Automatic merge from submit-queue (batch tested with PRs 39446, 40023, 36853)

Add SIGCHLD handler to pause container

**What this PR does / why we need it**: This allows pause to reap orphaned zombies in a shared PID namespace. (#1615)

**Special notes for your reviewer**: I plan to discuss this with SIG Node to ensure compatibility with future runtimes.

**Release note**: This will have no effect until shared PID namespace is enabled, so recommend release-note-none.

This allows pause to reap zombies in the upcoming Shared PID namespace
(#1615). Uses the better defined sigaction() instead of signal() for all
signals both for consistency (SIGCHLD handler avoids SA_RESTART) and to
avoid the implicit signal()->sigaction() translation of various libc
versions.

Also makes warnings errors and includes a tool to make orphaned zombies
for manual testing.

Automatic merge from submit-queue (batch tested with PRs 39446, 40023, 36853)

Allow setting copyright header file for generated completions

This PR allows downstream vendors (like openshift) to generate completions with custom header, similarly to other generated code.

@fabianofranz ptal
@kubernetes/sig-cli-misc fyi

Automatic merge from submit-queue (batch tested with PRs 39446, 40023, 36853)

Create environment variables from secrets

Allow environment variables to be populated from entire secrets.

**Release note**:
```release-note
Populate environment variables from a secrets.
```

Automatic merge from submit-queue (batch tested with PRs 39772, 39831, 39481, 40167, 40149)

Only enable RBAC if the k8s version is above 1.6.0-alpha.0

...and move the defaulting of the api type into a specific file



**What this PR does / why we need it**: RBAC should only be enabled when k8s version is v1.6.0-alpha.0+, where https://github.com/kubernetes/kubernetes/pull/39625 is merged

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

```
$ sudo ./kubeadm init
[kubeadm] WARNING: kubeadm is in alpha, please do not use it for production clusters.
[init] Using Kubernetes version: v1.5.2
[init] Using Authorization mode: AlwaysAllow
[init] A token has not been provided, generating one
[preflight] Running pre-flight checks
[preflight] WARNING: kubelet service is not enabled, please run 'systemctl enable kubelet.service'
[preflight] Starting the kubelet service
[certificates] Generated Certificate Authority key and certificate.
[certificates] Generated API Server key and certificate
[certificates] Generated Service Account signing keys
[certificates] Created keys and certificates in "/etc/kubernetes/pki"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/admin.conf"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/kubelet.conf"
[apiclient] Created API client, waiting for the control plane to become ready
[apiclient] All control plane components are healthy after 39.517396 seconds
[apiclient] Waiting for at least one node to register and become ready
[apiclient] First node is ready after 6.521587 seconds
[apiclient] Creating a test deployment
[apiclient] Test deployment succeeded
[token-discovery] Using token: 6c3430:2889e46ce3f11610
[token-discovery] Created the kube-discovery deployment, waiting for it to become ready
[token-discovery] kube-discovery is ready after 3.502025 seconds
[addons] Created essential addon: kube-proxy
[addons] Created essential addon: kube-dns

Your Kubernetes master has initialized successfully!

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
    http://kubernetes.io/docs/admin/addons/

You can now join any number of machines by running the following on each node:

kubeadm join --discovery token://6c3430:2889e46ce3f11610@192.168.200.101:9898
```

```
$ cat fetch-ci-images.sh
#!/bin/bash

CI_COMMIT=${CI_COMMIT:-latest}
ARCH=${ARCH:-amd64}
OLD_REGISTRY=${OLD_REGISTRY:-gcr.io/google_containers}
NEW_REGISTRY=${NEW_REGISTRY:-${OLD_REGISTRY}}

if [[ ${CI_COMMIT} == "latest" ]]; then
	CI_COMMIT=$(curl -sSL https://storage.googleapis.com/kubernetes-release-dev/ci-cross/latest.txt)
fi

CI_COMMIT_TAG=$(echo ${CI_COMMIT} | sed "s/+/-/")

echo "Using commit: ${CI_COMMIT}"
echo "Tagging to registry: ${NEW_REGISTRY}"

images=(
	kube-apiserver
	kube-scheduler
	kube-controller-manager
	kube-proxy
)

for image in ${images[@]}; do
	curl -sSL https://storage.googleapis.com/kubernetes-release-dev/ci-cross/${CI_COMMIT}/bin/linux/${ARCH}/${image}.tar | docker load
	image_tag=$(curl -sSL https://storage.googleapis.com/kubernetes-release-dev/ci-cross/${CI_COMMIT}/bin/linux/${ARCH}/${image}.md5)
	docker tag ${OLD_REGISTRY}/${image}:${image_tag} ${NEW_REGISTRY}/${image}-${ARCH}:${CI_COMMIT_TAG}
	docker rmi ${OLD_REGISTRY}/${image}:${image_tag}
	echo "Image created: ${NEW_REGISTRY}/${image}-${ARCH}:${CI_COMMIT_TAG}"
done

cat <<EOF
Now you can run:
	kubeadm init --use-kubernetes-version ${CI_COMMIT_TAG}
EOF
$ ./fetch-ci-images.sh
Using commit: v1.6.0-alpha.0.3549+5e4625ca
Tagging to registry: gcr.io/google_containers
c366cffde3c9: Loading layer 1.312 MB/1.312 MB
1911ea24d99d: Loading layer 1.024 kB/1.024 kB
3af1ee6d3b81: Loading layer 132.9 MB/132.9 MB
Untagged: gcr.io/google_containers/kube-apiserver:8562727e1eabe97a95bc2e52992db195
Image created: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0-alpha.0.3549-5e4625ca
c366cffde3c9: Loading layer 1.312 MB/1.312 MB
1911ea24d99d: Loading layer 1.024 kB/1.024 kB
86bf938b66e2: Loading layer 54.88 MB/54.88 MB
Untagged: gcr.io/google_containers/kube-scheduler:5319acbc670b5050f119e6f6e3c9b7e3
Image created: gcr.io/google_containers/kube-scheduler-amd64:v1.6.0-alpha.0.3549-5e4625ca
c366cffde3c9: Loading layer 1.312 MB/1.312 MB
1911ea24d99d: Loading layer 1.024 kB/1.024 kB
6743a986e1ed: Loading layer 104.9 MB/104.9 MB
Untagged: gcr.io/google_containers/kube-controller-manager:6698cef6338d549160d58fd8381f3d07
Image created: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0-alpha.0.3549-5e4625ca
bf028f50c346: Loading layer 128.9 MB/128.9 MB
a99e621f3f37: Loading layer 1.024 kB/1.024 kB
76d4fdcd51a9: Loading layer 5.076 MB/5.076 MB
ee455b365369: Loading layer 42.52 MB/42.52 MB
Untagged: gcr.io/google_containers/kube-proxy:3914060ffe3225ae29fe88cb960826f9
Image created: gcr.io/google_containers/kube-proxy-amd64:v1.6.0-alpha.0.3549-5e4625ca
Now you can run:
	kubeadm init --use-kubernetes-version v1.6.0-alpha.0.3549-5e4625ca
```

```
$ sudo ./kubeadm init --use-kubernetes-version v1.6.0-alpha.0.3549-5e4625ca
[kubeadm] WARNING: kubeadm is in alpha, please do not use it for production clusters.
[init] Using Kubernetes version: v1.6.0-alpha.0.3549-5e4625ca
[init] Using Authorization mode: RBAC
[init] A token has not been provided, generating one
[preflight] Running pre-flight checks
[preflight] WARNING: kubelet service is not enabled, please run 'systemctl enable kubelet.service'
[preflight] Starting the kubelet service
[certificates] Generated Certificate Authority key and certificate.
[certificates] Generated API Server key and certificate
[certificates] Generated Service Account signing keys
[certificates] Created keys and certificates in "/etc/kubernetes/pki"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/admin.conf"
[kubeconfig] Wrote KubeConfig file to disk: "/etc/kubernetes/kubelet.conf"
[apiclient] Created API client, waiting for the control plane to become ready
[apiclient] All control plane components are healthy after 31.252686 seconds
[apiclient] Waiting for at least one node to register and become ready
[apiclient] First node is ready after 9.064842 seconds
[apiclient] Creating a test deployment
[apiclient] Test deployment succeeded
[apiconfig] Created kubelet-bootstrap RBAC rules
[apiconfig] Created kube-dns RBAC rules
[apiconfig] Created kube-proxy RBAC rules
[token-discovery] Using token: 99b957:ccb1fbc703a0db8a
[token-discovery] Created the kube-discovery deployment, waiting for it to become ready
[token-discovery] kube-discovery is ready after 3.502064 seconds
[addons] Created essential addon: kube-proxy
[addons] Created essential addon: kube-dns

Your Kubernetes master has initialized successfully!

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
    http://kubernetes.io/docs/admin/addons/

You can now join any number of machines by running the following on each node:

kubeadm join --discovery token://99b957:ccb1fbc703a0db8a@192.168.200.101:9898
```

**Release note**:

```release-note
NONE
```
@pires @mikedanese @andrewrynhard

Automatic merge from submit-queue (batch tested with PRs 39772, 39831, 39481, 40167, 40149)

Add //hack:verify-boilerplate rule.

This pattern is working well in test-infra. I'll add the gofmt and go vet rules next.

Automatic merge from submit-queue (batch tested with PRs 39772, 39831, 39481, 40167, 40149)

Adding more details to API group already registered error

Also adding name of the group for which this error is raised.

Automatic merge from submit-queue (batch tested with PRs 39772, 39831, 39481, 40167, 40149)

Check if error is Status in result.Stream()

Fix #38774

This adds the same functionality to `.Stream()` that was added to `.Error()`, `.Into()`, and `.Get()` in https://github.com/kubernetes/kubernetes/commit/ce187f9c6a0bd9dfa8cc9d4f4a83a7e686e46ecb to try decoding the body as a Status.

This broke `.Stream()` because the decoding of the body as `Status` was removed from `transformResponse` in https://github.com/kubernetes/kubernetes/commit/ce187f9c6a0bd9dfa8cc9d4f4a83a7e686e46ecb#diff-de85e3effc36b7bbe3fb9eae6c833cf3L933

Automatic merge from submit-queue

promote certificates api to beta

Mostly posting to see what breaks but also this API is ready to be promoted.

```release-note
Promote certificates.k8s.io to beta and enable it by default. Users using the alpha certificates API should delete v1alpha1 CSRs from the API before upgrading and recreate them as v1beta1 CSR after upgrading.
```

@kubernetes/api-approvers @jcbsmpsn @pipejakob

Automatic merge from submit-queue

Update root approvers files

Replaces #40040 

Update top level OWNERS files mostly to set assignees to approvers. Also remove @bgrant0607 from everywhere but the very top level OWNERS file.

Automatic merge from submit-queue

Create SecretManager interface and switch to caching secrets in kubelet

Ref #19188

Obviously we would need to extend the interface to solve #19188 but this is good first step anyway.

Add a comma that was making the CSV invalid and breaking the submit queue

I'll add a check to verify to catch this in the future.

Only enable RBAC if the k8s version is above 1.6.0-alpha.0, move some of the defaulting of the api type into a specific file

Automatic merge from submit-queue

Use ensure-temp-dir in the common.sh script

Ref issue #38967

Instead of having an ensure-temp-dir function in multiple
places, add it to the common.sh script which is sourced by
all the providers.

Automatic merge from submit-queue

Prune reviewers from pkg/cloudprovider

**What this PR does / why we need it**

Per discussion in https://github.com/kubernetes/kubernetes/pull/36530 the `OWNERS` file for `pkg/cloudprovider` should not contain additional reviewers at this time.

**Special notes for your reviewer**:

Sorry for the extra work in review

**Release note**:

`NONE`

Automatic merge from submit-queue

kubeadm: remove authorizer package dependency

Removes package dependency causing problems as noted in https://github.com/kubernetes/kubernetes/pull/39846#discussion_r96893954

Automatic merge from submit-queue

Add rule for detecting exceptions to fluentd config for GKE logging (#1)

**What this PR does / why we need it**:
Add the [fluent-detect-exceptions-plugin](https://rubygems.org/gems/fluent-plugin-detect-exceptions) version 0.0.4 to the fluentd config for Kubernetes clusters running on Google Cloud. This plugin detects exception stacks in the stdout/stderr log streams of the containers that run in the cluster and makes sure that they are forwarded as a single log entry to Stackdriver Logging.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
fluentd config for GKE clusters updated: detect exceptions in container log streams and forward them as one log entry.
```

Automatic merge from submit-queue (batch tested with PRs 40150, 40144)

Unstructured benchmark

Ref #39017

remove go get failing import comment

Automatic merge from submit-queue

move pkg/fields to apimachinery

Purely mechanical move of `pkg/fields` to apimachinery.  

Discussed with @lavalamp on slack.  Moving this an `labels` to apimachinery.

@liggitt any concerns?  I think the idea of field selection should become generic and this ends up shared between client and server, so this is a more logical location.

Automatic merge from submit-queue

Made multi-scheduler graduated to Beta and then v1.

fixes #25318