49062, 49148)

fixit: break sig-cluster-lifecycle tests into subpackage

this is part of fixit week. ref #49161

@kubernetes/sig-cluster-lifecycle-misc

Automatic merge from submit-queue (batch tested with PRs 48377, 48940, 49144, 49062, 49148)

support fc volume attach and detach

**What this PR does / why we need it**:
Support FC volume attach and detach to enforce RWO access

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #48953

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Add PriorityClass API object under new "scheduling" API group

**What this PR does / why we need it**: This PR is a part of a series of PRs to add pod priority to Kubernetes. This PR adds a new API group called "scheduling" with a new API object called "PriorityClass". PriorityClass maps the string value of priority to its integer value.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**: Given the size of this PR, I will add the admission controller for the PriorityClass in a separate PR.

**Release note**:

```release-note
Add PriorityClass API object under new "scheduling" API group
```

ref/ #47604
ref/ #48646

Automatic merge from submit-queue (batch tested with PRs 47509, 46821, 45319, 49121, 49125)

Tolerate a missing MasterName (for GKE)

When testing, GKE created clusters don't provide a `MasterName`, so don't throw a warning and give up when that happens.

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 47509, 46821, 45319, 49121, 49125)

gce: don't add kubelet bearer token to known tokens

Automatic merge from submit-queue (batch tested with PRs 47509, 46821, 45319, 49121, 49125)

api types: fix protobuf names that are different from JSON name

This PR fixes the naming of protobuf fields that are mismatched when compared to the JSON names. Because protobuf names aren't actually used during serialization, just the index, I think we can update these safely without changing the over the wire encoding (note that generated.pb.go doesn't change).

Can someone verify that fixing the name won't impact backward compatibility?

cc @kubernetes/sig-api-machinery-pr-reviews 

Fixes https://github.com/kubernetes/kubernetes/issues/45183

```release-notes
None
```

Automatic merge from submit-queue (batch tested with PRs 47509, 46821, 45319, 49121, 49125)

volume i/o tests for storage plugins

**What this PR does / why we need it**:
Addresses issues [25268](https://github.com/kubernetes/kubernetes/issues/25268) and [28367](https://github.com/kubernetes/kubernetes/issues/28367), though it may be weak re. the streaming i/o issue. @matchstick 

**Special notes for your reviewer**:
This is a new file. Plugins other than NFS, GlusterFS, iSCSI, and Ceph-RBD code will need to be supported in a separate PR.

```release-note
NONE
```

Automatic merge from submit-queue

Bump e2e mounttest image version to 0.8

Reduce the number of image files required for e2e test run
```release-note
NONE
```

Automatic merge from submit-queue

test/OWNERS: add zmerlynn

```release-note
NONE
```

Automatic merge from submit-queue

Switch from gazel to kazel

**What this PR does / why we need it**: switches to `kazel`, where all new development will be focused. Part of the effort for switching from `gazel` to `gazelle`.

I'm imagining that we'll use `kube::util::go_install_from_commit` to version `gazelle` as well.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: x-ref #47558

**Release note**:

```release-note
NONE
```

/release-note-none
/assign @mikedanese @spxtr

Automatic merge from submit-queue

add owners for shell2junit pkg

Per https://github.com/kubernetes/kubernetes/pull/47614#issuecomment-308888690
```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49143, 49211)

Add more logging to PD node delete test

**What this PR does / why we need it**: Adds more logging to `Pod Disks should be able to detach from a node which was deleted` test which started failing because `gcloud compute instances list` is failing with `exit status 1`.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: https://github.com/kubernetes/kubernetes/issues/49185

**Special notes for your reviewer**:

**Release note**: none

Automatic merge from submit-queue (batch tested with PRs 49143, 49211)

update cli owner

Update my GH handle from @ymqytw to @mengqiy
And remove @pwittrock from reviewer list, but he is still in the approver list.

/assign @pwittrock 

```release-note
NONE
```

These two packages are deprecated. Please use the client-go copy of these two
packages.

Automatic merge from submit-queue (batch tested with PRs 48981, 47316, 49180)

Add seccomp profile in sandbox security context

**What this PR does / why we need it**:

PR  #46332 adds seccomp profile to container security context, but not sandbox. This PR adds seccomp profile in sandbox security context. Without this, we couldn't honour "seccomp.security.alpha.kubernetes.io/pod" for sandbox.

**Which issue this PR fixes**

fixes #49179.

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/cc @yujuhong

Automatic merge from submit-queue (batch tested with PRs 48981, 47316, 49180)

Added golint check for pkg/kubelet.

**What this PR does / why we need it**:
Added golint check for pkg/kubelet, and make golint happy.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47315 

**Release note**:
```release-note-none
```

Automatic merge from submit-queue (batch tested with PRs 48981, 47316, 49180)

azure: acr: support MSI with preview ACR with AAD auth

**What this PR does / why we need it**:

The recently added support for Managed Identity in Azure (#48854) was incompatible with automatic ACR docker credential integration (#48980).

This PR resolves that, by leveraging a feature available in Preview regions, on new managed clusters with support for AAD `access_token` authentication.

Notes:
* This includes code copied from [Azure/acr-docker-credential-helper](https://github.com/Azure/acr-docker-credential-helper). I copied the MIT license from that project and added a copyright line for Microsoft on it. (but one of the hack/verify-* scripts requires the Kubernetes copyright header. So there are two copyright headers in the file now...)
* Eventually this should vendor  [Azure/acr-docker-credential-helper](https://github.com/Azure/acr-docker-credential-helper) when it exposes the right functionality.
* This includes a small, non-function-impacting workaround for a temporary service-side bug.


**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #48980

**Special notes for your reviewer**:
Please don't LGTM it without reviewing the `azure_acr_helper.go` file's license header...

**Release note**:
```release-note
azure: acr: support MSI with preview ACR with AAD auth
```

Automatic merge from submit-queue (batch tested with PRs 49058, 49072, 49137, 49182, 49045)

*: remove --insecure-allow-any-token option

~Since the authenticator is still used in e2e tests, don't remove
the actual package. Maybe a follow up?~

edit: e2e and integration tests have been switched over to the tokenfile
authenticator instead.

```release-note
The --insecure-allow-any-token flag has been removed from kube-apiserver. Users of the flag should use impersonation headers instead for debugging.
```

closes #49031

cc @kubernetes/sig-auth-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 49058, 49072, 49137, 49182, 49045)

Set default CIDR to /16 for Juju deployments

**What this PR does / why we need it**: Increase the number of IPs on a deployment

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/272

**Special notes for your reviewer**:

**Release note**:

```Set default CIDR to /16 for Juju deployments
```

Automatic merge from submit-queue (batch tested with PRs 49058, 49072, 49137, 49182, 49045)

check for nil value in interface for proxier health

golang allows for a non-nil interface to have a nil value (not type).  This results in an NPE at runtime.

@sttts remember that bit about go?  Trivia becomes real :(

Automatic merge from submit-queue (batch tested with PRs 49058, 49072, 49137, 49182, 49045)

use https to check healthz in hack/local-up-cluster.sh

**What this PR does / why we need it**:
```
# PSP_ADMISSION=true ALLOW_PRIVILEGED=true ALLOW_SECURITY_CONTEXT=true ALLOW_ANY_TOKEN=true ENABLE_RBAC=true RUNTIME_CONFIG="extensions/v1beta1=true,extensions/v1beta1/podsecuritypolicy=true" hack/local-up-cluster.sh
...
Waiting for apiserver to come up
+++ [0718 09:34:38] On try 5, apiserver: : 
Cluster "local-up-cluster" set.
use 'kubectl --kubeconfig=/var/run/kubernetes/admin-kube-aggregator.kubeconfig' to use the aggregated API server
Creating kube-system namespace
clusterrolebinding "system:kube-dns" created
serviceaccount "kube-dns" created
configmap "kube-dns" created
error: unable to recognize "kubedns-deployment.yaml": no matches for extensions/, Kind=Deployment
service "kube-dns" created
Kube-dns deployment and service successfully deployed.
kubelet ( 10952 ) is running.
Create podsecuritypolicy policies for RBAC.
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/policies.yaml": no matches for extensions/, Kind=PodSecurityPolicy
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/policies.yaml": no matches for extensions/, Kind=PodSecurityPolicy
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/roles.yaml": no matches for rbac.authorization.k8s.io/, Kind=ClusterRole
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/roles.yaml": no matches for rbac.authorization.k8s.io/, Kind=ClusterRole
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/bindings.yaml": no matches for rbac.authorization.k8s.io/, Kind=ClusterRoleBinding
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/bindings.yaml": no matches for rbac.authorization.k8s.io/, Kind=ClusterRoleBinding
unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/examples/podsecuritypolicy/rbac/bindings.yaml": no matches for rbac.authorization.k8s.io/, Kind=ClusterRoleBinding
Create default storage class for 
error: unable to recognize "/home/nfs/mygo/src/k8s.io/kubernetes/cluster/addons/storage-class/local/default.yaml": no matches for storage.k8s.io/, Kind=StorageClass
Local Kubernetes cluster is running. Press Ctrl-C to shut it down.

Logs:
  /tmp/kube-apiserver.log
  /tmp/kube-controller-manager.log
  /tmp/kube-proxy.log
  /tmp/kube-scheduler.log
  /tmp/kubelet.log
...
```

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47739

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Pass logexporter config through e2e framework

Ref https://github.com/kubernetes/kubernetes/issues/48513

/cc @wojtek-t @fejta

Automatic merge from submit-queue

fix leader-elect-resource-lock's description

**What this PR does / why we need it**:
    The leader-elect-resource-lock description miss a space in pkg/client/leaderelectionconfig/config.go. It will effect other component's help document which use leader election.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
    I think it's is needless to open a issue.
**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

Remove service on termination when exec 'kubectl run' command with flags "--rm" and "--expose"

**What this PR does / why we need it**:
As the title says and issue #40504 mentioned.
cc @tanapoln

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #40504 

**Special notes for your reviewer**:
Related to: #44915

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Improve the warning message if the rbd command is not found.

**What this PR does / why we need it**:
The previous warning msg is not correct if there is no rbd cmd.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #


**Special notes for your reviewer**:

**Release note**:

```release-note
```

Automatic merge from submit-queue

k8s.io/metrics: restrict k8s.io/metrics imports

Automatic merge from submit-queue

Restore cAdvisor prometheus metrics to the main port

But under a new path - `/metrics/cadvisor`. This ensures a secure port still exists for metrics while getting the benefit of separating out container metrics from the kubelet's metrics as recommended in the linked issue.

Fixes #48483

```release-note-action-required
Restored cAdvisor prometheus metrics to the main port -- a regression that existed in v1.7.0-v1.7.2
cAdvisor metrics can now be scraped from `/metrics/cadvisor` on the kubelet ports.
Note that you have to update your scraping jobs to get kubelet-only metrics from `/metrics` and `container_*` metrics from `/metrics/cadvisor`
```

Automatic merge from submit-queue (batch tested with PRs 49116, 49095)

update-staging-godeps: do not exclude k8s.io/metrics

Counterpart to https://github.com/kubernetes/test-infra/pull/3560