Signed-off-by: Jess Frazelle <acidburn@google.com>

Signed-off-by: Jess Frazelle <acidburn@google.com>

Using the image:

```
$ docker run --rm -it --user 1000 gcr.io/google_containers/nonewprivs:1.0
Effective uid: 0

$ docker run --rm -it --user 1000 --security-opt no-new-privileges gcr.io/google_containers/nonewprivs:1.0
Effective uid: 1000
```
Signed-off-by: Jess Frazelle <acidburn@google.com>

Signed-off-by: Jess Frazelle <acidburn@google.com>

Signed-off-by: Jess Frazelle <acidburn@google.com>

Automatic merge from submit-queue

installer.go amend some comment

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE

Automatic merge from submit-queue (batch tested with PRs 45345, 49470, 49407, 49448, 49486)

Fix ha-master tests

Automatic merge from submit-queue (batch tested with PRs 45345, 49470, 49407, 49448, 49486)

Use a client interface instead of a concrete type

Automatic merge from submit-queue (batch tested with PRs 45345, 49470, 49407, 49448, 49486)

Fix unstructured marshaler to handle all JSON types

Split from https://github.com/kubernetes/kubernetes/pull/45294

/assign @wojtek-t

Automatic merge from submit-queue (batch tested with PRs 45345, 49470, 49407, 49448, 49486)

statefulset_expansion.go delete ps define

reopen #46157 

**Release note**:

```release-note
NONE

Automatic merge from submit-queue (batch tested with PRs 45345, 49470, 49407, 49448, 49486)

Support "fstype" parameter in dynamically provisioned PVs

This PR is a replacement for https://github.com/kubernetes/kubernetes/pull/40805. I was not able to push fixes and rebases to the original branch as I don't have access to the Github organization anymore.

I assume the PR will need a new "ok to test" 

**ORIGINAL PR DESCRIPTION**

**What this PR does / why we need it**: This PR allows specifying the desired FSType when dynamically provisioning volumes with storage classes. The FSType can now be set as a parameter:
```yaml
kind: StorageClass
apiVersion: storage.k8s.io/v1beta1
metadata:
  name: test
provisioner: kubernetes.io/azure-disk
parameters:
  fstype: xfs
```

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #37801

**Special notes for your reviewer**:
The PR also implicitly adds checks for unsupported parameters.

**Release note**:

```release-note
Support specifying of FSType in StorageClass
```

Automatic merge from submit-queue

Fix staging godeps for k8s.io/metrics and k8s.io/kube-gen

**What this PR does / why we need it**:
#49095 introduced an issue with the formatting of the k8s.io/metrics staging godeps. This fixes that issue, and alters the script to prevent it from happening again.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue

Moves networking e2e tests to test/e2e/network

Automatic merge from submit-queue

Allow nodes to create evictions for its own pods in NodeRestriction admission controller

**What this PR does / why we need it**: This PR adds support for `pods/eviction` sub-resource to the NodeRestriction admission controller so it allows a node to evict pods bound to itself.

**Which issue this PR fixes**: fixes #48666

**Special notes for your reviewer**: The NodeRestriction already allows nodes to delete pods bound to itself, so allowing nodes to also delete pods via the Eviction API probably makes sense.

```release-note
NodeRestriction allows a node to evict pods bound to itself
```

Aids testing

Automatic merge from submit-queue

deployment: SetNewReplicaSetAnnotations() should compare revisions as numbers than strings

**What this PR does / why we need it**: 
1) SetNewReplicaSetAnnotations() when deployment revision annotation is copied over to RS, it performs a string comparison instead of int comparison, due to this any revision beyond 9 might not get copied.
2) Slightly improves the coverage by adding UT for Annotation related functions
3) Upgrade the test suite to use go-langs sub-test, which is very useful while investigating UT related failures.

```
--- FAIL: TestAnnotationUtils (0.00s)
    --- FAIL: TestAnnotationUtils/SetNewReplicaSetAnnotations (0.00s)
        deployment_util_test.go:1283: Revision Expected=10 Obtained=9
        deployment_util_test.go:1283: Revision Expected=11 Obtained=9
        deployment_util_test.go:1283: Revision Expected=12 Obtained=9
        deployment_util_test.go:1283: Revision Expected=13 Obtained=9
        deployment_util_test.go:1283: Revision Expected=14 Obtained=9
        deployment_util_test.go:1283: Revision Expected=15 Obtained=9
        deployment_util_test.go:1283: Revision Expected=16 Obtained=9
        deployment_util_test.go:1283: Revision Expected=17 Obtained=9
        deployment_util_test.go:1283: Revision Expected=18 Obtained=9
        deployment_util_test.go:1283: Revision Expected=19 Obtained=9
        deployment_util_test.go:1283: Revision Expected=20 Obtained=9
    --- PASS: TestAnnotationUtils/SetReplicasAnnotations (0.00s)
    --- PASS: TestAnnotationUtils/IsSaturated (0.00s)
```

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**: None

```release-note
```
cc: @kargakis

This also adds sig-network-{approvers,reviewers} alias

Automatic merge from submit-queue

Rename test dir to allude sig-apps ownership

@kubernetes/sig-apps-pr-reviews other sigs have already followed this pattern and it seems that this is what @kubernetes/sig-testing-misc wants too

Ref https://github.com/kubernetes/kubernetes/issues/49161

ptal

Signed-off-by: Michail Kargakis <mkargaki@redhat.com>

Automatic merge from submit-queue (batch tested with PRs 49409, 49352, 49266, 48418)

Use helper to init ClusterIP and NodePort in Create of service

**What this PR does / why we need it**:
Make service `Create` more readable and testable.

- use `initClusterIP` introduced in #46197 to init ClusterIP allocation in service `Create`
- add a new helper `initNodePort` to init NodePort allocation in service `Create`
- TBD: add test case for `initNodePort`. This will cover the NodePort allocation process in `Create`. If this PR makes sense, I will write a test case later.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #35354 (not directly. #35354 was fixed by #46197. The idea of this PR is from https://github.com/kubernetes/kubernetes/pull/46197#discussion_r120910077)

**Special notes for your reviewer**:
/cc @thockin @freehan 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49409, 49352, 49266, 48418)

[e2e] Also verify content returned by kube-proxy healthz url

**What this PR does / why we need it**: Enhance kube-proxy url test. This helps to detect the port collision case --- node-problem-detector also serves /healthz to return 200 ok. Verify the content to confirm /healthz is served by kube-proxy.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: From #49263

**Special notes for your reviewer**:
/assign @freehan @nicksardo 

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49409, 49352, 49266, 48418)

Use the yet uninitialized informer factory

`informerFactory` has been started already but the `factory.equivalencePodCache` field has not been initialized yet (done below by `.Create()`). So when Service informer calls `onServiceAdd()`, it tries to access this field and crashes with npe.

The fix is to use `informerFactory2`.
It is a race between listeners called by informer and `.Create()`. Do we run unit/integration tests with race detector switched off?

```
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
	panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x14c2c2f]

goroutine 11688 [running]:
k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/runtime.HandleCrash(0x0, 0x0, 0x0)
	/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go:58 +0x126
panic(0x28f5f00, 0x61621c0)
	/usr/local/go/src/runtime/panic.go:489 +0x2cf
k8s.io/kubernetes/plugin/pkg/scheduler/core.(*EquivalenceCache).InvalidateCachedPredicateItemOfAllNodes(0x0, 0xc4202a9020)
	/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/plugin/pkg/scheduler/core/equivalence_cache.go:141 +0x5f
k8s.io/kubernetes/plugin/pkg/scheduler/factory.(*ConfigFactory).onServiceAdd(0xc424ad5950, 0x2cf6fc0, 0xc4249c05a0)
	/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/plugin/pkg/scheduler/factory/factory.go:347 +0x53
k8s.io/kubernetes/plugin/pkg/scheduler/factory.(*ConfigFactory).(k8s.io/kubernetes/plugin/pkg/scheduler/factory.onServiceAdd)-fm(0x2cf6fc0, 0xc4249c05a0)
	/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/plugin/pkg/scheduler/factory/factory.go:247 +0x3e
k8s.io/kubernetes/vendor/k8s.io/client-go/tools/cache.ResourceEventHandlerFuncs.OnAdd(0xc423a47310, 0xc423a47320, 0xc423a47330, 0x2cf6fc0, 0xc4249c05a0)
	/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/client-go/tools/cache/controller.go:195 +0x49
k8s.io/kubernetes/vendor/k8s.io/client-go/tools/cache.(*ResourceEventHandlerFuncs).OnAdd(0xc423938ce0, 0x2cf6fc0, 0xc4249c05a0)
	<autogenerated>:54 +0x73
k8s.io/kubernetes/vendor/k8s.io/client-go/tools/cache.(*processorListener).run(0xc424a698b0)
	/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/client-go/tools/cache/shared_informer.go:544 +0x287
k8s.io/kubernetes/vendor/k8s.io/client-go/tools/cache.(*processorListener).(k8s.io/kubernetes/vendor/k8s.io/client-go/tools/cache.run)-fm()
	/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/client-go/tools/cache/shared_informer.go:380 +0x2a
k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait.(*Group).Start.func1(0xc424a87868, 0xc423a47370)
	/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:71 +0x4f
created by k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait.(*Group).Start
	/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:72 +0x62
```

**Special notes for your reviewer**:
Found while working on #47045.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49409, 49352, 49266, 48418)

Fix duplication in scheduler.

**What this PR does / why we need it**:
This fixes duplicate code in scheduler.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
No issue.
**Special notes for your reviewer**:

**Release note**:

```release-note
```
@kubernetes/sig-scheduling-pr-reviews @bsalamat

Automatic merge from submit-queue (batch tested with PRs 49326, 49394, 49346, 49379, 49399)

Update to version gate CRDs to 1.7 and greater

**What this PR does / why we need it**:
Allows e2e's to be tested on earlier version do to version check.  

xref: #49313

**Release note**:
```
NONE
```

/cc @kubernetes/sig-api-machinery-bugs @kubernetes/sig-testing-bugs

Automatic merge from submit-queue (batch tested with PRs 49326, 49394, 49346, 49379, 49399)

Pass clientset's Interface to CreateScheduler.

**What this PR does / why we need it**:
CreateSchedueler takes clientset.Clientset param and passes it to NewConfigFactory which takes clientset.Interface. It'd be better for CreateSchedueler to take clientset.Interface to be in sync with NewConfigFactory and it would be easier to reuse CreateSchedueler in implementations which relies on interface rather than actual client implementation.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
No issue.
@kubernetes/sig-scheduling-pr-reviews @bsalamat

Automatic merge from submit-queue (batch tested with PRs 49326, 49394, 49346, 49379, 49399)

Make client-go authoritative

client-go now is authoritative except for `client-go/pkg/version`, which I think we can leave as is for a while.

Automatic merge from submit-queue (batch tested with PRs 49326, 49394, 49346, 49379, 49399)

more robust stat handling from ceph df output in the kubernetes-master charm create-rbd-pv action

**What this PR does / why we need it**: more robust stat handling from ceph df output in the kubernetes-master charm create-rbd-pv action

**Release note**:
```release-note
more robust stat handling from ceph df output in the kubernetes-master charm create-rbd-pv action
```

Automatic merge from submit-queue

add cronjobs to all

Categories were added to the discovery API, but the `kubectl` plumbing didn't make it.  We *did* make `kubectl all` gate on discovery information, so it can least be a superset.  

`cronjobs` are user resources, so I've added them to the list.

@kubernetes/sig-cli-misc 

```release-note
added cronjobs.batch to all, so kubectl get all returns them.
```

Automatic merge from submit-queue (batch tested with PRs 49420, 49296, 49299, 49371, 46514)

Refactoring taint functions to reduce sprawl

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #45060

**Special notes for your reviewer**:
@gmarek @timothysc @k82cn @jayunit100 - I moved some fn's to helpers and some to utils. LMK, if you are ok with this change.

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49420, 49296, 49299, 49371, 46514)

Fix: PV metric is not namespaced

**What this PR does / why we need it**: The PV metric of juju deployments is not namespaced. This PR fixes this bug. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/348

**Special notes for your reviewer**:

**Release note**:

```NONE
```

Automatic merge from submit-queue (batch tested with PRs 49420, 49296, 49299, 49371, 46514)

Avoid looking up instance id until we need it

**What this PR does / why we need it**:

currently kube-controller-manager cannot run outside of a vm started
by openstack (with --cloud-provider=openstack params). We try to read
the instance id from the metadata provider or the config drive or the
file location only when we really need it. In the normal scenario, the
controller-manager uses the node name to get the instance id.
https://github.com/kubernetes/kubernetes/blob/41541910e1699975a8f9202a89b6865e45921194/pkg/volume/cinder/attacher.go#L149

The localInstanceID is currently used only in the test case, so let
us not read it until it is really needed.

So let's try to find the instance-id only when we need it.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 49420, 49296, 49299, 49371, 46514)

Update status to show failing services.

**What this PR does / why we need it**: Report on charm status any services that are not running.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/341

**Special notes for your reviewer**:

**Release note**:

```Report failing services in Juju deployed clusters.
```

Automatic merge from submit-queue (batch tested with PRs 49420, 49296, 49299, 49371, 46514)

Fix controller crash because of nil volume spec

For volumes that don't support bulk volume verification, a nil
volume spec can cause crash of controller.

Fixes #49418

**Release note**:
```release-note
Fixes #49418 where kube-controller-manager can panic on volume.CanSupport methods and enter a crash loop.
```

Automatic merge from submit-queue (batch tested with PRs 46210, 48607, 46874, 46598, 49240)

Remove types.generated.go generated for internal API types

We don't need generated codecs for internal types.