Automatic merge from submit-queue (batch tested with PRs 41517, 41494, 41163)

Deployment: filter out old RSes that are deleted or with non-zero replicas before cleanup

Fixes #36379

cc @zmerlynn @yujuhong @kargakis @kubernetes/sig-apps-bugs

Automatic merge from submit-queue (batch tested with PRs 41517, 41494, 41163)

Make scheduler_perf warn rather then fail if scheduling rate is betwe…

**What this PR does / why we need it**

Fix scheduler per bench tests so they pass even if there is a cold interval .

**Special notes for your reviewer**:

This wont effect CI, as this bench test is run manually by devs.

Automatic merge from submit-queue

update-bazel.sh to treat GOPATH as a path

Automatic merge from submit-queue

only construct shortcutmapper when we have the discovery client

Resource shortnames come from the discoveryclient, so we should only wrap with that mapper when we have the information we need.

Automatic merge from submit-queue

Add SIG owners to e2e tests

**What this PR does / why we need it**:

Adds SIG owners to e2e tests in order to support assigning test flakes and general test failures to SIGs rather than relying solely on individuals. Ideally this will help spread the maintenance burden across more This work is part of closing https://github.com/kubernetes/contrib/issues/2389

**Which issue this PR fixes** 

Part of the work to address 
-  https://groups.google.com/forum/#!topic/kubernetes-dev/5kTLRfKId9g

Tracking issue
- https://github.com/kubernetes/contrib/issues/2389

**Special notes for your reviewer**:

None

**Release note**:

 `NONE`.

Automatic merge from submit-queue (batch tested with PRs 40505, 34664, 37036, 40726, 41595)

Allow `make test-integration` to pass on OSX

**What this PR does / why we need it**: `make test-integration` isn't passing on my OSX setup (10.11.6, go1.7, docker 1.13.1).  Tests that startup an api server fail because the default `cert-dir` of `/var/run/kubernetes` isn't world-writable.  Use a tempdir instead.

**Release note**:
```release-note
NONE
```

/cc @kubernetes/sig-testing-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 40505, 34664, 37036, 40726, 41595)

Rename provisioner config struct

Automatic merge from submit-queue (batch tested with PRs 40505, 34664, 37036, 40726, 41595)

dockertools: call TearDownPod when GC-ing infra pods

The docker runtime doesn't tear down networking when GC-ing pods.
rkt already does so make docker do it too. To ensure this happens,
infra pods are now always GC-ed rather than gating them by
containersToKeep.

This prevents IPAM from leaking when the pod gets killed for
some reason outside kubelet (like docker restart) or when pods
are killed while kubelet isn't running.

Fixes: https://github.com/kubernetes/kubernetes/issues/14940
Related: https://github.com/kubernetes/kubernetes/pull/35572

Automatic merge from submit-queue (batch tested with PRs 40505, 34664, 37036, 40726, 41595)

filter lastAppliedConfig annotation for describe secret

Temporarily addresses: #23564.
This patch filters out the lastAppliedConfig annotation when describing a secret.

```release-note
kubectl describe no longer prints the last-applied-configuration annotation for secrets.
```

Automatic merge from submit-queue

Extract strings from the rollout command.

@fabianofranz @kubernetes/sig-cli-pr-reviews

Automatic merge from submit-queue (batch tested with PRs 38101, 41431, 39606, 41569, 41509)

kubeadm: Reorder the token packages more logically

**What this PR does / why we need it**:

In order to be able to implement https://github.com/kubernetes/kubernetes/pull/41417, the token functionality (which now is spread across the codebase), should be in two places: a generic token functions library, which in the future _may_ [move into client-go](https://github.com/kubernetes/kubernetes/pull/41281#discussion_r101357106) in some form, and a package for the token handling against the api server.

This commit has no large functional changes.

```
kubeadm: Aggregate the token functionality in sane packages.
    
 - Factor out token constants to kubeadmconstants.
 - Move cmd/kubeadm/app/util/{,token/}tokens.go
 - Use the token-id, token-secret, etc constants provided by the bootstrapapi package
 - Move cmd/kubeadm/app/master/tokens.go to cmd/kubeadm/app/phases/token/csv.go
    
This refactor basically makes it possible to hook up kubeadm to the BootstrapSigner controller later on
```

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@mikedanese @pires @errordeveloper @dmmcquay @jbeda @GheRivero

Automatic merge from submit-queue (batch tested with PRs 38101, 41431, 39606, 41569, 41509)

Report node not ready on failed PLEG health check

Report node not ready if PLEG health check fails.

Automatic merge from submit-queue (batch tested with PRs 38101, 41431, 39606, 41569, 41509)

optimize killPod() and syncPod() functions

make sure that one of the two arguments must be non-nil: runningPod, status ,just like the function note says
and judge the return value in syncPod() function before setting podKilled

Automatic merge from submit-queue (batch tested with PRs 38101, 41431, 39606, 41569, 41509)

Split MakeCSR for new signature.

Automatic merge from submit-queue (batch tested with PRs 38101, 41431, 39606, 41569, 41509)

[hairpin] fix argument of nsenter

**Release note**:

```release-note
None
```

We should use:
	nsenter --net=netnsPath -- -F some_command
instend of:
	nsenter -n netnsPath -- -F some_command
Because "nsenter -n netnsPath" get an error output:
	# nsenter -n /proc/67197/ns/net ip addr
	nsenter: neither filename nor target pid supplied for ns/net

If we really want use -n, we need to use -n in such format:
	# sudo nsenter -n/proc/67197/ns/net ip addr

Adds SIG owners to e2e tests in order to support assigning test flakes and general test failures to SIGs rather than relying solely on individuals. Ideally this will help spread the maintenance burden across more This work is part of closing https://github.com/kubernetes/contrib/issues/2389

Adds functionality to look at the components of the GOPATH looking for
the gazel executable, rather than treating the GOPATH as if it was a
single directory.

Automatic merge from submit-queue (batch tested with PRs 41505, 41484, 41544, 41514, 41022)

Proxy defer on update events

This PR is a series of discrete movements in refactoring some of kube-proxy's twistier code in prep to be more async.  It should be reviewed one commit at a time.  Each commit is a smallish movement, which should be easier to examine.  I added significant tests along the way, which, unsurprisingly, found some bugs.

Automatic merge from submit-queue (batch tested with PRs 41505, 41484, 41544, 41514, 41022)

several issues hit while trying to make it easy to register APIs

I was trying to create a script that would register all API versions on a given server and ended up hitting several problems.  These are the fixes.

@sttts I suspect that I won't be able to continue down the host-network approach, since that means I won't be able to use in-cluster DNS without some finagling.  It *could* be set up (and we make it work as a for instance), but the simple enablement approach will be hosted on the infrastructure.  I'll go back to that.

Automatic merge from submit-queue (batch tested with PRs 41505, 41484, 41544, 41514, 41022)

pkg/api/install: use apimachinery/announce+registered

Make core group a little bit less special.

Automatic merge from submit-queue (batch tested with PRs 41505, 41484, 41544, 41514, 41022)

add front proxy to kubeadm created kube-apiservers

The front proxy authenticator configuration has been in a release or two.  It allows a front proxy (secured by mutual TLS auth) to provide user information for a request.  The kube-aggregator uses this to securely terminate authentication (has to terminate TLS and thus client-certs) and communicate user info to backing API servers.

Since the kube-apiserver always verifies the front-proxy via a client certificate, this isn't open for abuse unless you already have access to either the signing key or client cert which kubeadm creates locally.  If you got there, you already owned the box.  Therefore, this adds the authenticator unconditionally.

@luxas Are there e2e tests for `kubeadm`?
@liggitt @kubernetes/sig-auth-misc

Automatic merge from submit-queue (batch tested with PRs 41505, 41484, 41544, 41514, 41022)

[Federation] Fixes the newly-added test for replicaset deletion upon namespace deletion.

See #41278 for the original test.

**Release note**:
```release-note
NONE
```

 - Factor out token constants to kubeadmconstants.
 - Move cmd/kubeadm/app/util/{,token/}tokens.go
 - Use the token-id, token-secret, etc constants provided by the bootstrapapi package
 - Move cmd/kubeadm/app/master/tokens.go to cmd/kubeadm/app/phases/token/csv.go

This refactor basically makes it possible to hook up kubeadm to the BootstrapSigner controller later on

`/var/run` is not world-writable on my OSX 10.11.x setup, so tests that
standup a secure apiserver fail with the default cert dir.  Use a
tempdir instead.

Dead infra containers may still have network resources allocated to
them and may not be GC-ed for a long time.  But allowing SyncPod()
to restart an infra container before the old one is destroyed
prevents network plugins from carrying the old network details
(eg IPAM) over to the new infra container.

The docker runtime doesn't tear down networking when GC-ing pods.
rkt already does so make docker do it too. To ensure this happens,
networking is always torn down for the container even if the
container itself is not deleted.

This prevents IPAM from leaking when the pod gets killed for
some reason outside kubelet (like docker restart) or when pods
are killed while kubelet isn't running.

Fixes: https://github.com/kubernetes/kubernetes/issues/14940
Related: https://github.com/kubernetes/kubernetes/pull/35572

We need to tear down networking when garbage collecting containers too,
and GC is run from a different goroutine in kubelet.  We don't want
container network operations running for the same pod concurrently.

The PluginManager almost duplicates the network plugin interface, but
not quite since the Init() function should be called by whatever
actually finds and creates the network plugin instance.  Only then
does it get passed off to the PluginManager.

The Manager synchronizes pod-specific network operations like setup,
teardown, and pod network status.  It passes through all other
operations so that runtimes don't have to cache the network plugin
directly, but can use the PluginManager as a wrapper.

Automatic merge from submit-queue (batch tested with PRs 41466, 41456, 41550, 41238, 41416)

Don't use json.Marshal when printing error bodies

Internal types panic when json.Marshal is called to prevent accidental
use.

Fixes #40491

Automatic merge from submit-queue (batch tested with PRs 41466, 41456, 41550, 41238, 41416)

add check to authorization config

Prompt user to create the config when using abac/webhook.

Automatic merge from submit-queue (batch tested with PRs 41466, 41456, 41550, 41238, 41416)

Revert "Modify load test to not create too may services/endpoints"

Reverts kubernetes/kubernetes#40798

We seem to be ready to go for it now.

Automatic merge from submit-queue (batch tested with PRs 41466, 41456, 41550, 41238, 41416)

Delay Deletion of a Pod until volumes are cleaned up

#41436 fixed the bug that caused #41095 and #40239 to have to be reverted.  Now that the bug is fixed, this shouldn't cause problems.

 @vishh @derekwaynecarr @sjenning @jingxu97 @kubernetes/sig-storage-misc

Automatic merge from submit-queue

pkg/api/testing: add deepcopy smoke test to roundtrip test

Fixes https://github.com/kubernetes/kubernetes/issues/41438.

Automatic merge from submit-queue

Bump fluentd-gcp google_cloud plugin version

Bump the version of `fluent-plugin-google-cloud` in fluentd-gcp image, because it's broken for version `0.5.2`.

Recently, gem `google-api-client` was updated to version `0.10.0`. The new version broke `fluent-plugin-google-cloud` which doesn't specify the upper version of `google-api-client` gem. I'm bumping the version used in our image to allow future changes in this release to be run and tested.

This PR doesn't bump the version, since no effective changes has happened, leaving this for the next PR to do.

CC @igorpeshansky